From 4fac6fff57d33790c61ce19618a7d4a14df69479 Mon Sep 17 00:00:00 2001 From: paigehargrave Date: Tue, 5 Mar 2019 07:28:14 -0500 Subject: [PATCH 1/4] Raw content addition --- _data/toc.yaml | 74 +++-- ee/ucp/images/architecture-1.png | Bin 0 -> 33017 bytes ee/ucp/images/interlock-design.png | Bin 0 -> 38440 bytes ee/ucp/images/interlock_default_backend.png | Bin 0 -> 32333 bytes ee/ucp/images/interlock_production_deploy.png | Bin 0 -> 31489 bytes .../interlock_service_clusters.png | Bin ee/ucp/images/interlock_ssl_passthrough.png | Bin 0 -> 24098 bytes ee/ucp/images/interlock_ssl_termination.png | Bin 0 -> 22517 bytes ee/ucp/images/service-clusters.png | Bin 0 -> 34572 bytes ee/ucp/images/single-interlock-deploy-2.png | Bin 0 -> 33440 bytes ee/ucp/images/single-interlock-deploy-3.png | Bin 0 -> 32339 bytes ee/ucp/images/single-interlock-deploy.png | Bin 0 -> 32522 bytes ee/ucp/interlock/architecture.md | 144 ++++++--- ee/ucp/interlock/config/custom-template.md | 304 ++++++++++++++++++ ee/ucp/interlock/config/haproxy-config.md | 29 ++ .../interlock/config/host-mode-networking.md | 237 ++++++++++++++ ee/ucp/interlock/config/index.md | 231 +++++++++++++ ee/ucp/interlock/config/nginx-config.md | 69 ++++ ee/ucp/interlock/config/service-labels.md | 45 +++ ee/ucp/interlock/config/tuning.md | 36 +++ ee/ucp/interlock/config/updates.md | 36 +++ .../deploy/configuration-reference.md | 146 --------- ee/ucp/interlock/deploy/configure.md | 64 ---- .../interlock/deploy/host-mode-networking.md | 100 ------ ee/ucp/interlock/deploy/index.md | 199 +++++++++++- ee/ucp/interlock/deploy/offline-install.md | 38 +++ ee/ucp/interlock/deploy/production.md | 109 +++++-- ee/ucp/interlock/{ => deploy}/upgrade.md | 17 +- ee/ucp/interlock/index.md | 108 +++++-- ee/ucp/interlock/usage/canary.md | 25 +- ee/ucp/interlock/usage/context.md | 21 +- ee/ucp/interlock/usage/default-backend.md | 37 +++ ee/ucp/interlock/usage/default-service.md | 50 --- ee/ucp/interlock/usage/index.md | 92 +++++- ee/ucp/interlock/usage/interlock-vip-mode.md | 115 +++++-- ee/ucp/interlock/usage/labels-reference.md | 4 +- ee/ucp/interlock/usage/redirects.md | 82 ++++- ee/ucp/interlock/usage/service-clusters.md | 62 ++-- ee/ucp/interlock/usage/sessions.md | 46 +-- ee/ucp/interlock/usage/ssl.md | 225 +++++++++++++ ee/ucp/interlock/usage/tls.md | 63 ++-- ee/ucp/interlock/usage/websockets.md | 18 +- 42 files changed, 2158 insertions(+), 668 deletions(-) create mode 100644 ee/ucp/images/architecture-1.png create mode 100644 ee/ucp/images/interlock-design.png create mode 100644 ee/ucp/images/interlock_default_backend.png create mode 100644 ee/ucp/images/interlock_production_deploy.png rename ee/ucp/{interlock/usage => images}/interlock_service_clusters.png (100%) create mode 100644 ee/ucp/images/interlock_ssl_passthrough.png create mode 100644 ee/ucp/images/interlock_ssl_termination.png create mode 100644 ee/ucp/images/service-clusters.png create mode 100644 ee/ucp/images/single-interlock-deploy-2.png create mode 100644 ee/ucp/images/single-interlock-deploy-3.png create mode 100644 ee/ucp/images/single-interlock-deploy.png create mode 100644 ee/ucp/interlock/config/custom-template.md create mode 100644 ee/ucp/interlock/config/haproxy-config.md create mode 100644 ee/ucp/interlock/config/host-mode-networking.md create mode 100644 ee/ucp/interlock/config/index.md create mode 100644 ee/ucp/interlock/config/nginx-config.md create mode 100644 ee/ucp/interlock/config/service-labels.md create mode 100644 ee/ucp/interlock/config/tuning.md create mode 100644 ee/ucp/interlock/config/updates.md delete mode 100644 ee/ucp/interlock/deploy/configuration-reference.md delete mode 100644 ee/ucp/interlock/deploy/configure.md delete mode 100644 ee/ucp/interlock/deploy/host-mode-networking.md create mode 100644 ee/ucp/interlock/deploy/offline-install.md rename ee/ucp/interlock/{ => deploy}/upgrade.md (90%) create mode 100644 ee/ucp/interlock/usage/default-backend.md delete mode 100644 ee/ucp/interlock/usage/default-service.md create mode 100644 ee/ucp/interlock/usage/ssl.md diff --git a/_data/toc.yaml b/_data/toc.yaml index 02932e0ff8..8569517463 100644 --- a/_data/toc.yaml +++ b/_data/toc.yaml @@ -1298,7 +1298,7 @@ manuals: - title: Use secrets in your services path: /ee/ucp/swarm/use-secrets/ - sectiontitle: Layer 7 routing - section: + section: - title: Overview path: /ee/ucp/interlock/ - title: Architecture @@ -1307,40 +1307,56 @@ manuals: section: - title: Simple deployment path: /ee/ucp/interlock/deploy/ - - title: Configure your deployment - path: /ee/ucp/interlock/deploy/configure/ - title: Production deployment path: /ee/ucp/interlock/deploy/production/ - - title: Host mode networking - path: /ee/ucp/interlock/deploy/host-mode-networking/ - - title: Configuration reference - path: /ee/ucp/interlock/deploy/configuration-reference/ - - sectiontitle: Route traffic to services + - title: Offline installation + path: /ee/ucp/interlock/deploy/offline-install/ + - title: Layer 7 routing upgrade + path: /ee/ucp/interlock/upgrade/ + - sectiontitle: Configuration section: - - title: Simple swarm service + - title: Configure your deployment + path: /ee/ucp/interlock/config/ + - title: Using a custom extension template + path: /ee/ucp/interlock/config/custom-template/ + - title: Configuring an HAProxy extension + path: /ee/ucp/interlock/config/haproxy-config/ + - title: Configuring host mode networking + path: /ee/ucp/interlock/config/host-mode-networking/ + - title: Configuring an nginx extension + path: /ee/ucp/interlock/config/nginx-config/ + - title: Using application service labels + path: /ee/ucp/interlock/config/service-labels/ + - title: Tuning the proxy service + path: /ee/ucp/interlock/config/tuning/ + - title: Updating Interlock services + path: /ee/ucp/interlock/config/updates/ + - sectiontitle: Routing traffic to services + section: + - title: Deploying services path: /ee/ucp/interlock/usage/ - - title: Set a default service - path: /ee/ucp/interlock/usage/default-service/ - - title: Applications with TLS - path: /ee/ucp/interlock/usage/tls/ - - title: Application redirects - path: /ee/ucp/interlock/usage/redirects/ - - title: Persistent (sticky) sessions - path: /ee/ucp/interlock/usage/sessions/ - - title: Websockets - path: /ee/ucp/interlock/usage/websockets/ - - title: Canary application instances + - title: Publishing a service as a canary instance path: /ee/ucp/interlock/usage/canary/ - - title: Service clusters - path: /ee/ucp/interlock/usage/service-clusters/ - - title: Context/Path based routing + - title: Using context or path-based routing path: /ee/ucp/interlock/usage/context/ - - title: VIP backend mode - path: /ee/ucp/interlock/usage/interlock-vip-mode/ - - title: Service labels reference - path: /ee/ucp/interlock/usage/labels-reference/ - - title: Layer 7 routing upgrade - path: /ee/ucp/interlock/upgrade/ + - title: Publishing a default host service + path: /ee/ucp/interlock/usage/default-backend/ + - title: Specifying a routing mode + path: /ee/ucp/interlock/usage/interlock-vip-mode/ + - title: Using routing labels + path: /ee/ucp/interlock/usage/labels-reference.md/ + - title: Implementing redirects + path: /ee/ucp/interlock/usage/redirects/ + - title: Implementing a service cluster + path: /ee/ucp/interlock/usage/service-clusters/ + - title: Implementing persistent (sticky) sessions + path: /ee/ucp/interlock/usage/sessions/ + - title: Implementing SSL + path: /ee/ucp/interlock/usage/ssl/ + - title: Securing services with TLS + path: /ee/ucp/interlock/usage/tls/ + - title: Configuring websockets + path: /ee/ucp/interlock/usage/websockets/ - sectiontitle: Deploy apps with Kubernetes section: - title: Access Kubernetes Resources diff --git a/ee/ucp/images/architecture-1.png b/ee/ucp/images/architecture-1.png new file mode 100644 index 0000000000000000000000000000000000000000..74d5b4e88f9d7964da038aabcdf4aab1b3f086e4 GIT binary patch literal 33017 zcmcG#Wl$W?8#Ri1aCZsr!50foumpE^cM0y!5`qVJ*Wm61cXt-|#e=?^-~YYeZq@yC zw`!_pdS-g2XS+|IKF@igzA4FkKp{qff`a<+MOIP;3JQ7~vVB8BfRtF0S3wS-pj}mD z#G$GuNsl21aF$|s z^h$QaKDq`!U%RIkDkPmVy$0$R|Mrr|KahDBF>f4ZyG{x7mC8ViVZw=FN+%hCYABI{ zDUoO*k!t_#ctK$q{X2C9Mco4_4&H{A41|Xi^uk6$q5dmC#DvC&+zE$43B&U5M)J>a zTK}pN3jF`Q0=PSd*x_JGG_1E+J6^%IGY^rVmr_!=tfwjK+Iehjn8cCJrod{F48^6y z`M8jv`M4E3m5je=GDwHfkat6a#an3fx@g4H`u&|=r&7bs)04ypCN(#glC_$OsvKG~ z{+XJInsiCO1MQGKtqjORQq(VB(fHy0`=LZfm&=D=Iy%P9za3yYS5U%1mhVkPqhs{ARah*i01vcCPK_=0Q{x%#7^J`A0!9obj=+ zXszm3_G~m$Xqe8`QFB*eyffl621S2=_e&?XVTCev3w9YmY{irI=NonwMH>^#1?A%dMbKK-zxKTZX3R+mQuq6WTX zw!G&(s`0)Uj8WjB?46K_wI};_aF)!QSrSs`h=Tl(r9&6-U+rUQ#^54Vg@# zQ;YEEGt)I}+sRR!sxsya;Uq&Nh-8p1#34On5-U1lBgC|eQ#rws)btLYF!O*e?i^9Z zDU&`D4MRp+4!ciWA`bgUXVLwVETE{4fm0D;CM)v!WLOM z#XgiNMoLbl14wr-DQM)(RS~$ z?tLd!qB!^6@(!V+%Z7DT5D<%P%<%2op<+g4MGAYL;>peXQ)jb{80(+O0gNs;jOtb^ zWQSH8fs4*#Cdu%KGN3Z9|9#`LQ@{Bk=t(|xcQc~~FwtkO@LAU84X;v%W-V!wttaPn9AT4OP#CV@Vlx7BE02v3&lxsl^n?$(}^-vlq>JoFv_23 z(;^V9p12gXule=L2f>LBPY6Ej+$GzBf0bu|!~Oy|kvg$>KE!!F?KgwF1ANf2cJlsA z$}Z%ut}KLE8hl5L7Y4)p(yjV4CMRewQYA6K<(33qWfhE55##^YgJYq-r(36q`eCEE zay6dLnzRTAY=nH^Pn7spn9dN4j}II1Yr*twf89g`sIlL7B|&hbXAT`tkrm&N^idcw zWp}JQ7PFXktaUS!AcK&gV)7_RJ-M-=$r@a(PECe~ikjbMDeuA}Zc`Q`T?S8+^xsZTqMe z#>X8*E!Qt$k0&J#Lj;!{28ODbdI<_z5YXa4Itk;`+yw`8J0xYIvzDeE$=d&IDg&)p z%{6}CT(<@sUYsbd^_s&REuPh{aJtTF#j=n0Gc$|K;;Y9rDz=weW6fQcSC-8!6=BLS zGfx-?9aGnY;?u#V>dh%OH8p~o<3;1~Yvt%N(b*^Ny4bw5Z=L3k(bH7Z&-l#%ZfY1w{1LrVAgygnh3{U|PHFj9;C) zzQ`dHj{J8Mqkd0jsxuTBBWdCc$o1v zXZ@TNJgn^mF}>+vj&Tn2j~i7%UCu!dy)C{nFgiO5sH;n_2(v?fp1GoGI9y~u{Np13 zFXSY+7H)_1m@L%2H&}ZpTeZykQmm{Iv5L2#XNnUZx-Ny%Oa_jsJf5*98>z4DFnsLp z(bADvFvzsr;TM1mng4|hI6hno7*TV_q40jdi29dnC+&?4s5J2qIBrR|SopI9?**$_L+tJ7cJ5K8 zB$gY4A3ZC6Rf)8X9Ki6b@4tUT0hp3@A9JutnaDPtll4!gT6D(x* zTp}CR{e#pBD3OSN&#ng_QTmqu2`wRrIFi-w6*SVXRdursLJrV2NKgLXqy$f>eV8{`WF@_1{Y9;B4jZ!i8{(D-be}+3|}I zc7mKO#^urb2p4kaRDNaQR#vS>mG8V=dnMwBi_`Y;9l%$BLfi|KbY){k?Hg@N4#O##!!aLPdEqp6tix& z;kc?N(KV>g`7clG5-$j)m=n4JGQXgxiO=%e?5>(Ez+CuHlm zM3-j!=C8UNr{&Q;_hH9)Fuz-Oe+U2=Ep3M4w5S2AiD~O6se#>sB{0XL!qq&Ck6i!N zrvSuQbU1uqZf}(TM6+8MCV$knw@g*F2d)#dIy(^~!BCqf`$ddj2yc=P0BUHqV>{|t zp+WtOJanaD{&``sy+Y%`T{gulCG4ToQb;+9Wi>bzpytLgUcT>6XPKAr3v|Ce%;|q& z>VgT}vaC2AO`>_1D%ZgDg#&KPs{878A@lA1`cX-IF?yf4h{L+pj-uG|uTwLyYI8JIh`=OfY z5^EhL_QbWf3@AHxnxAO2p$MtF=YbiV08XW4m6ND<`cl&qYFZ$IYMCr2uOt_Yy-o6n zj(6z8GTr+Jg<}1aw?Y5bhVh?M5BT_2+_vWr+8kak9RxL!Jac4eTFQzMFUc<#K|KK? zM#Cpe5k`ryia^SoPqeu2{8qz0c)*^D-4yZ{=bYChXK5X$fECAwlQZ>A1lXmnx)EU3 zoiKxP&T-Cz=P6!FOAG7{;nm!rhguW#yMWCwD(yYam`an|-O*G=R#~%}-`h>CzGo)k z`AcNEDT1NEj=)se>*Og)R~!W59x)M<-EY0M`FI!0!wq;&_T`eY7BSzQq$qfIpNYTf z7=}J;-8Zeu$geW4+8u2v=br=E*7LHjo@NIyfO51+l^N>Ez_z?2!0?e`d695_Xu5kp zUcTN^C^|aI?A;@9br{K-?6}ehbCJ1xZjU&55@7z?3VcQFius4HM8JK4M3WX&-Z!_9 zd-!3T`0}BxL?^vDl8E%=`&Pf$#xL3}gA>*InTg-@9(e9M9Se;%WYGdG{{!=WBT|Iz zmc-_y{Xu~)zq-6)!~o&thpq%_*7ccbACg!DCH02`C967-rsm739C@BMqYTSax+vAz z*khHxKhzMAb)e(=gcPF^{I!tK4Uv_1ICHZrH+dgz=o)VPPb1}Eg8kT9WFwrhb{n!l zf^-l`ZhOv6&2uoD`4Z=5Lb&oGfkoO6Tspd1dZd$`P;N2IaD~)~aLp~lkS)=_jzYKT zYfk@7uZgvJepU0pL*TOVy50E0tt-Ejjg641{x8liujh)kx`O`Ck2hL%7Bt!3dp@#? zavb+)6n2}7j%#t3Lf7-EgN?R++^~H5-|r z6dh@}RR8$stdFavBLqV1@crNJri`BkIEToM`LUq!LtV`vNS+C7MyhoJQ1{S;wB-JO z2pIoy1fnKNmQ&~LkSVBPO=w}uG}S%D&=TmxE;t3XHO#9r%F1edqq%q3`*+ydvf)i7 zC&F)DG#t-|fwV&mr2N>SJf9-rS&%mSnharz97~6~zVKYzZ+7!gAb5x%kg7kNT_(K{ z@IQW>HrRNu+_BfS>}=bz43x0J>A?So<@n`%P#f73(cD(c(|iOZUtiKz&rdpeiNE^7 zWh{WRu>bE>XXht5VzEe47BDm4Pc-d#Q6@h-A^qTn<;bDhQ1wFj(KX<#AlsnK|Cv8{ z0S79bxlIt^L4>vLv%*fgsH+JIB6bOkHbME6e_MHph)Pj9O<;qRjV@9sElC)x)PiC& z2AVk>$3KLt2&F5P7C=SRy~f(8he*P( zq)Oic80&A!V96EEQF^1Eg)UcP4;dER13Y^5%&m+Aup|Y_M2~>dtl(-t~SJdOaRMI&! zCQ+AIdJBCxTu}_}a)eBlza+JA8-0FV(@E;nR>M5z;>ZfJY z#lq(9p%iF~<(fi7ukg;>UvoiQex{FTHoiUoe9oJD%Q{>~N~d*?do|;C0xP`BKm)%7 z8&w|CxFZNWY{(WU?s)bD9=;k~A`c>6mxYqWJ# z%_2jvEVG^6=)QHPt=|$+_eEwkknaF-Mqpaeu1#%^@WWQ-bZt(3=Jhww% z2;Grpfrv(QXCCcJY{seq5#r;5hrN2ugI>H)-nu={@90S#D20=*Eut6@9i(W$xv~O& zy!7}FOHX;_`D0X1i%&9?FKQ&oX=GE;zJlj1)R8iban=yU2@S{*1HWUOcewfY z2+^BSi?87%TznwKk@9TYa3Ks~S>V_n+EpkmM-;w!8<1-kCSg<}QYms70Ig0@VLIRG zTpAeUekSRRw9`Q!ly=wr3ErDDZBHiw4AWMWXJPa7R>i z!uU5@Sv$BMFs+!20i>sKK`LPPrn_8Y!?NpHk}YJV>kN#&}n+#>O? zP&wca^?31<>*WfZ^$c{Pt+sO^@)`twRck8$t$zY%PS(5xoqQUYDIcUm+kk5>T{?Gd zE_~f#vapixgaPN#fa0i3UCmiz$&{O%u^RMsq@!DIX#o1owAI?oBa&#xr<4ZLvWUljFVQRo5J ztGnHh_=4mnNUAA53fz|~%ar&(H4 z+rVxss#qjBWJLYWag>K({vFle9~>j!v?YgNX|u^#`tkUn)u)OE8^j> z-w+Ouidi{XcEtLew^zxA60tryx6!!hTP+TYpIFabD zs8E1gU14bb;=ZqfBy8Mrp>K~DqGQS$206$5GCNPb|I~DR~+KX6J4IN zX->Z#QX-J@dVhN@ts)yw!tW*HfBsC}6BP9o)hV?qfccLJC(RLy7?Ls;7NKTZ#N%?% z*CL|>^6Y+BM3kz7jx#s2VssD1sl49srs7ROe9V#}o@LIhw_0~}A$^nFe(CHk;3C_w zm*{Chbv63){keqHAf?M!)PCR`BBz$)uWgFQ1}KbyFnnU0nGx{ZPaMu-N<{fX#o??a zz3A_AbiH=G#wU;B>u!JHTi#~P|4b;%i3@n1NUr>dJ06kM}Krl z{60Cd2Jop4;hlhLbh?mc63~^42gl$Jn)ThO96HW?{mAHjH?$Ln%Y5XVY^Rn~*`DT< z^>cg29r41G9Z;OUVpiTKLVLdWOUuZdDqfMAKqK<{Z!sy67#3FP(wTK1U+=FHZ?>4S zJE-?*{YZ>@Dz+f4Det9I*U;CEFLEt0?H&IDi55kmn*jpe6j)o941CEg6o@NEJ^NNY zT%!NH94B&Gj>1)LHKBfpn|R#KTA~`T(=Z1$23`s|5hBU~^TukS(p&sT&dMMfjKzaxg39=by&!kuM35LCKRi;*%Q;qlA4IWb@m=dE6UAreA zsD>R}uJz-){xmynV=rUsipo@eYGi-eGbn$s(;v6ic&D|tT*!J@%Mo*r*Li!-M9QB( zFn>_X@_l2(RK|E?F>5*Ckx+wqrn<~l4IgY}R#aj%l}EGO_6)^)xn85M*ny}s^Ie-r ztI;17663-uX1PULzy!{_QBqwQ(R{^_6c>k~Q_74CLnWYQXU8ZiDtdeb#m}s+0!*O4 z_mxcxicPxL(f0BoGjvn3DrM9W%lTLm1S?K92VAdFkYNFl3vOzy4sbsX4;x?R6|64k zuT7U0$m-|Wu2mDWWlS(=iWWBk(FY_2Dx)V2K-suDIvW;uZF;Fmi+|{AIw6E+exk*9 z1qQ?*Mrg47$5o(nZ||d-g+=+L0TK!d3WxnF_j&YY$9FDt3X#~96#UNoL=G4J@EKBa z6sjwv+Mw3#IlV4i^|sjK;)AV?2=voqL4_;u0pe-xvk@mCS?d9yXsVjxq;B7tEkAZM zr~30pCT2wc@TmJio}0PwjllaX_MwYaO=mX(t$DI{rhr`3E5-X?Z2!mQE$}6uCb1@7 z=*}QG3uBi0OwQL=s8}g0y0Vgm46D;}ikwu~8&^?L(F7|VbMl^{huEaI=km0(vR)^~ z*tJ4k242wT5qGjJoQ|8Dr=YDG8YFXgx`)f&{ft#Vr^4a*Bsre_iQM{2)X~w|JZNCj zwYAtv%Dsxsu-QBn{dPC)@)lWYxvoYF*$%$xQlQkQnH2G0x$X;(KhNC7~lf-mIPx{FJ8P&)l?GVvsQ=uuHo0KhNRr0AHKMh5w4&4*n#F?lY`v`06( z$|>JdO9l~-b+1LfFQYK_4%Q3!3>#gnRrag)qy#usQngaZt_o_nKXE{Am>Q}v>gO@D zhssVBwj>SH(lSyfl+4*y^MFLM}OgRMyslxl9?hZ^^egCZ*UIsS=w3Ip%UK zJR+cjxpTAD+I$zGAE_Y1MLCQIlmBZLVyq>7>weH>nNL)YXO|N}{hVs7%EOG7a*U|n z4W&(dc4sw$+>i3H2$3gdY}eU1?5%>vPLe@9GOP1k#G%fr%S(eAacz5o3x0Mi)8A8> z&FNbc8n(8TEvw^W%?N6+d)VxaW;vptRjp@fMJV5;LkoRiao^t((77GJXd?1Cd zBp?GlqZ83Mg>vtsHYUYj9;<1|_T6JA6yhi9p3M=#wO>~h3s;Mc%kH4#3#iOhi;NS7 z`=cQN?!tG1g69>7Q%N&f`XM@9PO3)KJbWBrbLg&-JsglXJa3Gx>cwf=OkFzgBz90b z4U>qMJK|%NRrv3ZQW?(RSS>vcT4H0W-T8ZX$-q}aETc_ zbrz}^`7FG+v^vRz&D2!u;fs?-N!+2Pj_z=y8Oem6F@!#_4Za1*k?&I*+Jvci4oN7R zv2Ka$k+GL3o!WVoTgANXOEK&_!n3pHu}enwIoG?e+~fLf0B&`qz%gs7HX10C zn{-*a{TXU9Hc_{g4_oCWlvk~~-AervN9HHy-P1|UjZkkln1WHoWSum+ad`KtuUbv0 znG3H%e)rpwg>*LdRuQ~=OG7Eb*!ifiaZ<9|D_ zH2`=bq)cQ4%}Xi~!LaFZ>!z}&b14dEhh)a8`H?B{0UR&5UjZHX5sO6oPXF>gNw=I-7g6XwYh9-LucH4CV%3G=Kny01L~8+^TK_Uf7H z?Qs5yO0Y>^doWHb#W14CCL?tt(s`sxHs<7Wnl^I1Gnu1_n>V2a9{MGd4J2INO|ZR> zYDq&aq&C%?CE|=$pKR2mvsP=hh})?JBNe|$@5t+9n9Y}&lU02P?b_vJr;wCA zW{aHnV^R$!tFnaNIeKQVE^O7N%VY&6Yx3Gly=t-rj{+y|UqE;T;YRAvytp90SV?zN zZm1V5}*TT956i8v!;W`4cAW)L?eczdjYX-0UFFr0O`pzcJr!$Uhj3p@TiS=q{l zkA|mSRd;YqW?|=NzRr19cG_(IsGt%0g($SFNdwVe#uR8NH;iOu>%25&hVS+854#UA z9g^Bv3bmYcqKE~qzZ(bTIV}##GOAlX)6YPr%y@&I>?nbIawg}G2MptLDObzN0#EEq zcufrQDfq03_I4|shKJt83|zymU%u1gPiE%3%2Keg@)>OO_N6D*oq$-E+YX_4&(}-z z*R8)GdmCy?HL`*39^0avIotFwJD}T)RYBvjv7e61*g~^&kFJb_{g}j}jP(k?qzddL z5nq^oS12S>%%alyVU1P89Jdhs;^0ipOBOHTYRQ02)5am%jI0?~F{GHtl+3YYBc>F6 zBxz=a`3XlH(`G#R;52p&rGK3>K{kq~;mmXc?W;E^Z2kh7iZ2#Yrs?$B(Bs! zfSnIS{@|RMh))q*YtT1&&2Z;Gal$V~sPtkGcrLu5Rp)^tvf7|u;Yw+4gXTSLnq|!2eyku}KbfmUQbcu6t%< zCn83f>-%Am++Im|J_F5d!zB&tC}%p>1YV6H(GSY zZtbfR>IoAD=pR`(2ne`m_=A~LC?7w8p^nSjMn=fG?Y&AJz5*JaIaA>tjs!iTnW!&D?b#uaczZe&V{qucW%G zVCys3WTD2F)z%VCnaK=U@aWAoKs-t}ek|XFPixj)ak`ui-2qTBwl7_GJHyMZ?;IkV zUApYCQ;R|QV}nlu_wAa<4|SmAM~IK%WFeYRZ?L0vd|#oCj+A*(9z{p|YEZDc->=yq z=9Eple2L@$J7T@%X_ooYzjW|5##1i_m0)V9`gIT>!!u=mA}`MTYieyZIawI37N?iN zPK=PL!AjL+JT0wYKs`z)w%+7;cA?ZC^ve(ZQqft8zEZ9-F$qd#dbvpNca7AgpvGKS zIYI`u1M1KD#v#T$(nO+gv%54>p-tduIGeCzV`l|oavbk@+oUX-gn|MKfYqAcfg(&X z4(Epk2iaOhqVfu9td~3&8&l;_iDk-;7T81KOL<==Df75+6~ESETSUOe$vD2 zV;+98@{$rC$%CLzmv@S(`hkMgtpf}KQD%MDq+8zQ3flIp^gpkBxSH93GTGRhu=`|y zZEH1e!tB>vr6@B318*vaheCi>{v3H)vLEji;kQ3Xs5Av+yZfA_WdVS z0y^u2{hNK&e0QDkyJubF^RuDbV5FA^khI#o=kclUWihvT7VlBrs=UQO`I3W-YX;~+ zGRAje6MvjFTGApIxuR)-lBMOtinBhyVFY%Nx95}T>60TpLlI{DrOBA#ol*2N<=vOn zV(E>MD|r04_`Z0@vH45oD+k{-7?1QEA6`QKL0b4{9K+eoneXDh$OK!Kp>6@$CfWT* zhrc_+vs1XmS=kG!iE!zVB=(=+!Cn%`7#oe~s8@TQspR-=eqVGtwBtW;H8=wyYuI|_Vn37D!{_Zy^#%!RcTXSigjQt=@`-At6#ALW7 zk46pAqe|#!;PS2WQ51PtKWmwmD?e_6F;!aDQdkHghOx2|>rVyqNGW)_q9#h_VlvRD zVD-a1-A<(~2lF?Dl{~M5et;QmgprO|3!E`>KhQBAnxs2oeVlt3R;>S6(No`(2*u@7 zEVdY-knKa`?nx`S#Z{Zy0$;iuy|7MVrn+)TyMP87@Z0JXdH>=D;?99uY zi(zi>c3o_eWGsb#?jir7Wzp$&Z5PCHad<^bz&$K`qrx(}3rDPD_vDyWFLw-lTUtVK zdT^A#z5S@7u~hT`_Un8op!U6gphW_?QJOPSXg=HgYE#l0Rw7g+!^5wJmnIF{aQ!$xE$e*xa;It>2evlay#T1FacR0l59^M&mmEB&%NHokcDz6=l9A zf0Pog6hTC?8B$nEo@OlJCM&2?0B{>{7gzi7q!eZ}1*Rk|!x#h~e1nS!tvH3xQ;QPb zLM#!ViJN@B_85Ra7kmtZdOv74)L1kqHfTAL-MWcfZ9xOP$8nNDQsjWpYP5L|> z;YlSlP+ev1m`^FCVRVBh83=I$hg~XLEX&%VZ{;seTHM zV$nM90(P#|z3jHl@^`Mz{T5UKJ6p##u~?e(>|Ey)XQpb#gBhy;-HlS(Q`vN^Y;dT< zGEsM@G?AzPsMhnhOX}iEa)OEUJc3_Nd}I?M}gI#I}g$_RI%@_gaE7{Ow_9B zH}%?%YE?uJb6TBSwdy=<6Bw1G$4~YL`QRA`{Zes45l9Pv2#UPh4|F$vNb%T;#eZ;z zrn_V1U9eg+DiJug=mJYJdM6S3?w8{h4m~y9ovSm%fzq7SWDx;t8OoZv5j4XY(-zH? zB2-u-Uq+Dj0b7<>yP{p{ab&difUWywh2f5qydHtkkva=9qH2Hg;CMUan(Pvv* zW*ZxuZ)Yj1O~JiYn6isQBoqda+28Hk*Q&o8maYvIs!r_V?+%SR${HHsCnq+cVPSct zrAW@s&O=!A-;cm5Sy!PIT#C#;?jm46IBUQ$l}n-XW=LDiF-n*#jH+_rF^j(cZWRyP z35gki{EXIHoYO@7+L}T|-yTg#g}lDS{AO0VkqIt_!TA^2bVYkjmfnPwl#((YO=2Vz z^%oi)8>=%P!{_GVDFZk&)Xcpefw<;Ess2Ue{eiA>KagrIjZ)emdXYi~uVPJPQ^33b z{Nmz?vuT89@GDJO=I4JFs~6HHu-)e1=rzmC%nYHR2aC9bg!9of)%?;@!CGW+>ZG#K z|0>kd-jtA(guA}EX+)wBaDlt8=GAA*D(LyIl1y?Mu|&ufVrFKA_{Iok<}!=r(rL_M zU-sdsAyFjHX_@E#W9gL0JbHRe(hJLoS7w+q)^B!1v=ah-Ak{T25{tw()IR*XoYMc~~=QZDSQ#yzpO` z&A(P5%G79ZHWv+G)2n?S2XP&hU}Zpuo5#vk-|6Mfaq5;vyl@VxpN%rxPm}zsiy?jK zsE3~kzd{}TE)p3=r+DQ;U8NxA#$j2CjCkk6sYTt3TW7gaTg;4<(Be^@>spgl)D-d>0RpIVyoM)+MG%N*^*eM%1X zCJnxR!%UgX@YmVUt2e9Ow6}L$3JBW~gVVYq96a?jIajSQ-k7T~edTgI8m@SM`?UFb zCt9Z@y!mp8S1PRHKzc6db~pOKoQWdU)aKx&F+|MbCgv%q8iMSn;@dFp^|1wF^Y1ln z;AzS&%g48nM;bEZAfPhNdlKNQ&gFi^8T%np-NV1?d9_m;jTJ-@zu~}_9mi5hQkL^O zS0n?dw53PCP5?252%#6`7O3vtwOk^rk*sXaMmIQrmk#0}-5 zkCUXBt}YxJk62bOi0KTTb_RG4efu+}(9b{{j1zOsX>Lb_4Kj5v5CVwGe|<>f08nU` zjUb^m8mTGK700pnnYrtU+o6e%TL}BH2v8~IsHSC zFufl;i$AFVe6mBGw-hm0=$&^iNXX7Cg-;6LQqTJ5`A&Nwy<7Q}kdYA12$C_qZV^|f z0Jn)~u?rBDJvmE917zGkmXyAtiO{@cRNTu*hn^npefvW6b~yDuaGB$c#k^$iGT*73 z8vG7HF0V}BBCnm#UszJDPCT%7nfH1ssNeDB?9!_0PN5dquFV^Oz^1yWv*97)Ng`6&77Tu^R{x z7~`YjE98WZoOp@vY`ZgJhZbbh?hk{XMjNf{6J-~F*BKp{>G{lj|D#Sus8b9{|A`uC z(Sl^bAS@ZwE1+@>aX)k{Q$9Sd!4`Xc)2bBSZnKMfNGiUkR*%mgEIU&24(t#?dYUKBqwQ> zhTk>$?jbVNa?>HDc(S|CM3{W7^PxeKraCC(gD$7*H9zZKL;e_3#n*J+zGWKZ&%}h8 zH|3`XA?_#X^=1o)U%cDe!F?o`rehbca=EI?>Pvx|Te@+Fh5=ufs7?>B>Rd=GO8XWF z*rW@vXE(~<415B3Ag1l|K^}gr)cEu{7Vm)F7z$5b8(MTlYqK}&!rl{G=zoc%F$g3-odN(hZ zleUXUBeN!!S1XCkVI6k=Ybaw`Qcd7Ld8arL85KRPJW#dhq0grvHF{W?K}S2pm4r8; zmLVe--+zFOtmNsgBu#Abl{}uc{k}krtj0k4%Jtuf$0=Y51`~{n{k<^hxH(ewdQK>* z-L13a{97;ehw##8?gs*lew>>WwvMKo7@#Cz`NNEzW}N6@)zGkXedxVIDU%@4^ZmXulEvTERyqG{)IC!W z;_ZLEZ3!N+WgE;6p)IX)#GZDy(^^XuC*Vjdo6zI#1(3C1#`z=o0iq6j$u{rGael;4&21+|#DGUNOi z{iI`W>u(=D_@*WRoxSD}^MfL5n!tCKHh{gC{=x*bx(q>S8z(br+oM(MoBR|UK`6tY zk)GF_4g*y1ht#Zi^Baq82qMOcz8u*;&S+jP^y&o%(8O@UQEoO7NR=oHABO= z@{r->wq8==V0cf%Dw@LPj@xYKLRd$`*qx09lB?4Ip%T_*F6R>LjS$-5TK`jr^WYLM zNE(Q?n`iciVL}sL2tdTXcRdFw9hWxfXipk@2O&8InQr8CzY;^-O#KYbS3~8E0F=jH zF_ZoJOZpZ`=7k!T80p#k9caRj8b(ejY`O?Yh=mnC-lKk#EEpMWh)rFPy*9I2> zkAPEkf}PeSjqR2b$~p(F8q4SGSnh@=$Bq}6b=Q78AWR4bpWPq^#WNzC76*=D_XBT% z8o%ZM48D+(s?>*7-O4m~kV~wg2!UzJWY786esP;$2%b!y zH$xbN4XlMo$oZRZWwpbA;rA9+Wf2kDv6eKbtgCNu7Kd-U##0e`KazvmhUhx#cWDX+ zTu zJPvH<<#iKsr`2p;qN$@^%~8rC$hzRgTVLz&bV_+Htd=kMseeSUf^Yk^F~ivYl0&Wo zhi!bS_3(dfiCt;d3)T&IxMEyWe1GOyzxtzj2Rii!LtR?{`GEIiglZr$j0(+utDRFe zgXnp)2bPvCiiWPi{#CxSG(FD|l|A$CmUdyH)M8rDkXPUxz7ayqLE^}o_Q{J_;hFI za{@$%8So~hn>$G!-mjED4oHI94LfuX%iQ@aV}mtPkn|flJf};{| z@9u8#pe-&e{P}2!!eMoCGB;g|IhPY~jSzH%!J=CWH{L}aY8#~hW9l@n)3%`6l`&>%Y1M|}Lu}Ac2 zv=c&aC}@~_JYH@Bx*d~HUa4Tt$bEGJZBIz9_T(K;GMgvSc*Nfe>FBm`2v}#3$)$te z;P|OU5Pny8e{RpjsNO^&;Sw)%q&;nDY*J=l+=is<22jJCbw)z9Bj(^6_3|Bk4HVe7 zTBT3Pb9%$oBKdXO@KNdKncZp6B%fx1-7pnM7LmH=4U%E^0J)9)BZ|%yzrKAIU}tDl zv@0+^$B#tNz%Y)?v9dSYQ&d{w@0HR579_Ad} zIAr10G`iXtO!@dPop%@+8DlW^baMFTltE1T61$9EG0i8RzOb7gTz-}QkTmFRN65rZ zPEW0p%Yuh&4&8tH5Z4+3QJb_&k+Gge)S6$gb0JUHJ6O1qVFQ7 z^xuQRMyv4fM?L!s5alb?r}dzAo92ko0RfD{(EBZ0+&Q4KI1R%AEI?!MGh=;8JiiCuOG|>PNViJ;>+1X(G zwI<_}`7%O2hsG4>0(=99auJIv3_i;t}HLUtoI4oY|2`S+3m|+87i0|7?&QbupaW2Gi-jem^A{H?S zF*L9ue=t`s(Qfqf6ZR7(;I3i*{{kKCpVf5Msu+pAC7s2z$?VuUk1DjcHLxM=C-sD>NeT+p4M~&za-Kf zzv3Q1cF8L=s`}d8Pcg~J;uuwnjljEuEqg!Zug-o?QSo>h>zA?S<(gTZe1Ylrb_-tiWdVyB&pe60etv`20T37v; zX?yIF_8Aia0wCMY)Vukdr^TpsXEA)o;O*ljmW8#wF#>9;weI}f)`9#DhouxXSy?3M zc=8X4BZXlpFyqqx`=iOLau;W3^NV;@pLF!tJ8yqB{d%2wy2IzE`)Zq-<7{9+z6%1m z3!FxqS7_EOx~rg`q;S>iRzaTXiZa*iiSG7J%<-vIn>x z-o@>^=htE|M8p42b7%R`#utA1LUDI#u;LVVcb6i?-AZvMxD4IW^eL z+}vD9p|q+B2f%s;M@D9rpKjKjjbw3|ci((dwhlGTl z{q77fg@F8MmSeEDvDrJLnYLq*+9^1oAksS#fU0`RaDqX^pGn+dW3o~q|C+ar0q@Oe z)-69rStd}P_NkiYKi}lBVIH0&GqIg z<&bgp>rZhw)sgp5S?smoI8?+cuf>V!(aLd8k%?*bxsxq<0b3Y*>0V zjUWMcks4VYzyo2y1tJM5`OEWqyea67wXzVKTQoF7!v?+lj=Jlly9hCL>j7A44sdr9 z%6*J5kg{RPk^>OAPby@gr>j8_v4Pb~hOW^5`J%U1$guCvCtjW0S(#ztvr9_`BG0$m zzW&}Lserjf{tO3(%{_Q{z3e=1nN&CDkLs-0=gKGcusD7oxEvsva=HF|%`eK==6~mw zH)AgN@3KgIw%enOKY{7uW?%WgxfH8M$VA&-1kd+-QdXRN2Uz_1I@US6p%1#YzmQIu-ux>Pk$2%3+Y*F zPCFhdoQ{m|cKJJtLt9Te9-PR(4(}P6-!|Xvre9UPsx_^4BEcMGvM9?o{dYg_y%o*i zk>#w*I27j@bU7)1M~>L!qOpg*G_JoUYio35c&R@gLT zchx5xt1vC__)hQs4y3wBwCY}uw?($S*A+~fy3nPmW$J$}`}lm*IluTrfJo)gwmSrI z;46cEXJ9)Pmc=CxjBwZj{$vwb{5F_KPfq0D!}`CuA62PJiJAkqck8}~<-nWGd$8!$ zHy1eDiTti_bw74;cmOqwuy&>99>`Pmnvjw=%ZFi<7gO&l5~g8l5PhZAp3oS0F0khF z$F}WZZ~Fc`W?d|F+YbvQ|3K_PIE{DT`R_qIb8BMOF84~AIrc(bP}KHlp<2k2sHjaK zFVC;{6>Cez{?ea;i}0M@zBgs*z)(m5g=CWnnXlq_x{2L1kDCKv;}YI3Y}BVap!um8 zA_-oBerBaV#X;CwCOUi7F_@D>ga8sptF_CQn!)b6!{5ivFCh|-5eBZO z`qR+S$@1@7zrpv2Db_R_m$9>ZS5jJ9FPxZM)2XKK#{bx+&;LmFBdnLO2o?oB^BV9K zG+eEs0Ryu1s)?(CzJWnnwLHqp1w`JGYCoU4_?odd_=&rM0~-)!rgAgB5kS~i!Fg+) z4r>@6^JzDiVpF!V4lBC|VeEY{r&grAi`pxnj+jwonqE@e%zT7}b@R~7@83h!{I~Fz zz>C76c%94Xe2!CWY6hJuQNp-0no*%Q=3Xq;x(ORMhTI7lGtagA;%vSYlA&y%6p` zh!D4;e0k%i*-F6b4zK_r&hou;Y-{xVZX)G0v>;Ws*oOZv(49_fp^7jili&2p?dh2Y zuMLB(M!}jzIyec&%9Y-+VyA3$h(J&5O)Euy!0syeV-!iFRxt#jb zFq>>9$&Nig39im;mNW`kt=OnAzU#U~wY(Hrw1k#cfp6f-H0NsSSH)k4h`g6E!uYiA zfeS4Eqyd44Y_SPMG^^k8XS4M()#YdRN04=hWfaDr&9><^j#sh6JCp7-O~`@Q)*-l4 zNl8gUC>8t}g?;XHLdGurr-C3058g%G+S)Ig>x96=+I6wb&C0lMIZss0% zBaevX+;LZUzNaM+l&D{25_o6Tb~R^c;F3uOGw6J?Zu6HNf%$i)myqKVhMDV@uVVsGXg`mWm}>t69U8k`TsKrS0T zU0~H2EKfL|4#WW^w7OYUx2XaO_xIV^lW zUT!=r`&h9cHiW$M5%~{+jY%8r^l`jJsJaPmuQN2?(|gdQ;cD9S#Nk?!!9uZX*NbuZln3sX@s1N zoMpFH+%}Bji#Yc}j~$bVzghk7JrWNOx{F1GS5kC|0Y8Efdf(Yp)m zH?>(dOt9VEtt4HO$zq26v|Vp@ZadMtKi_>dkkB}}vw=dz4^H*Hl0?`+5*L)4|GV97 zMsv2JhZX`o!48dnbg^bwGds&nE(9zF6U*v$CuPd~k>+oqgn#3XhVTBqb*l}_UFE`6 z$$|{1U6N6`9WdoCpMDI6k>n?gO-2hCRm()&mA}f4XAjs{zHi-Bx$kl{WgF}w1gD;5 z!*|6)1>6ZWKR08svaXCCcu=SA=j$<553l8~$r-<3ug9~+P=|L_p>)c-cATt3!vlX2YdHbO0c}6@ zz$3}X!*_FpNyynl$|24~-0SaxMvKGwQE?QCIH{TBq3>EU_TnVf8d z<=D)*fLi<9-Gy})^%&>mSHQbeW`ZL13b2CJ-yZBMlzf+w(pv2+V7NQBz_1Rzixm6> z4BOO3K08T5fCVclnX5l(xu4jy?6q&|!58RSWPi+Y3a=Av3ZJ%VTKD21Fa)x9)iOZlbr^^ZQ-#5~H8>-`O6(^r zl&U|f&3kDQ4qLp%z!LWb{u9UmaSWO2Sj*5u8Yo1KW;x5d|0h@A0 zcTeMc;r9>+z$QVcSGD=+PuWI*y31+PHqf`F!pQvmH&|zW*77hb6kwCFugS$?Jm`k% zF%urg{jigM<`k1Ee^Q$!I!O&7V=V(>*_Pr}TunM1`5TUwAXqd#iB5ldR#=WSU`{$a zMuR!Z(HE(YMyzWD&I+YxO~XlddM$fy6~#?znKb`^MpJ zT#09%?`LiM>&Q7r=#Y5Z=iL(D?O$CX-6Fq#{|443=|3Ca($Mq*5{@*(PlSb~IoF;8 zhts_o_@#8fS!6v2Q<5r6p4kV*LB-yB@dxS?zs;1}OK$Q0qU>i> zv4=-?m+|l7eS5Mso+VT$&o8dHsOEnP8SmD-p`CWzocU>aC zNg&(+@$Tji-L>wf5Th40bh}$^Jw&#)&_=l-r+B9?L;2H?orBZl+$D&4{w*CRTz2b| zf&X1r`q|Qhy?U{XAHY^G4LuEs@^1^9wkgND$NE0aHF(xLw^GQn4UV}O((=%BkV@>L z*Uj*lJ&CXPEqD4#IiHGNvv{`G6Opqz{#x+kTFpJ(*t=iQhQ{|2)?hjue(2QfNvLW? znF8bIF9&y=NH%ovH{@XX7Z{#`5U!f;6$0WaA8+{=s!zY1JM5hykDu$Km1=$z1V>TE z)oScvQ>-uVsIa_!D|BBx)%S8viZ0dM~R~!>bIhbnxjfL5MHlWn@H0f*U z8FFK$``*5Qf|>yE-;@HS8VQ2h+%4h%C@gR>L;|#ByoC8006ov=YVN=-lnCj6k0Nf;9c= z(hKDNat<-gwrgY(!|*kqEA6{o_`H1EarX>hwa&mq);fyhXFVT%tg^+7@~o8F4pKZe zwz1S{-`)MpLko|&|BMENlaj=gk1j<-v9+3@me$mKnDfAT1#oVOREGQx$K-oTq|Vg-FSL#r zjsi#;SyQyMq?xNUJyk%+M@XqA!^Oq*Wl~}rdHd2sfEz3~y=SvX6LPtrgV6|fKgEVN z&hc+wWj})#bolW8_Xz+cxJtC4%v zn%7?1;I1r^Nb>Vdk_4m{P2LNQ121k-7Nq&UeCoB>WFd@?z_rH#OmT(!ynQ!`#{&`9 za&#S@?drnB)|6Pq9#7S=m%hYfE#~bjALhelKxYq$I2cd`m&TSBCPszmD%3n_>U00= zkCg__0_wOx@R~R2Y5m;h>YM@3f@2laxmE87(u^1esB(Mdeu+ID#y9V~Nc<+OZOlpU zXtju(KQVs&ZD7i6rUmrm$H3-320AR_#m-O4Y;fQa%7no7ARRhctg`7-9)N7|!}myG z&rZh8`sqsp>s93EhIglHOZKl?gCL=?03Ql`x|h4x9b4N>{u`>dKbwokB8nYXZ%rZ) z$=S9MlTX+(Om8?(nEl|Y8**4(q;x%k>3Y0(3-m04bA^L@(zPMI;uq$zuaK#L8}I#3 zl&XG((8WcXX~%o&M(Jp0S>nJHhk-(r?;2<-HiBVAoQ zvG=_+p5#+0aU;X+EM3012o)roIiO+>{G}J}X;oWN%v(~zwRPstx)UVFlz3v>j{XNU zv4A5O8|(8%=HS+^x|@kx4^kc(#=^7=u?r2=d{IZtTCmuu12}Q`2fTApu;93o;c!VM zy5m3ph7Xg0yPJo{KSdr`L8Mhd2vIe-vX*Oi7C&)#x!X2yEwrV{i5=!FY6Pe$ETw5& zH67jre&IsnAIN{ZmjA{rbU63>S#P40zqk(ph0+joc9Ka!15+5HtP|9km>LVR(7dY7 zW5sO}=R{tA&(?M10(DFGkB`pLxHYh#2>izNCOc+aO3#IZI^=y5%aH4_bLlqh*S4r2 z|5CmX%}T}unhCyb&)-kNZbI#KMHbP>13`1%xlvVqD>FV4*7#<% z@Z259wBtOgC`LdBQSuChyC;{EMg*x_Qc{nA6vDv8aIk}`+c0OTuLWPBK@G~iHm1mo zQ)BLaG?XUw^s1v0r^TQ%cC3p(y9;x8Z4TOGIT!diJU`vO_ zZHbklIs1K!F$4D6OiH#}Jp+Sp%mTg1oMM%st*rIFf)Z-VWTyX0kU$+8li|v5jtBRS z29`PL>q^DC0S8JSv%Pm$*gJEw2V1&?8#r`|*Hc8rMC&6|XmoK(9PSmb3jN8WhO~)} z^vuS_wbl066Sf6dzEnJa%76(#@sLLzgRsosn_9Ge&fUZM=_>xkubyi({%1uW(?PEz zScYr*@2oV&0dK2ta9X^?IeLlpc|yze2k1Fm9Pm(}Py`ptX56(e;5cf*-`+&HwT=5s zDB;+`$(IfUCFAYSr`fsW*J27MzM^adA6y7@^3FPRpV~tE!w6G zAdbhQ-VN38{C)X7Wn+7LCvw#-1FG83Dfb^(J*xtFba|EfWcP2zPRjanCDncVzapZpp*8;L$h zR=+5Z3|?h39)wADpCV0LB!WN|fWJ^Eqh$?O8;GFg?50;0-dK!= zj!0cQ>#8Ipd@$2o`A)J^r9D_75^=?MM&ks{c#Oc-p!e&K0}`+)956fsV{CUfR_VC{ zsk)Ncg1{ts+uBl8Gj8>gsK|T$(S|H1t)(R10y8&MG=5HIWoF4}KG|Dk)Mjr1CQ8lO z^AUPaiRgcyM6_!4}LYmo4YuJToqeJ~I=^#?V< z%@0&{h;0`X-D^?)tfyaOXD{-K%o}a6MNf3CXsF@cX5a)TW#gYtEY8McIK^plBChd6 zJHUBZ%5tzErH#8O@k9YVY{JVzi)%qmE$I_m$dxf%)%{HKGHU2f6l4w+)fz;9j1fd2 zmZ#fy-A+j>RWB(s+8UuKpez-iqiFRM6*tfg$(|z{=+#C(yGWxEBK~X7%6qFbD|xhU z(|@BW_jVjF!N89=P}>iovs^faGY7YcmyJAU;PTfdz22(nH@uZ|$5p)<3#c}x=Zc1X zFT-Jri*_D4x0X*bo30uOeTF66+yNt#wA4 z=INt#o^%+mT~Ol^?3RSQ!UE|-bq4g@xwR(Zu9@Rqvr`e?dN@`ic$E!IKI>YtnmeYU z<680#R##JK5m2nTrv;-hMLhDyShzI?m-|}EZ@kdiA-ed4AE!?CGRav5KH1L)YpT#r zg3vfu$80~Le~N@s(a;iDvVI-Z3c{bgtNS@Uk|Qv;gOjBIj@M8Mvkve76~Unp>zj{9 znxKfyzl)d6UU|aP!P-uoI=QJ|8KD`?37&Mo?Numnt z)_oD8ZbM#f^{h?xB0}U@xpe2o8YN@niHxi|-Qz>`xtXm&1Tu{+1@lo<)akF|brDRm z&h;}wsvH}3QkDGkRJ!C|vK}=Q;-4~jSEut>aGQ99P+_vP8|M*jWa^c~6@39tGGuJp z^W4nm0XfBJ$Gufp>`-@fp%&MAyk$Ro2cc5!uf8T0s6EWppG5Kyu1wEAJ*Cba=S-N* zFm^j?COakxl2kI|7E*~5JNFEr;HM$cwIS8XIF>WW)?c#zG_REA7}g;{X42Dn?&u|a z&(Br9RC7a?Ygqfc+Ijwz%*i^&X;{MwR~K|*V@Z}$sa-K<{zZG|jXdcln6aVm8`CA3 zG?6ORk1BW^K%iMgP@-ossOejBoF`(nfaH*g+>0x(W07h-klA;E^a%;xc$ zM69xjL^APDTJ|xpex&p(9-0KY`O>F0&pO|D6uKt=m7haPNj4lH-HhL5vT5U>;|6!M zo~@@iyVHRwB4IhN%dQeM&oD$wKW~nM#4bMO;A1T-Yd^#o{z_?n4^ybI<`YF=;29?^ zn3sgk`ZLi{SvEXn01-zxJUN>aY(nO0rQkv;g*!BlvC0F}{iHm>t}qG&3oC61x%)v= z`+3sq6(OaN(U9uiT7!)6${fMR9tjTexPmp@O6Yu1y@TrCw!Pn2{u z7>(_9K?Ves)fCMsv?l9Y;=&kKtZc~d+|Ux6Y8^)OW<}mV?foen9I=+IR>tJNYQT25 zyWbLwP=6U^Lfx4f!fZKwFoq9j1Yy)2d5Pfp+*pjb zh2hJSkXyWTJQKD)m%{Bdm9JIqBA!%d0Uy-M2^soRnqt^+h2cY(!Cc8I5d5^BbJ}3rg_U)wk?58ZVdgaUN+| z5kS=B-5*A5cr(22HI4|{k_E8icNy!_ddA!8XLG^BYWFMivi3Z*ZfBs?S;IiAqsQ|5 zS2Li)!_>_ssqN2obV`>gpwpFqIK&>WsM%~zBP>%rq^Hpc+P_Zctt&kX;L-mW+Y>WHDCKy>_RXCKMK&7)W zy9agz^&aNFS|Vl9oD1aUbHUmbE+Ti$186GPknXlKy)X=qwz*LbfpRKZqoTV%bu8T% zQU4XS9igf`o8g@k#ObAH68$DCZ_ zcu6wk<9?`PeAC}O9e;W;bW^pV>5KSwxNH23VsXS%2_WUMJJvi@akzh(FEdsjjIoe$ zQ@?J?=V#5J6cg+EXX33)ScJvjKfecm|CaR7B9PLOuc~wx7%0gro{gNI4^(rc?pTXd zGX$u-$D4&Vd&&-PD422Zd|mx&bN5B`03rfzPoBJJXy|@3f+;QF9w=4x&hNJUT&#_d z0>26^F>wCA=U^FidZ{Z?|n znv4(+$#yv8EK zH8cOIfRnu8DMi!Exf9bL^8u1MgtM@?`-<7lx0$@<P|!anihF!a^0aRTz0sIWyo6AWSm;;pU;! zaSe{k5gQw3apc0DdVRV$NTDw?Ae_9PpD>@}QrMR-I4Y?eZ~%Zt-O&^EQVK~)NS+t$ zD0gQHxKj7@_Qs2baMZjkfpCCpdvm&8c_BRgH$LX?U%ESlPPvze?a!YT`4Y$kLmC?R z2nY$^iixc)(4b@i9vd8l&d7Z_W@ct^jG`*9g`J}084nkxA`UzPo1=h{gOmM$lD+6a zgxuEDuT6aJ2uVcDixN?Xt%HMuy2Br&6-{Xxr?P~;mqESKKgwT^yNGU7k+4KX$?kEK zBae*B_VhiX|7UA^UQ>_goJq-9TC+;b5cZsPSeO~${S@imeV0mw@06en6?Od)#eLQJ zcS2&LiJe#n1ru{tzv4E<<#$)3f!%p$Jssn|9VH*!r|(O}e46SwBZ(vCA4XHn@WpU5 zW7MG5)cq{_Est<7pJlmbSKNJUB|Nz!Eq>vxi9(?|G%w{|F>$3b+?bOCw>=O)?H-Vs z=mj==-h@mpIC3ksQC93f*esE(kfj$2iCJJj2)(4&2aZHEeDZkEBW^X(KX?!}oLqB1 zVb0L-E-fwnnx5_#bNdbR_`MiiM_4ZkXc;uQWqHGT`CmvdXJ#+YUu8q)MThRhDw{ae z_?cvq9KvK`yoBE+A{zP?y;k2R+eeR$%w{eC4$-5|T}dfM!}r_uN%szoIR4^W^P=YA z-q81h7^t#gUn8dQ2;xw4G*W*xxP!|t+;JNV{!1B`>iqcbYcrb=B21osV{UzD z`1?42!e#|0J*FS`yhOw}I@YV~L;u%$OK3t)UY@jJ=g8F&7S~A5t&|jBVMKq%UZTs9 zm!~(zN%Zj4!|zc}+a@6)(%~7HSJFM%qCPIdi&}GURYnI-I+W{IR8J(lWa#4TU)XR$ z#I#vn2i_7N)n3BOC}c5r{#*f@n)>hu2E+E1d+Ad92>damSPiF;hLAr-NhE6ZmX zU}8S>*NSScuZpp4$|xSY?254}%(CuY1o7oA3=1q)r&f;jDy+Hu#MHeRBTn#>g^p`E zi7Lgj-qP8cnLg52td`()rOneoUmq3FWMCvWu{l)L%$EK3JEWbwoMB~$VC8}aU&H!z z>g#M+=&Q~O=5E|8|8MvHjDx(rBwyKX*PUKP#AF~qSus~$|RmaOT~oYYcbYRskA8y~-M$~~9Vc(%q-aXlL@&E^O(o2ODx zgmTQf3eKN9c8kAgSes?3NoQ^&H>oun6eS{`mxmg*p-g#TGYw@3d5)60f?k#F0(^P| zn!5=1HsR`6-RD&}aY*>r^Cggk?q31ACbHK>{2Rmv?!`JGBh@A`ob8Aj2kz!oOD73L zB4uKoG?~XuB0~CxlTv2?4FH`S=SZN~D5~#EBQ_s&oPXgF#$d`a>gadK9-N9+0&K92`kg!`vBG7y>iV74g*eBao>2}QS&k(V={5d&v#@Trmi_M|M2~!qWvW@- zuI^XWnN6P%i^J zS1tWE56yM*l<3kK7;%9RXK6VmSCYcZr3{L|<00d!D{m)N<4ZiO9=THb7^LH_hd%j< zPKKTF+`Mb@^bo=n>+Ky98{xKYv=cSQPHf;(m@We9?xme@ZkVyTsX07adFRKVQ#ZHS zR4$Ed{v;D%VxP1}acI~3Jsw)ENiMDx0jofCehHX=OkMfHar{?AmytDYYlnx{zmyfMS#I4+*qAWgUtt6A@}*bvL)vs_Fy7 zFc8k|Yv?Dzhr#NG3?N>H2bX&H&0oy1rngT+PHE~Hfg#08Lot<-!dm1akVIdUh6M>& z#U7Xy1xwvvchYQa+@O?2b5QR>G51UK23;_ABj ztdoW_gU~|Uc@C}uk3JGzmrg0+OV7Gn*T~6*s%q0-J$p1ql^KvVBD+1k*f|esnd-u5 zM#+SJjmw>x{3kg1G;O@hk(}l|2#xQ>@qk#{M-l*4=c#)Ou-)JdZJDrqZvubhmm$Fa z4VsIxa%@)MM?OC>{1hq-g8zB7=vC|$^X;3L$Lf~H=%%r>R2d+^1^+v}t<4kHAz={} zY6$y(f}ff+dMZ2_9(C*rdPn%n`u~#_>#KYYbU@qb>4s&u^TVeb#l-6`8zgOi z<~HL?cX_B!+4|0JlyFw1o~Om@jmO05jr($0yvgf4KyN@Al?@Hoo^)N33w7I{Yy3?m zQ$|0Lfjt=;Zq|Hx*-V6p3(dY0?VMF{unvB!lRiUgGx$uZ*S!onfb=^x9-`i#99{i= zb|{hD5dB*p0Y9EX3m>v^E2`n`b+QZr5_@u68g$T|G&Mnd4&r5fP16EyW?_-~iFE#) zXcsjzr`#xCH*pn|;^Yn7@Oq3`EG5qnq!U6aN=l}fHdYkN@6XA_{F}yIvw~j`e83P6 z8dr^+x1zoQW{v%FphF@~$vD#G4p4ajcqsjk9PJSUXlR&;;D>b;>OVc}R2W7=#GXm4 z2nqMJIys+JVJv_&Pc|-ZxVr;5~{~tk)2>CSEBM*WsgCYrp?~?%-0j z%2Zh<$x2gzc`Kw{4_1m&j$COb4%;*vgjZ4i%4QN6%%t=9p|P>iKKA=gSdg-kQr)0n z?JUl70Y}Zq6>`_bT?TyLQ+p8ESOCE%n7x4OiM@@@o~DS8zq~v&+RvrO@`t4Li?JW5 z#sCf{r`*qAyy9#PsL|Cj#^<*KCfdpI@k4{t(t2tAs@I^K<5)JZQ$TO=0DMroHZR!5=4d?%2f@qyzN5!m zgwclgleP6>^*De=SHJZ>qS+ENa9?h4oKCjz@e$?lN zN=j4nK3B84R}hE}V+v7Tlg6MoYYa)HtQV_nCXAke;gDB?$+ynHhr;+bK~-WRL4Y_= zeEa4&bx@SsW^I#c?n1seIhhDEFvxe(S3)hl%X@mH0kPk7p%?+<_d`ZbY_ontkEHMmr7ukiwO-};e~0Mo#X)Ed~uD{O|Fi-dke?rCiM9 z@SwDE0Jyu|q-Ix2*^@o|2 z!;~%4Z#<_S1jDnbGqSTG{jtRM_A84TIAIb$A2E90Cx3B&AV)w%e%rTl!~2m;?~JyW zx{E*wt;$`}A?9o8@GPN04}qBh5COX7!GH1C*48E#9;x$|RSJ#J)nGvc0r-OxkGP8);4kVpT`&L^No!N^!*5S7&WxIl{N zLB&BTZ{$#Sex&8=6^3X|OG*S+XofYTt>ncn8y(aO#m+U*z<0w&ZE^L+O9 z7M%~MP$yto0)xS?iKHop?Wgf}O=0bB=;-Lv$sVVaY}w8$O&YBmnU;%VmPV&ZXF}8? zAujKVe=82;X#!!-Uo#dOKVKsU`7tS;D=4}2*<8}I)CECO*(D*Mc%&Y_qDpU)ZaLytmPo1uV>rj9sammY1dmBTteyY{o6Bu6gzgq&_NeMWE$o2t15Hq$O&+n|iBvf#^KvKZER(t@3gtgMRD6sN7YxVUMAY|DAFl){41YRi`8%+nw9o7kby zs*(M)6U@rrey8MN)F{CcU+vI)#wOs#M^$7L1~*_s7a97R1Km^5W}Y`&PY#bMoJ?f9 zmVN_NlkI*tSvKgA@Q4|X-!>>#-gOZWw8WE=^i$Ecr0rW2q6FM-M&1IDt%r}P#SAE+ zc>oGM-1cE(eIJu~vRRmKV-FrpXIs8{p5R(~BFRT3%R_T%$D%COz$5E{pQTukq~73k~77_GV1 zv5^so1Z>GtG*%qh`p&>AF*kC0OtvqaoBNN7Ufq@r=?4xQpAYI8xm$JK`}YMnfAwNe zJ2A$#@94})J8A2`c!fyN%r> zwp~!n%VgartM+vl`#Z#Rm@wq6NDB0MDG#KK;W}2Oekv06V-G2UbE_ma* z?K-yYgYoZgz;q1k=?v_>-iGY?uE`V!K0K{OsO|1qiA)PK$T?MOTV0VbA$hiB{cbV6 z-0Z6LM={H~a`Kp@jCU%qv;sDvQ_-?GJzT8X16xLBIif~hFeYDajb@9RHp*T;3R;^^ z2o?UUA9YCa<)-wb3UwC7Q`eS5SIbg=4HWctk(W_;ZEi1oaazJ1FbS~sj8kY06 z8Q2u$?9Boh=hGjgt-dk!TLYf5<$YHXg6@ zg%T2G)hL9rOI4D|e&?oN&?ut%z>^8DV!m2qh0fNpNBxwV#fwHC51;(vf&qzB20d02 zt)b%6+q@2)&lCce@TKk%=HGk;y*36Ybz{~EjFy7xt{lOlU|I}{MhH;-P+cO2&zHQp zyh?A}Xx256b^Tr3D`ITysWr!Av0C^VC_y&#b)_v%_EOgL!aGH8-gur^KJQ@#1TbK} zA6;m1=T}l1R?Ba>jo`{t{ z-vJAN6Qx}+WD1HPTSJ@N)<;;C@;ODXG)H9p$AS1LU|Ux-#0?vLQWNhhUdOvB%wqzq z!kjXDoBnH2XqBxWs@=hl;L3lb2z=ntt#583Pg{oG&$BnKzw$9MGZ|%5|r6%9ws&H?%VqWNSui8(bMKF z!FDdESjDUcn;otV{O;Z00B+Wo@Nd;_Y_I2r5+gc83IuM5U|v!^rs2yTATMIy!~@cPgeQwcYFj z#xIs^7auPs_cmlkk8i zr*mOIU}BQ(9!sh?x@VU_BkazJB5gSs%b9^WW^UEM*dn4QS*Jtl2)(QFZIi$9ZPtTh z)w|BmkQ(9&#ARFylZ1cF)o8QTxKJM8@D8lLmECX^SzCPAPDSW6B2ew17~dg5beD8r z34wA3BMT!|z@ZZ;#c-TL1&dNSnvuh^=YJlC&;LnDp8xp}{@{H&W-Ge_Wq-Ghe7Y#8 z9V?EqhTi!|;GT8rn?;52#sS&0*fY0s7IFYGbp6=`Kj&WO{}8g>Wt8Qj^9Suh z>Vlt?oNyn%Q+bVfS+{|GWns?6@(V$D(lO1=^wS8;;o>$UWLSbFhWDo0_>=H~|2PY* zS_HZn=(>G)zSM>^4%>Ao4bR!U<}{1JLxd2%XEY*UjHtYbls5+(Knav|8&UiW2y_y> z&d_^?iX=X?Wt39jihW`f-2~hI7Am*$L|RyOFNEX^TnM#qra;KMo-9)b8e@f#{4!8&nPn396PY-&o@#sZ^oJ6#vX{nB=S_jPB#<+-a{>&`I`D| z8L(vwQTN1)=Bb655dJmOqM+@HvqlpQ?PE>LZUTuI+GT3bznMMCw=1?QIASnY0zKHd z!;QBHrLei-F~-DJAWRUblQ~VN7Yos)fqPM9GUsZD!zTs{5yFNUxXIMzk;&nZi^(v>xwTda(8a~ib zS2I|u`|M+!wH-DY1Uzfg6{HmreOWo0Hv4ukF_Xv#?+Sc_jyCKyQ16Y;X&XPx52)3G z*Y5@j>9yu&Naz@B9c-not|o}qDKU^CiRREXi|s|lv@}CA$76BsY$^<7r~1!K9|?qG z2>mqt$3|^6YUE|jMW=6p4n*|4dF2SI>9noS)asUpsOH|CuQi^TNocO37cZ-8OS7?T z;)ETz{-=*i#yiEiEb;J&HFx zP!nUslE(0(7|lK3-rq2S_X(pP%xnX)M!`M(puL7dx)DEXXg8t3`q%?QTTqL=4V^n> zf9hGs9Yw~C8fT$>n&zt}S9np@9q!des$1p^-Y$LNgfs$utYhrno#?f|$ZG#$=S; zIKFrK1Z>4!=6PqmAKc&Cwf}p?^rbz={s$44^go|UjIymKVPWzW=*_@qjgv1snRqz4%U64MuNvr|6JE=Hz4s*=a!&<;i^Y z$&!yA9O1EBgPa;M6hU!h3q^X|X3-%7Fb_CQ0b4rZ@f?ha{eF1jha;a_r(FurUxkBzZ6OBuG)(TSMmed$FMky$a(o7E4R!K*T6>C zsT}m{-W2&M3?rjM6E_SfCj+dpoC1gwi@gP18XQbcVO!D~e*%*QA=~9=M$c54Ju;hr zc2}UCB9Zg%C)@S6+paCinH8pJv?>1#ftAV{luOQdns9{IFZ1jwV}83`0P)9ZFzoDJ zWc})?il%G+Py3k&!`RKP$l6th_j}lb<&Q&aT9jY}sE?t6LDDOJ;lRq0BWs9gFsm@O z02T?{?Q#aUBYfc5M*Gj~_|ATHtEY&Pb-EkWkXBdaL$%>~Z9PUlVAop$3WLZxMq|i! zN|x0M)Urvif3z8*!#QkpqfwSgEq|M8)rM`54-D2?vW*<&nlM^-hBjo1(>CHF0lW@2 z%9}v(HhEZkQ;%gc!AeI2x@N+Uj!t=w(2cu|I?HpiIj3scQ<`x^a1^m(q8Wfz5ixby6ZAH1yu0A zJ1!f9fFH5)-y^}C!$L`|Hu$E=T8yLI5y^BkjSttf4W`rAF9-5NF#q_U;AC%O>)3z2 zihOyXu)2C;nd_4OK_)(Nqm8p<23;ADb CPGi#m literal 0 HcmV?d00001 diff --git a/ee/ucp/images/interlock-design.png b/ee/ucp/images/interlock-design.png new file mode 100644 index 0000000000000000000000000000000000000000..22ae01b5de7325b1b232d5c81b48fa7c8a4eabd9 GIT binary patch literal 38440 zcmeEt`9IX}_xF%OvP4pdWP4{Vk?hKz5E=VU*|J3TH5DPmWDi*iGZ_117fH&VeH-i8 zjeQ$t?rV5|KHu;Cxc`NFe&V%U%el_-Jm)-L;g2;{sLwN>hd?0IYO0Dl5XhNE2!yno z;vBeQ?sc^s0ttqwDc;xh9$BfQO4995MmA((y;9afLqnbI*7Rdj<>gz{<+ZaW&%RZ? zp`E3u{d!uSi$vignZggdS@xH=u4HFNYjTMM#c?ROCH5$rkxR`UOU|BnQMKW3@_W19M| zhM19!^?(N=|7@VEq$*8RQ zkt6%vGuHBCjNl8fe#PdvvIlCSkE+z~jQ%N&yE!FL=_Zv`U42+Ya^~F1>UhoG_ok*M z+IFXU9Ye!|#FUg2)H!PA?UyE44>?oGACq7z??%8+{xuset%Ebz`$ETP7aMMEOb&eGfQ`t>P4D2 zpvY-h_d^cS|7iFc^$6}p>qn>;H0noSfN(?Zv;x6^?_4!u9)B*_mw{B5>Sbf#FOHyBz)u=a(QsAtC(N;emgI z_2Qv$jh}l9Ju@-z!}N$xp=I`ezcwrDpcjFT=~sI!d)oX-5L6qjbX%<$thWwKM|+n% zbiYl1;biLWDtbQ=$FXXkdY_36iK@RuVH-I)t%k)-9OL#fK8iX_tnCb%2i+4F-#cDe zS)qPb)2yMqx75E}2u0{|Lm$Vdy3`xe`#*Aj3#)UQt6nbhL+0fzaPw~{u{CF&Zcp-& zXLDLosu6miqmJ6kfkynB+jyLq3rgS8a%wO#GLjY@L^$RZbE&*}QFg2S4#7@wpRm0) z?uUDS^-eUmu_n9!`u&ElUw`Vu5W64Dm2lR*Icjl}xZ0sxYY%E%?BAa~-3iS!OM>ZO z>~NtA;=FTs{ICv=VC83?8Sva$^`q%)ez79vq>Ky#@=2~{fL7XvQHAR+bvpxlQDp4u zySv;CugPh5_f|&-oi|w$4uECub>LGLS}-b1LukrVrQy={Pb-vFE6+0s^rTB{n{ZNS`%?e8NGh3Oz|2rK6dX1Z#oBg&3uDQ3jm$on7aO>r$ z$ck52y3Bn>y$54p1h1v#-vQgun#yX)m_>)Z~Cezt@42G?4CR!>weaW{f zIiVv}92ao7eUQv#%wnLB`KN%)G0;KZhPmop%Uu=>cWIEjw->{qv#NtKHGF3jJDvlr;7U*-Hq#*9N&LI zb9R)R%4>RoKF*xlhwX2j-=18awVMi!#=y~-nB%~{<6x1JtMSdoH3G7BGa_iGU!R?y zkMGdY-hOd@1=|CC9cytq1a|)uT6wd^d0dj~PD{4s;sz@J<}g?U_jg=7)~%Sy(IR2F zMDNzg!}8aaQ?^(x_}$&~gB)mJ^Wy4XF80!%r=mh{S}hApQGWf`jIXNe^D8@e_XD4^ zq%vsY-l5GU!faUMxoXM(9ZrVG7I!~&HP<;`Yz2yGmGg;@Qb3U9~}tP z4*T+lQA5s_h|@^9S3CAl6ZTN}?xhsI(?J#4#P{?yV&NLHVpc!iHLF^c1Lx4SKVIWS z_;L`ix0^?LqHXe_lag|dvUX^o3_(`I*$XNi9YEt`x2^u%$lvTTIi2#IbX+CIj;FKpxG)%^4hVymiGU@#TKD&dxTP)B=fajgYI;x$)%vV!2e^RDSk z2>i|+LuscG(b-!HrQRD>LG4MmwUW>{3*o!uwGfh%=pLNc+y7AOEfa!tA{b(;DO9r} z(hx+zFBd}eIT}yKqEo6KvctQSFgXT`{g^GS55Tc0(A?qVREd^;7C29J(cmwijPU1gtUWfnIq4HS-Q&)zzeaGeY`fBe|B@2Im&^y)%OsQexBQ_H;Z>W8vA z+nmwHs^ew_IBPaI0)gu&L`@w2JVPtJE*F5?Rie9dJw^`yP0p_SGpYmKNCxv29w6hV z{de^*e?kMG8~t>HBCw|t5)wi6`_qxMwfMtjYMt#!^P?sZhlwMwr&`J?q6lP>( zWGH|<0V@s;6-q9$q~PGH`z!X+*t@Jr{u6_@;br{TT4oDHAA#>5XZ)eN4vK+ zadlPh^YxLCxVKbHheVILPS7{=X~9m^;Yz|8c++QE5}No*=T#t(U-BCrWiDi2c;?KW z`#=g~2b=5F=pOWP%B++aTgJ@k@V98biM4n)?PpkdEH&siDCptg5hUroew{RF$_JBd z8^U7?qMsfoNBwM^I=(|n_CktgHw1E(r@`6hoik95TKnlA;YeCG>HW00IQqi)d4>nQ zcZP?D1CeHRH2V7bgv^41l|Op#sXkb|yUu+0$>r%Y3p29`teO9Y64|ZhGV4~FhODd` z`{MpJ)xp4a*jRw$xQDZ}%v52#0=drVx`}{e7cmbG^p%5So=?Qa~ zyWmEt-<~s}^pB7q^7H4(J&XbSdol&G9<+N26AMX+8;Jkp667Dgs3)dhZxEW#2&zv| z@*O*>+upFswsDhzH$ot>%1reVdV!7|Z#RPcHzLiYf3xs#^mLedjqeQB*48FEwVa_0 z{U;y^!BN1xW}X-yzk>vNx^Efn(`&MAN%;0+W;@fOjww|r%iZd77z0H9Wm_q)pXsgV zb(_EW3BOowaP)L7^kmbfSO?}8df&oQXKe=R*~txE%}7f-HmmM9hQ@DBg|Y9>n4>Vr zrQQ8jmhXG0=fm`4C=e%<_w4(^oCkl!tgkW;e;FO$;~x2%a|`b&gMZ6p_HL}|arW4X zF4B^%1Gs}5F$g^T$ukcNY854HKUSls*TnXHXCTG7{deS1*ijTR_R(@BfOkrp{`b7sErNc1;D`ihYk?kz`jK}95=_x+ z_bq8+jPA?>5zcDwwULTt_Kp|kGcE8&llA-6L7!6{2?@9qe^21B8Z=Ndz2RSt;VQ8g z{3kgin|8)BIor4H|bJ zCnCdlRrS0P^UZ&RYTD(N3(DAT%UR3CI0JQ!{Yf39ch-)M^pWbb7PEz2@x{)w?23xP zHHP7aK;61gy)S(q(Ct;&82s5=xGVPjyt*-fH7uBtCGWtss(EIF|a z62Q#wla5YaBjxtgqbB8c+K;LGS4Zk=O#9~!4-bE(Q!xpft!O2S%-NT@oO6{WgS@MU zI4)RMw7HTceRzLq^83WbGlL7SL;s;DmhC%uX=*wilsofcF;uAG0Fz4nKspG2B(E76 z5fM_f7J)}jwfnZeIzt|k`3HC#`y?d7>E4tn%GuPl243g;NjZ4IQO3-C8J9-4d>8sL z&16{?n%J)<0iSPTcRbejo|EEidm_)>?xXFhL^)90OnsK9O^5ij~6ch_n2|3_OOjN z<3fsc6`^LTpLw$YDI?V<`I}VwS$ono%slJTHFMsyEe?ph;#mV~1>e;7%E6Rvsw8Yr z<;dLAw35j$EDAI}H7m$%83K6%YDS7PS6x&~A8MfA7Ee)Q*#V!1KSZ2&_3lKb=Hd>Q zk>a{;ZSH&&L(fns}qV@8Z@#3Mu*M9~`p zjZ2;euOSR^C8W|L>1QG?TBy2@!Otzt`lYm4yU%wXXS|fY%bms?vVxfnWihtzEW*r$ z&M${UN1e1rX}y&7<_wU{)D_VVeK$vsYFT9Xfb+P@ z-I&YK_~v>e#jTv%&PFlIjxW?SH9O76O-5cugx+1=*PR=Hx|u2npdM*wRrrdT8=x7| z2bUA>>NIs!n3$Xq49Ey24MSw@vi4m6dyUbfMo-C@aVgrn9$-)VYm+g4?I4=GtA)&8 zKb=I83{`snEz>f_FSN}|=-Xt7SMTajU-vUg`&xfuNc`?(`CX$=p5LU6S~xrhH`CB6 z*4=vyRC62}Jric+r6{^*a19AfcE(n<9tK~RlQSokZo`i+V0qEmQ~=A7KB5ROha`Fz zoV~CZ^`@op>{u(_sq2>8Rv0qqc$xj{=tjP>F8o)hlKu_&Xp`f1X!cY`wcHr1daUB| z?*3Gl&`A0kZDdipK5Eh9<$!GW@&Mh+`eAEZG~eX$;SR3i!1yY*ga!mvFwy;BlHP@Y z4nb_LWx*K@o)nV|5S!~I+1$r+&HFy6Gp?*ZUbn%Fxp&D700@m7S^iwVd*-7_=UWJb z;uZ%P$vIVzCaA@+siV-kE=+1`YYTmh5pVE$Z!LG6?ksVB4TS4~0XF*+$;Q^gRaCs&O%6i<$FvipuJnUkINibMh zmui=GhfBQf3nA4EJ5$?2wF1kY-0DIAbE=lG&;6)#d}f^Y?`#E;{AVe8^edqc_BO4W zjm0hN^q?bYLVkT{SO?)~}wJH*2k3Vja0e@U${4^|QAm0LC8T0p ztV)@T@p)lh{`+_4??WJDNpvBQGdcZ!pB&#o7lE&30AN3m(QH}Ikql{!>dcUEfA-k0 zyj9VaW&T~?weyAO{(OIn7k@RxuiXivLMEekBqla6`b+rsO#mSNm9=`cQD%?H`Ic~OEYVMlMpDPy zuKur=;h22*;NRI5Vgd>v$FCChSUba3ow2!ww=VBgjG44Umw^D49h}iWFKhHuVG~Sx{bO30!uXq zg|Yh}g`2@(Eu!PmC1wRTQ&2GxtxeJlz!zSVmf8pSHH ziKd&hQyQ;!baZ^p(Fs2%Y*ssj%+HrF0vk!MItB^Vu`;ZR=guQpE0Nzh4NS(^L9sfk z31MJ>?Wuem6u0EL$PC=25E`K|SMOkQ_r|^0TLa!~jyNLofBO}H3KJGo($-h2t0mR2 zAmi%V6M-4>*rq<}4!h1%VOGHDeS4D%?2hwa@1z&3^8U&OtwYL>7wm=ST~W^COg=EQnTujT%X`X`uFC zq)>|Ut_lnS;o5fwhDzwW4C zBLPPY^qk@r>4n%FM0~o%Rj#(4?o0)OM@s}FEAC<&06^1;iHSkuksVu5FI(}xs-{S> zD!%fdGet{(s;I%i$cm8+@GdUFlmF3@J+LW0XYSWPQa!l-n;-e|Fm+=Y*)XwQCcbk; zu&cXI_6d`^6DQs;-EXaG5`TuA#EheSvG+G$vIz)K@U+aylLy|qP?6c_j2KJO(#jO`y1p9TA-RymVHR6LVfMU>WP)~ftoqGSwHF}}`FV=s)CPEKd#X6HXI08; z?E+tGMMcH^ZGvLl5h!q9~ z&&d&hMBaA`uW4nkTzEQQy<_9Rbnl>2b5I;4tJX^rdHNe>R&Xfw zGiM-@`o&-vtKm`p8Hju?Rq^!fKwGAwE_BG%LvI?+hqM_EpNQjDr`OXFu3pHR^z;a% zp>ln)$xk`BrS`nJD}R(b(O1)}Ch)S87Ne;?W4C`cCQz2Lv|gouZGZ5eOs7JK<9?Z0 z!y0XumI85gt`A>U1dYP!9h`;&d9ojUO);_9RNAWF_Eb`8!GXFqPJVt~aXui*q&E!7 zeDlWvXUXTv!TO$x*AwhfNA(VY=4G`*k3FgFY4wAy;z7wfpSO`7dMwwInj`yaFaYFY zPW!S@D+VCz7GH&z$or#GgrhC359syfzQ;@ZPBNh66a{b83~m+~)!`ZhWu7R^QFVrr zLdj_FStD(3iCRIjr1COIgVSaPPs8mhS*}KAt9^x3Y*IT#nq2wHFMr`m{MYJb&zX(PTkc=b_gYuIk6EfbiXqbx4`LZ%e}L6C@CM2a4j^$IyXwo%?>f zD-u&L=%rCI0f%cg#bU_&{ia<)b(hRNJlx%O&haH*P*I3#&RQb-R#Cc`Za#V*xya9v z_#ULdVsNf|Bnbt}RZTqs;e5>$x9n|6((Ms9<6docE6qOU|MolH?0K3->ka;vxEb-4 z+!mC_ePSiTLwvOGr%bf}5>f>2=+qKzh~0I< zPV#VF60d-M5+(b70EYwl?tbZkOuLvwYoy24nv2}8&xcgtl(-w=y-T;5Ckl}LN${J= zR8+;X8%|LsHG`im`{C0MCAll6&O5mGE>83HIx$-8?PKVRJW-&`Li(uJpJH2;|Cg7s znymOs^t?vB<(KK_#!+V$>?jA&RTwgaZyrZ^h29%60pCx@@^)}Wt0@2dq_z-%Jv{g+sD_8r^KF^63OD{N~8Yy0`QF5dfPAgBiEGE9P&*x4BE zzxnI_!%Sx09F|@xuKMKMYKeY48$odieYPINLor6Xv9l^}|$mp)IhXn9I4t!6qxqSC7;L#QSS^7E^{ zM^gLA4yMbUOWqc_SGf*B)tcIahW70M3*45)xJ51(UdC)T$Lv(06g<96@yFADjLuQ)+XG;! zV*>nzml~`~2O}ut{p!i99f~m@E*s_diUyzO|53M!p1Q?v&K!t40A*&{QAZ~nM)r|& zK8LlfGP^S^DB3r)Zn@o{AA9c34YG-uwHQ)g18uFn@I0A+WVM~cY-;ga8yiJJ*03|qRlxH zf+$4{u9z8TsTNnrP#+V0)(@ZVzhl)}ZxG zg67iGIrV-E>PUPkvyDd%+47k&-8I?5y;*>^qE_}lwiWWAJAeQ7EdzZ}6~CROoy4*( zSzH<@{ILzNTGn+f$$(u0z}(t?90qET`x!7EjYBEi@mB3nu{*WTz}RzYjloao^j`q& z<-CFLMi`Te_dK>$Lr%2MG^kjyqD`Mz3B=OKX)>DWk85x>Moie$J@(M+TI9ON>f!3y zKU_&s%ra3hI5sx3T^slO_(I%svZU*cyl>waY=s4_w4^wbl(+g>4St{tLo~+~Iq-kC zt~22FE|fqvI8OLU=G;!0P_OU|_|~8VSNt1!2yzDAGA&tWw<;!RP&(#E=T;m@)LFPo?JKjx?Q(kvGoELTSl_9}&@YsENr znDDCAjq>{XJML*6?d49trM(|4_3G%}?SxChd(2+>=Ty&WhHkBF^xV-5ap~;nIBoz1 z)j6pR?ETe?QK1hj_=+d~`0gxu6nJ4Lmg{DqqxNP6Zc;6g)aC=fsKprmx?+ZRUnC9% zasOsAT9o<2_Lq6BKw{{4g`74e+w{#5DKQ2Tv(`16($$s(S z0%}sDHfEr57xVk~?}_nh562ql>z%3muj`<>J8!@jbxsEx&7lx_H1fM(H!L)qcF)SR zBHnVBHG7md^v96W@-4@}oh!nXmr_$q`bUlnrsi9A6_Bh%xq)O?^(&QY?S-&G*81L1 ziRKRil%CC*P|6}yYqX@I zLD@SEL^Q02VoQ~n<90$~BKxk@mgmm>J_Fp8eAKv#%*yTI)|}3@vR8U;jbMhg`vIIc@HK`eK46UrE;2hhN}n@aGPy<)K@F z68!wj)SPgvnR|y=Sl>U0LJ@&QDB(P{&)sQ1o2ECEa>#-L6Q|0$q1nIBa0EwCea3oz zC0iC-s$gVda;(E%^<=+LNxw{1`3rCC;PONX)x;JlbZC@@`mg(I-bI_#bZyqnm{yu@t_DE@irqu? zG(H?%W?~9zuBQ>JWquljU-Qhc8QoI7w{fkqd69X~0CZALN(;QPu{_nma+q@m=Y9WaPsQw>!e2P=oQP{%eNrZ%uh;)e9!8{o5yG|2$li&=cw^9+l`& z?#TH%(%KG?%pu|ZBlh~OPN|rR`G+JUyG#9un8hkLH@A8RbFAU6*ba)FhjG|lbx_YF z=z0y2O9g5!lQhcIzM-M@LYP95k$u@E#d~sGP0-yWc$tXwm{bYFrpk2IsIEl1#apkB z$D^!vsK0|>C!}Pt`zHLo;$F)GtAxJ({Y)*cABXwiYw^iz9 zSgN905&vqy>%xCBp1##p_&NxMLhHtJwK8Z23ytR+K({KlydH`9N9)tQjn@E1$oZ9g z`B`+U3M99mRl;UbTwD#h9{8vJL=`g@!d`mL>9O5d9z^Nws`1mYc53m7{9#17)OIN@>Hg;eE zirRS4qdY!KbvdtQD~#A7b<)&~{;@Y>R?u5uIR@8>DHdTbI_muf7;PtIvQIy6NWUJ3 zk=3MrTTLE%dtjsnehwibH4#zF z*JPCFUBozi)~tY~Vt`@b0|uE~Abyb5<_6PBHJNGQ`<3WZ5^BO;F^zC?m?#OAMr;xP~D(;#aIQTNf_@8w*<q74%rlo%TUX#Zq)$jVjSMD}Vr><)6fJ)JcrP>M< zS#SG$o_)EA^KrkH_otv8|GJHR^+f}E_CAbF&vQoVG1G|C?3*8n?w~_{D)8o>?%qU= zO0eNrNdEPvqLKs#t3tt}Oc{(RezGOuDc?4;S7tO;e*EngaOADg^D)>*7WO#s)2v%NnD6BJRF0vQTer={8d4p) z3{&tlD8f9VAbk(vg~ggZcV5@?JPRs!{|X~oGR0gXd>lOUpJDGr9q2`n&{=^0Pj;+w zIUJer@UTRU-IM&}y=%ga!^F}~u?+d8QFl_(v3ddVgS58cmGkn!z|>B3oYmuN%7v%m z5K(Mr1Jx;>A3I1&0v~0jn>U(+u|5km3^- z#x{6pzh|YRKbGDba}RWOUJLRqne+8czT_inw{)TJ$}%<14{|cwNUVTg4JKsRZEc{vkZXr zhb4B2C`dUjc7pEL5$K@Mw%-nV+hzgdgOS3DK3$fI+5m-DQKe;JBeky ze3=bDGFb2V9Q4dp6@IucbaU(~oU;MFLj1TFIv@ws&5sKT3c@-{WIH0MgVvn7ND4?k zNiMu@YY@w~(La&v2NRM3S1Ib(19Ym;SI~=+gR?~d;Onp4Qp=!=o46?;a8xIe?v+e1 zcM%z%eJQMW9B*U4?|zx|lg^marh3d=+zF3Cm5+HdFEa)X$-mfX!T;Sh6=22WHYg9( zBLFO;Iv&u6k6CO+x8)8o#YRYJdbGp;tV_crc$ktt+0S`>R?`x$yzDKsnHnb`a!{xe zW_Kc?xKJTq=t0j1sY0dv=_qn9>14kvZ%>59cGzEi1`QB=Q)x+44!kXf-&fjw zpnjtu!j&Cn1gn007^`X%))vO2QfCnVA%H&WO-z5io-d+se@Q{81J|V#_%|Ax>YsjU zAM%@A2JRtcg%ry-s)iyvXobpj9%aR&{aRVLk7aP2aXlr*R&qmp#nY)yF&?wxb=_fC z z-S}BiNRBYeqrkT0WT)g45w#GeQkK)H?$IcGCN^EbTM(g8$aVVm z%_}t2pSFM}fPA|``U{f8aN&RcyRue7Z_-vY`H2?X{*Zr*{K|Fr{fM@zmH!M4@WDCa zP>^?5^iwXCv78JX{3wK@8t z$(V=of6b{hjVo`H`Ok(I$-t3K+HfaXcK>Gz<@;f$Qve0w^zO8gs3AGov8u-vQff%< z!-_Uxjf7JE|2aDbu6-{ac5D69eN0+WK(adJV}2U^_xyq{ycP?QIN5d%D`=z!?@qSz zJQ@D)rut%!@HCXfelhU})I{aq;e&O9!3lP!KiW*9eSaclqSzq+Gq7E(OX;A^KQ$r$ zRZTh%Ov=$^O3aC>bQ=Oyfk-NZAch&QDa-NKPt{uMv=^PuV`u)em`d_f8jniB5x&QU zp$3c$exI!~6<)S}{*5ENA@i0#xhQgSw6;ARvx#i(AyOgF`RnN?&5NbL)7PJ5a-4^} zu@v%5SsWeZKCuy|7{3=?j(%dS*X~_1CFC!VRCmqw{HA z>2d*wFXhtA?r`LPxF+Sf57LRSd&}Use^}7mk`E2skJn_{faA>q59aWIN_nj7IHIH) zAsjo)bm=#yb4-t=ZKw42qgI|@LY70nx4~pz_b+ggH2y&+!NBnL2-A}R2D*BfJ5&(}R476FYvOK=CemL_pY74NP!gFpkQn)U2@8`u%0!I8)_js)VtUy3BgLph= zAf%tB4eR}@h*}Q50ASNr3cfh0hXHhEKRGEWoM%~7I!}w)^M6E%j8;`+U}S)P`6xXI z??ZqiiXP}*v>^KyKU{42+8heqX{a+`1hi)8*=Iukifi$nc+xSk!Kz`~8htI$&~RAl z8Ov)8U+?y_Cy|Hjp3I#W(~2IoN^giGEpo>lfgf%AUFGCH?-H?)tLH#-(w^!>ciwjZ zKI~OSM4L^xno^>L+I%N1afx7kMLdvN9?N-Q=ULCt5OdNYk2xfLFxH zsn*G0c<_Ns713J*eGG=EaHZaLIuCDNp#rjZrklL;XsHk~4L(I`k;NW83}F&7`GuDczG%^v`dp+t z=ii7&b}y^nLhwv;J@L*-5CRK)Z+zE&?st4Ut#a@k)8H*4IaO631d3n?Oz#;W7vO#7 z)8+^J`u2ezu_exY3nKq!!Rl{6Po$!VEbe;mi&msmIxr}%*>K+U^+aLw&Xe&0Wla?c z8-Ffb*=d|E)5Dl_DehN`ExY2~v%5nbWvyTmLc*u1Aq9q=3#E7 zoa?Xk(D~Kz+`Dv^$L8SGGmsqQ5oVOHXP!v9sR1;{80qb91$<|k)G-JaZk7tF%*w56 zfZY*N6#-hKGJuUxg=U?xe)MqlwiY+&_OA;3D6{RN!7BxiraN91rmhtC-!>q8FYG#~ z3G%s4*XttF@K?@yX?wEX&>d5Ocp2z7S~ThNti4_!PqD^fd*#nOuIt#99YCZHp*C-4 z_cB2y#1^;hHuXTYJS(CvODR&95f76X&_cCJJ4)PW%t@1b(@XxCnOVkdR+XrX_k)eE zQX(tG99G`QOEN&8d1SC{EtE-(Xh=fm`rQi-mYUnasghj3(Qhu+dh>QN32A9R-z#-rIcdh_c76MW z-cDm;9xpmy$X7YTt3|a&I7(!fw#+LJy{+z?fybwRPC>M$drfiUe+qVqN-OswaNCmQ z*8;j=qh93bTtaJ?!oW2bba@?{BYlMTZuaXMDudc4FYMDN#g`aZhb&Fb~5=$7e{hX(}1gKNU_Few3nd& zL_;#q1Krd7Mf^<6*tx2OUDWOaVe^l$_*i;p{FDu4ab-52t1-*7Mcj0%b-sI<^WdlH z^<7427BDaT_;L_rgvpa*Qg~xCQ2PUr z%<(O(d&ji~wssg&&PFaJB2l=Zyu2?%%u%nn(zRMcSiXPUtJOEu{YAyrHKP92+VTcy(%NF5Jjq6pKlT+g~ptcnqSo}i#v$HrGvTw$F z5f*tKS@Zq3oQZbqL1wTO1V}iE(0=c3<;suRCAKQn+A z6j^iz*kxrX6z$x+%DP1W6 zsaKh5-Oi7O7$D+Ev>6SW^Pn=GDEq5lLDBI50G|!u-zS#78pka}M4Sh0`z|8Gy7zi> z8@9JJXWr?b$(n zp_F=1BXdMedBXh%Aa&4r609|2^^QnAQVv$b%=PP=Q^Q-B9|&GexL$+1EMP#_F6K$8 zAC0VD;sb!7#!`ZVx^AF&+2(vPyw<4tAO3A=p=!avDo)fTK!d9`-*VXr5_YD{v7svV z`@~?jcUV+&Ktt4#w`BLoi99J{uz8STETX|^ndrK=*vjVDE`0Om2B71tAPq{gETdnD zoV{23=>wVWbiS$^^r_R@20yk+&Um{mcQhZ=kKKxw?B4F`$BiTCWeOiB%URQCCzE7zkn{HLpa^kHQr`4-=ojWcaML zGYpV;_RnymkVIjeRMReiGoP;F{!8Y)dYsCF;gmZ*mbw4dU@Nx&s*(HaRD>SUZJpFM z&k_5H_6!{g1OBu7Rln&isKYe}wuo@|e{SErC~j^LZca}LfSG(SCE#dXZzLmfXa21p zk`Vs}RMP*>eg9vSKtiPafqucs!TdkB=`4go0Rt5PiWAltF$p|*;lmWE^o!{qZzRAM ztw%)G7P`{O*och^P#Sk^+mojB_4LlQzQw2AbxI+0E6{q3IQ9mbRzANf}j zD6Z!f7VZMz*!~i4H2BIcjW3E91`q=|vaY!J7Ttk_JBCce#K?$wtR4__G^J#BjOZ)? zBMU$)BGXV(Ef|{o=p~vnMw*_Y_{Rp&DUC>L3jmB?br1IUAAr)j>{NX$r^-3GEe0*= zo++f$d}kUSnCu(ke*f)Sd~hHwXipJCs9E~&4%?o|k8A+3c=bEotT)MOUS^kXo%s06 zCrvn_CDd0=cubI#NM(3U-LP5dwf= z8*p)1Y@9Fp2ASCkEo(L3$Af<1xjhhnZsyfikB(PzM>_jG`TEFyTV`q$>XcyT_^p%; zrdlMHQ&kmFo@0VWtf~nxs1=dP)YBuXs+`}I+lIY$qYI^X(c>eA18fOdzc(b%`#xu5X~Ykv@ZdW>=hz(KcNx=6Pe_qDCR1tudk1N z{}2Kgg|AiVxDjz`;wDBhiDM5t0TGO`y}94tN}pP9N2e(l>qTGff3T?xHFi=rN4xzI zj53R1L(YF&f+LKc-~ECGVd`-)HB^tGt@uxr_{0@yGr34M#7}d2qjArJxkPb#i(}~s zv)5~X9s9QyY~Kgbj3Wn^19!bi1|0u7{ms>K@irT0#}9j?rfcB>nnS6-WA77|4n9UR z>ku=MfAu|7m7*9P3D>L68$s~p!rxb$_nYl`hbKA1ir=C*H{yqW()xLd)L48E2_5D7 zRqX^mVE*21u9lV4Pnm-+EGnX@ygHHaMzY7fRi*h|g_D!Gi6N9}VP|TUQTCOi51MNoX{^h1wUgZl%qy4~wgLTID7LVSNcd zpE#?!`N!)`BY=Kt_No4%>L~Ou&-g7_9cM4zU_e;9TZh5Ol2Pazra^d9QVUk|r{MVh#0R(GUk1O$cAc?3>Jq9MZ}1wgwzzs*y!ye`)Q%rDZ_f*2DnXiM3=2zSz218Nf)3LU5k3_FU;)p~39<%dU9Hb^gr4@ysXchnY zkgIW{qmiDnI5bOqXM`SFba8Ta7Nj3kgb8xg{+4XX5W9%g%g0fJelu0`UF&l0TY~tX zky#vZG9x9GL&m zPxCv?3%Tc~xA(A`j1%Ooz^B6=wi)@C@$i;RJ=0)j6Cm;EC@^_@uf8hY@zPv^W?Vt# z_Mr*4o?BX;QNdK6uTVG~_Ch9%OvcPrGD2Fz z>BwoQ<*m7_mP{wyihKXClKZQ#>|no9{D|vZUmZ_d9vtbrS`^2+Ml%jn!{@gdLq}ol zH)YGUW)fvy}B@afHXP+g7ulP=+0XLSn6=RT7O?5 zEQSKJT-j&HdJ?tO$g(2Upd1YceUTLQyiW%{@gF3}X)AHvd$nvXjyGQQZK;N&eSFv{CU;N! zsXl)5cwmflbY3`Vx6uVY2l|GIe6_;#f55J5iRjy877j@myDA(9$yE?rlXCP6GYRR zva;lPT=1!4cvL!ik+3}&rc>%z_BG+tZ4ck;bw+XjIP^xIIEh(ZA-nUDAzE#*-JKnn z+)Ac15IMO=to`5fT$N*InnI!P9< zR~R$eqf@YU$UIUo*zM9d`8j!p+g*51Ty}luRX<7{vKGZh9)a^_;sC^yYvMbly^9NA)KzM31lA$9PnK@L9k+shxsFysb;a z-yqCzL)SMn2{AKNBpEQ__eks8L)?5~+LKW_kCndF>UB!<$BVK!<-iA_@2^}dSiLfV z_Yg-<**>);A7z*GF?!t6JvicgWG%(lM$be9ot>(-4>$e>5oqy=^+!;`lZ^T{x%q4+ zvVJRSl>s`3G=xW|%+^>k9#k{Pdk*&hqKYW8XgSAMecJ(@ha8=~<&KpNI5S*_fn{tq z_@mDe-a3tn06BnorbcgpVtpHz=jQuI5LNCo{C+puxK%rZO&G)cFt;ehx8vII?Z0AT z+R*Ckg#33Y5X3{4pp4L(MJu}r-pc^2nCiC3dCnx*hP1+eFFXHLN~jE&AKw%6EeORz zb$2ennTRO+4VPiGdEhW1mmOb5C~VDGXUAi*!Cp4|7bMKvd&pqdT-sgQbJ*`;XYUbLBdseg-G1@TR|4OCU-TsFT^pN>B zld<~Sx|6f!Ro;ir`G&rwI;;GQPtu)dcLnf(cx_S6Lg;ImZn%zJZ?;Y&;o%9zZYs&d z3p1_qFg9*L6*2byhl^&KvuDDlN6x{NzEuU=lfA?!l=;|bS$ zAtwwty)gUeWtaDs#%VwH0K#(Q!U?DwJ`!@^FUhO* zPh8TVKN92;2HA^z`eEqM$Ng@d0FpP7S7I{7<{_@_`~QgUCa|OLF6=m5!ChK9!Vtfd ztB$--!Z$Yi_6(s+>$%x+Yq{k|S%x;lrVJ~?Xw_Xz^(*HZolf?Zj)LsJ3lBm7$d^~l z#-733DhXCW{>jPEyD8_wOiLbGX+zHWBxx@VD0(xZhWo~!fSRlQm&}J>l0{>6ZMKy~ z%Zx0%4cv#nzd3A%%2qb%!?Y(z!#pZIT@cWXT!gwhs?2JuOw>rtn8en1hWtvfZmB|k{TrV%6 z@`?eqIwzEAw;Y@A+ShmQNBrn>3xkMcu5lHZz>#|K>*l1SX6;wY*^?WB|JR)2OyE#6 zoT#AEvnQwD>v~zpzB3+s))SOdzNLF?s|W%`W-Xp&TKKcc%gfp@uEk65TAmZc?K?n_U?@-T01%%y;HsT z>}&eS!r2CA*{p-&6T@lbiTc-!0>bQ2Ln1W)=BfSt*(B?nwx#%h9&>ByJ98=`^l%ZB z^g%*ok69Zi*V(@n)?U;vJ94=20%oEWB%+insp&x1VuI|QyrRckDu>ooFEF@k@J8-> ztx3-UaJTkETP~>}xW;!i3}faCMX(vIq84^-cNFO z+;%gTZI#xlf@V3Jzta7mFY)vw<5H5f)B9)Ik0kc=?&x(U)!GmIaSewMtPIk*vZ|Eo za=*zdfZVanz}j@Vs+A`r>QHf>dClYgiAA4UNM0@qE%&MF9B@;rb8rLZ?^g7AtmPWQ z5)8awxeLS@gIA={N3j+PSy;aQKEeNzuQ~)n6*NtF<#On_E>Ip zPS=m)_pws8-0`+|OGF=RJ}#qtyse}Db(aIBT>xw-{ggzxQ?F*1K)LInT$N`&n4%glsV&e-$)kcI_9=Xu-)HEIj&`pR`>ggMv`9MAtx8h zlDC|B#|h1s-t_gkxOHwW5WuB#*Saiq_wi7GE*$n8=VE~Rfz1QZI>A8Bf{b5=QuC<8 zJ*1W#sRmQVyOG)7zx)4rd8hHXrd!q5`$vFx^0(j^GJl&P3jL(qXDnx0CWtyzu5s4? z!lt=gZRI8Oo<3srNk&^`UR1?aN$HMy2-wyJfpSY#bf|Z*`0ZJj-F4DCVXX1qoqwHX z2t-1(L9`l{mU<>Ick7;?9F7P=t(426eDu`A-vdvNTtok2I{(^V|G~5V^Xq@$uK)Zx z_Why4fu(-)iQ9xtXQ`r<@aWkSE}Z3lTLgCxy=tPdS})6E(2C&C*^4ZRNL(@-TcMGV;P z(Y0k$TVt2QKz!f>JxTX(a|OHz1?;DjK&aduH~qza)Jx z?yamZ!IJZ*yEY@`2V$A%V5O>7x!UdEOHcd#&un37IT8&q=D*x3C&~G9z6a610H8GM zXOfh>HjG)Bz2^9mj&i*I@N;G+!D{F5VY=iE9a28d%;4i0g#E0n@@=|W%ULrr)%_*J zDxm+nM*Ha;+by*f|GI8@PV1jcfVUh~Pg=}N!Lx??mBa8WI2;bRYxMN3=pjZ_6jmj$ zUpB_djxz1k=n_OC2b!iF5D;eKz4D^Ex|-%c87i)b;XJ;MvcilZWNZ%t_w_GGZxLcp z)laBi_H=<(uCkEFj^s8Z0bYtogZo*!0M*sQCohguG_;zo0^aS7m;V}c%q$~i!OVy$ zhF|UVpF1v$JSR^uTcpvy8@{Xl8`DXE=#c>+zHtFft=lEu1Vc*79uT8>x}Q+@I8z$-t5Bwlq0^8Eef=FM1vF3;DuB>@<@Lr*Q~B+H*8Q0X~a zI;xv#TS6|wr#@4FGVy*-0YWlrADQ&n#6*?-=~(2R1;C!J;HAM`3zDI;qSDgn?&|7H z&y7f!if7yCbr8quvkkaAcCs1TUaVH z9}p?$U;&dgT8`p#EoN>UQf|krwd9kyu6r-`VL)n>`YK*)Bgt4H`B+R+_x$NPqrAoB zB_}!$=yZeVRIzjah2TY#UJyYE>{Hqg1i`5xnH_VtLee9>%6Mu|>@fNrT0ON8rzzy$ zBz@`9c8%A0JsP^%Jwj00R2Ax= z8W@4qJ7(Q8kmA{;6v?#vmfy`9Lw633S?g|OX3+^4YJnuBAXiKPJtMe@AWx`@mZfe? z?~Lxp*!k`Oi~~ST9qWK*F)YL*OTWTT6^lkComwPjJ73ne;{5w4DSIvcjXpi-UV?=T zc2&*#Sf}QY1c>0*(0ff~`{k~~Lz^!TG8|-5RDT3G4s>v|KEBQ-_@8lrKW_3|ts@o- z(=X?%SNLvz6*JDIELz1^pGBT;@c+BUuQT2C?{s3Z4pwwT-rj7Ky6PpTAz)Gbo7+Cx2J_-I%Ui)qqsKCjzQbc1J#76(ITz4l@ z!1{xF2YCP@{K#Q*x6}#|2a1UTw!D|lBo;B=2I5`&F*ic|LD?4&UD0n(sNc%6o-c`0 z*#Whp;F>O}~awUSDTokMoZh{G_Qv*~e>TD&# z@e%BiTTDBd8SI$Xnd31!fZ0wLIHD{rIsRxc3yvy7*nsv~wkMbU!@JaWbOp3{Fb zPnXPmUP3_OS_i)H@d5IC+2n;@BpK)?J?{`8PTeOZda3`-J&4}ftXqX+r7vFG0>#%a zAqvtB&0>Gdf8RK~ddg0$ObiLqb5^4uU1m!^wSM>3C-UOr;@EJUxMx1qFaZBANyc0T zS&Dv^pTeJQ_iqK}54L80;<(Rn+CtjC805v+sur@7`7V54;$Y&{-Ba%!1KiZEG-dBa zj?(OlI&qJ#7PQrX0w*!yl4mn*UnFJ8;Y|);;{<_{f#^uVYdf5twa}}l>>s&4dV&Y+ z{2tSgzZ_{pBdnA~b!{|6oqz0V@%=;hb8C%7P*?BUr+T!Uf@!_XVM1E=Wulb!*u#&K z!(VSMm0%C*y%W3tc?~{CCu5pmM4bswt9*@g?ms^kW z{Nn{USzo&bVac|^pYrEVY=)|qh7g$Y_k!U|_%0K%g!@2f2LTESqMURK`E1uMW9sL+ z0LLg4{;^RwVzKTqfXRdW{r4VJBhsG*vx`_Q+^2L{M$IzQ?xNF zD@y?^jt>mb&}d)J#atiuPdyeRB!hdQN!}(9#XSXR=hf6`0g@Qf2kqYJ#asROi{Q}p z#9a(Lqvxvjhdk62%7wpkRI6Ge(%jkEdER*_?D0pS3Go~!u<85xh};5a^*08`oI@!t zc{fz*24l34!{O6l(uo}kCXUbYe<7b1hzQ1u>+BCt7sOKbJH>*p_Ya(1s*{S-pu zKAXEyH%nr`LR*lrKD-UBf$qlWHBE+HmeR2ZW{p|(+7mQGi;)%Pozdd#Dns+ zpV`b}5y2e-1azWpPz+CUyNOc__6~b#@u3tunq?b`i7@H+i5jRp{N!!iM0BFL^VN4= zT9%jn+uJ&Fp3a?&trJTqfr<$GMs$_8E^98cm~zz`m(&F9s6X0{_%#J*gnT{Spq%JU zv>_-v!z-FWor>^9t9pTlrzH>|c|-#GW2(ZyY|fV;5D4_*YFzm<N= z&B?rO!9`BJ$C4P`pi`tH5T{^HF3SO%N)?GQeLy{I^_XfAjI;jzCpL4kI^J|hy_@gN zQfxeb@?Tbq6Ef8&6C5m>UDP^s=&%rbaKX+zgk9WWZUx#KT;Tvf_DX185(FX@D7-)jQ`!bZ6&Nw9lsa}y;GHz8m+S>10VPx)lkof-R<(IpRH?plv=^j@DnHjP3WYtrrFG?5e4HY&Y&N&c z7E`LcQt8F6oR&58Q6KenDNMsm+f zR%!A4Xcba=L%p5HtXm-QB^o;S37cH|SWOFXJ+&m+qF|1XZ15v}yp3|QXG9Y}X66*N z*-H<+NrA`I>ie}OCw-#-Gws*0%&5g8iyfqE8wf&uw@d)uIlzdDpYU8y7s zb*@{w=bW3iE=ks}lpo*Gt`V)zVH>^9&~sSFczN`2 zp}}^lIH_6vM%SwYEKE%PY)qVN8;@?wwhSKI<{NgD&0t&jz<({hm+u-*|C|$YNcO6$ zH%j)`hu^(Bk;J!cpPjG%5`0!9r3VTJ+K1OoBV4h~AB1Xb#WU3vVn5uT;wM^Q>Ttq5 z!<|Yjir6|eM6Q*@JNV9+0~-GawYsl%GUC(er|Mk&RwrtdXo_geFGB2}->@+oJud6Y zP{AQv-?;*@J^!<{t@GP~0;Z5Jf12l~mU(4XoN zjyYJ=h>Pz*3}1D5!w~XVY9MFyqZ~FsF60Hb%VXQEt3EzsOEZeP5l3jHyVll;2?rp& zZjA~W{@NRL@gTr+wSn zdeeJZSh#90LK>{A`m`ax^K$N3UyJEiJ#RjFPRUiqf`Tp{LS;w?DnY=j#bLn~pP+b# zfM9F{zr&)o$Dy|4T-;!`>oqQ@}Z7Z%?9Z;F5S-AYr$8*FLqp8iyxs9V{($| z_whzwul2WTQs{O6)I?m<*CBnq0gesRDR0N2dl-zvN%7tFK)8kl?_0woH6Eb?336Yh zZE%h_u7i$OX2$u&+f)5@x}5n%blP32oriL#*}js}eRO&n123w249l2RRamQ>y1TXy|$awFKGtSrs_N_7~7qIZVZ`U$_mA&do( z+8I>=dVoBDif_2r{Uh)roB3Ljzc1z%4~4Cq>IgLzqu2BlG=L}dtK!6`TnNuENOVomB-&-&u!xO z%KUXCR3ZFR%OAvc#wLFV%|m5kt;-S^tf#dyFf!~LC=j{`hCZ}nxS2DH20n7#C)yZI z*uV2ctTo<4vDf!&GhDvXG!H}3!hsy;#_=PcoIeI^b!$py zXhf3k><6kTGqfvX zFFt8kCiqq7RrV>kN}fgUiGz-4ejB? zkex}DMh)W#ucFeqj~!*Er}$(9N#sNqodZXP!G|$jZG>gU!bg|*Lmb!|WIqO{;;j5m z@!mSTNpdo*8B>OU-`#_}W%%d=Pg~Bies7V~AO9J0If8NR6!;BeA>=++s1wqxj-G8s zeOi=&_;RnZF1fA(B~4){1sSPk!JqUhYJ(3n9cgn3v&`X(Y#|e+`BxM2O$i` z66YXSE6<9KCE?~aNkc%Pk=Fj2jcfn$(qIwRp>;JIbueeLObsaK1SbiH3s2K%!kcI+ z0p)WS$wn$2Ksuy&v{=ocv3Nr7L^l%TP08h|%zp>pQFxSVFO=ZB$%V5*o0csiK^Y3>XB7938F!{6!q z<#@=cr~Jdi!@*uaj*N0eqbucG^wLm?1JrJNv7htu2E>%Ex8*2BbR&`tdYo?!eD6c*7WjIThLr$^i=I6MYvF&F_Ru0h2&4A?Pkb-WOr%-EV-_MW|BABBf9UhTZ(_NZ9j?XFu2#woI+|+KhBb zO_V@9*>VOD()l(*3PEyk5qk{la9)T;u%ZRfTLt7@G%oyd#bp5126+8O^hovs9$3S- z(|b(>_uN)}wuU3$PJvme?agbd1#E#L8{G!8FF`b7FwGHF)e%jN`Phf_-=%hIs&0HV z+IDj3140gZzoPdhIO*#$Qn^1Lz5gwMQ3XI_&WhI_!gop#Dmi3oPeQ%^!qO7zI%z&b zUFg`^rDm)mH};%mh2PTpRI3r7kr`A?hDlxk%-lRs>yT}_PU6_{48xsC>lIgBXJdE- zvFDBaHZwt-TYr(twK9+kVnu!WEfDd+y<63(Co{Mkng0j5S44|Dc0^VOva)(w{!@BM zy^#O($HntY`2A)4(SY9(ANXHX1a0lr;HhqQi+wr$)|B0;XpY5A@FL6T3HPU;Aon{# z%8xi2L|)b{H7m72&PPQ>z4~(*VXq7pt=0DJOWT2@6W8w0MQI<{E6bjSAf7{_Ztw=< z5+0DIW1)sHGEhw4Qp{Iy^DNdYnA%x~uk*s$qQp0O7s?``ZTwXDeTgs(?UmZ@E3Sj{ zfOLw2>LrmkC{VFV;!dTwCj|@v3v|khY{6!PebyZs+WrL%0%G3<1+*&>YMFbt#*k=2 zZ~SU+##Q@{U6<978|_TvtmQK2l(Q8RFhVY-Qv{h}zfL)vzL;)`aUGtbQ%suks)4}? zX8oMqlbLnOjC@3sqwXGf4=ayhpx!S~<2vF%EggjgZ6>#lT18a05SKt7i$PZa7d)!N zJo^@ok;eP>0p-3&f{8j6p~J02_(Jz=P~Z;bJEH)wPK< zaBiq==RggRnaH^l=*QIc(AH?u7E%qqonv`PKWQ~!IdstMm*4Wz>3kY&Ve4}#UI zMk|!9VQUm96+XAvuh}61t=<covr*8!!{>M0CHOPv@%0xYP?8R+bx7xYfR0~(om zYGW`kYMQV6mvfBnuaU;X{5K`uq_LWN2(Jdy$a%s0n`*Sp#Q@x{DO2gL=OGNIjh?|}9xZrcQj=dI_TTu&G@zfgaY$P>*I&1rS5+tG`n zkS*N0JPE!}&Vy49Vd$*2l!3OEO=BQh?A;`v=F2p*O9Fxrfr1uMtC7PkL-^gXF%82h zxrkxS%1GQYl(q$pRvgw@VLdVN8a+?bjQP|eas8I(;bSMLRGqc;cU`E=n) zv}BSxJhu%#G%&E!<4yp^bfrS4aPfda#QPTF?ZSx5C(T`ZyRJVRT zjFL4_R6(-(Zxign#u+jfdYq5%RJ`TN^j)^tlxBYRatlJFAr2$$V;2=dEby%(R6+#M zI(rV`UwG6!nKtTCYEsdkHJV-c)YO+6M(5`wqdy~C!)=d6C#GrE%A34e=$E*WU`5>h zayqDBtGb_MTv5nrx;E&wa+Hzsz6WJeY0HPce>sA+BDj= zBG1aLg^ihZ*e{x3$%>Jn(R$+^IG;45)#--!>Sk>0c>4hUd_VThvqnn%Oprw|IZ>ZcM1f)>wR1*#mn!75NZl^N( z!Xdg0kSmC+&-x+@;pxSCci<%S>jI0qUPJbsyM#FGWSk_ zDyD*RiuokLX{)-TFy*C9#&FtGNC8I#=aZ>`hMChzLN&;Hy=Ad-6 zA&zBy7e=W<5{@G}*7X=K*R==ZSIt3@9hXyoA-IaXyvAz%eYr91>O16G=lvC zq|##h&Lk|mH-eFI?F-X5uT#Xw9&TjxqyQMvJ7K6nT8u zcF{u7y9gpkVmoEE(! zid%`qt;U=8U#R`jejve68RzZmizx@X#`IweDtmqF85;|dg~c)ZmpPOPWpSXHDf~C7{^_8YLx{ z&yM22Ox&nRe+Kg_kq`mGhbipLoY@$Yr0YTNYA|UVhvw=z4P3iUa%fg(P7i5R!^O!K z?nSYnJgs9M|5h2zI`D8CB;vrg?nxPOV)xm56~%iODtt2YhE*`7$NtH}t^~v9v>D7M zrV4bo5dWRqY6|qvUx(wsRZ*!hB!&iBU?_f9{>!jn@-Q0MwvP+gT%2krR?gA|m|v`V zH(3AYZ48P&q{uJ6U+?KT>KR{x*`IiEUc*4-Y1YGr(saEMDGknE*&$X_nZ;8sCR5mT zU2XDU_;{9G=zAd8ZOuW7vw{wqvS%p7QmqBau5KV^X=*WOOE>$L>Rq z9jdKWS|f4_>+y6-F8mK_^R5)I{`R4J;7?716dl ztrt|>m_|vqzZ0gAOx6KDK%k zF?fC$Ts%7jJ?{(fYT(@`Y;1lGZX0&g>qc@#96azt48mb>CnV~_NH1wnuL{FuaVQ5F z`Hi&czcr(z(GTMr_@+BsPBm~^_Jm&+o(FFqH!KGA06#op=BG`z^}9uiUT5tSWUhXz zsUc?pp9Vd*EL+BFcP#_+qZx>p27QJ0FKjLJ<>*=cBJgLa3W_rw06`*%=G^m=K(R-= z{K-dk23tRYxH#YbXyYpuTl71l?E8t&PQ!9GH=HHkga_?W=^YD#^1*|477UCmwugZ7 z8=}+9*~xJDeETQIe;n`pCzRcFn1Jf@!CxiHGu9s$JrU%QZs4o`@Hfk+Kjze9eg(IY zhwxld2Gkbw0Spx}2Zj#Jr zLfy0Rh8MEcK5jd+`t#i+efA2~<@tF(IojAA033~_6m$F&A~P7XorI%7K0_!K#94FN z87{~xhn9H1F)a52=)?ec%InP(vcnVD%AsYv^gmxNW8v|OBumhWDHq5PuU1jWbKDsX z$l{hBnFj~Pko3Uu?ml(%UPi+Ji4_|tDlFz_-MmpK={r`t|Dps|VxTvU6AnMjm56}ul}<(jgwDYKpHX*h>fkS zZjg;r`sIIwIsLZX%HeZ^SA%{A!gggYj7X>7KL7JKUsuZ^sBQhYe@t6iSZr{@ss-5EN5*FKa_y$&m86my#%hF?%bdRz5HPKw3=dkX=p4$wLjc zV4E|IPpXVRK`NewdpzXDSi~jW0Bo1@ zwRtw?du3WG+kJX*09~uor>r0>4mGeg+$+>-w4q8wp_C3fUnYC0OF$4y=fGgOV8=W< zODmfii@P&4X}bXX<2?Gw`2}es0Yho05ch?PhwOCipA>+GmXeKM*MANTgYkEew~A}K z+MRKXCqrIX9$0IdWEW9YB6CO@6;MLmzvz4703N892(pe)00T<%h*xAsvVkFh1%w=t zt=oNfabT-yC~a`sW)w8C!C*j^m`4b-KxvDGs!Ciu-+y}>WUkR0ap>n+#h{#RPBW5k z+j##PMl5f6Euffx1S|%FG2#LPFYiYNMJZk(95MXxXsf-VQ54Xe$Lj!KV9uX6D8tY8 z;XS#V-drk|)fmT?&p2=*Ja;(cC5l?6MT$Y}8B zCQEKstD=MBaPKxqT9(3{1fQ(F_j%DLF+bL8DEqZzvA7fd`4=^Uktf8D_=M08f48IO z8L$(Gs&(d&gStN4e$QnXxsx9^yG7@PL3`zAy)7&iroC+~6(q7W^qW_g12;*Xwfo50 zpbW+Iy29NCNqNlTMf;bZ_km4lyah27k%LH|2ze1J$Q%_sSRHmuAmdhh*y-AWU6!@t zNp`VC!FxH6trm!KLB6(pQ_aoaU@4*<(z@J}uh4AGzg~7*(dPzEf5?mY!;Lb0+{reb zZ7!BF_qea!Mi|vrWhz@q$UV)Y)C5?1F!E#CJxhk+uK z_=T=X-{&bG@dHO1K!}=S2osM3;FbGJDdQt1kf?paauBJf{T}4t{3WJnsh4Y&XOAFE zY789j~cV?E?2A`S~^YImm&0{)o6oBFJMQ&}$G) ztXjHuZV;uWubQA>VM&=%OX4YGUgWEkTSL?~SF4w1g zJjei~xPKZvLK1@9PnLD+DIy@y=2gWTYd<)IiEvK8RiGW*1}@p?Q7Mu?sI6=rl>(u& zFX(|_1mmJ&K)E;-3B!Vg1@ z5ieDYJX-Fp9Gz?q&#RCO{ua9u3?xqbRU?N56y0wGvjMWdtS3bGar*OQUbgUYK8CaV zl!gNw`Y3wdw-{Oi4pX8=(j z!9hlPSK7PZ6}5mVt{e9T0?%3KaA`Mky=;TJ(}#4j2;3@FJpnj2yp0TsItIGpd)p_j zO|;-!^}C;)mty${B=C*s*37xk7+fDkf}SGAt$4X=(MNj(`t!}2HJm-vwy#}9hV4gU zq5&s+>JriEX~#+7-?y!@KTdv*62{}^pINTg%}7wd9~^-+uyQoWgz*!(5>DsRYFLj* zoW9)4mve`FV;mz~Q zfUK39epdg(XHoAN8|_ATh7@%f`p>8x=TurDt>oI)kKti;-G1FO}m4;5#7jcGnwJjk^{T(4kw%BkQubea`1B`r&mc&0e0pKKiCnW9R58lYM>oy z4W~5&=gig=11FPp2ai5a(VYIy#qE5 zvf^?_xJ7@S{^9P5Zp`+z7)>kWX|sCQ5zQ*-6nWCLf%9d1MfeT#`c%k8`q5)zsJzZ6 zAYv`^h@a+K8dMQ<35NQ$v|J9aOFbS!9zr^4+_Va~U@y}2ZN)ZPWnit?JkkvbWu|ZJ z>%cPGhyus$?|(rmg28w}4-6UH-hk%$ck?q@pECwmEd&&n|6f0Z5cKE=|3B9jB;@gl zkSP+qJBk&(QY8+wlQSGZndnt*512^;xa9YTR8~AFXN|kIQmKCaSV(lu{wff-xPY?^ zbhQKBjN?Fkh@o5UdP^H<3}LJU8uxstEm(g(>3b)derh5@Ahp4?{WcIClpzxJfK%N65E@ zllu;{e{BZlWBml+A3EXWKOp~Trt!x1w&MN@XzL-o#Wg_>k>h|?1sgM?dl@~BgCCW- z`i1i1e#9ZrX03|k3xZDE7fb=Y=}P-*)N%U3$p!~Dz*cnmwq6FXUxD8-(E)(PN#0VV zswm?US|cC+NKfLEgb-l}sei%rT)L4_4=1>&@WnS1L&){OlWMR2IfLWYoO)Wex$B|2 z4Yq=78PTc%BRHX8%6c0Jc?{TF*9F9MlJqUmW=A<>0{DsiB2PFiCw(|GZTVaxlyPdh zO#Q~VQvjdF7L|JfmF(70dqBMEf4Cs4axE>8I@N;ZvoAM4$vodhX+6vn9c|bVH`${C4H{Gl$3qcvsvy~cXdIOQ1AQjbyoK@Oxz=%8=7WX_)j zqR8k~Q>1}m7(@n^Jl6C^}&!JqYx4tkiuF96$d`9|Z{pwdg< zZ!`69znpS$+LDK%5`IA-C#LS+zNw$jUx4OK4R=bJfs8o58)0oWaq^NHEx+z;c(lPu zwxEKLpWQw!8{j5!u|Jyi&`A+V2+l|VEBorqcW0)~K53P0r=iP|%;O}J0}p`(tQOh< zIZu2~?>2+tzS?(xC{{_QH+s(ftEym|i#z>}khOzEJ^lb zUcP=faTEt`_lLu*XPo*jG2VRrVncsHkF7!CM#_BEo$c}#lS1Ag21R@ErfNLNdn!^x z*H*=KG2wGi@K@Du2*%O#06T@fo|m0EW6#-yXxGc)XCBwMD!Ql{-)o!pE#mJDwdGm( zzA!0HK5fxyGoAGi=cm9!UuRB_>OrEy9v1T!X+J*adZF(;MDti^!-yks{&Sijo}Z?3 zO;4fvlg@p(+l+Q+#56=8z5HSHr@RqZj+JidY|RK#g?YU6uK9gTG>2=CTUX=&Ujoud zbIoll9f~>-6*<^LlqFpj(o73vKWfn=7I$OtNH zm=H80d$)db9}76#AkmlUU9%l+g*m9WFM!S1_YmQ>Yi9M1INm}-KAhk9v|^lm3Xjj7 zun`3*0sC&xhmjf@B5TqyerJK%^lKfx=GTR zv>AP7c;7Xub7qnzatxPf2d&2nd(PLb5N^{TV+GKs_aYZ9p5fv0k`&? zuWy&0tgV2gsBZlV(>~WvvjAy=1VY%b#_!11NNs^;Tu;>e!y+~#!>9Ep(pA%-hp;k> zsK1x%!PCZ>-Ghos*n0`L+UTB*X#M^U=MBAitrK{wG3(q4h`j}aN z-yitvD`Y2SKb+BDFfGjIyO3nZh5Bq)2$;teTTUq9=o{w2w2=nIGRe)9l!{+(=h@=Q(_aJt%+o8LVsim%%5u_ft)tM7~Ot2_RwPluLrrS&e` zdgY-jma$Iv@#yX%t=ih z`axH#0r6cN{W?8%@e>5~*NTOJ=l`#R^8fSMrygc1=yw$z(4o6L{}1;EoRNR~ zME~pl0MH1i$r!Ug_?t2q7!ZTx8UA&nzMKNI=W^i5aEfDdTLVZ7NJ&tJ!dncX_W)G@ zm`~H+`#!1rj{}0*2D&V#Ue6P90TkCbkh%qtWtu9S6b|4so4?z?(-Bau)$ldGXgb_Y zPZP!gaWK1|jB6k+;#km=d;iy}%4PuJ%l#>J4wY$u${PRm$H2X!elkQFw8C5^{P%MJ zc-!xHP~AL5A6+%wO#?z#!o`qUAPBX(_}|arN%?rvPf)*0A6{NfO${C1J9D@JRNd~u z{`8?E82i$4jHYw4=9O)SZUKkF{IrE=6_h$k6xi#>VbiW$> zs0K}T^W>Ts6wN@ZEIlyeNB_)t5fpRmQWh+gZ_7C}m-$Xr=gL&e_c8bZy?)<$Jvps^ zCR|hm+?61Sg7k$arg4Aawf#e>NdAxvsKZ}whQX`9&d80cHM2=B`@iRtoMm$dtZ?|{ zcaRhdKwj~+plfI4(G72XvIAH3N5NDbv(|09-<}IS81jKEYJZkRSAhI>v}x zh82L9&C$29&Jt)}R|^NpHcilMalWa#*#&5R$AJO{Bf8JFfAnNRnj6Ftc#*CEErnZv zzg_ADY%55}$wH8pqj>^nS+~Hf@~E(?d8o_E7$E6T12E#O4H?iZXu?I44IThi%bqYr z9M%83D3@%OD0`c{$G{qm!N%6(`eKT!dwI4OidYAc0-p9>X-rcqw1_9GAcMskKEOnb)z zAL2J7sJa@XlQ8Jyy4lw?cYJ#2omcEYjwKFs<=Y}t)u>y&aV919bukqKq@W`Wk4*vt z$(tm7#Euc7EAi^wHmcmjObHUbg9iOwHp4%TBc4;Hgw^=O({vk>eJ{-b-`%P%$~idt zTUMA05r}^7VSWZK#?+pik&{ESQMoVLdwF|P=PQEA6@dCf+VUcMfrf+9PpAq8!jKTo zY&hV-lMT_9)JMT9rMYi4o7sZzpR1dRH@k4)l#sCB_=~nXJQiD1wFs#$m&cZ)cOXLj zR`8^EwS3thaHx))sVSkq+AZAsqA=AS=2(nuDZYK;YNN7rVT&QqTkf z!+fvHLS)ccFTZv(b#)|`_35)S+G?msj#!byTIkDlI(*7x-ybevLP5(9sqy zGAkD_5_wV2RLDyuuSm})ixQ+PNW=bk^Ut`HS}}HOh>*bukr{A;g(I} zF6TqhwHs~tcCx*JrRU}%UxO+$#F~j|{OZPH2O*`_aC&cIAnniw^LHV9yKL8d|n* zl77>>h=W%aL3u8jZkYni(%|_|g&IHfHFf%_1v%jKEERO3e<}iZO$zk+MKsMva$f5H zwo*@CX#>TI`}#YxS$5fT{qgK0Wd@ojh=S2FBIwPH>Zf2ksr4aqk*al|E|Fup?wP-( zb~v#T@Eke70Xormwjlfzt~J8qk@T-0oeH*0t#?bEOVh4um?c~?+j-}YHvfdHGI3>@ zzshnM@~*qtwnUlo zO`|8wNcwV%y`X_LMS1mOqnIJHRsq!$(cA}yN(z(F6Su5$Hi+un0o zDh|9Odmf`0Y?vO4~xoej_P<-mFKqD>(?>Ztza){p2jk+M&COi zrS}zzRVJVmHXszub)oov9|>WU6A7HSFAxFn_=Hga5y?k{J{-^6JVsFf>b%dMjeb9Y z!&wyB+_?`QixpHOnF$&2qpTmM<$ut4p>WB#a6A-Tlu3t1C*c7TZ+Hv`3M|M8{?OWM zfu36mu0eA0T)oUMc?44 zLcw7Hy>taI?Umlt)Kv7-;qp#4-|(eOa#1vVDRO0Hg%u;*PEaTw>YMxQBhWi-TTMCj z=XXSIq?Axiou8CUr?<|!fLj09*nY99YpN>!!a$MXk3m`%6WcEp$gPL4J=MDPRkOuT z1GIOZKVzPm^IHafIlIO(rr$@OI`~OKFY5N?FfOS0cxO%g2H-Yc12uSkul8i{=C8xT z!#HkF9>1OX=QmVB2R>wS9a%Bs?O|v}_9tiFjScc4FIQj+pvm=6Tif!%M2dQIQM8b8 zOn-K3GAL`hfo{`F7k4NV)W=G{8SeyiNNhgf#+CtKd?eH_wjb=%3*ft3$peCXd&v}I zj9Q*+fVao`O)XQX(i#4w9PD-rH#RG8>v3oGq*Cx@jz${YBL{Rz&z*&@cfu{(f2`6H zgbBe0ukn7-VR92C;c4%Qm-P@}o_efNT&>2}6tY+wwZq*xGhQe_KVP08aEa?aUw9=< z8Fv8)N(x|_RzB|ltWokk`aMdg_Zn^5QpQm7S&AA#3ET{xm2blOkPAPO{@h`$|K_){ z+8!KFTL#R;=j-LeZh?0Y@|p-s08pX5eSGRa2oI<3$?bnr!Ii803f5C_+-mBSi)I^zr3$P4Mygxs9Cevc zO?$-H^UY3llgv{WmtjyMFpEL@Nt>G0Ds)PX<%!v=SEvd?Ld4h_Ii+kYES^enT|>2G zIoJ$Mu=|fD;)3bqz&Vh;PZ%TC6YF;Az&=t!6*wLJWdXX=@5+HQqyMJ@X0`npFs3t} z0e0kdtJk5y9nqr-8zetVOk%%A?|?(uXqxShJY%b5ji7ff-_A!f`JTWk$+v`!rcV{? zB!?lEqvm@vXuLfF8uO`9#JpxPkw#a{j}+v;@1mc!x1Y^ezz zNXR~5a7fuu9hOka(s?=x5f97TwHc=3YxfgaPk}59H5f3jgMSi!f|G5D#TY(RH`-hG zlj8_d3%89Cj;0}5xj0#2UCub2$Z>w0u0>pbHfQV18=H4CgHN1q$y1QA*~hM@`*k^- zpf74(IKtI-y`%+8$(ip3c~CeMaTKlU>f%E77l@_MXw^3nZWqQp4S7~?ZiW#v@BT@? z%Kh330wJ9dV7y~~O-|zhlDkzoYR`ReZSe`YG=KM0 zmsC)8)*VEFbkJ;GIPUa-G6sxnShcQR(a`ARs!U!uF@?FgXj$k5{1CA7Y&;$>PvQC^ zKF0IfB`5U{n790LL^XyxmB?HWs3~eW-+3+kfdKz;*9(le{;X;ZcC9$8DPJBm6~^5< znc7@bm8odhUNV&Q=l|^IQiqEZ_gX%!T+-TAvF>Rkx9n2>oM+;-yY^gJKKjB#NIomi@os%*`i^dTbVEn$kV}q?$zF>#Szi$izbnfxch9e^`v~mH z^akv4n$Ne}F80m>f8`&3I(=(3&jZH@Jr8tbc1-RPzLM#x&=w$) z>wc}(0^SX1pu(u^=W<+3QQ0p*T}*xTTh|*iLRRUSt_ZDrYu%k}w2`A(c++F|i*8#3 z=J)BdCe>Qm0Aq*sw+OI_EMgFJLLzw18n?NDs|vF`R@LxaDwGW75?&m&!~eL+i{QPh z{23V@OgZdU+Z)y#q+a#+;__c245MH)1ZWci7QX-O&32>-E@8LN0omZ`>gTe~DWM4f DMs;Je literal 0 HcmV?d00001 diff --git a/ee/ucp/images/interlock_default_backend.png b/ee/ucp/images/interlock_default_backend.png new file mode 100644 index 0000000000000000000000000000000000000000..4f56737a166d4aec0bb9aabbc91c9b96f5651b6c GIT binary patch literal 32333 zcma&OXFyY1w=Rrgm!jJSBA{D}igb_;x)m@YAYD302kE`5Gz&%Py-1U;AiYWyq(*9_ zB_bt2AOQjd2!uOV0QdRMd(Zi9evo99ImaC38P6DVg;$T1Oih;K(_;DOvD#$oU_b`Z4hGIcEA2d}nl#ee9xUZ|>r5>|{n|VP|h^#_eq4 zWM*dPY-#U;r*4#{qPk24yLU(3BYA$z_bqbO7r%`}HQ`DRX&yR%RfOqkjZS%TK=-eE zYEBbk9Gf9=YaaK7q1Gl%Cksna!BNjTNnJM!}K;^N}L-i$yGS6|C;(I%H2hi|`X&d$!x4TVqT zzHYME+!&f?!Cj%D=1X*SbK8ty27^zmm-RM@=`-N)JmU@gRkgLGKv6v%okX_lcqSk3 z1{rdz-~x+u+^4^&_=eXTe}Ta{mo2iNBh!{n=Wfp7aMBzHiD7Us$?V+R=D@XAQHRIX zWPb}D{{6Msn5rcwJUsl8n3HK$+yN>ozW2~vqDf=Txg*y{&jgd?#wSWtbaXZgnBh|V z>+9EiO4HJ;FE~2QKYo>(Mq~$a>bSbNWaZ^q?cIM2PCc>C=d)Ej9`$X!!Q}4;3JTut zhlpX#QuP&_r-*eqTc#>icqHrA7uNNoCxNU~d=EZXR$>Yax99lpRF(Ah_D0X68yiWc zch<=yJmSUSlTLk#BH3kSeM*MV<blLUwzEv`miKw<+I=CydGBYQ#lKd1NJWwrl$D?qmmq*V8 z#c}J##&Bs(FOI|C^HGGd)X~v_&hv|XO0TH6H83#1DM?-%vBxw$r>1sG%g@hO*U*@H zags-Lda1j+TXM09dLyZEBPlvIHm9)grkR;pqqq-lof&RxYdbqLb1DdEm+IM_atlPN zp4*UFUVi>XTsF;z!NI}0jp?N7$w&ny4;&bKqv@#h+qNi9`tS90tkTJ`v9VjragCiM z^bQ%-+R@$~d5QLG+ozD9DJzTBY$l~Ys3B>uD!9A51Cg8-e|;G@Xn&R{>iFA=2|L*q zb=2j_T}1a}CEAY^m;%?=*RNNp!e9e|HH{gdJB`@ZTSOY(jn%s678P-~^`w+s&~v!M z1LPTXfYT<3yUuAFmStpILCEa*L}rzi3INq2pA}bISm0)9Ccg%+t*xnRY2|+Uv^3i6 zfT(x^jrr`I5fL}$Ih|nP^sDK4baXUO`BjIvcGuRMyG`nzMg1~N7Zjk$dD(Vq8p@=MC_%p zHn&7XFh4Tx&f;+0wfF`JXlDERRn6i?^5&>7ajZ4)S1KOgK*H(yZ?D!bRmp5tpi^0% zMjwJE;JXnW6Ej8h!xNWFb~Z~qf4|~%+L(&N1T)!vkLA`?)z(h%Cu97(!P@!;2V<8e zS}mqK6E?ofOGgGArC*bFUtb)5m?(7p49CM6+YEMg_6!-~2-%rF5QblT|&R{ws@wcM+~ zJ5`I`wws%qTP8K`kgjuab!6NPS=RDj)$$~7VETG`-YM`@v+Zm*?hx5vHa0foEyPY8 zF%h^Eqllee!%8-<*+9OA=TwYVsnM4gThsPrbI5rCL}C!+d4z!P=E@dwXVb8+w>NTg zbJJ(R#*k?dfjr}r=JER#r1xqPu9g7gSd|;+O!fF3c>0V*Z=bJ%f`Wg!$@)6~U(LHg z*{hf;DRz|Z()a#6wZ7ruL|7CD#U7GuBpG527&0a7{J;I`2qkXuHve{OX`*%tl`mVNp>~YcS!y__$?fsY?t#eA(E@4P5?TK z@*^#bdgJR8gsfEkz}=JONP~{R<7Y~(2lBU8a%H-h?Caj0_p1?-k*ws!5GbUJ^=p?$oe@(uh9n(w zhyMnzmAyT}rldaBpI}c`v_DpypWhBZF~n4DVM%5E6=&-Aad?O~eMT*CKX1c6!&V~N z#Epiyeeou6?V$!=ZxD`rmc(ZnLO{nru3X~IMF_|F7H@EIMP-SEySck#T4l(N4U0j% zlkeZ~wA*jB*iQ~wq;(-1*2;Zm6$~F}X=y>J1emaYaBv!=F3*)7d4jzEiu~;S{6iQF zM*hu9{yT(@`9UOzdQ4p7mKn;2(6!aNv(8#(H&%nPadmgM7_D;j+*)ca^ChhTKsEjS z^;N){Hb_q?*pkKuB4KTec~sDOeG^-P2&QG)thZSQ%C6%)L@&#LDzi{Vfe^d-_~Yd` zJ*T$xv7^Dw2*0(mx~=67;35cZ+p(iyO~2;#TzX`yC&DFqK~j>Sd(xW)OOSB4gA52o z$jJ*losC-^jiwvRQ(`{r4nPBh=kz|8D@UCaE;2C@AQ#%1@ZX96+1vuimzS3Zv#_vW z@tVo#9~j8a$>H$dA^NAWQ83GJ>-U9?<_isP;UV<7b#;bg>8OFV@Io< z%Z%Z{sKt@Kl+Bj$ROBjhX~F%zI}PAdW&qc#f%LM*ErAd)LAe78jp1RP+F-~&N80Rn z*6h=kgbCAK9l%+XHb+Al1)Ww0wCGn#k9;Gchz(mK{v>BfG zktK*P0Y{ZLkt{W}wFJP0ashmRAp&Y*!Eyn-nzlz@&)vpC^#Ik`4t|MX<<+mZtt>6S zf41tI&oX_OBw+R+M=>cjI5;>ecpMP5`H@OqXH0ijmE*(_SMIK^u8nWJe(wO0c^J=U z{0M&-jMMbpy%eV_9xw9L*0xImU+3Ii7StNX6u0agZmH%H4(9W!*qD@uL~z6< zu}FxW6}p|&QrFCR|Nid@t{Vb&KCDkBy!SByRYEChP*?e7<|B)}=&RsSH0=7FfSrR9BD*>6K>*Bq(D6{w$+cTn~?EP2EHfFXI1Z@U2Hhyr%O)@1V zhI`}Jd`Jpun*%m>hLQGlUXi*_cWQms^0hZ+vBR|(Ca>n@yu+~^>n(K?pr0H#% z8Z6YWywMilQS)@_i_+d~+o*OKlqba95~P1q?Tnd*xC)E+{3lc^^w)=2i|ztwL2?a) zumFS>=R6J1_3JQDcfrz_ZsPrSNPVNDPmvS~QLiNGV|RJN0U*=b!bqG=aWw}ZVirEz z>#tt}>YiO&i?!V5o>i)ejO>lfVoP|WpVA#3{<)l0$;!$Kq+F-0&qBcEXC-sT;e)^fff~%{mo&W&}WMZQXC{JMFI0hcT^nxxJ#6xiGxkEyy_4eLjUP^g&hBF6% zGQN(W1Q_FR3Hl8b7oqyTOpEE!c`Yq15DzZx;E|ZH0cBJqE~|i4f48)zws&k`8&#NqwRFub{46vEYk#1irmgaBdD%HdMlT_8HVW9n$3-5WiXp6GqG~luy7iI$IXUJ^ zb~SixHNJ**s)y51ax+#6fx#lwC;JMtrbJ5e6cx>Ei>sGf^fdc0r6K6fsI(n*mXx}i zI|OWH&MjDlOjM%}uJoqv>PU5Qg+NR>ath^b|B&FUY_68JI$AS_ttRGl2;^3*S>7~% z3>bn`HF*^OtOdT$~N!QU8UDpkPNPV!V;ZrqyUMUz-r0&JEi+W>h| za&|7$rqI`wi;H}9fNHt8xJUg!NNW zFrV64r?M5hsyAy=nY%)wCMEmk$Lq>7Z*j5s^7WSv)|T zCP@2wK~`Y92bH~i;xrx%sCsXA>BZ;tfZF>fl;aH@W%~SDfMq^clu!A{XWQ+xv`bbK zTSi^6$(i(eZu&enBo%|v{z0O~&}S=qb4308%>9=g#ohB2T4l3cYWn4Wvl^~;jS`cH z(-AUbvGQ>;2@5a*VvU~uMrNH$XF21mRDiE0E%GbOTuUo`%4q}T`%I|T9WOn-1eh@7 zH&E{2^;>%LT#tNRA0$_ZGSRU}in0+Q(TygVe(;U<_eX>3PY={h+kVQV@wJsLTH+Zm z`?SVQ)R`c}+Q(|ZAm**CAM~Y4c{=x15+*N5Cq!`j3nL44VrsqUJPYdC8(rm>W#V`d z==$O4iV7*uCEhr*sfgn4dZGalWn_a^4ZGiP(35}nuKrM$%;UGVp1?J^-%Q*EdV!GtENUM z@b3jJw!Ff^POzX-z-j=|+ej|j_GMlaKHmm<4t`O)e=rJv){oTT4bq!+Xst%{C|gK7;>){i!YMOp&x21;$j^%I=(^l8|+`A*QT zxFpt_dUatzo<822_k;pGRIV>au>&f|fBbOhoRF#wE+{A{vq2VL(WV?79`;g_z*G2z z?h!Vc%JTB;>S{5NjHn%}qwG#eBM8$*Kl_o$-0JF$c;}$ zmfvPy+H{x5QR409<>h6_8QJ{;Ac@YRJVVAo{}VJEWssmJa=Y+oOBPhC^EPfd@ieUe zj*es9wgvTDBDfDK-&fsYo=T4OVumA3P+zv z@p0&bN)}4DpukGi0~Kz4L|jY^vy{VWNaw*nJi8chp!_p2F#*(c;h(_1Yk;u;x&|sK zz)i(=>3;gJZZS%|11bxsDFax}Q71({j;<655fCWAoJa>=C?7q0fkj?>)s-ZYwz34g zLl1O!7(u!6jORqld#DYCs`K24^WTUAeA~V%4g#Pi24R2lmSDs5XJZd^gRkfIDw0r* z@U?3?e^}OSHajk{l@_`xeG}VA#zF`MwF0jjIvWU5j6lWUOQ|8i%%^t`oX9Z@L8#Ek zY|kn~Md~GKACIayN?-1(Cdhj{pxXo)`ThGRRdLQrfyR++BNetCpm&uN;WK#^BJmEq z5HY5bD|APBa+cJu=~UQ_B^vIm8nWW1lFwwa-H+Vb!pI<8k@}n`C`(|3nrTog1TZ;~ zQ3WxJWMX6NSShS!H)(U4Xbv9_{mn;R&g^eK1Vjyi*;CM*)ra1c96)S%nbMr%h zv)v~%H5F&r4TO(k0}8%owp(=kE=`~ zc9%Z#fljx#AGgTUpKnbUCl)~`>1`{kza;2Av_s7n;1FzWKpaA+AYzhrXNi@Nfbf}4 z_M;Xqsuy#$vF{kf^R|UPH(1x!j*}IpH%GN_Ya7U%$5D)tAPH`R1@qF#5J#Ooan%?n zY*FR(psqc0q&J-xgS7MsUfqhPAMJ+bG7yG zZKdFSI3aNtRp@;)9S|i`aC#ZZ8OL=136y3J2yqPP&~|{LGTgJ_($&J_IYPg_2W2EWu zXDbNop;PiKo>>lp+DE!^brq{){rawX*C0sYJ7nN79@LpCB>@1W8|wMpw3&JJ-pICGFUjoc+N=wrlzJr1)kFAhV5R(UfKK*BUg)#4?jOaAo}nGO+O!r@Ti4*I!H zXkTK=QaN$V-H?u1JbD$2q@THX!h~ouv}vbbT%&#-(h&m0#PP$;| z!=JYPm2>%(vd`bV4eL(^OAOH@9|WUrzyh#u7wFf>`7^LwSE*{f-8#;#Tfqhc){ID5 z*_faYmN3kH(=2sFkPfs|Iud03$;T(IrurdmW&0MkK9DIj)07qIfQ8)u*Ci;_9YO zoyXEMRw1M_y6^BBXwjp}X(v0!nI+tkUCbR246i087L&!CyH5pIny=cvDfL4Q7oy#q z&4p~+HZ>GL(n`ftnytQ<)vo-N_f)TvPgqwIQ;~GR%yqjbV0idqMNWpD?Vz3K4Z(|p zradoqINwzGN!cLn+7cN@O4llav}>$Y>~zcc+A0dG7p4pIbfa8#FJw2^Dh%>ebBpli zcMh(;AvyjSOF;R%6xm>rrehT&s%gPb$71{0Vdkc&$N}v}F9UP+TT>*33zHR7%2U&7 zs7iiaGQKv!Gl2guie7;iSb6?>ew5PBmT;T@&g?$=Zp6NEJ01zP3AgS<-1 zq`ci&JbpdDgI*E86oR0g3mq?m+9;z64DZ|)hFz7)UW49uQi_B-UGwWBO|j+LWv<4t zB{kfu!ZCSyx^I&%blx|^6KqP&v0a{vUxE_eWjUcDZ)$(!#tt@Wg>%`I{+bSwN9+3Q z+7+iId%ihuW~^^^gA40CV!LWJT)|C?*SA@X4f1qYec!Lek(Utntsu?nQCJZ;Yl$UQK6qqWqjpcmjNGKcd*XCkr(G}RXl}vjA8oh?H5c8vjMdm!! zCK<8ll}R&I-pT^|j9r4~G3s!(i`$kw;*brzG!{n7$@)O=A z=GYFo<%=~63ksNY|1Pw#e4wU=(7JnzC(V8BO-aH###VHJv2I0q*L~kHs=7vVIddW5 ztZ}yTO53r>(Yl)JZ;*DK6*)OVzW%W3XUmczU}GHj~SrieMG*? zY$<~FaR#TB7vc12OXW}=1Vle3$-ZHupI7Ij=$pBQG!6P5 zI5_p?Xd{|QFR8+|tD-M$#O<{=cU$D027%-;L}4CP zwX17_F%V&h74l()(ki>{p7QB>M5&ogV&rFG;p`$OxjA#Ny;gJuWbTDB-SsMxkX@IJ zqM&ok0tGwoJ^_uC1VIZW7SG9dP<|6i?E zHWF>2zYdC55jd?r6n2bSxzRvek)|Tf&`*qBX3Jq3k(LH1reMM?Tb;;(o3%h2Fhs97K@QprD`u_i!MOp(R<;4zGLz}K9i zZTzdO8{eO?)`&#kEr}qG)BB4OFbKrvDweR^!D|6g@o*L;cVGw%*ng46BDhYlt~O|E zeKn`-rDQk)?tN3YVm^>I9IA)GhFct1rRRMF4O2KA6U;`#DL=7DO)tr(Ua1fX?X(5> zMS%Dp1-l6WWcmf9|2C2UXC;3$EYbgH^d-G06R=75QAc@P)kOH6T1sU^lLOTPxxVD5 zWVx-|46hqJ>aLuGCxad{nE0e z?n5y^$Z>*c_wF+X!~a%{`!oH=h}2C7T%Zw~EdQ5jslV<``}x%WJnez~X)pf2Oxw9P z?S0Pwd9?ved(*O=`Jbn~^JH(es>k8bLjJ2>|6{cQ-}k3w`(LK*+?zIQzd`VSQSud| zy=f!=A69$!>;AOh@i<6EVDtZw?e6#e)&4I^zGA*N?dX4Z#{Y|q#=oe$oBpdFB||$Ip%RNKIN(3!hK~P#F7CW^dpGEX|M(=uY5#4w$T6@S z*dHCV53ha6m9+s7Gec_Pm?JK*ED0%x_E5gfDGN@G$Xg;{R{%kgUdVOX zyddQ`jgZ8D3xIfMI(Q3=qWVy!-P{B@mE;N0XLQg}hWnUv!C_I93mAO&9$dK=PoRUl z(Na7xl*f%G;;+4hQt#_G{=o4+!?OIBVPEeH5_sU`p9|>zyWhEo+?Z!zG2639 za>)VuKl48QkGlf?0(UX!?a6|HhyOR*n*V72=(vlSSEHEWnbBgDKyRwv$3XK(@IMzs z>^{dtby#r5_$PQs6uh3j`xZW~vJW`b`_W~7|KDLl_U{6{HK#p6ENs62dqKdz7wiUb z=i6Z83AQ64d$J6D+_!tMnuy#RkF1>Wyn5n%r{$awe3 z6{;i1m*81p=taY0>_H>Aiz}iDry2ivh2&L%-H7J%*vBu%Pk$!-+Z0Is_1I+3#11$2mviFu{%z|q{{$LuB6j8BTiZ`~YVm*2 zS0!lg;3ak%=YzZB8$IPx|DzD2-BF(%4BqqTXYaZ67;^k~jr#19!oINoK=y-F@a%6c z)4hWNe?(#eB8dtf{Q-qr(@*uEd(NgF^ap!o)o1n&-fQN|HQUYTp;AHg`_L+@w!U|P z(7pffJgM>TJ;7t$fW6tZuYviM#G%G{28~{}P3D(Y+L6 zlEU|}aSuLB{!Q_Vu)Q%u&Hfc5`P`oBR?Y+~f7!(%qr!bCmSd2n-Gzf^pYAhE7w!$3 z`ER;iWZWNA_}@Vx!66Po3~>C5(}{|*2NG)Ve>oqun+Td7U!igC-qS`8j6wS3URpDG z{%7@nc1Wg3lj04=P^xts}S0cP&tO_IWIH;&h20Qa{ zPYu>G%Dj{(B#IJHxv-5qI7)#yord@{1v-wJmk)D3_Sqg{04pif+}zslx8Pib`%w zN#3=n*%YoKq%S9SHg9#_E-^VZb=dYIUQyNCUaxQP{$ET_quyJ+&$)5xfC}RsMuucC zW;`pAHT^rU*}5>ili;ZDT`qve`=ANiehJ+T9tcwARoC#-EVK^^3&W@p4FxrG93w5{Bu9V~(%FIpj_ zcVrYbP$ci?no8jg_k>@JA8!#o4&}XP&&|IwsaILLeJ6cmv}T79`W{}v@2ut4I|rTl zeQvoSe2s^Z=7N`nBIL^|H+V)VkJ~_Ba?XE&obimv4|-SdX+mI`l&Cg;F9;#qD<3qFPwW%iS%uw=&x zi`cJ>!>dgK+Yw=60({z#NumOcJRL4DZ5DxV2W)8t>lBUixk5)n=a=A=r05 zL&JS0J97Sd9t7^6LX03#J{I5+a7TH&Rl=^i>uy2mDm-$YKNu3V>HD!@&eQsE@R6ZS zUo#44AWEtjk*X5c)s4+nydw*azhnnX6S@i23VfxFk8j!ZkKnd?RmUV`JpU>HroUZy z1zOVWdrTcw==+AByBI8fUqh&&S-^*gM_gPURbQ$VDTZ)@t! zld8X6<-JtzlWr!7D4=hAwra)mDywSji3#4~T~LmPiW)>STed9R?k3j-x6yjGK1mRE zd`Pl2up|F@#OLg4~%zac;58eHpv&P^TD@0gxWU>rcAoSicLc2!y4Ws_ zykV02B9iO`d%Y}RPN(Mn=*zFg?RGO)Etkn+P^6a)FXd++eB`X%IRni30MymeR($L?EA@r@5Xz=t1 zLCRk;T7sO`=maB8Z*O&mt08*c`DE|83$3jl;BY8Ch3+;*3xtYFn+V-}CAjkKaN7xn z7dqxCLyZT~VHleH-X8W!WbSK@lC3Y#ww^o2LZg1T%O@%O#54I2CGl(?9!Q%CABcDm z7vVK>b(PzzvL&ywy8@e>gfIn@%zShI0p6ZnKc~JrwRT-X$Jj2XB5pJ<({QJ-q1Lb1 zoU=uF=o17m)yIN!A0;Lnu?7Aob@)XF;_qW?T?)rS9qs2~=;de*PU znjW=XJYUlLQOv1BbP?yd`$y<`)g0ZPJPrq1e)jzilvAFKycP^3f9f&fTUn5(_;P%k z6lT1`R2#nZ)A0x+8{_X5$9Y}RvEFl=1f{nUy-}-#MxE?$v4I~4AZZsV(My%{6VD{x z?6pOY)pZ>lJ2Q9@oI7Q32(EThvlW)b*)oj<0l}c8>;4F@E*!M5zN6RkVUeZ`Ty;C^ zGKGlbJidIbUKe|!;}g30X|J)j#p7`BG{l~WRDoY?2JD0@6n$@#{8{b#9}o5ef4%K8 zPTDqp`(I*6MPm48#sxZL&}RfI&sulS!u(oDT?yOjx_4g(95Ytadv2J_nJ5*>Rw)7^ zsKnEE`RI!i54^CUYQjax;HM^h_rIKO9*8PJsW5Y%iZ+lQ{9x}dEt9p`GI6xANKL8? z!uQKBj2~vK+{+xUIrjAcReZRg_a}wM`k%r%zO_Dgwvi`V<0E{3Jq@8tW*&KBt3~ZN zA-=}jtrz3s+DW26Z_jtF`&55Rkl^YCuENc}Yy!u8wLQkt_f3OtkAPV#v?x=GMqfG> z*uHv@VtmYAnL|e(UII3%Ub%O1-~iRjvkzI~S;(^i za))2&aqpfSKlav~;~L0vb=6SC`x!07{W!y<1?#O3sD+d6P)2$A}%m#G0XPY7sB#U+HoF;PVm1lVle)85Oi$s1*bk+!R2<1^ISFG-Y&`4 zz~lDhyK)E)u6*>US6RB@EKcA_FFhS{CeD=^Xb~DA*husrekj{NERRxZyja3#<8hnkHp09?GRl)CFb)yolL&1Sk>`T zd?0RgcxyA)x?T=?<^;k|xqG`VGxf1vL8jmXkXmITC7;8Vypdb;`*>jOSuon|zbHg3 z_;mDV0)0_vbUc-Pa@B_rbY1$b7I{dP7pG{HsVUrh{8!y{p9x7?!&?iuZ$d>X*(|2P z@8g~4Mtl^psi;puacOj~^^$?qj*@LvN4(p`5%KaR&eqj-tGJheVD+b7?XF(I`^K18 zf+sw4&2EZ)dp5OC9JjbDkkP%)Yw;YtopRNZ4GwYqdA(=Ctg)|g$YWGZE~}m69S;R% z|4GQvS8nr3hJF19`T@a9y*n^}?~ixFa5kGQn_CWXXHJKw+Vq@kY|L`<4tZ<{jo5db zqMv_CGv8~(&_y)td^?!U!4X)S{L!+mH}3+fG2Oq&se|?MY0B7u=Dci%8Vorh+pf&k z9t+WA@3w!qyAsdgoN^vc#Mo?N&?$Xb4W89Qzc)@BEdb zzmpo4I6cRCEL5R*=wLPMEx}4mojk;T8hTdF$ZMC_#&5hhvanu%*IT)AmQ`eW&bhh_ zuHPHzHBqH6BjyJ4f4bU%I0Z%4z0;Hc3)M{-$yM~W`Fw-$qM<@ujlQ`1xI4^bO-UmP zRpdHbOtVIOa`{f)?DQz3AO;w~&iDel1-))p z1)ZhQ?Ock|fE)vQ8NCi1<$ov&Wmf3b$CSyIQ*FtzTY7`jPNCNsa%>pXp6~X}fDDuA zyG>Vc^^?x{0OOkAt4H^`r&LsdFT$buq1Q|Pi4(!I7h6nCc1v+6&9sbxxi0PZBEayU z8Q2f(UQWet{?7|&FltKu0v(hK_%DN)IzsAE(f-`g_ zmY4o$;mHsFP^*AHD)<`TZxmlVzW5&W9QZVIMrFk}9%k_Pf6M7~xFE>Fk+deI_Mt=f zLSB3Xd(_uLPFC*zDGSY6Zvsud%84f>&rNUybi?Kxoz6EivwJrJA0iCwX+3xEHZdx z$}~%g9>mZ8We=Xqt998(_=j0X##wzN=|t>ICp2DMLZ){Yhy{*^UQU+$tsM(X%4@(z zO{X}ds?Ew9QqDE=T$qd5(J8Bo((F?|`F&w77LJX0j}&4K9ItCdsLx7iCRp=WDyuEF zL@+atIkCBRj3?#)lk?6c$<5ENBDN#9Pq--G#r^w2+(Q(Lm^fRd%qiT7tIzJRV+kwk zKADm{m1`m%uESC>7MonM@#wD@=r2hmAc{Kb_w-*YE)D|B4Pn+d#`zWZJH~8 zk#_6FBWt4WP+2)*a$IvfRTcr5sc%P1^sE?~`?7gBkz6Z;e_~+KX1y?*q zq&U=lUOzx~X~3d%Yx7IOHnxX!{gsGy9(MmI01WIyM<0T_(1s`{4qb~2InPM-Qc=o_ zu%Ns;{Va`9-3M)5-{2HHUydo?c+~pQds)Nep-2KDGKTw=40T}BPmxVHR?XXk>y;%( zCfmjUF5&m1$B_c6<>H=m^x&UMJfUWW$7@m&&)+jgp5;v{J{X8%Ke^(d^uDyqaoNQs z@BMJ`!j#eg?PhIBTVjSSu~Vb1j?D~cWF8w^U#(Ay_*q^s=&V+mq^&Gn^8j6;Kj7~7 zm=_=HBbAhNP0gf!u)(d~ng5P#T3b&Pms&Xo{N@|}%asKRt#e7`SckIkh#c2$)4m4# z>HH7y4Bnl^!gkVJSLY|Ik+EB2NiiQDIwyBZr(MGFX!HwNBS~7pb;TKoq&#FpLauj8 z9C(Iisat0GU55TUt@{5VZ$>k z5yFGs+=_5Ov0ooZ%(Er_{LIe@OE8Bq8!(qN7V3xa(tpquxMuHIQBkC*^{$JpKun3n zuu>;c;`7e;ATsH?U##Csm_&KoXswn?n}uujy;9ba{+i0#@`WCaVQXw}gyF`$k)#$U zZW^6!3-{Tg0l^g%S!U*Vr3RuTtst`So_6Q~v1Ba`vPwXM^Lvx%acea8#=N(_T-*4( z`nNW@h4q=&^VGO{4{omSy%puNI#E6DbdqEFHf~nkn5B7nzNHc)U__JGKktfPEdOx|# z3<6mKJ$yI)IFrLRn;Ttc#}&oAn#|S5-l+{ccvPJ}eI$lFHRfg9vufjFffu%JNOzT~ z-;krb=9;RAu#eCEYh;z!R&ay#t1eY~0B!vA#^d)+)kR*^i<5f(fR5|yJAnh4IzfvFpt*05`Bz8)!FHDiI74^*nuHl z@N+HKh-e`-+3K?L)eNB`&q`H8^19cf)6qyyn4?Y^k1{*qVEzYtjoPwWykpb@R=wg2 z%NF-jm6!`_*lI-#hQzFH7^D>V5~5bW7FcKuiai~wG;P;T_sw=Le>^6xkIpBK9%vJ~ z+u_{%Id4(voHo`4&8xE+&^x}qN#>Qllbv+pvstR)Ia*usX+djGyTrjsi&=S?^jKvs zECxyZWI8v+?KvEO>1}3Dwunu=Q)?@iy;TZHjH0sL;YYck$b$slVx){dg~6%Q2^74#3~4y+1hChwG{|x ztE$(1f8QI)F5v3(p3~aieTn9VPUAz~3pw9^&#KD$Cbj!6wI^BhPN zf7<|-lSLz?C7`QWscz>%`{AU6P;N5h{Ted`7~2G*XGhNcCF(HOmjBpAa^Za zO}C*uoP8Vq&UCEyN%-r?S`EiK+15Jg0pX1n2j7Fs>uldR=f?j^dJvj&qh#(~y=Rs; z$A`XLo*7wxw6L|^0M4sqwA)S0rBC=lVgXXYf{2RJSg0pX`n-97=Y8AejP-W<2X*oQ zRnzBN+05`j_&Br))buz3qpRUkDu<=ht6n;{-9IY3shFqnh9Icn@}a(xNl03IJIDJYcKF7Eo5J=1)%Opa^fm`m1&6)W+-;{{2YK=M z2TOK$cumGQ-)QXdh)a(o#bPbEioE>l)uxW>UFjYb`d}#=e4dFq|C&Tm7pL8@gkMhT z*4znS?*>JB@ECk{g|3vc{mbmnLpN3pdbRv~49+3b+9UIjEM0x|+M2edxAJ;>blqoz z4-d!R98ym0xjzi)tX9DS zyW!e(!@pJ^wXQBzZ5LZOH%Q**JQ}Dw#D(k6AX!+MWGHqh34c&!iSd0JS1M56cI)oi zrrd(4<3tvX+Wi@1^9YeY-*W0E^G%8DuH0fY`bZIKk#%Ko_};mahf#Tho>)>(Vi9IA z=X-BYPOe=8Mlo*_1wZWNp%R|TZMh&-LMUCWFNXK@xm3F$J4 zOn%79(KPeB{@J@Xvos<}9j7>8vhgaiOtF?u!oDsiEZg`E459KTH(%=~H!Id7EX9?9=i(`;;iE9Ax&`mUz-PG@e9SnwERRkDAu{XTj%11A0^M1hf)7y+*a7DQD*v1*=&kdB&a#E zKeLpcC$E{)3}cb+5g7bK7p5ri;KX;S^@tp@jo0jejAb`bIpkEJOTqkN5SdCTa+D`V zL_zh%@=aesy{KM|M4M9OcZgl+h{iRZ_K_M>Ev_Ek) z`mMQ2l9TOlJV)MAq}u>mQYT&B3~$)a#mVf2V9r&CExTLcGcHPLXqM=&QuhgZhpDyt zMBWrE_n|@hOCp>5d|)HWV?O>zHME^I=wRm+dOxOAi0IY}=y!yv+ODR1qehDLr{X^E zm=?_W9G|0IFt_@|<~<<0V8!%vd|1^6Nj3-nTW&bohQTFT1r?R?G0Q5GTM4Ls;tcXg z9eDyTV%f;Gl6z@LW5Ki0q{;jKcRVlk9CMYg!h&pluV{F;Ic%avS}yH|v~}vo)3k7O zl-&?}0ynHirY_HR9UI-In}8 zm@%UvJv|(05Th$+ds90j4mqO!RB@)HjrI3$)dp}a9jZ0g&G5FW9{RmTWLs>ZWF{L? zn3>6ZE2y$vdnDV9?2*04Te^A?xyWAG#4TKV<%Y-}$+eQ~m0g72d7kH1-{12O z_uliI^Esb+&iRb9;cmio?dWiT&Vv)9>C$tzlLlSAy9I9g1qeJ~-Q4eK8_lY^z=1Pp zNo+A#5i5$Q((Vy*3jH*ccnyQt&pIkO#$;t{S3~B}it_VJ@xQTW<|l~Z|?}-T&b_!nqA>r z8eG^s;a@c7jZ3Y5bFORi?8LTBSWVr;a(&Ne)Ttd~a&VlM_4*K@9UKU-R2fopj65qO zj`s^X$9=96nSImHP4mG+a&~jJc2d`2HD)0&yt27>;A6%bA=PH-WJ$<+pAI%P`=u9` zew4JX?V7!JO}=X4xU1^7M|Upx`W?IoXc4v=8vRg;6O*Sii5-&|%5_$VWlR}ccWmwI z>CAfE;uf}9L3oljNz*o-6J;^?gx4cqNX1#GY`*0@zM!~o&;yq_ySh7L(-9}#q}q>< zGfWSgi}Nj)vOIN;nQAYYd3X22?dF4EjDSh%)A>H~7M}~?{Dsw(vV{g(H%DFK46YWf z-MnT{x~HCdyz#`Bg%^ZNts@z0)Sb55yw#R1Zx=LvV$x`uKQP+jUqxxbx2pQAyL;B(^jMXW+)VYE7&Xk*D)2-F~L!ZPWd8^nqS^ zoU?6stPVpdP0S6tKJw(6=0keVut$!ri&iNFFEleMs)sKyMJo!L_ZI$Bvv@}DvP#r- z`cCV0+gKk32}63m7@OtXi0kjR2*ruz$tAs2}u7A&1ErY+q8$&eDcu zLu+?~7Yq1mtp`}O7T_KHQYvOyA-_+HZx)f&EWdn?UD|!)nuJgFEkP`%vmsnfQ?avK zfOg3*-P>lZdwk%*dX!Lm-g%AO6+Y2vFLm9m0HznVLP%db>oj7VOzDZ_cF~=^;^H<$LAqrGP!MYKv6z&HUE1G;~DBU zwyQ4mvkl|^cP;mOMSO3&a%U^=&93Tr7YONQ$zt;k@pj#QetI@B{@TCS4DjW323Per zzE_q0TjDhtg~#)&&>eRD*&kyNU_ac~Cz0B3r@0llGpSQ5rABSJ;XgGdG-Ao)l2As+ zPF*3Aom5H0vbDMZ{rR~1Z_C`T4vA|H{`r}D-o8#RGaYpLD`e+`HjJ%$Zp3DWwcpsj zT@$j>scC&Tq*&5;fQwVX(($4#o|Q^WH+zF}iAOai&vBK|pO|goi8~sZZQzPiI_1IJ z{P}yUNb;8A$1IOofd!TNPk>|b@nW5X z3#|j$we;C(i6w!A~7d;~%)4&2Cg@ABl|LgKoo4OCS zm0oO|KEtPk9T?2gm2zO}Rq-|$yIbqonEj>Ewf5Vr(PjIJeEo8h5H)r8yZIq@x4aVg z=CbntGd}(nCrX_>c+0jS84n9XRF*z^^S}rsU_G;f;T+^B_jH9Lyx1D!f+vF@Gu}d7E)<_k-}>_r1F@4helm5ZHXp9QE}fOF ze~8j?-rAYWbomIz;)0q>8ZUloOD3jf9=+S~A|w09EqJYy$ThGCCH0NF4pGP=3FzE9!N8)3@vrjz=}*Kn&WKFRX(Svq%)h)ZJJOTooWAAVryxw zvTRod;1l#nkC(;*1iu^JMVxS@fEYAZd|&sUWrb^R1{&TNOHGpL4N&a3{On+ z_EalZm6Xae;;Kfmdy!I4!q1^LmmR#v&#wH}b+EcY=e~MHxwWy8o0Fp;m8vEwDY>)k zQC|QOr{}*kg@TOIUQiYzyZ(Fmjw1IXQ%@WDJ1q|lbX{wJdy_qibk4|Qxgc~v&s%=} zz_i$UT+~J9tM$Oa{$u@^Re=-bZ|wGrc2v+WRnPy(5MivNTXqJXnES?~AI}hLeab=2 z-+WNTVIkf!r3d8V#yo${lF^eJ6m*DuGC?|5}Z|u-N^oW86Na<`KU=UP8Zg?-`vv zwFg+6T7b55#Yc8=zyMvum8P=ta!@h9)8t} zl1@AIB;S|mWqCU|Joh%1%Og@%3b?LJ-f#(yG(m4^Tzm<6_<)a&#_5Y?zU$uK_VJeF z9&AvDaq_PGVR|O_`rtU^UV5KJ9=eBI~fZ8F#TIO6zpKbV}~c}_b{jup%RTN)Ne0C zK6~bl{t^?TG!^H9nry8z({g8~vS-KeKia}^{g}kYq4uWGQpYHr&}UM~Qp5R=2mD*j z?`rJxNE+VPh};ZY_8A_ar%KeWvW_=?pL(IZuW&72MBLY@SRbohY8CF@SqcBgbH6U!p9}0GJfTa&6_s{M+5xyBa*7P%Jv$v!7% zXR!;#%s*mX@+;;pSx$dx+Uby;BbHuNkzgpwT{NqXj>%IgJ6k*`YSTg?l?viiOua+C zpC!aygIVihLQ7UG)n+g_bMb$h)yJ&Z%Kl*6FIr&ABA-=H(dQC89q-sDe_Z~l&P{EY&JD$1X*|$BOyH3VHc(V!{R9@3`Qo_z z`?s$x=vJ#?znIS_?j^>?u!gcKxKz($t}CkNBvyTmj82aHbdFqNSbG8+jqY18(aUW) zrWs>7KR$Lx3yN5INuvmb?PVWLHAxwEFn=zbS03LmIwWZqiz^pWjb0=pW2%Pk2q;ki zyG@IzS6Ka@OT_(K$?e;G>T^HEz5VwY75^Ga90l%x9&UxCYpT_7ukEGts28&gDRyvl ziiTNcgz)O#`G0XUwZ;meDLZp5`m1d@JDmztwSyyt+QU3Cbkhrk^+rV;GiTXr4FN!= zmsP6aco7t|D;*o6rt71O#|$-^hwJ9EMznBmr}-Hq6j^Pjm+Z8usadsBtIp*`8Lh=> zmD&>wr&Rn`K_3m#@h{%;8xc?xP$;I1ky*|N_LW{9A*k|5VXGom4?Eg3RQ=q@x2CvI zFh=tGB@4^otrtT&%TeuT7275+aYE>MUrLE#Yn*6(2Sq6GCwna<;>X#zE@=%PJF-QY z*lSNrkd|F@%U?7PX0_H^J?6K8KjU2~R_P&7l~`V$#o5J~SE8_0CqG+LH+G;b%tkr# z37g;B)!t(U{D0yTI4C+P?jCC(`1AD2zWb8rZgB`WCx4dsVxe0z_HvScJhuIETWVI5 zMQV7=plxi1$9mf(_a&1goQiGi++)V_%M7*7-`PUhG~_Gk9uyd?FjZzMDQc>_br^dA z2g~vG&Emp4#vY+5Qj1v8OIlt2W0wmSiZ2%s2fk2GLIGZ64rcmC33M(sBg|4xK;xOF zZSA;Jtqf2}Ry!0ecf=RAtWSPjb^S0ll20#PY^z&1)7hhAV7{B(C}YfYX0G`r zPdu9!Z8JCp!`Pe@;#e4N>3d3|dI6w7Upy$nycsiUldeo38ng58m*~_OooAp+@UMCqq zEfW-9CWyhAedIr4_7|Kr3c?FNX8ZAnwGu9p0v%*rLqb5b0UDYmcu=*uIwB%K3%KpATv1vW;F2euL5i@;f$fw%k(zoRtNHO_;$jbGs< z|H%9C^PHqoV3jYc`Hq>G21BvB$2K zns2p(;4GcaQsX|pg5;e+wS<9@o>TBLgy!&l5mZ^+G4^Kckl@_ul)r^LuS|i6h`)V!BB&bKIw#}ngD zKX0K=sdC^m&a;4g>dB&k+C)8ew-5er^Ozh{b>j`Lp5f_f-IS`mmzY~v5Judc z2Zp*e_hq%q=19Kw6kAK{a8F(__59{Wo^3g`bJVoe__)4~&wI9od{%oslSX%s> zh8%j6Jvm#GpK@vv*iw6=>|!?+3I831Jy{nSyn?Fr+k@)`YhiYKv-_@IQu!Z=0l;>f z*kd`Q)ugK|rw^s_0fzNxJvtjT{%+6j{b`?|PR+qw?_$I?SPj~?$cb-!6ta~;=sfq_7WW8ngyn&BKYvUp{wU%l^V zuq+s}JNMnwCsB84T5gJM`=H%ifXl#Gr|Rh8M(o$^dDon1`$Tb5J2{K0%77QEK@@Gv zTT0f7ZPlxSkJnzYw=Tsbr$AlHkv*EwFuhRKofUtn{w$mXEBCrnWXWE+fAWc9et~Bh&X=b;|R1jr=m0xokB;g%| zmP?Sy;G;92)g9<0nGB%6RpAZc?Smb~l6~`Z`GERms%ya?0wJIhcf`Fl|@A^&@U0wV7{Y5&+a z>`BT?JQv-P4jqRxg@MVX1HtFCzeyo?`O$=;oS3g|B=MI`l#}?q%6KXOQU}9|Cgw;5 z2!OS72YCzJzX#TeF!en4KcoFWilvCD0INw=V0I{vX|7Dbr?Rf0o}+5T|kA)xSrTH z`?XSm6H`u4KzlLp1h(FU==$xT+(VQX8)L~BoT_CsDkx7a|xzbhCzgGsGfDCuu9iXh>`exz(;Q26%v7aPdjlg&QnSJr4(g#K+<4Vq}IU`R

x8{NnWPn;3HU{pe7-_|lYF$~v+Ni%PJ_!fbMESQvQ z4h=;A!^U%79A2?=#_${d``*b@$sJzPgOBiPoFTM1`>#~?3A(*q+$L>i{*0a5}^JXR2unp z1Q9xkQV{;Fgr^r67c}wt-NgP7jA9m#M*aa(n?VW!f&oBq^v#C|MaF3{id>{OZwH}K zfe0y|3!>w=@g^q{5faV>p^Ne)5%DBVLadQrwBJ|w`t&a@a|ZY0L0|zc>&u%ifLZIQ zD$1fjfAU+L3oZ21^Gj&d5p!691Ts<(M%oah_A9`Nh-3h%)2eucelpsP{OEXibe7BL zxa0~3sU#9;=fKDRU<{}qMaOj`tVk2d-)>Ce>mOhq|02xne37!GoLGeEfccf?*>766 z-yk)v3_?@gHDF{;AieNMR$QVJe!obnkO26uy~m~sK{R;~`V;>~QVXy) z6E<$a6b-yePUyb6fv5y!6;!rv5oW~#!9X4bq5Ca@0pU}axnu-o?-TjkS>D0edmqbB zX+SB?fkxVMQ4lDbk@jCnWrhI8EY!11PEd;@Y@qc=T+bTL=@MjDk#bJi7byipu#>M5 zp|T;B5d)MGWI%Z7`B5~AokSTfaza@CR|J||FmZ{iaOX0-LFijEhz`hRqZFiY`fh+o zB?^>k@Zm=q0iD7=Now>5m4bP+I1&wjl0aSkjIe%~BFe(K2$pP9!$y8RP63$3Wb%T3 zDJFEW265owxC8pqleE z!*vPF@PWO|l|MwvkC`0!CU6}=TOH_>w_J=g1S2^tsboN-Y4epMFvlhEQ(ls=P;Epo z=SPE~AjyI69TbMb6InWG(PAhF2)keBpgg5?!s!#zz6BuTBBJ@@Lim-%gb_(@5cmVo z&9*6W;1QE9SmB(840 zNJ$XQ4kuxu;a(7$Gmg~y0wn>HheOyIaGv=)1OhV}OnMVC5&R!irW2xd3A>%YNV*Fq zbvz2zlKo0345b%>1i)1jbO^KMM)Fghc?}z<2B{!)1ws24v!OzMO9iFGYnW&NV2-ZyL z|6q;reJ13AAj_h~q|=ai!34Z;6R-v%r4@gqlv06V{TC$wozstst13Y+H;6RyYm+3W z{3Irw!_0_eYd+umGt|a=1Z`}876<8;pyhZIQlaM4EfnUju#>@vc7MqEo5@i}upba8 zODPEIud9DqX<)uFe<6a;qVQ)NO1s&D3D5|FEKLQ4IjJnpMN+yVXw>D;umTD6BPa0F zQon?_h~?{Y?P!LR=|>AC^x;JHh+OvW$YUH4xSBCOgTJOO>ZUgFNzrA_K_aH6?;v zpncRU%zjz(cdlnJiP`aME>I&f{!}p&q zH2Jt7u$-~+7%zB+zJZ!Y7Sw@douLz(YRBHGABC5Xfzb|S1&fkk|)Uw5*VxP%^YQoEq1W zy`Kb6bt7{$0B1z$xPMVS*6){X=+7wl%OnvS*I{8Tl9&bRX{+q%{hP9MDi|>x{br+n zq6Xi51<7$HTv@JOUeHx?z4zbT=E~aGHt~0C>w@?B4ODcY^5E9W>YXYuM&rZX`(jzq z;KGI%on2jhp!Ipb4GnK__mXx1axCEf`W_F|%goG-b){i;bQK>au}f;#4sUp+uc=9% z=zH+_F?BCgxb@1FE4|)_C|#b6Y-D{nzVH4_XtRE$r_5JetsitfZsO2<)`NaX;u0% zr+YFK3Z|UniMY+FZ{S8!(alsy2FL;>Ye4DX!7D+-xM@&6HW}@?S5;H9_;Ux`k1~(f zFYL9!S8YuW*u-cmiH`l1rX6u!S{1t46dWomnD|Ccb8yUoJ1SwM&nMRa|UQs$6c(6T*?GK-!L( zb)nQQpMw?u?ae`)-(K^%@s+*p+}8C2aT|x9Mn6|R@b#_Tj|W#81ypQdIW@8hzHrbLN`pjVo3?R_AgK6r~S_)cU|>T6R3RqlZoO{z&khYu;Q{DKjOz%H?>AIcm6e+(d85@It>i#K4tSCm(kE4pd==>Gr*Fse)=h$|*~+`9#KLlDGm zpnuT}f;hmR?9iXPz(+&FL2d{N>NL1`?)rm?)oG7c88^a2x1>JY>E0#y>GUC$CvJ-8 zk0+NW>+Iz^YkWHVh=P5a%oi7xO7qtz_&?=vXuf)QU`#DxC6LevVEj?E&wOIV*T)c zF09t(5z!nArmfYEZif;x0||EnqsX&J40$G)V8A-HyqcrMt#*2(aUsqyF@)(oU%!-z z*P^Xf@ufg@wDrbd)|qq6TOaP96#jbQ8)?)|R8wknK2}eJpJG*yVJJ(bd!8q}eJLlf zz1_2v=|AC&X6NMDYwIyYTMYh8?DD~RjoJioiv$yURD%y&d$yjD;{9i=Hzi=6btc5K z;yFLkR6Q~YI{Aa4Yc-=h>a?B{ST!@YxrA#bDa_PR+9t_=b*z7~&TBqf+%A*+_a6CQ za+vK6%4oMwDuLXqLHGhEf8;Y=)uR6zBvv4q49e(4z0Xnz+Xa@GblB#S`Jfc{Odfaj zeEx^Moq?ga5cSR&ZR+xzt4PR?R!ZRtKgCok7(Y_-n8&Nx5u2&?xD!95(GW1@)iKvR zY8&jZot2h3DWnXqL?Hi;T5h?AWhFlxq__dR0z z3t9vWYaHF!nlakq5_+Rc`f#Ww+)lAo?Dvv+4soG;?TJB4={~*oAL}FUC-H0o;m$Vx z8ZhJ(9*KPGB%zrxFx?oiPyLg*T_|b$Pygoi;;LSO$VW?fqH?{w@MfBOgYyrj1V`7# z!${Oput7ehiP$S>6kHZyP1IV%Zv+{rECe?%Cf?dLYw9k)>9gb)pI}kKp`*?;xVYd{ zVmgSeM8z$fHDj}RIzC8%`=fyq|D$f9&XOCQ^y2i zrsQVzX2fgt+&0J?-SXs-l3TTN&7U@*0=u-uRoIoc4EoX%Yw->@*%B!viSu#7fhJ*j z64&DT#y+@BJ|g!JjvB)L)fyRCUwWpk2)5H##PpeR4q?SU2B#ziyF!@Do44auMN7xV zZqG++xHHr&bzhCc!2kMxIkIJIqZ#_OhDw;2wl&xlQ!yE*eW;J~F>viI%Yi_wk9XtD zL(v*eozU^~x-|SC%||w_u3$E4b}-gaPM>8b`p{l=LQ3LH6UL|rZp|h(IEZ&8RcVUZ z#hbYB53`O4Pc*rQ#y9c?Y6>%Dxb)4AW-M)N4_}6ge~Cbdz>9&?5@#+e%;_6K1C%lk z9Sf$`P(1IBdCL?Mlbq=(;dZkj@)^CwvZfu4Ge3((my-PGftoq}1{^~gxdtZ^=5ahp z&s7aQUguUv#`lw!n z^v=-7?lIMD?+%7=q1trwn)9nHb&CeC8ZR{#56c5Zbga^aV-57Gi;38^`+Z5hK_fX! zHJ8sHjd&!%=f5_g?7g5>wX5=|o#U~0is@y>dYJo zv;E0}u=0gYBh&zwsS~=nw@CsTc!=!`Q>T*Vw-n+sV{svF#OE#EGIq@>gS5;9h(F6#3Z;nebDW6~r?LS7VYS_xI3< zsffgLVWrgLFBVBSIHBOgsAGjVZ+!K=%)S2_<#jOJmr;4OXEv%FRQ|5;&+OngxZ|+v zQ$=(1Z*$Ob;)4+EAE_ejZZEz(>Wq8-THpR3{qR*E2rQL1zjw{S`9dgv`0w*kzY&~; z*gC(#NN4ACvHx!nZ;uO|tPP!HDz1)kd5vxDL4K8QD*Fi3u}@O*b-z3KW4UP$?dL4j ztJ08#E7N|Ka0bT3{W$m=>brW2_OmDKOT%BRFE$#qpZWB<_FV780l2y=n8f_%Ts+~yTqFI;5@ zU!V*h7dX%L+0@OfMQD7VeTE_H=(Lv;Tzj;RK@|~JrSLrFN$t*Saf`ffL z{GYMwjC?sFUT(cZkbZVX608yGv;QSHgZ5)KCsv$2%ab2G#NIn&I%ePd`V3~wCnu^` zRX59U;+Gb}nkHj7Z!VJ*_SiRevzSS|xa+3fN=N)~m+)fJXh>nI#`!g)2Kg5VNmLt*RE`(e|w;PjU3w^UbA`9yeW55@cA+)UX0A9!#W^*X=| zo>}%i?^~AEcfw-BSF%^L-5&5mar*s_Nz+>xiyq@oSsVuEn{Je>DX{c%`JG=IkG~3S zQvKnqougz(ed?s(oCHP={AAI*y1{gT+pcz`@NI`4H}Eo5PI_0@TgDo0;_)=RmUWNY zuiBhTvjK@55|**!P(D=|=uOMF57&LfS5j`m2M4ll-%_r%YrTmvVcl=}%k6w-TAPH< zBm$1=p#C&ldrG6ukTFa?GEN^7xyP2RuZ3Mx!JlI5Pth4_@(dC=yjhCD*DVe zvs%42HI4LxbP~hEx}c$lVLkK12o@!qVHH=~hxw55BRuCx2H{(O+DAPx?q z4%HW@3J#le%syvs@WIM1v*dNUaAcnbZKWy9rh}Pmt=tqHAzR8iIo|#P+`Z&`bY1sy zO)UPkF-J(fC}H!i6Fhpyax7fc2G)J(TiK}^6YC*K4#NvWDEZBK9k}*jOuP-i{+njH zq{`?3r<~hJJLTGVa%OS6I$J2J*v0`nEj+?4m@3aLn4wz4 z-hRpu7MC9CYGHcIA2x_+E0^^T5r@6vXf0|}nK~%P2jw_$oE&^Wa8{B-#5|PPu55<8 z_Sp#?hYfMZ-<>We+L>67SsHwSeAeoy6-6;Od?F^}tp!jkez@{;S>g1IVe8}kV!fg& zM-+R05nq$&Zl1T{nMWACaYI^zlCW^cqWW=Iu1QkoAIawt3!TrP{rs|Bu|8$jeIi;T zw*_TgvhMFse&=q2c%ZAbZ|I!~rWFAt^C%8awcCt5f%&CyCrIjy-)3~HM`l#GkM&`V z$|^k`KjFEOgt#zHc19b*`eZf2qiB=Ls}J9#Z&Wy0s3t4SxQ*i%zq+_nJ@R0;24Eix z+prH+-`689LcTfzBzc!9_Ti~rUf?ox8ToE-jpt$K1||(_gt~tuIafr@_DiRz=kyOi z*bYECoar__Q5#MiX9Yjmti~Ckh4?=J?SjQgiYdx*K{~;L{#jo9_U{oAQaS2ab05LK z5qIn2Z4L>jkmj3j9}~OwP~OMD9w&J_}tK*dod!&43R+0(*IIH6<7cRS@6BBfiET5;_dWF=h{$g>xY zg)9)`)+-80Fsn%lg?O7yr;RHDih%AFefeH-RIKHcMx$t1!`{AAg5lh`kJTCFIw{;l zcV*Sap4bn4B9<>w5n3IMe?dh>uH5fJJku>3GyD)h|HUsvXw`H$()x=&5k-h&9Pmwy zxlc}7%5lnD{I@ePveYr@wgyH?*!Bzjw~9k>|MHQrz_*)Yh4i{Nse+v=yj1~^MO@_b zFvqdw?p^mxRkV$~x5vMnUKKDFM5Ocz(ziBF7ycn+seVPCTjPdPgHUyK=(P!X65U2& zGFPIWhi6g;^0fFYkTvm*fMJ|Vw%nV-8|sDVlA1OX2uwK?__!OUC)o{~5%!OZJUyW7 zyl>mz?$XCb{wB~?zmnZ+EgJ6A%d6t}W%rpombO$}=5HuV zO*6PVf2(2jZx{D^oe6_+p(?iy%_XI@TXX@~ODuZH~i&mp?h|{@Vm;1#`Z;2#hChb)A)C@ zJ}-V7toCI!P2padZf2}~!UA=``=mD?sQfuGAb?H7L?{}J3((5)Dz3wh1*Vd@0r)5 z%POxwbMN-9mXZM658um0we2nbu6xmG+iJOB+fAyK^vPu-#+L2SDaC-yLLmdgfW<0j zCuOyW(u5k$Z7Zmu+tJXM;-SG+nr5^6UX8DA|) zzWmE|RW@v>^^_-CkQ~0lFYMr5Qu_~&bI)(YU^IQG$ZHD|&fnY8=-e-BB2^O_DuNK_ zC!B84PeBdwkcH|t3iEf_ohBq_8Dm!T`N8N=kEU5#(UMIct$&Xkj^3Xo;%gj!)%g30 zc!6}HuzAP=btZ%P?da%voBkVB^an)(%rJ<-1F2sxbj;z`V>k~5D1?2>FI_`?{6#54 z&j;NbDw0+|Vz6ox^l2D9``}I){!Qufdzpj6}To!qF%qK*GIPc{$6(;UA;n40^Xm zg9z?L>G)ub+ub0K4v5WH4ECxD;bapQMU}f0P4kgR)aboA^6sWLYZaC8l7Ro`gyH5@GsiT} za!%Fs6_}epSJ*T6ai7~NecjyFM{DSykOmkrN|(Oy(R6#L=COE-^`598zo#dD`efA= zlF1(kzOq9HZK_%&LAc>1#GY*95EHPXjBDJFtYfatkV6PuXrNhyo#pv>REo_(1;tW? z=lJ*agCMT(x$C}{kYem$;j?NKlkwl!VopqcvuXE(DWc zDPQC~^Zt)q)=l&#P7HaWa4&dLyttqVH=z!QssonkVmh*468(P`N=6`njuS`6g!sM$ zx^VhAd&|(xg@A@t0g}!0`|CAJ6#DN8%Lu4RN_4;)z|+>+bG{$ZK_!|m0CPH~!e}{( zW@+HR=cP#g$~kPk00dJlSaV}%SRTRiLw-9;-gYVO3H$-hc}L96Z%TIexmVqNU}^{{ z;eyk8$E*bc?tJ&8bGS3TDr`?5Op}z9b0zEbmw`X&6W*@UVxC!#BedS4z zj?J6QE8x!6f=Pd$K|!)*ovd^J`#2c-_4oQvh_pXpX1a0h!{qmQkQ)=23YcqwMR~Ix zx9jJxLDM1tz7~SfFphim<7b-kC4mtcx{rB`SLOy#SMv8UjIEJ$5_-@?qog*F_#Nb9 z(fPOKU?`53?7_0kS5S5%DcTUqKIZg-7mA>Ug2ZE($9#Jfnnu9bwOO-4T&Qzw_Sdyy zC0eEfW=qlyp+0x;tXGhIDjyW_Qm)}%-?BV&w&Jdy2c1eHVvTd)29Nkm&b|rgRa^R% z8M-;%O2=xEr|jQ(G8y#8llAbNCuJB$5TQ%DY*lNcQ=CZn339M|MY=Hpn*yY2Y1pee zkW4-_#HTv#JNTCL(b6eH+0L}-$KQMQ;39?ub2ICxxFSx&yhy()2YvR`?Yd!kxk-z%&g7ee8yF%teM@wzc zAkkM!-kkK<=k77vj1Fl1F47)O^nGj-6Ea_s3R|3)p8CWL4E{FbQMtailw-^s}YU9!v zyAGSZB^T=J>`I73b!jB-b$IB?M=6CkJEUf8I8uEJ;o_-FRB%bE`I~fr>4zWT)}?rB zL~Z--R$5iYrEGKPRAuTrF+52ZbvM#T7kN>+nVq{Hr5t<}bPQWE%4ZoPzXt=6umidE?@Ji?oWJdIDG~keAtLqV!9|_cFkioKQ@c- zhT)fc&9g%|V6WpoiT=~vjnBavKjmmK!$kz4%M*f*<&3KM6J z99X5M%fC>n=jkd;40bw}o0h&W^D6qV?StDc0wmVy1;Fl; zfB5GB;I*=i6^EVfzZRS?EAhL0W8~S`KMO-$KFF%_pg2&#UZd3hTeSDafYFx%0FoLy z2y%)A0DUZujNikrHxfjO8_^)|e{*eWO^7Rb{^QOh?AXLeAL-;-c!8An#jGHJalM{< z#ZVm3U>r1tK{D-Y*QCpuDg!3nYDpmLKBBQ+Hy^|*fxKT`xanI#Bwwz-;7Tfy`h zFiT*N`*2a)c3MYaEie9+ijgmy7&ir9h6!s84c=T`DY3&elNmHZTBofXdsZww%4J2((pIYn19yt__5 z9@PX@mR&JR3<(j1p1LNxnZ}-_hdU<1vPz-SOnrVigO5Xe^`Uh^$GE~Z%PdVbfAw7; zk}ftk+nT%qv3V}l1>Ey*@$CHrS)c$mQS zN?-nkR~;gO3$d*y>;={>`O?dJRv#*yN}dc{3$an(lb_)~5z=uqYBR|$EYMSf5WEBQ zS-SMaBs=W~Q4#_GJc7A{0eAWI02kp~Y`BCT;&GZmoe5mZpai}BqW*rAFVGzq!O}8Mjo|$W9jwwBtGEa7m?8q4-R?DAw;MaIj)%`# z6V3wKMaW>+g6rT{d2Z%ZZ^12rwFsr}s_s)~XUpLLdJi?(3M}&1bTg|8?fF-VR9A_% z&gDsE2G4HKHitfD=EwhB&WY*8*r~%PA`|Mv7Hp^wQV@=GQGJGWSHp1=J?+|S?S}Qn zPVfw}nW;mfsbYl%FcL}6`6yM9ip);(D+e8hu~zJ;EFnq#)a(U=Q!JI1U1aftG~u>j zD>hIbDDFY0y3z+*dhc0pvYp5v_~O#83T!SiC2{23qglH`t8QmSw-s=I+(0kT6{hPb zVQv{S(lDJ#KB!PCm8))uZ)HyEiE1?g*aMVeIbZkd|Q6N{I%-jwQq6z0Kt zjur)hP5#fO7n%Z*0wd1VN&FB=*H4`dA-rA?9;*J6Kco9kd*@D7!A<^Q*XUJ*ji;@~ z=V#OdcTbuW8WdDI^FbcoMDCn1H)Kr9b1h%4sRQ<1-Ufx}xqDAy}%7x{;W zQ{Pv4@c@J<>i+T#|H)pap|@BXQ#s~qjtNYkS4t$f8rT*N(d zE(Lnb=h_Z}4b=`vp`Qzt-h&3*;9QPc?5=>`@!kWs3@KEJJ>E)V1vH|%8bg|URfzO@ z)JRHvGwE)Jd;Q`eE@LXa);h<)0CF+Uj2Vn-SS1cu0H}~jVC5x|iT-J&WDjMR$ zYSUKdfY;5d`#*XiiV2|Dyxbw zl6cMwOsxD`Vsi2b9ceP5(?5930)%Y~jp6S%71x?|bso!)k6mbO4yElPtLAU#5o1l- zVr_4+cymsfl!7r_m>HxMyJ6LQoSZLWz~%);#?P@*F69MGlmX1T^UJ#-Nxk<{m(Sl; z10JKpxfrbaKf0Qy1S?6LYIo9_dL4!T}7O{g3$ zmQomo1Cgfj_@fy|YB;iiS?~Jpst|{n3OYu690^8s=N!Pddk0u?=+x?wnL%DKFNE^y zpuS1l*{gYkXxvy*xZk=w_sS<;$T@OUaCOliJjw5qbCbMEF8K+c$q@;Ojheu$kkC9f zRe~w!+wnTA{+-O)sh%ztQ?anpimiN&*47>7>)|060Fx&GX-%FSMPMFMjowJG>xFt4 zXunHO8a+k2=qMJx?Z6U^0k9~^1=*pNob%? zPW%_*qc-<1>hrK;c<(Bc2SenLRgg=fa&Xr;r;m*UE{8F{`GY#sU0csEig=- z1d1hXp=CKLdy4~7ohj1nHuI z2%zMo%eaWjt8DUSp%^ITG#j6&uF&zvTGO&gZ}PkR`dmWa3Y9KS);(A9JTsok^*}R zB>o1d;CK+I1S_042&7VL>;qH-gzGv1r@Vs!_R7@XhM$bxMUz2ADm_3fqs5{Og!x zxKJND%o$tg8FI!JNbKd<+8pH(G{yXqLKEN=PU}5>mz;1A2){2iTW^9q#$f?cf%Fqr zq$BtAH*?FmDzAjQYW^o{Izu=AxKjA`Dx6Y5O9@3IL%N00(q)uodo`5nTUP1=1WeL! z?@)p$5*Ix~v7&EumXSzLvJ&jq( zz&i`JM>WE}9uB_6{MtK1K$84MFWNlhfKV@lqJrLBjcGXlr{5nhf75RPQv5-?t$`{u zlF~W6yt7TbXHPBHc!>p&P?Uu``)V zWU|Nu-&%YQYv^dKc6AY%li7j9(Z@a|Z8DZk_wgjMC8%Hc?Qz{$9#;u>D+|(Rhcit( zn4je_A)P*}d$PgR$)!h>zh$A%Uk)vwzZOtuvXiQr|4*t$T|s(ITy*-|?<}K)LKiE$ zH@;#AV%CC^-PyA_qX{9k#LNEx>FM%~W^T%RyCdUcHY?v5GB>C(W)9LPs{;DMl z>nreZ+n$ng$7%f<%e=6TVa!kN5@)`Q+B>4LTYx0sgL|>5r%q92tZrUd$9f@=%=p^K z;ytC*6hYa2X6B${gY~p#V|<97F;O-Lne#S`5s<06CJgzZ8s7HghYodbeC?ta=x=z| z+vSu(Kq)~6=j!Z0rvVI3uP9+@hgDrKb3nS()>p-}>q9OaWGGMnC+lNzejDTz1y>oE zgageooM+AS-p)8%bm3iwasajI><`UiuH`5Fn!?nEE_KF3x=#^+Vmv+z8C|>Nz7L9` zj(oDgQ1uDD$e(?2x?D*UT>9Hp*eUqg%bq6vr&DrkpHB+w(MTAI26p8O$P-8X zk4C$GE6WUMeRPuA9g%*>Qzqka2;D=oB7m{E?z9=D`REGk9s_!_$X}0M9+H?yj9=&; zb()QSy=7b3WM9v99=Pb58Q`d|gQTA6_FhzwL`3=6`qyrLw=d)Kq$e%j`Jx~v=jQh* z3f>sns+)FFRgY$6nHhgg^X6My{qdeSc2aS}BXRE?H0FhhG%nW-;D1z=KFHPO!3*+@ zXzb^|syQO@SXaxfOxm5g6tFK2vFPvr6P~z{t}xtw5g=%h!#@am40ih4av5^V)Wda} zOy9}=g1md9eS3?9h-x0s74u?;1>fi(Z&`%BWWYMMlwQbpljwAsPsir=eomB}`2q_< zvg-7o!No%(kmbZIlE!}KQf0HYE0HLWGqUWIQxSRjdncwCkD;~dab}Q)87bNu{jz&> z<%nqG^XGNg&1@>-gg1sQcE?+?1A5TKi~%e-r3vTco-Ute`TcJD!-n&XUa)^qH7D$t zU}_ev)=ogFiO5`3YN={}Ft{&E`QF&l>{O{~H~i-XLC!`BNcS+Ed=(;4H4J_vs9)HW zpZw|)A{*st7AdSsZdfG2_=FpiB)+P^JhAlQ^9bKGjRFr>i>3i$*e%mZZ2| z&BO5cmxJRL_?(XetyEf86QY$|akE=w2q@-v-86%Q*OO|LZ!DAgQQI&O>>Vla)9!LU z?H-6JGEW%tnVE)wly=W3ABAEjA98R0^W)LiAowsk{oft~6>&*bFP`(uRAedexZQaUrgpSh4^XL~x7@(j6<{zpz!yl1tYW$G38rQlMmLtlYY zF7AaynwdK;WBzK+S66<}o@U{q70a!WM*2uOY@=Xt==!E?r)%h@9r7yhLcf8T3pM=Q zs8)7xE{&V!t3RNIy*>|0FkO#&y?l&4bxCQi1dtdkp@usE!q`?mMo!>4r>oNu>ZWka zQuKAtao3c>E2c+;*3=PxI%NC{YGmTJtg_y(fDl}C1tT=ynhBs-#OH0ft?Bk$VZQK( z%ue3)tE7(wWLEf9{@V`%I+bFgv+_|zaFayBIKRthj}H$EG&v@mqL~=J{goFYMUe-} zvBjuQ&H2M)efO0|5K>345Sk<`%ZENbRnHFgyF`56ZRAnLoHjjgCY^t0h>tHga~Ao9 z3l-!oZxAJlS?xlM^1YOV;B>A6omeCE6xWVV%Ums3yPFrbMtl+I@vOuPF z+3{HIAb;oerS}ykXNBKH{w3%4-dFeJXb=*WgDxfIeDQX}<-8#+JXFu7`(4`XE=bDp zb?m69SoHpu5C7m7)xZ@=2^1 zu>H_Vd5p_-5MPt#(Uq3A;{|1El}WMKlzkqyKdkC))Z0?l?L_H9!w1e<59NP#x>&>g z8C6-@n7P%dEQ8N@M(X|aI`*A`za`w{{d8C%=%8#khMX-zpP8-DWz2Nh3Ki9ucbYlv zMr6e}egkaG=ljPyhR}rBx+GLBXddyKB#6Vx^RCW5@hIe`-A5(q1~mJ(ku&P-eH-f^ z2dYyL)f&w2{wa*~4D{ev?3#?)R<~mQJ{302)GTq@!Qx>Px@%v->`2TW!HCwEuC=Ns z5{pia286C{I)w{wf7=X8w`oMX58z)Ulm%7FBI+|cZ$)wFjI)bzmEA3ricWy^$IG&g z9|M%MMvyKH6u^8gZq~fuDg?TC$_MGzo*+|j#As~ zu9|~P(R$SpU43oKTh+X~;M=>HzvXhSBHiI8rPE<=tsY$doY+1ugH?{=VYIc;4mC1L z3Z!vJrol*wzZAuj^f7iuLow!1kyI+7KRq{rS`>w_VatwZIV11i^%V)|rt*M6sYmbd zaHq^u6-K(=cyeRCX#R*hq2!R<(a!si{H|Gt6Ny=%x8VR?xMtFvTZ58OC_QkrH!{^3 z|CiHdYk%*tI4HZs?JpKji{@x~8|#O$^wD<9c=X-ziLl2|KG81g?@WGnk}`gus(aSZ zhC*sqz_m61k&o-e)6Jz;XWwGpy!5-oXji0a_Xy4-^4jina9;+kjyn|%kfXmX)DvrK zlSaBSix+c^ld8$7*7a-gi<%^;@a~FN;ak~q`5GB6{r;)=7A5e*sJoNO$Imup(%ygB zhKhd?iVu9Zs5$r`y^sTPO^@Wr{sbx#QoN9woQFUjU0yl0f$zY>Ett`$uKrteMKs^b!4x0Kkt7Se2uei!7f4EIc;c zLzmr;EiqH9P_#S$D!lTstpjyit7cM4H7+-B9T8P#XD%xgi{+t`PErFIZ8ekmH}{xo zC3iI(%b}2X!gOgKn5AHLbm@^z4^jy1@c{3t@gLM>=`AD9Mit zQXg>t6#!+MAtrdCmFm2<*_s2TUOkxw9&vReuJ5JlW(uuk)8WTQR7wR)lkqXEy-2zqr%4p=? zSS_82=JfL&`*uQ$Yrufm{jGW%GoL69<44iW2X4I-Ad!rT3a6Nqi8Z5cWKHb;F@>Xx z@)`6!uC-htb}GN$#TSBnp2>Uj42uo~v$z{h-#3dd+5JMNTx zOM5|H;675v0g6?Nm7I{Dl;~HLcuC>)!-B#;a~sNk`k5+)&6=vXV@2HbUSBAsjYp|J z2wwAd+&2^>abHe8x$uxk@B=Tu9`Cc?&*qwQ&=Eq;`n5xZ5TUqOyZ1GdS(g_7YaynpEan0yl^bKB%%fk%Vijhruz-`kaICU3o7 zx!GMTVqlTj#VW0;YJ`)kIqVy9=gX%N$@)t-_r!E{7Z4CpmA6FcaG#5u%y5^l>olW0 zQWO)3R;M}`hb<`rwH)^G5cKQ0#vp)33Jf&!Q4D(jqH%QHukl9WMOV5`Qnti~OIa=tUxn(xLc@P() z96xL5_&B+u^^T)88_FNVLPbXhx66F^Z%&2l&P!*|sOz1#1cezXT=zRMR^u1lW#3gH zFRX1A%Hl41xJ-pr#-85tp5Lqwo0iVxfZWbP2PrQqICaRm=iILqE*f%{Xm6yD$ddxX z+Zh1kQ)HPM6`BqRiGH6;YyMrc6k)ohylX;=xj@D!HtK}APzLS&&((uZ{O=BLt+Ho- zI;b`se_&clxjN=OyR~Qq_W2rn&19PTRD^WKNLvOR`!!=|`N!;f++N&UK>_4l!ic*^ zUy4Oy&NL^-PT+A+O*rYQ+BLm>Yjd{4b-Gw3fziavA>Hgzy@D?d^)_V@>jhm7T36%v zl}wd*|BP0$*5vnW?mkWWF9*|bbTBHPeilQD>OHS}Thvu4*~48kD|d1wRrVD|Htj@d z2!AO-?G?{@TNFntPm;43mr<3}5zZak=d;gCZT4gE`_YZ&1y;3;&ZF+)lZ|N!n?ymR z>5@6`F<05o52-Slf&yHR_z@yEGl097fR4mRKJg38@Xxz8s%qBlI~O3BF|fwi+y3qS zNuxjSyKQSJ@SC`7+l;7w|8jz&e9cS*PB6WFst4HF8t7k06xSFCaNE7nHvG5WP_SUF z>Q;^ElWma(?SWM816eOnQ=ugP|b%(bv+0hqbz8pz*reMdW^k8f4 zuN?_otk#KYJ%Li}^);)2kPA7FnGQKQ1&@chrJ|ONYR|xaSV+Q@dlWRXGabxunesIM!YfBExly+6%>#Lw5hV|UTv z1(Hzw+83@>BjMRCTA?XtQ+dC=qk0X(QIBEkwB2B#8`{*|PkGNQF`W>RbSjF81zkFq zX5{d|#p33dS4Z=II4zOW1ckNq-gwnvW)Djh+)dz_N}^j?v{EY=wTvE@uNz5T*h8I> zGE(N{1HW_hr;eECs|(jq1;&cMsv17Id&XHXu4n6Yxh~QPtAz7SBfimQw+EpUZ%QR) zKmcv7TaN2+SY&4Xl(v5@@uqqt=k56ZwNpu%XEZQYXT4J$@K$oK)h5fb^?1F~;t|TVpNVc;xzc(F=E7C%Oj|X<@bGZu0b34=YQv=$l?Qd+r7|pFZIV9-o8QNnN1YN4&p@ zhIrp17-HA87Z}VR-_5N>qht|IwrN0Chr&0~V&53YeiWB$a^zR7 zHBdM==~=^g7nwwvysVT+0Ai4d<#zI+hPxhxmG5OK#^>QNUUk{7fvyfaX4>IjnUhRT z#s`+Xo{Hm{RYG$CnZW~v0=&>p2cN*LqJ!g66p;E9T^U-gK4EC6DMy^$ZnPuNCk}@V z&(?y~D*53J2_rio&_xnCyHi&{DbGx;CTe(mAXb7=RDaw;m#unTPXXt0Eq2-;gk%dl zmD!%OC;lEFZxY*f@8KYL*tlfrQ}1e_9qsKK;}y82E+;K&d5UP>t35dTf%PP_ZM+Th zJ(-wAed78RFtPTJXHa~+`B^_NEItnYCO%sfp2(qNK6;Y5Fbx0daSN=<6K|zV6(LBt zxN{9w-uY}3v;&oYs{qBUgGgg;D=w5lL{A#_p7FQUHmCH`FZxjRDV2<$Uq=$k6jeOT zq5%Z8Bsh9YLO0bUKvbF_xTtH13uDuvm_;9dH+^peG-cdi)45=nf63C!9SB>WV%E&M z#{0|fyk_6P*nrnncTk_)$PGEE2ljbfYdMY*uwqTED++}B%?a|0_fGC0ofs_pO>RZ* z{M)G$hF!7Xe87=Wi=KP4!xO_3OCXqOXb7`PGN^psfOFIdOx}GQ7EMtPB zWsiK*=_7BxFclwFhS8~%@SD0a-Nb?A%lVSrCB8vjbmwG5!Xnr&Eu>VvVHKgEkONj| z;1lSNI@Zk`^fGml$av{X1y`)pfu1x@F4VwP1BWNxV2>~{BmK)?ozD>`pYcLn1JzPc zYL+3`XI!7)eIqkzBeCOJvsrH!ePtCx?A3UTB-SS|Y1ZC*vpJv^T=GsIhv#1IlE`F- z1&P@98|XJTJg&Unb(2vN^EQDtc=WQ<5-2t<+xYfhLbJA9e-gAZjQXw2!bvxzRac7h zLmYh12yg9?tFzYz+kKalHsX-PZEvLRHqmb-aseM_ZOA6e1>=Ii%Gx8elj1D8?=Jcj zQiQlz$^YzQSzTc7^BIJaqHtW$g(7YCIna73>WjlGLST>l+2r1I-5Vo!6KP$~moKYU zClZ5L_F8nq-Arz0v-xC-w>2+x(v-CHn#VAXgS66PdHj|4^~A0P*HO^N^bOcyJAaz$ zO5F)PJ}`A`TIDlc$MGR}Qdg$nVxZ*D#CPW?doQ1tRUA~9bgY3VB?^dY&-*Uk^WHHa z`yf7u)jnje?wx1gcwIqUGUZfC_)P(GXPxN>^HGmah)eTVe4&Giqk^+F;?#Fz)oCS* zQR@+HL+IXpzca8`JfVrr3m#hd_`wxZ-fYlkT^Y~Kb}dXnOATwfq`g=?m9>;79$%R- zYM^%6(t3rXMJa)w3+0ZKLuetpZt%i-u(=9V$FmGiK3nuTnRRK=XC?8LdkWL~JyzsL zJ90pWpKuy~cVF2A22e42!lKzM z&+H}-x&AtHyAUZi9FNsb0^5Uiz&4?rF?Rcdy|>&;YwnlU3v~o`^Fr!!@z(CC!H^P} z%>wTOwy8@%A#xP!IOxb{z^xSOd7+-p6Ws;e@m*d{0#@p>ywI~~tGtlN%X=dm>~>85 z2Y@4hw*b8Ex*ij-a^)AW0*W2QfvS{%&G~@40B^XaxD$E;cmuP!R38g6I9HlOMUl>g*Ah&IM!1DXj6b$iGfHIc!HgYflpvLMQKbC4=}2^il6f<7#38KOi=&vu~!d(y;&3Sb<~z_bGEe2K?8e0S(SW z8AHmTWy;qYC@|<_15PN}yZWyk{;+dDmh*K4ZcZFw#1BGjs2gwwZdm}tpiu^)%W_X= z00a1sH`U`8r845Xp3y#b04$Z_9B~ z{MW!>^Kwdd0|8V3A6Jnpb5aq=GgculQf=22Kp;u~(t$XrZ)Zd-{R9(_1$g*ZIT!Ho z|JUSp1O*oL);|s&h}iob5bpoD(zoC-ti_HrfQayx`=Rs4} zn}2m@H;We>1ua-tqW?48^DM{DqA&aZ8R>~9|IkqV6MFG|;q2LuSrunM{i0ujb}Vo| z8CF5w!F#m1!jH-iA4;8m`RVUYf=T|Rj!P_SIj`n|XzVX$hhF0*R6o2wlwl_`vaaa_ z8ev&%>+G&8w+?2@vO0`Qz-t$P27-S9+47c15C@rn<3-0rUD@U`0%lfNeB#+hD?k5z zLTCF}??5qMt+9RZ_31$xV;}3SDBzVOtn~)(Oxb^4&Fa*S-5R;G*>@+(qWMfg;d8<{ zU-o&MZZ1^^&80z0;CW}H4#nx8ovHy^=yd>K z!f$zy&hGL&$P2}2Zgi#wjG3#)eSAP!Oj`1o^&K=uyG?$uWKH1-izTN)Y<(l)pO4H` z4F*FpiBP96)%O>x$^bfT$?KpCZ3gs7&1igm!WYEqRWph;m7;++g5ca{n(6~sFImY1 zEQ7oW$b$Nj2-6NtK$^gNJcj1#S+89YQ}~+!Xb`Cs!=Sd#gXY@|Q8ad*Mka_(WigjX z8zTI%SS99na--LL`^@@u<(8NKtsy+J8c5ysFvVrp+##K3Lj z=D1UEepVP&?A)tp5A|&lKeX~=3Ev$=@qJ5Fwmjy!_}ZLjJ(x)+b8II+Q$5Qy7f4>k~dM>67+PQbHR<_Ih``U&9E z(5c}Y9{1_n`Pvo5fHh!No+pjfddxm5{I&DK6XP-|Xdt$iNfe0iMGc+=Z-8kw)lu&U z&3trh7e;$*1{!q8hCMs#Ch8siY0G1mBDreQ^+CloR1AMZ$tDX z?A4P?K4@gK`*effV-6ih-XTm!W$~N(Ry*GPfihJhIPgjj%e|z<1A$oUG~cZ>IOcyw zacbj+^L?#a=Dr}&+0BX^Teepw_lZYZe7zMV856E$!c)CGV9)%h1}?D4h=e8jAoJGc zfmY9hjs3j4Q{LP0LKJF~p5<&-NB8q>(5;1dqAmXawD%?cP_F;q*C1NRsZPj}ip0s9 zEt1hnA)>MyC1l?#+su?w=Ll(`Y~!Tt8oLOiQ>K12cHxNjdsux-o0~9*r#BQc1DcysxKC|{dvqAajcafD61vFexqwXDjCa`B3%>7N9=Cx04e8d8cGOX_4g110`9m`InN#dg@|no!NCacu@(XB&eOasMk^i*j`uf7< z8eMl~ZcnHvHnIn?;?Ohn zBNYZ1xYotBxt{%g8>C5T5d9U!XtcplO#h>`VjbvQ*3L&!d*eY;*h~yOn#7>13;kEO zYyTg+ogIxDpx2Y>JNp;bMe+P+w|dqb7NZw#ur9!raT@bPHylMg6XM|@NNxY$dacIw zA8v0yJR$PEY$4vX6;H;_SOjB&uhP5Jd9mYl?!3Om7(&=KHaviL@XEQQ)o`&85<8Jp zIy^_%&X9jt3|k@Q)rogoyEo)~TaY9fVbzsu)ieK}d(HiJkoWh}CIE`|d|b$&*d( zKrfG$GRQBa|2Fqp=#jhw4NV66>jz6X6sWL*~7 z$3VZ5eO*+qg{OuX_Q@iIv@q~+frE1%n%yjV2_^y1ehnd`i++a}w8yINImboVXlszZ zMsmL0kB))j+$3E$8|FmbwZ+maL%fSKv#?C+XL<{s0;554CKE=_%?Z>2R*jM%dr3cP zDx-3*>jf{D@w3`Y#>xPDAA!wylj-!p34zIWOxqPfZ>-ZBsu{~an_YfRSKmz056AMC zc%2AoSUXA@T@NUEI09q)5Znwsfny@4AH zC5%q1aZ(=EoYs;nTey~New4NWFTHL)Dd6M%4ouH}% zN1xu(t5!_@9pYrX;t5?$qsu9F>q1fd!)p&bS__}dm!I1Tth6;~FazS-MK#m)PZ*PV zUmO~(P%7?{&}aouU;vr?J(z{VpyR%5)a=XSqUR^@qZ}j~`>pk$zxnI~QrO(8;|mqo zPD?A!^~%S&zJ8&wn1D+O0vT!_9)!wbFp{ovQ86#=++nbJTzlt^KTR@pIWWiI{?%XS z3Uo5|a4(2NT)>hcl?1onrZLj?j6H+D;P$l?B3Yxhk_MNvCr1`I($6OehUIn-+V`UJ zd#N3n(Ht{$JT10QTdt?2%KcGVcZrw;lDBzXS$E;&p3OZD-j0_ak&O1A;odKhG|<{` zsrz&M8N)vQtn8NGGBt~7$q$Td6gPw$`6{}vCJN+rq`G6n25pdt^?}r%1p#LB*Ao36 zlrZFkpGtg%sYw4fzmLefoN^%zYMr8{4YnKbr9FCj+?gburThmx+;-3q8sY$T8jPR! z39cqGg$5KQ<{mwMM9kJW<^Xd`K`mzqhUhuClkO(7uyS9~waxKHrqR}&UTTv-??raO zKj65JXon*|Y7f>jW;8LQKJ=f| z(sur7d@Z9pI)Cpc|e=K@h76bsJrX&7jMp|n`WrQ zpD_<2tyDCrbimmbi)HM_X1_b^-=21+!FfMFyNav31i6 zqd1~m(IzCtSh15~n~780>zYK48mF4|aXakQjW2Z3dun%|oFTowuuEU-faSWHfODgF z?w#zqRxoS!9CeP8zT{FYRilEsw>O4XEc$jDgH1|!< zPeOaO8rE}2eB!>^wK)^&Ufht?NaZ8fTDkD25lMdSwoHuDp+x~+B=u484H_kz(?M=n zMM~2NHm(>7-85A2LHBdA`ui{0p`&~5twWBXY=piJmT*pKZEb9iZ9X^B#|=4;0_*h4 z!=9Y5U#zy5FfGmSt%!#qz-f_iCTTz>gN>3_OrkDhOi#L_?T zJb38J;Z&}{nd4~rMDibv84822-(=Tde(mImG(=0`No7TbkGvRuO1g-zxaTO~}OEMSGYdVZhr?Z09%Mz#lI`l~?`77p* zB>rgbiO`~)$KkNh@M8O%G0CRj!d%t9P%?qoF*GMYxvl|t9BxOszZ)yWCeh}(fl+0B zcDXUAe*>M51l$N&YRo$Lo+u24pNL~x6h4Yuyl#}i!+=1lqRRT?LtdDIIKq2=Mr?#> z2r0Hw`&6p0#i4XQSpdkE2=vOF^!vCew$3{MNI-_M`)M|*qX-n14>J@MK#j_^YR?b+ zZM(@a43_Gq;TLXR;ZGkQ=#NQcxuHO`bu>GK;sm}3O=iObolP~(uUW6Ib5#qk$r0qT zIsJ07p1O7({z9iJr7`y-=?!r^(6iZ&zwNy5OGr875cpDms{X6!)54`7(glEbve}0M zHP#gwl1gX3@cjn#ES$jjBE*Q_nR|O;KDykSn7e!8tj_It0A_x3|= zg@P&oUs70|Ag0zgYz9ovPwVo2&HhBkm13ko4H9!0;Fe53nD^;#!2hk7m(#cf&&)12 zqTjRYGk!zcq-167zl zl&{T&QUV17c+P9ZLoz*cIAJvg{gCDZ62(mi!IvQK3c2DBn7DWhhbIj-`}(3wmjk&V zuMk(;^l5dMPxhaBHo!e|8*8o{Y^u6zW@+BvuKOZg}y6NhH zP{V?I?a8cOo7Z8h`3sy2XvLh5I1_Zr!A7{x6t4451eDyJT=AVz31xYxYZhW~RZ8@c z8`uGh*J#ysr4%ohi8py~dH$&_VVdl$KKX#JjP95YDaEkM9OJkBPtW?i{Tg`no8z(R zl9wWEkFxG+_Ufm}!NKboWIS2>>w&%hJxC~7gU+m~qu!C238*INRw@~y*vx!YNeh98 zyid3L_@k?}rtZhzI%+=~g`L__?R5$!2MA;9OfC#rpT5r_b;L}wu3ujc+(*Ic^FsG zYz0Fiv7n*jro`L&XyRUApBHBLr@uR#3~WQWCT;bX7D3o;B&BOE7nd{m!)Sel1 z(7Q?7vy)x%(r=ui>Wj!Vt)F_7mIC+Q@bO2$B%~0`gd#FHVgVC%Aab&?A{!F?pn!J$ z8t#V#D>+=LX6x20+B)Y$^Zrxca(G|>0aBT;|DXc74EbuBtAttw7p>=U;Q2WCOF+z; z?jRQxpGTQyLEi%Pg{w#rt}IlE;@V{Rn;sR(MIm@Rnu@dw@V@Yv7`W5GtD>q1SsKB;Zm6((k#~lbb8}$A*KDnp z0RM*d*7O3i`m+&Hix zPt3eS>+*SWGTGMDX`Zkij7|U$n$0tMSknh<~fo1iaix73KWm;fk(z@o3!go%^PaH;)vYx@&ODKuu2e;FeDjk+*Jf@vU3O z{v`R2qLHkrY-#VMO&eU>Pl_qXNQ)elF*0y&wk)_5q2`))>Y>cWjqELGEc!Z@8aA`= zWu&t_crkePFjOwY`3SRhbDR~}!T%slN?Y6=T>y*Kl26x4x-mS)wbtk$WXm1U?{BeCv46t9*f7di5>zTH8i=UfFv6-SiV9 zd)!V*{HYE3yW$GK$E(-*IYwi1BlQYA$2*_>xGzf2|Kg>By|5#3#}%@q&gx4wYCvg` z1kH4pa(OPeDPQ4FYk1x&+DoS&aEX9>1MYD!e{K-;`Q3&{RD1Ci+wULijsoX`M-Bp* zQx$A1av@vu|GNJHXzx^nkNp^~3iwS0JXr@@3mB;M=DxCJSAtN9^!JW_TI;ArTt7(B z4$QWFeKoHZf5lo&@%x}brm)ONMX&bNsVB8~OApr{xBloXriYIf1RmV7|IS7~I755$ z2mVh{@M?YP+Lip^xGhf`?8uG9xh9VA`JpMwt!+ChU)oAQ zW8h|p?wfi)7y9hAL|>%GNuHqglHtgnOJLU}F+CvEYw5+^yIQYo!)5*ZuK{y8bVN;S z;NQay3Fcmdm3`0j|1o$UUOXFKZhWUQiC0G zsPdHrm-pcv>!Ynie%%0>(Ih^gA1y9N2&Tzx;{LS|AKmLbA=dT%AMK+o9UMslsjz_` zs|g&M%TT%gw5}{a$Q&WW_e&51BR!$P(FK-YJ%LGzjulKuQ$GJk|0iAGxViDMA;$k9 z>al@RK;bYHL*q#6t!wfOF}LysZhTf&*8D1CL1@FTd9G-`*AKZH|uM#;eG-V&+sLr`ea$YO+o{Na9}QRGi;^@9i2g*N^gg`L>H z(rP~^Sr01~nL0u9&u`!SB}|hi@qczC7Q^ZPIVn&Ao}{AiAHgs6hzeEpLZr*4*b^j5 za$AzHRkgnwN$Z^vL>d3)(Y(EPG^yfP*TsZZQ&v zoZELH0{h*PQ2Ka(s{sz9_Ws=*)0w`a44vy=Q%{8d>~Pw9TTL#bM}yLW;JBKC+o|uy z0lGps0u-L)_`Q|S8Y87Bo-eOX4DseC8z*X%3;oicwEaJO+uPiprr)$cCEMuy5-Ki- zP~l}En>|7{KU!CN<^d&X4pr0O!QI>X_pv+jyP!SzVN^t0HSmBJNYN8|Sc25?mc*uQ z`_9;Q(sS*rD%gA$LRyU1ZHRRkc?PYUl_r<6Eg3k>aC+@u`5Za9E3%+X1N?^cnIFJu z|MC?KTPv==0vzD?E=1c!Kr^z00Rs)5@ZPFq9rNnNZW~^BM_wS*wPp{}41Y*U&2Ftg z+9Ori5I^{7E9%^#T~jZM;T8eN_ub6Bfzq@qgT098LGk^_>(l!bTpJ3bZ@&YIB*5yJ z5^l$+TMTm+$2l|^ajlfx*E)-(zs{*{MYHE(=IhaHU&d4sIS!WV6v)YkG^xBS6Woe9 zgN$Q$0=*v=q2`pX_9AiYukHJJ$`#eL4RhUcfcO)?GNtvEHj5V*gkRvRHpem=+#e75w8u0;8|m+JS;sioi);m4 zAHc$%z3y6J?!9A&Y|jugc{Vg-0FwLEQjNmdHQa)aOmybnrTUT}gBx%7O|@=1T=(Mi_C;i zSs--}EsQ=ii6g<)S4#PGpRk+Agd33rXPSI=li~5qN%{-6su=ho#ZVdaG^18E@I~*T z_VBeVE^Y=isWmPOwOK|O);K&#=8$nHtDK4EFv#IDjWXScvF~_-*neb%C`*x;fza;bVAyIj@R|^doNxFTUIaSP)y>4D5_kE951!>R&gf2uB!Sl z$=M)wHtWuIM)itIQ|t;qPsadN7RM6b!8^LdzuOP9Aj&sg-#vSbNlv0_fVNk6>rP1g zxvaSXFIKEv&?{O6r3;(!-b-V2u@-el0Qd#yW^`&MPN=mZGoo~;BZWLoEng7VYT6aG zoR2zk=B>%dV5LF^joJ{_y0KxQtBlI<6FTxbi>&|KJoWt!uEi2A8cOfX9JzjHf{XlU zNI!0TT%Gq{0owyjU1|t7zSV>KRU0>6ZIB@zDoRs(8x$%!rPdl4j`jfe>#1riwGPIW zBWI>fjwSamEUQgv1ryTPuB($hx zB}h#yQkOgL_C)z7u*3_)IS@mkPXObwh*avh&6+Vmm(R>d3dlpCgky7RrExCev+T^a$U z$0U3Fw|%gDg2FfB{+*?N)$l$FFM^0NL_++)`36E;tt1lGauem@&K06-1U zd-wfAXZ0f~-?7R6fRbGKHSq6W*c-^;J;4e2(yj;JeaboLxuH)1YrU>J0ULX#fqxjB zztQ0tFHq$A2}*w;y8nhr(BVNe`Q4+{y8Yk58w7JdXKf4EhRnw=FP;6}OT$k6f~Ga6 z4zD>PAp8qvM#8lQ^7$$M1$mUgeZ-ZFr5h(U?lp{i1U-gk69i_MtGH_Wf=ji-Y#qgz zG8n-$l=PS-XQTvYhr(SW>QE4z&l)o58CHf=GC>Kk+X!!CIOky}r@ z+CZcr(Ikld8b1H$z7$#bNS{NN$6xpcLCeiYAM24X^b46G-;|H(fpB4zR`TdWmb={h zX|m2j^Dt>YHwcurAihvz1}aD#4i4}cB4d||<{`(Wyh+kQl~*`OVmAh#nWV8?rJYce z;v}zE*2kM4&gdbr&sW2(uVb-N`n<;fC}HO!kBr=}HCdQknaennEIJU!?C=;3Sr9K* zB9TAKZF*id7(D4td`z{f2$*ovH}Si?*Z4G+gb+m0n9&l4G_J2cPg>^ylv7H&*ukYG zk3=iutWQsOl{|u^d=g{yYI@ZXe$aI`{sD)c!D}Y0N---!nJBzCD|x{%i?E+!#tu8B z5C#b|kGacnPO_jgu9~`sUp*|2#@b4tl;`YQ_bacOg4Rl` zlq_Qf&Uau?r?IA;?Z9Y*{ux{@nm|}*#j4t8k|G}JUF4c2?4(-NosZHJy0S>8PL8w6 ziC8R*e+=W@OoQTG|R&}oV1lpGf7y;uUTCEy~2)QNw(`igb>=n&r z*Gmb;hDA5Xv5BE34~D2+%@>Ug4?BoxfQDyeXu=OfmvniZe)%HKF92t$kZ1S08=3?M zd0x=+VaHP7VIXqBa7VE^A84^|Bwd`gZmdaVt+b%*9;mi=teTi9Y`=;E!+$`dGV-x_ zR5cc|btd}$P4TjxXUfMtSk)!GZw|4R+?}VC|A;J0r6XI<9FBCadN}VSL@HUq7`84e z&d-T`RpCVtsoUDkUUFm~n(@BY`T$S{PadK4+_DZo@#;1U0j8M!!*I;F7#h)k8qc5B z&+Qg?8G-*bmYNETgL=9lR!WcjwmkPpR5R~9Ag`5I74L6r+yildgW8x_)rgp5@mCR5F_P9?0+*=eiQ~a^)U={C2w^ z?o647Vj~j!j+`^xfo&;?Gm~nu7Adv;-Tb+Ztps zeDT4DGHgAR={-zkck8Z>S5S_jZCX5A=brbX%jk7n!fO{_cGmT*|!)daa*~8W=8_wN5W- zS6BOVTt4^+L-_v@TnjBo{x!vu-+ajsSu4aLOWEja&EqEbbl-==tGf)onyCm9CatSO z8JzPt#n{^o@gpl}J{XNpL@aj<<;kC`o{REcCF`teCKa71Q@SLem4k9HVrL|zaR|bl z!s~c|L-F%D9Eq?Oj%eiXvIZg{=l%GX22tF00Hhr4(3o#Uez7<>B)p10uHe-}SX!v| zqO4!#hoD5nv8ieu%u&}}#Q{f;u2R%${*#n%gP)1Kz~P7(hr9N=*A@Xir!HNK$D6pT zJIGJ5>8pzXG{3fECFNixUc@*#+kLsz4jgqrW}X{M5RDnKIj9O#D2jz~wC(Y@YTPk& zS@bZuqVUO}%0|43Bq(+gxgW!4n~5E_i(+2g9zPpCsY@>>ht2pCm;==6PxLVZPRI$( z=v*-X1{@B1Lm(q1+kXQ0*%KyF@pEx8a#L$h#{s}LJcHTy<7G)uIpHaCJ&h0_F_1Ft zW3QBSlNaRQPnmKlFGCI2S@n=J1|x2){8gS~U4}mQ5!-9S1M+wI0h!lmg@p@Xz_M@i z_yzB`sqe|92gxN~xGFbxKR3S8rRvhk#u7u(G9@CrAbVC)quk#7W0_Y&*dn{K%z|7L z8Zle-B9PgLjk`cs@LZK=tSI8DfZm;fescXFFJ8?1aoO-^;NU(fnW)y`veMTr3M#FQ zW(}EFRl;~{Gom7NB=;U{BfGFFhak^*QNdg&Urzn(EVT){Sv`f`ekpjDIgay*#-Pm} zHm#buLGz6%!LpB0rp;@=)gNkA!`8jcJF*VcWPYHKBL{iGxIf6xc1y5O7oAt5nP~8W zoNSp&ujTl2Eh{5Ys2XOJGxK)#1d%XXRToxvj`+IJ?Q3VHcjin}JI6$n8&9#jKtzp5#n}3sTo;{JhgDxC#80cww$R@p6uk0Q7d;A$O!YE2lbgn1TP?Ec0-Bw9= z0pO;!9j(9Q?^~mkQ{Tmnw~MMTA!*JoR?vd3soT>B-Im+F**b#z;~Y9=fudz@tGy{T zjCFHWt6DZ)$z$2{(-$;c-t$GTAb~>L-3+VNdJuOZiq&yp8zF5;Qm9j()p_6Kd<>xl zhF&45x`m{Yxr!=Ub-HI1N{>}=!!9q^oweF>-Nz_3L0q*W)6A37Vg^StgUBIEj zw>5TAybtGZunm2_%A!SzhH3T#U)?D8g`+MWwb#_=coVThmAgg~VRO~QD&tSlG-d=0 zvWDjCl!r|xsa!xr-7qJx)69Ea&1&P>DSZLJ>v!_FE{5c5u#IzFeV0LJb-EjEp*OEc z1XNm9kr_rdR|OktSN&pZ>_-CqufFM|I4Y^}f-2f%Mov#yxv0*-fwy4TM_sMK{UgSR zV3*&H8wWM(oBCpyRRUna+fk)YlG`B7PEv)G;Z`@9w(6RCO>O7vG`D=)eZ$8h*fYD->oVNf_M){3#%HXYy{t~a{6tAdTu*fC6UUQ{zS(GLH z{$NH9Mx1!)zG<`qRXPK$ql5jJ|0w1{lq@s`8TBiDGoHXwr~IznOVQbH{s4>{ma4YS zoTgvj4}^OBZ|CI0`U<-6kXb4E>KjMcq==*YN>E=vP`38lT@eLE7rx|OF6&U5?(ZuE zKmNySiN1;T4!1s93!qYV8ZKB#LA5-f&gAXwd zkEhx8@<}U#ZB|TXP;);FK=_liHY&?>Z}03`*RX5&syDpsvBz9Id4=>P4~R$_MovJp zHUqZ+SxBfPA z|Lw`6D5GMJ9S137X6?5uhmseAqOhnFQv5`>1x;8OvhMvLh>x@7A3v)8dxOi{((ABr zbn?QPks(VXTpZfvs)o{+_)U7mZ$c=ay;|J6BscZizv!OK@EFa9hVZ9N6k4pFS`Ns6 zqU-Z;ca2?KAsqDo{uTK-4x7HBWok5gEF_Z<|JOv=6=*;4Dn2G?mle4j%+M@#fi^j+ z<-G;A5isP!3Z;-Ex~Fqi7{#Jo-ztsat8I4sb9gzF9W%3bV_5iiDz_I=boH3(0O>hl zAG5q{Wu@l+#hQdmD-|fEQZG_j1&dubGAOSYHn5BFJeZvxO73J;o;@t%B0K7FD?Y~~ zvs#I6ccs!RC4>FtpLmwXVh>EUf%s5M^%mC|$^Gd{>kmFu`^xDj7uI)FcSc)eg_b}Sm|cE^-b9u}7#oXo$wR2{p-qJ$|Gr_iy` z@Iq0Y?!L7056(#n7U5T`^6I^^W`=rSO`B43|wr zUtC7^2t~Po^s6Mes;!rchHpchqtY$o68?sWvb-2o;oF zWgW^YVtRTD#Y?sj6DRY|Kg4KGLXwIezJ_|91Of?1s>tgJo;i;wA5iAd(hm!)6z--| zxo&9raZXGwsj=^5&*qiQI2`kI4*l&y}Ub_tZsAenv`& zC|z?p+Y477$V~V=AIYW+_3uw7%PbEdR|BC|yYuELxe0fu7>mPnQE&CNSO5QiKWCtA ai8J)k<+nB+yL-rMr%s$X{_?29&Hn?sx2IkJ literal 0 HcmV?d00001 diff --git a/ee/ucp/interlock/usage/interlock_service_clusters.png b/ee/ucp/images/interlock_service_clusters.png similarity index 100% rename from ee/ucp/interlock/usage/interlock_service_clusters.png rename to ee/ucp/images/interlock_service_clusters.png diff --git a/ee/ucp/images/interlock_ssl_passthrough.png b/ee/ucp/images/interlock_ssl_passthrough.png new file mode 100644 index 0000000000000000000000000000000000000000..151055ada76c16b91723aec61d932b72632928ec GIT binary patch literal 24098 zcmdSBcUV(P7e2aaf{G$Gq^leYAfO^W1S}9Mh$x^m6%pwr^cEBpr34$IQWY_DM5UKt z!6*o!L@5D6F$4l35C{Q6$eoSn`@Y|E@BQokcRfBHNoLQ?UbEJ_-c`m2=gm+X*2%1c zAZWv>lP4}fkWd2z3ATx?0iQSqNq>YO`|(pJj$RDzo$OzqmgXFyv$CNlZOh|LJ8ui$ zm-86hfcj))HD@oQX496nIp=D@_HDN3&s*eW378jA^xV(gnW$8Yqcadc;Sk;pEWjRxGwNli4f4`0WmMasy4P5l4r zSCoKruMR}JIbmwOw+Lg}QuB)QKLvoL|1vE%TK@1KKz9;uOrps1;i z$`?r#jn^{m! zug5GsKjajN^z8jeD5<9Bvzn4so71WDt$MVyUo+^81RtLF1`X_HAqZ-?DXkE2LAaZ# zt*u=gH$g2N`Vw0b+SBYXKg*jZGaX0fE7{>pf#b0oBmNv$Tx$DJU{$2zeR2(1{JUge zrnHtDDPfrF@{N&v=GlRe;@Y)Vg*FzEoEi%62BJb#CSeU&;+^z>{`If-w`tz|8T=2* zQS++R0mu5&{wpRZo>V$};xmq_RN$(}C-^+CN4cOB2Do$EMboviaEQD?vg%M4Sm z=hv>?vKPUAlDYh*wuVW=5}&>VqzjEV*HHbl}iJHvoxZHgsk@DqS{*gHU@)1JR!Dn=}Wv)H#o%U z3!OM~{_sE;v+ix^*C5O2i9bJ{INq+f^s9OvPeI3gG|%q0$?K{PlsxpU)R;cjHVX6p^*HITXy& zI4*@Uo56Wnb6owsmj75APUbfz;V{^NQ1@JJ2-)L9iy~{zSXAD>%}~>&HGKN(7W42) zd1f$S3raqKv?Xk^l;9*OZf*Yj;1DM6d|#;>i%a3J{0KoX-<}O~$P}-)#F_OEGl_TK zDTGgd@(X%E;XGRSWyUH8OXSMy^>ULxMT_#OFav?n>+X$cMa=$mY%I3_ z(+`xX4KFyoMFP2yMe0rTs-ix_t=S+mr^!?YFS+8xl~giCD7_CX*`{jsR8&G?Ii^Ai zf{gix0)V2KKPc?inD^`v(li~{m4}t+LqJu&bh-p{fvM@DZeh8p-gt|I- z`$>5QjE|ivkIKUO!)IHlhn&7G_x+vVIXsGH@_Xu%N^;YeSPA^s)z6dUG0QU;&a;YI zY8WsT&PcSV#50?ko&pDUe%cD6(*T@wR?;M%zfzKhj95|(B70Uywdzk4vaIV_$*kg< zDV5T|Yy^&_P4<`#pPV{1;0ud)=P@RVkfg}(+mm8>>oLbz-lBm(bCzPzLtW+=;J`C&-3~)Dk-aB`=N^nPY@Ru_V zJD(Rqd3410zc#_@aNSR^lp+^fpu>72yoCrLi z^F6&>7+A5~QDP>=ML<_*@xG*zRq)>h-`36d7Ff52eWYcCJ(Dn;Yb&czJ*s8C_UX}z z-Nd7597-VB)4hZeJd)^+kDUG_8We6mkol>4x6n)}L7`@TX~Kb1UFKLr&oB7BQb=zf z5U&rxtQo3*O8jIi2^7gi{@rY=0jEjOCS)m7JXBA{R{BSa@()~^-)X{k2C!BADdNF2 z)jc>nH9h=3McW7iRFG`GDHiP(Fi<}nr>gHobG_&1Uv=0otusfpGp_)J)%?di6In-0 z5*oOf>Y3sFZu1dfAW1TY!PA2-szV?4QTKb@BdM0uz8{$v5S42?x3oLoDyYHq#eBb#5xe~jo_akBX zIOp{ZKm)WqNVyjH$wV~d^1W60yPm$SUaJnuqW~44+WC6+{V;&ox!$(a+j=NJ)$H1l zZ;7@BYSp1l=shQCxoD~`MZ7Vj*3*Hw)9%G~9_$Q>LO#*TZD8WMVI^QMq4_#@9L$ck zj<@_$s!DDjv|H4}9d|idtnjG#Kvwd#s>6?M4Q1@48J_O$wlo*&n9n_`c#U31s!}}| zjM!MovRk?`75(aXEON>dfMwh4w?t{po6fY(HSCzCTz5;$PJP0_=%ISO>#0K@XI+z2 z*59ID96LQ&gjCQy?&UBLM2VOPH+L2&TCS%zRm+%vN*(m^Sdq!}5Y9#_mSjH3Y%JP1}-8@LOL<3?u0eAO;< zB~s`5>(q<1d-;$0=x9NgfNh^=cTkrz=&L`{d_UXgCCFH3nkq{*HF5K;GX^@GUZOEn zVlL8rX7r`DXK(aO_|0HZ*sL+JjQoHT6)ls+6zQt;WD;1@szRr`}p@B$v zS-Cp^wFhN^cVLAp94E`-P%>kFU-favty_=Q>X{)I|HR6i#Q?rNmI@&}y5CXK0C*Ij zU*+3{t4M`6B|q<(KJ=;TwLcZ{HFbBAg}N0cgYGE`PJ(L|$}Vu^-P-eps^>QwUQ?xy z4llA(Nq*D6A#KZ%}BZ?xa!|NRvK05)N zUU8aawg1J?64xZd`QWop`~CEs5z*84!kJ-|u+Z-hcS#UdGN#nvbwy=lWoeOg%gp!m zUsm7IvL(!?XOpK5fLB0W4^kYGhsU740nE+@?%pA;f1R~Mh%=$;c8$Kv^gg4-ANV7H zRo=IccpfAREKE^G&+pH1z+02H)+7@IfDJ~Zb62={ei$3@EXBBKF0Z@AvbGb5a;Y0Q z<_z=zrRWLY`1{>=hs83{t$Io4ULF}I0zj@(4P@HZeSrsBK-;fXwAOJ3YyreAdb)|GyFU3$HTg8vcjTKry=e83b3Fhm6hh|OQJGtvD}D~eDz03dBvgd0@&-&i zfUqvLEzUZWXbI%=^;e7HB6R!y5)Lwwo^c`1zvg63h?yaqL<<76V$Z-au$mCzdO=68B7_ zX7as&d{ha3Wr+pcM|mR!^Lg#Q+IK)r`X`Hko}V{hEez&ehC`HO$z>}FFe`bbT%jJE z5pSF|j?1h!QNlAryK0(hrm82H*E195=fTps=SIFINPpOkG8e6u5ijbuVL8yB&)mBDKi}q2A4WO zf*|_Wd9pWV3Hbd|ed2Ah{pp+wRTWm5UheLyKqxDynSwrD5LQt6EDb&@l^ISmaK~gO zt6Dz;5@}^^v$nH9t}KjXHjiZC&ZW*%HfWfM0CmmEn0()?o|$&Uwd19DT>mw|kf_eh z&)BD-)qo+vap?ZA^$P_p@9Du$Msgq)`{G+C*Ol21e3;@(UEg6g2*i*%LyaR@fH&k? z!{HtN&&NSI<^C%!X}+e5A3Mz^W~ReN5_O&_k&v6r@$ISrN*ngd!qK1Q+p~+ak|?>E z&(E-HXe3%vDrU?g-1UdBC#a{Q4{x>5b z=tKF4`5?ga3ig?2EJuS-&9RR}n!8~xG6)VTsHL3j74{@$!sLSsabR!0?|4VfagFM+ z*VlX_f*sTyYJ*Sq>F6pP{_X${daQRkdZYfBCLBsA5)!0m``S^8_Q;9C4^6B7zItIe z-r%i1VI)KP(DkpHAfDh^g;NBQcNzvxc4vkU3MmGc*L-1KvbImQ%v4OwJd`tV-1}Z1 z;0+0$o}TGeD#-&f>_?SM&Gp+4JeTb<+Lpq6KrVSOu_ZM%6?Nm}_Ip5lzr8zvo&_#P zav7Y(@lG5jh|l9VmV@9n(z~Q?eui<8psl5Kr**=mZPL zq$`_mFFdYX_9F#Y;1dVAHzeaS?=MC6t;Cj>m#>w6TW12^sM>tQ%z!ah#Q-M}kWmqY zCQ7Ci7&1Q)kwgzXZ@$7gtC%3aqvl%MaASN$(%{mR+>F{WrjkWh%IO@5M(S<7mXLwk zkZe{ZrQ0PjM9wFM>T6L$=%Va+73@p0FHID0!C;%ke{iJ;Vn9pU5;s2A51hzPiiJ{K6w&Z4wsy~kzhqs~<6Sx}_83z)Y zMPK_}Tp*XW;FaH=fH%=H50iW;U?3HuC;&ix>NS(BJ`j>OojZ4qT8jk95ZVY!1Gssn z7BHR_d_aB48Z8|ib8Lfw!DqVTYXx;vFOKpZCRQ>yDUK}dhPje3iL{jCq;{q=u}e4Y z_&x|Prrb7%N}r*HN~YpSJ$aZlF4jPapNLJ}2ttjv4}LR+c^1^%x5G=iHB=K58{So6 zlBnOVg6jb^?6!2JO6|t36+`-r-K5GF4^p--MnPivyyUaY{n#z7BN%1^8As#LZux+> zofxTC+}fFkPZ#J>0AMi|;#_mpKE%UIxL?Oqm**_pg&3&VW9`#A5<0RJHc}rJH<)^x zLs9CkS2B-%+WBfWyg|y&=hGYUAC0Hmja04fI=o0qR+bs@%0E?izZuPMiS=|n*>X^x!Y^su z&kAzl#{N0!XXl;R+_yqQ=a*T7jTl2y7J9p7U(H1~(tlEHKHh34iG39{IapV%JI_fg z()0FSLldu)jzkBH|Ni}3^VxyRhY`h!DTHl=u4g8L0|eMJ1Ht5`^`@yJY2%5zpK51f zRu)IlTXl+&zkq!S@ zT`a34p<0{XRkiby@49T_3B&DO

##{p;=+(+v9lW6Yt_7RNs-osyA`c%Pxq{Yndw zyNIfCDIfm3{zEQZ?3K<}s>Yd|j+vI0mM8I@TZ?`wxA&JFLkkbsU0T9iPnEty*|96Q zqH-Vu=iuh*`eFiRGn=BqE*4MAvHQhd;}gz@_PsWVKMXlO7tr-0GK({}keB$^Q!7T@ zIzxVXn-zJrpw;dD+m$S&g7<)Dg|7PGZO_78>A1rL_qUaco){O>31O@dWAZosjo~qm4)Y@Z$!nROl;} zk5lH8AuVNU@!@Ps=u z=7uB&M{@tnH25ywLeSzzTT*qJ$lF$5>L0x(*=wu_Nfql85t_y3%o1W5SkvF#eWGS0 z1S!d8JbU&mZ=e{=EjYbb`K=U2m%f;*p{=9i-Q}3+erVltHDZHhY3SS$Z|l|d(Sp$WnS7c;be=6YewLvHC|ttMSPLQ{yp4aW6{Cx)?$myL{EfWTJhM6 z*H$RQZS3d;Y44`21JEj%2_1%rAdTzcLF3KvBuouAmF=WAbdNR9ic^3Fa&m->Fw+eRAyU7sfA9nS0zi5%!27)r+@VXzrFsJ{GlQITgoBo3>N#CNE#qvNoa zRQ)>hZ`6uxhbK5h)6QCe4e7)4D70_kg0xXmv(tY>vu04N`nZz;>Klh5ml8tH<^#wJ zW7LMs1}01>YM3R?`79@Ne7?J$up0jhPJ=gB{ydetu!2vjR+ajyl6=~`Zu;~3pa%>c z0z*!Eg#~mjC_v%wevL&359Zd@@!rXaV3(YQ2QQa0>_iJ?M3 z1gR9*tit~$uoUk9CiZDd+|F9_urRKAyp)DQ&pD#?Uj*TzAa(I3^vccTX6n)Yg@1P( zJZoYsFC(z<#e#^6D6Ogrsfk>+t9U@u%@%8@IB_*|l=0WR9|JX(a0QZfjQN35x)`Y` zI6AkoWJe~GQH0s>pf!WR8I%XKy3`6)Sb=I!`CTl_$)Rolc6xfo-hy9y9L>>mN96G! z1>03^>AF2kGAW6h4hx8B#*MHzz9G&eLbe%wM1K$cj`(QE>72@1BXuLUIXFcN4eZt% zmK|cf6HDQ5PifW^ld?=q;rJTbrJd2uBoare(qT1Yj3~?UfKT5PRdF_Bb6!~)+u6b! zWNezpzfta27bi`;%xy;J&@028Gv59nxvVO70d=Mvcm}22kohfF*B;mQ*CtQ6?^z3f zF613K6zz?uF!eTv2f~oPY73iS2w44N7196i-~7LR`2Tr$`Dc`Ve?2aDo4tQ)O|`wf z!bIuc-#m7y(SvIJd@cG7MLu+%ER%inMA?bN;%a_v?$D(Q+;**2^=Jhb;T@sGR~DMt zW@^awsw~Z!kw6KEgw@P`hEh{4USF{j64L0czt%4~w49K3qXKGZxL}x1-dcvU7Zg1B z&H{C$Hh4$d=FD{H;K5o$w@3XD_|(L2t8Ul#N)7t{8X=Isr%O`4y#_+)t|tC&%`5?# zistbvi;nd1KoPM9%-Ph6Pb-NN3{38rs6W zD}1|5R~^W>3%QvcQX}Bji@7K=sMsrizSB>}KfWJSk!#fQe|SZ`e3so%01hdlZwiFn z4hD^!o(<=vyj+8Qg}dFD5JbvR0`goGnjPYv~t;i3<${WwU#bF|4{pEd^6M#&sv~JYc16zTNm2AdV1ls=SLYg z&T@B%{+r|tW&vW5{6?(41!Q$vc@NZ8_(evJBLQidzTc#&ch^fj1I3mBfyJ=?(1{`{T+IN{|3x_M+8iq% zXtOA!xL~{p%4Lz6Qxoy()!(^hYa0xiruGU@uBU#0o4fw!i6T(Edsb34`ci;x5CKw( zYM>NaII;*r?kV}9ATa$@B`E#bAopQSe$P%@S9 zG!UBiZmI&A9Dx}wVy^8t6;x>bNgH(f-nDi`E{`atfV^85c2jugIUV*Ax>=Had!8t~ z2lx-66y>(lp4Xvb5-2a~E1$=e``l# z7XB5bV9B?C(fsx~UKNLe!E=hh2}GS+|3L8Fg;c31&6A@}eph@4kYFbU*qj#Vg;E}< z$z9==A?me-(9TP~k&J$3B&YXa+Ad~pHkQ8QE(5XoWl}R2Ka=SFls}`$FCAIx52ElM z(`E-a^%b?C+E}D>;O2Q^Ca=7r&a+N{)p16Hv17xOT*9o)&@l4^AvXw(p4CtKK{3Ga zH9&P)-tx;V$7uMzl75Ce_F2%%{fpbZuiR~)Xsj(+)Erc9) z8k9d;?-vjt?i1-fkV4o;Bl7xa$ga|s+LFz8G?ziu2`i5eLZ*a!EfQmE?du$qH%Cp3 z&MH9RJJ&V9nx-fCVpn;!UyOG2OcE$Dx*=U#qet)IUR#(|dCx2S2rUq0;|)e2?q z`nWj?Z7c0jpqPTU9dI!#_v^MkU-=;=i2chNf8$k2 ztr5RxFrsiZvZ)^4aWzL9y=_eVF@CYd`}f)gy(OEv#I(57q!!7cV$&O%W6lkQ^+u@k zns%e}nz}(qLkqJ9Ub!-cMd8F&kaPV(7`VB!r7d+x2V+GIYPxE>Ha*$tjzN;Pb?nb3 zP!oZsmhCjZ(s+8q_Ej3kLkFxQdb8<}ou1X=*-O{8wD&eKt@3J1Ub!7DIt{fpkVClAt(p(5 zK8Gkor+umq^{>!}tlt{BK#ml2D@9N733+_EPo>~84LOIj5}ZDBWPCetWQC-gibA!@ z0=hVw*8wOfGU;YRQ9{$`Ou2o8W?e%%?s1UT`?T!Zi7>ATGVSzb5gF*9$dx<= zv4-SFO|7>}F6epcNqOXNd=+AVI*ac0IsWU&2t7Y$K<+{7rtZb(gT?vpgDl_UBm$og--I~!a&+es^vY+zR~+0w6>SzCg}MqzX(u^QYw{> zskySN>ixO^XWxAB4~v?tK$=rLx{TUqRa{$J3fV2zu{eM#*fZdhmfka^LZThQS82>H z{&CG=Ee1H)9YB57*@{i}llceAdNxkVLvCo0_Sbw!{YaJj^z&e9c7e3mtWEFfTZIYX zRvOQf<4;pLH+M|R9n<_i+I9GVS5t`hELSs1dnIHoo;UZ z)JPST3e=U}w20PBv(D)JCg?+z`?_J`#m0d)*QW@K>2crI;c#S?qKZ-WdtIx6Orjnp zMVzzv0j)SnnhuXlN4)@oG5Gh`FD8i$o~|rP+naZxiqYg-BYhR!i?*U2Og&mwFlci* zr>bDvTb-?U&<2ZW8T}%+^r1@qWh*0Ov@hEUT{cFSWF(3VHu*L$J}-W|PsjhzImB@v zHnHU$d68sV_1%Wr_bs`}m0E?bi%kZuxG)Jg1@qi%IcmfT&|LCLJLoF-Eq`C8Gb`oo~71hJ+%;Y zE3W{2C@Uu<4gn7#l;ihDHz~g5ZXT=7(0c&EHBlDmrWryD##^HmN*i>3-`U%%v;xF+JE8TfqX%CO9ytl9 zm_Hr3@U;yZZhyTdAPI+odedXTEB-qt{n-C_gyWwbR{<3V1R}3mtiiMrIDRlOSR2Zf zDhn5%j&2mKhq=!u8AR~3Bh230B-gB|-&?cF@!&E^PoMzI0RfK`Ja~S6+M2a6dCOgY z4$i~DAv9^NW!6zR?2^A`TqEjs#|e-N)Q*o~;0H+YepH~uEe>@4I1rWoXYd0A>3=pp zck4aqAb}Y_Oi4DtvxqeSQcDuX9TfzT%o_T!C-$o}7lHylZ@slC>RQ21P@7F19UYaF z0(qqJ^-}6`id_}W&9!xKw6z!zwie#_$FMbTa?Ye|Y>guK_Ew|wF7}pyD6+D0`9xpP zHM?>Rn|Fhsb1{kf>Ixs=EW8<<)KL=WNE0BTDD1&ooOgO~mPq&WWM!^UTmv^c7pF8< zj1AQ44zlc;qVZTt6#0ldX9A4&W=L--Va=bh}4Rwx9)=B$h zE5x7Y##Syz_VIHnJrc<+zCGIo7MnvbB*j_Z#u1F7W2U?#x1bXF)9criK$ec)njQWz z*S>f^2N@IWlIg7oOUYZB-;r_wPG)E@8*aM&bb> z^7X<1D!zTFHj+e5aYQyL{GJkkj8V@cB_n|Z_MT{qFcv#`fB?Du>F^;1R8c$9~OW!#cy9Npc{RKOr<0*bBXyL9Gl4i^Y&Ek0L6AS%0 zmHcfMDJKj!bBrv{KB(VEZ_PD$9ceGOFO6fgCCOHjy=W(?kH_yYtbe`3BJ!ZRqsz4e zu;K_`4Yj}54ia5;N*`DDe|9Y%US^BqXGdFPw+(6GboeUu^B&m2?b%iQr$gH20T=a5 zE@UX=J=fCzkQ234d!$8i<+oB4h`pibFwJ7~_$uiGXiZE+xpNxVTa4}3~v?x zB-g)6|LTd{rxxW_NmIpJo}N53iL3eiTLeZv1-~E5)giwZLC<37v158P>xDX<&IR==qFi zmd}-h@p-yfPJP;ZZPiePim=Z1&R2?Yo-2E#dYZQ7pr7h}3FzZLLEzq5za|5s?!VNN~FOun&Q; zj}`veVJ!oubb`HxhAP$}*quuQ!_WIB;>Uk*PweM~V0%q@5juA#Uo_G?I3Fu2%$qK~ z8d;KvKff$c5(ALL@YA7&EG2Pw=Rr^sG&H(1_QWC+4|+QZU#XPsLmcelEX{o49#ng7 zISsLWK_^6E2nbiYYKK){y{_B2i>cPf073!O3cVOZls}!*vB!5YSh$mD7r98y-u*_w zI^p*~$G`xxS~l`$R+^RlfqU#5cKlexM%~EP7rxx8%GxH?cE(E(E5p(6`&;d=<&|O_ zB-u6~;ks|O4=;I=aybph5ls#4%})GrRi4acB8qj(`77cLRfATfSzoS9i7?c* z0z33Y2Q^Sd_o48c!kv$NdG?K@KhFJZbR5IMI&I_lA3HJCV$4AypN!BSAoCAnWdii` znGf*vVC_v&6aRrrfTXbN022Zv2PoV&B^f0G90%|L038_$pR-_e#185ef|O)MrQJ*1 z(KvmVmE}b;fqKdWs&|FUgVou)AzGmKcS!Ci_qcDEhh2t4+M4kt1n&YeGu**J;Xh|) zt45q4_x07<#}IX%p3eE6u|9Igr`h&g+G~ZlB@MX%1^zXQ)7Vk{2i9_P+<%5NolXI>X5rb@=(!bB?WckUDbF4Yp_ zH&X!6%6eONJ|4j87Vhk9OI}Z->kB`bIn}y5wr_r@!>PTu>Oye+uprKIBX2M92ieoR z7@Mh& zVWv#%k!7Fon7EsJsp{$_cXxLOq*RIofw(mNJ3)AT12~ukW8sfsOGh9AXTyWRuwajo zR|sowJHA_S$7)v8m)lUel2aM3eQY|~;+)_+V8szFuoWjjwK)R89x;9M-QVb-W>a)V zqt5?lug>Kv#D41(>>yWhk)7Ktauw(vKpg3Z0=o4Tj+)BGw?*V7oPH z_6SO^QIDS2-Fm0bi`})F>+NbyDk*wU?EuJ)@Ks~zX4aZPNmxqe#mjO>IV&J-?kUky zLd|fl7ec|G8tUG*Mk5lRPj`@8UswCSD5`(>0uuRY+l~whD!lL4|FvcgyTHu=ADyU0T0tfr8UkB7<p{0c+i-9{1t9xWUuLGa@Z6&rgkpSX`9&4^;cb1p|5b(n z7jOZ9eBwFcApLf(kvgD((~;bpYAK?iQ9w~{7cVb31N286DcK3V%YotZ`I07V@NO{_ zenRN(W6s>ZDl}n^uZs5 zl0k^IwY4>}MP%a8GX<5AL!jDY8q)JI44S?z2G%M^Y_9~R3xIncST=)pTMKk!nVk{# zjkDirv$V?PuW&UetPu?Fz5+5n^4I7HVVZAQ708vebdD@-v!K|$yZVVgQ4mM-4L~MU zu9O1!i5}L&dK_e52L7;nUC?&<-Ip-z+K4udiPrk%=!dj54)1ULn1-LM(T`mo{F6VhEco@iVB zHcJ26x{s~eS?2_yF`uC_(T}J8h77UI?h?121Y-mMsji)m(tf~^f=HVP(1f@^?>_^M zAZ|DwrG4se?&;ni#L5HJddFyqv(-1U&#eW$2^dywa5rUnG1?}FdrNRJ2<^>@Q? zs1r~w;JFzFcyZg+N^pymsHdtWdLXXgADw#hDE9(!_OLL6~4D##K0Iko>)G0BJ zf(JWcOVTHkp2{%*&FR-U#t`vcED*1?D2UGrLjgVHW4=8VJ5^=(D>ye$(whzeD|t6^*3P z)YoPY9&)YWXzEFJm2~jz{9P%BN(_jw1VSdgNl#b7yd&of>cFbU9;g@{^C2neY3b8D za)s_*^?WP6OcuNIVOP z6a659I!dA`?NC(w6r3X7xcyGqe-C!)qFEUBYM7fai9(yBiWSce z*Z0GoPvscHePrI*mtWVIJ8juW9WgPKWZ$sBJg8Qu$MlT?unkOLWbB~u;}Ma%>KYGv ze<^hBomml#y8ZJ|gZ^>x^PnYK1{8By&#sHmsFD{)ZZ?yKZ3a1C8JXMG+fut$R0U_0 zeHUNK4J8s73MnPu8)Vs4yNzkrFJtZx8fYZ()IPHxG=8LucexnYKVH@MsMbw&#Wsw^ zxa%?VXF?35D&r>fc88n$Hf0wmE!5}19Rz0H^)ugOW#jXHMn3~Z(%>JD_k3CHq4I0; z59gaSp7b%xUa?cquuBl8l{O}QEsvB-@lFH%kJ|I~+CQTH)h6+iAsH00Y`$G#@A8OP zy|~EWA&7Ep2{fcYkEEn&XX&Jc}RJ^WNb)>!# zgjD2qRoIHfPrzoV32jr=b+jn_jlhfLmtZF-2TWr$S|t0#%TudcP@XLhTf|vO{y8k|!`PZXZb!Qh%$GdHL+MdSrd%!e|VI zzA1d@u2emuyxl5hqU75=N8R*xNdg18l|7Cqdu)9y^@g!8;KRniEcYFA%jo13UcW?B z^*dTni8yj+oFCsD`x^Nusi%WMo1=HHv`dD1CwlVsqHbrGCo(`M#Dj(2E|yE^o{y*2 zJpBt+Hyc0+n5;(Zw@u6DqydCyu(~P3we^(5!6hBg+7ox_HF?(M&#(=sx>mSsk9Y5X zs`S%gEik#OS%(1Nqzdd69RCz@B^%Um_fgjoeHZiOcrCN+)=VQzMG;RLJQi@;gL!)) zgfIDuOASfzC2@vV3`SV;tCJYVt}g*$5y~;UUiRqRJYu`9TUTZMPI|l8+st$jP3M9s z8dW+8+i6h!p=0xopv8}Oooh|4x|59@OK#gMeICwE>DxJkt;rC3jXD9<=}9%j885ws zyFfw)2JArJVd0dnxpy&3jvRTsw9U#aBtxY3893J+JZF>%kHkRFGCK^#xt_#SUWFr&qDO!FXiH z)%0C!o`Xeow!Zpk4p`*6yo)LkpH*L-8wPdgEX^1wLHiU2)=OhX^@p*uR{5cCKy7HY zEONQ*%7z99Z^wcj;9kV#%9eI{|I>)fzbvE+WuIG05Qf4lCrNINdR5i7>qD z6NfEO7ExOHS828)UP1DJtkP8lnE+o>iRPTCGZaz3+TCd=bqRaLGQ7?}rGj^imbpb> z;qGn^BZV&hjubxNe|{c_u171sZ#_XO2|)7d>Dx;TZCM%eq~E{i^Tl4AL2uQj*8><% zm*PZt045f3VevyYQo0MjiCvJpZ&}Mk;%Q}Q1g?vK=DLwOEhus1*kJ0v-taZ0 z8F~E)^-!7Qeu~Wj;{a=tGMsPABnWYEG-;x{jpQACsuBsX(}gZEf>L#G?q%uTKgRy$ zz-2G^aE^K_wtw*iaekZFQ^g;7L`jtrH`sGcDUcL1gAoMz*R3k1`6b^UU1REacDN4* z2|&VO>ASSY+4ms?;tms+{rf~#?S7mbr)!_X0aCy*(v!wGQdlr7@h6eEAI)o_vF>&a z$D}=Hp51_uc$=QZ&sAs|cARLA%or&JVXS%v$6>&`_f3~DG?tX`l-}KLF60yQLr)q` z3yxM)R3r`bDn3*yYaG6$(QMHRw=pCQF|hj-$>HuE6L}kiuVUOkp2~a#MM(tVQ(Cn( zB8Y)5fXjb4JZV~|RL-GZzgA?MT`$d^$&G*$hLy2G2YdgCXm))Fh;aw zQ?JpjLp9sV#L)8WF%XTmr2&UD+#g zpLAG0%~NMm)a73igiwS1ho&&zBzX(`{Y_!v5^Jum3R@5ykkn+|eC-^2>>GsmAXaIF z4RsQxc>Z2#01>5dm#aleV;4)Vp0>6D@Fea_T{y*4SvyY(hmh*!zUCyhy*y3!QveOo zazSB>oTK;lsIpUT^ICtQ!XeDf0K|R@^0xtE{jLC^PLl;CUqj*wARm!4WjUbdn1l;G z2&E>!I=AtJOBl@dUV3b5C_kIe!7)ql^-JVM?O?Naklmm8=!j+szkl3j+B?&k?9CvKRv#=~Di0^Nn; zo_;%7^&*hsl>Xy+NyGl_HL4I!yu3=#|DwYB@H4_BeDgz@E)BI-f$+eL?XK<_wI=UA zo+?=jq8@IY|77>;u51G#pE#z`;qm}?DS_Y+(!TQfA0SA6)AfdehCLNwBPhxJ-kTTS z^#;~yQfi(_Z1DwE#^a^+4W)JX8qgxoiECTB>mc56)7j%nYT?J`_P}%a!Bqv|ISBPh z6zKP=PGVOUGZ<5l+^f0i?%(e#m+eWhO7H5Gy(kaYJ2kQ`!*)R*BD+o)T73NR%Oa&4 zbYB`~Pjd1Nyc0v;ccUof21~f9jSYZt)}RjBKP^C_ct|>SxDWI{Gl-j_xV7g7x~B2j zcv146IS3A5AiEU5GK!pMD3X4nCL1Z}-1%h~+_}J?0F7EseH;l%EP;It(pGi) z;>iNV?BCv#*vOn`0~JUqP<|-3^=w4G^s=5KVgrLj2T5@H<)RAjk_VG5X+znRBC2Lr z=@TCAdR_yZo!^&M@8Frt3w#gjg#$A+kg-NUHP0cy$?Z#gXVy3_y)#3sLEh+%ox(?e zf}cVLCy_EfA$PwYA8u%FnoqMQs+HoAu7E zYflJ>%!E^EEuCAauP;fe^VOtE=_TffjFEB+ML1;SUV`HS|Cx6m%9?viWIR%CZuzV0 z*m7*3Io<{R(oeW)%j>CxC0DaUptLdH7Maoun$_UO#bE3iv~Q7E!|dTrT*A{pSfx1E zQ8p-BR9KYk)>lDSgqu`fXWT!(SSI$egkio*7l+gUGUFhu^fE?R;&cmC0N{STIf17t zU`mvGP4FFdKFT_+daT7a1PxqX#AQ-nZV;+YO^{VspS#?nr!Sx4aw0;Be!G$vyU;5Q zq82iH$cX%L1Ea&}L08GCE;!F9?~C-F+`8@d?8{tKwgQ%nk8gJ5`0}))y$|X0 zX2tM00^1&a+F!Bk6yrjT-2KcwkTGV=9~i{PfREgBsIay)J@hxz?}#JEMq_v1h&)tG z*%V-@*u@!HTt)#KB#txHD+lkKl6|ps0CGCC||5m{3@>GtxB0grfagN%F6&hN(_ zGF2~7$zNf|(ClD+A&C8>heIYiJ38K5n*EyE2e2FL+vU#^oSt6Ywx?%litZYlnz?$m z&Ki(#-q>aq-&zb#q8xKpxxkoPD+;AgRWD?9_55l#g{*pWh$bMyv(oRK`|&>^{K(t| zN>%~jMFKv$XP7^P+Py`|Ue%=bF13dY=9W>y8(-MmdIO<{zPRkZdMKuO61HcEY zg$>-m`*4ojrp|j3%zGK`FBH{Uj-79qy5)VYKQEi1XnDFu7!q!LIVLu7t1A*kKDiAX zA&6%)@4SWz{XdQuVai=)dvh?GOETda8}u8j_`ALM6<(|NUf{Uq`xPV;X3@cM790DA&bA)W*sW%S3ZJG957dxPn=%KX(_ zx0L@=B9L*(n#PxmpA(bxTNAfHX%!awRd^p0w>XUy8F(MkRgrL-NuLaFRlj%TP|nBZ zYB;53ydfxt3(OF{4{k73nVmfaI;PHrPL^PJ6Nz3Na0g{7coLw*>H!S4ge%^VC6mgn zLOjZe8w{sbxJ+iS9q0;xrGeMoa6uyIqhjdTE0zIeu@%0urjlNR)&KMGcvHnd=tM6e z-RJXKd5&WUH5qPyDvam@H<_$g;Qpa`U&_+&3jHY~a09NnB=lFoZ=}~`cPW(^KB@`t zn7v$a^NAzhL-ol%a|hhHQHBR5o!omzWPKACG>G&P&ZX&=!Z-a2Kh%NC~G(`VF^^{fmXagZ_W#8$T&i{v09=5r4Vuhg<9B>xo`p%t3N@qG`E+%V<0*R?uVrq zvGdH6y}{ih_(oiNdrzxRs?zCS>8!p{aD{O|68nKg`@;iy0oXc`k2h7f)J=b8yjs*&fIRSGDBZGt|m82lrwF z^re zOfT9CyUtp4a2a>;-XFSWM)2?hd2((><11iVky0Qdr#m=L9#!DOx5Cj~Qc3s1Fz#&ji4UCFAZsUjU$-?L-GT3tKiL{%lrY5NMfP(A79!jQV>a2URQ>-S09|ive z$d3^fenV5aG5|g>_gEO#n?8gMR5$xIFfefF?qO7hpFaBdFW=a7As=hWZOj8ZHG0b{AaznMO0}Xul`n9KS0>(I-!k_dbBj7sz4S70 zyiFM61pZBn4%ePP)3%p$Rd8o+#u_9U{gmvrJLrNI^f4>xBSC#3w-x?c;Swc3VQ%!b zHQ;aR`%`W&d|t27HwmRF)uw_*sjoIrxvssUJ1B2v-81;idzGE8gx_E<*JXQIuAl%) z!)ei%yX9Ur{mL>Z5$s>|O*RRN1jqQ-{Om8Pt9PA0VB8fV<6kV^e+jAw7bqRxr;E2P zmNnhEEFI;@U+N0d>qtu~NZHm~b_UAAqh;PGh&Lo#ye=rNrtirH)s7-_1N$I4*29a*{yBp zx!l^i_{-X{|4>tE!AWq%Yqud#{L=&k(e|bMyxgumXR2CQ>%28Y#dsc_A^Otu_$44ke1Mi z8h?*SMY!0vX);V3a&aDPvD|V=zoRFlm3z4ICQeVIK*&cS_PIdS=6mRwLb_{vvRR0N zd77oVD!JuhTDsRNYzB|;pEu24a5d;b&SskF8S0a7?0IL^du5qFMeFWMplXczAP>gLMh zq2B)f85Flh(q>=E{oRsmKeCIu$(0bw5}}kVS(1Gi(}tqa{V7ZKTsxzpkzve~;@*bD zV3?s9X~Im5j3w(lXLRrLJpVrbK4)I9@txy*&-e5BoaOyK=ll7bqwjtn#bFhMK(q&A z=sBbeBg8mWCfY_>>E7N7xFeEI%8yTLI~Tx)^C`L(@2tIvb-zF9y=Y4@@T@B>nF_UY zXrxHizHBW9HRnzA5n!U@sQnd>4QyLTS4X%t*TlkYY>fQ$)wxuwrv~NWqj|_z3Xgxu zkAz2YM492jzdnV%-@u%zr4d{kj$_`>_jpU;2M?=IL69qG`8S7a^`& zH~%;4fFdo6VY?eb13-C8&(D&Cd(eSRYCoV-6F@%yLipzK2X&ZKDzgmA^78|54F?gr zy07Pdo~|U@DnP|?>cZ{6JzMZQ$0NH&~j0Z@A#liflk7`(j?$ zCjTNdsQ3i0bi;hh9S@%yDFM|33+Y&)#_%H~J_AD6xC-{)Sy3bZi;bRR2-?gyK_IsKPZFy=i+UA@%e2Hi<+Q_dR~f@)$;_c;{Zq1a-ugVCl&$ChPHsk`m_+3WeKtg{iHQxLjpQm zAk@=xqoXn)f3=-@uC;D6{JBI1L~Kk*#49~ec3^p0aZt%!DY&%cKICn1BlnLY;b;jK zTotOuW7LkrcZdHl-VH)uliK~8U``Yxzit_U6biZ`9B0DzA!D}O6C|P*w<=og;349V za}Ms?=lZBB)w0G?b>H^=_Q$X87LmSTsk&WST0(4}$c+?unX*$tOyru#Ms7+9{B;~A zvH2}GioEvDmT8dCj0nH_t=7LqE%GZlH#E}y za2@Mg(O84N?40(ctY24Z7exShjxYQ3Q)WSFYx+*0e~x?vI-JRm?Ch%af{ty_fr2NW z{cLT(_W|&^_Y>LQzdFN*q%^T&gs{v8lEFNwuZ^(xh{)4Fs&M`VSgdUosm!+Y;K9)D ztRM`+=bpldJY(<*qD&AY1-7MZn**$u65w$9QIU8Wd5+hJO$9n{6(@Q=xa@z0HvO=8 zO$4KZ5LPxAim*H_rr$uc=!5nLoAnzKXe?P{V>38sYzWzTyVVW=DkUHYiW%PqhOR{1GdMbapNqAiybYQiLb~Gm;x(V%GKmMK}eWmg%?g%kF^Q2(QKb{ZWY(Sv$*k zV`9MaSH_CyiYDlkFfT1Co@(9^Py!=h8Y~GEg-iO)Xk+u?!B8a` z1o_p-4Q0Q5s#O_-p+v}+voSgTd4ci1By;ZsmHn^@ei*^$#Dw}L$>0s$fOs@->(_en znHkxiLH5Puu50OZ$K8kU_eR_0qI=rAj{UjVq);AGkltE`fJOo2v@pn@0nmG;q=oQV zZrWJnfiO6h#E%2=H)T+k0^0}*1sw=0KQuyjMVS0@~Ih5OOTDm3Ekvnfg)T>A*6-XV$?s$v-rBqOfQc;-Tv!YxnrhiFL~Yb=hg!~ zaQMsbJ6@;dn2yB_rp65_Twk_zlo2{ZmYuYaSF>0VPhsP~zG=B0yR$7wiZS~ld-|y+ zEkVEY!AH4)w#KvO!^%!l^>ZbIA!8U}|Q_WM0Ob!91TdWB@Z!o;re^BycVee)%5aD8-BF ztG-asVU}h3C3e?XeZMT8nHlu04s^Od3q=6tpT%=lVt+|F_CAeR{`BY~U8Bd%Zmc&F zRcSbHd#cgp4%1L~#7lRCq$J7fmnii1CFEZ;&+Kp$5VP@=@h9IhP`3q~>}j4Xt==>Y z+j}HC@xzb?$CjQhI80_xgj{@_Lqz@ffk9!xf;`lg5rR~_XOB(g`rxwvLdLcz6V>V~2cIpL&?nv!LH$uj2 zaz$a&{upzwTr?|3ql{6<8I4D-xb?T~I%8o)RJlyr(iCa*QRUk?*dtj;<4wz#z%*eq z9$5^VmJp@aZk|G7T0gB-(Tyk%j2VAG{HWW#UpJ($s}kFeBzJG}`9&3wII?KB+muIs zVeKcT&ZVIg6G^GS!`nWrx+>ZD5|f)f9&p7zP2pnW*ott>7{Me>4I*P4u%2J0?8J2x=q*P?>4uTGwfZS{Vfk!9Zb zc7`URGhPJG!B{|mP9zN^CW7^XAWXE{!+{&KQPc#4V{)q1=9O5H(dyAW0ql>17_s-!+x#RMS4%TZ`?C~|6OPi}hP9t>d zLjuo1kasIMA&WjtKEM;ncX$*}&qFT`y_G0bsoosby7Kj?9>H}XTrcLf6WTA}T)LDl z^ZBRLsb(?hY*mp)SKW!nm6^Q07tSlRo(^KQJ zx$P9}<h{2ZejOOBwY-1ZB5wTx}~Tf%5hkuLFLgm-eTJdRd*QX}-9Q?jq(8XBW{WVo9#fe$9ZqkQ13sKT6xz%i;03Gr zmKr!!I_Iw$EhCOO7AN*+K^FkdY^Uq1W`SA82+PvYoq&ACraKcIs0S;Ci1W1R0Q{rV z-#hjogpLF{-wfnw>muaJIr#P2_SNFEF_Vpg0-n7`=GDz0+bAvp!7?=uz}AUx2ESOx zP4mzmd*B%avfd_P%K8P8NRaW_&I1pNen->jvmgBc=5AP>rs;hMcC2L0K{22sJ;3O# zhiARQBx_4hABcpiX+31)ho8#<);Q-dPF)0(`sL*H)rn((mDb4+g9STpCNiD}=mBz* zTQJ2L-hjRzL3E5W>*b#a)d8y~CnLtwyS|ldL14UpHdmf3{PI2L79bBX04vU4xf~;~Az%7_2(xwsa7i9~Y1Cxv9BZ;E--duWk1Z@MMaS zBUHpGriSGL(xG*)3hX05ewdvK4_q)kH+{H+6tD8)GD()k{k~FhpzLsMfL+izs{QMR zLi#LDHVchxt%43q|CdD8Z>DF~;^)va^VfGSw~oip!Mp1(6E&@aCk5mnSH|oG5hni@ z-fX@HvMmYnSe$ZQzP|OdX;@5xEDUu38QeO2O8})Duh_tL^e`|HnQ`(^Ze%BTv^KDP zJwCo*yXbaV1RJN(LK@jNy3=uo##P&SFWBxLT4%X>OvOTMUMBx=nJwSF0)C+sxcLL@ z$d;_$i~}0Mv1d=MJdyKc#vdM-KQNGB`XzrPWiiKl<)9b!MP9CMIx!GBP=dVreu39_@OY<6$nTtrla3)Eu=m^#_=FDwkhxB@QC}&N!0QE3BcPux^JViAp=@D&fx7DE8 zJ)H#YW3x2bf>5W({bjK#l$h;&8*1%tJ_9?yv}+WlaWmX2~~Qic(X|BtE5BJ?+{Xs<+-cBwa+Enf>B;zT8sf zxMf~ll3*uwp~|QEtX(w8Z9QCCpW-!oN8(NL+i-kxC(jD0jY{J>7in7;p&9Y0=!w!8 zZPZzC&&wutGB`G6Ip|rnmv@EMq4;Xd7er3%Uo*Otz-u=dr`8MP$IREWKpyI`Yr7{FA`J*TTI&3mDp@i+^1!w( zH^aO>S&1)OF8&=Nnp)MR@^kMq_KxCJ+NhJXrs!oJcB%A2;XRrFR>5SnVQCiW>>9Wg z4?FZ;=IMj^{}~R#q9U%>U3HZT+m^XgtOCz4soYodO_lM7j$PeWrv65G7xj;D*}XA_?QE~lL0zmbZc9ln9{vAzvPqYD zN32;)op%pzB_17c>?FnGLI{jmO5kI&Zng^KNB5RK&%0w|2Pm;h7dB3_$kwTh)-!kU z*L;2XAn^;ML%Pda)xP*!-Nj+2Qyvx?hISra7AW=1-`}w>#?%?d28T^Aoew3bkj}I& zoDiGDbsW+(ymbX>cos8#7@ic`u!BoHBS|v5G(ur}K3CX)6lkpf_sOC|fcPMlD1P^H R_NY)<8!P+cxMMyy{|jFYY<&O# literal 0 HcmV?d00001 diff --git a/ee/ucp/images/interlock_ssl_termination.png b/ee/ucp/images/interlock_ssl_termination.png new file mode 100644 index 0000000000000000000000000000000000000000..d49625d28738afc13905a57045c0aef998bc879f GIT binary patch literal 22517 zcmdSAcT`hb*EhN;0!KjLC@Nj$SP@W>5~_;AvC$EwsvJdXfY3roKvWO}^eCcqK@2@8 zCG;XflomQjNhpQ@5ke0T0^izr&hxzE8}GQ|{&}x)Xp+4%*Icvy=A3IkH8Ri_+$p{j zf*`@me_k|!Ag)>n;%w*R0pHm9iWNbSMdjs-=gs^Eehv%zCEk0hy7B&cjn%-wUH(0p zCPNRYrbE1T#_2sf?E2;LUmuPXeoo`B$V^Qw;CF%^-@W?#gU-K2PoBtk*(Wp1Yhfh( zMd84q$kgziJ9kZ zk0Fd+93@5R&gVxJ_esg@AF&p;w=Apty|Z#EYYN-c>1%$8I9Y3KmfP^L(|~W6*B!=0 z{a`jmSGPWXwfvQ`|I(x~9^L9ZJAfi-Z6T^tie6BL1Acsc5fk*&UMAp9YrJxX#ou)* zT%M1HX^l}5s)SWGdY(O{r>CmaG=Vwggp%^Y!c3)8#O}E8!xt$<<4pSNmS6)C;N(8AVV6 zPGhzbkDGqbL=CzUVpS}(?>`#R=|yPohoIo=-`y%^_LAP59{+CTR(9`Y$Ras_Aur|C zem|aQc@yWB}Hj(pBu5LS?^KKu)SI8e#fyp(^zr&$j0kp0zqfr!Bv_!U9SL0 zdxX^bR*5DD1UWd+Btl8%>67y5AEjnWkQZJPHr}b$DdR4X;+1o}8bmE#m6$zRAdXWL zN2PW^P$s4hk3LSEycyj5~oS!bdS z=8DSQc(s0|l1v=SkU|oGDl(-J1FYiF`mn9}$@G}bc|2x0ho++3vzkEJxIgt=ch|SY zN$tV*cK6<)G8997;*EXDG4}~JW~DGiUT`nske0{T7sh}Vpp;!-XDlbAwbU-r>oOgv zD)m)^DgyV zKlQ*(p%lTCjUPvmBFF&RAZ2qU2~dcc(E0u675HLb<1mz+GU^P!2aqSR!Tj_rBAO9s=C#%S164ttv&Db z2a5qkp13YDvzo~^@S4#WMAoo}Kibf~Z(n#}oURwNHJyXU7`x19I3#*BlI*(_KKcR+ z6v&4*x+6s8-uG&I(ent}rgnB)y94$C4n|IUx4bz`dYT*L+>>pd0W_#{kI4x^`!(+y zB&f`Yy(nfhl*oUtf>(}V(^}pxzArriaY2w-5JYxJ2}%~VVD&b|%3YP!j}Gjd1vY!i zuVn~$Pj7f`5dF24+wtpfPK_#5Y_IjP{_6`_yWelIZa6zTJ1$Lj#P!33OFpGXt50tQ zkpjr5aq!cXA9JJihkLbGKB!h5$LWv?abOEBhXZDc`|R3)C;4hHDi@m_lF|34ob6ba zj<_VBzi+aPl1-p_)MzM2WzFlrsR@P;w8Qry* z$2LCSsc-v#T>a?{IN)+=dUYJ9e=J~glf{TLVs&Jj=Ug$x8ORS~STh+wu3DlAnAcT8 zz?DWM_j9biO^m;~rM}#4dR1m)gjb_xb5dVt-48^%$38kheIcj);kYJmS8c66<3L&O zC0qgOolLx8tG(CnOSp(3F`)gnDmRG3*rQd;c}V3Y4ah);z0|h2bz>liIV|&(c{_ht z7=lt$l+T_W3IrRkK9=kz<&fmvyEw0s=wJx{*6yX}&e?cn=XK>DHi7dE8NfR?zfaO& zhi;=|*Sk{O+}Y=OrOecSJlDNa=s=pSyq=Mmom7MR{M*ru?@MEqo9((nGb`GQn+xmt zk%3a~wHz6;F`Aw^29e2U9XmZM4nfelt@uI^wl?3@=#sUVL#7eLX-&4_ttYb}==j=F z1_sLO5T4D1)>9goja8F-=SYrU))uF_aLBp+L`l>&nk&9yw!AHcl%j(Tjg6BK7gxvE z{QT71Ylmf2F@0*1PYFC4o3NnlY&vGvV4}~zgX1)s2w^g~%3jtc9PmYD} zrUA9cg#+ZN)CiC!XC1gac8v&pN9;i8J2Vs5Cc<5*nQmxHFWc8aAiUbh_$!^F{pp5& z<=grGG97ox!T_znJ0QltR zQ{zmZqx?}+K;W#J1*UDPUF>f;{rAoM5ANMmi1~3NnkP;_U~phS#V=PI*?rJdwx|m(tw(dhj-I1;YVB;KJ*a_rL8vk~`}^kh*Ck?d|H~GBnaZsM)Bh@1m6G zqcvlU=EzIjX|t;`mdNGswY8a7CeS^Ua$GSrw#K4t^@g-iqAXFYs3Q4F7S3}%cfo8{ zKDMif7$w2ftvCom8T3ZQbwGcm-#(_8YTUW`H`7jg*_i54EyhXjz0Nf&@J+(%T#n}- z1WnJxKH8qi{3Z@WPF9v9dl_i5T){L?RbLvP7?ULX&B}jc>AOP;+e|ZVZ@@O?@4zYX zq%OW?=EIwap0fPAe-IWDYi|udp3~GrU~zyb_=rw)_iajVjKvu@J^r*%-V}=q2)KrF z!v{WVTHJ%o|6b^T52q>hN%H~ux{Jenru?{TLbXSIFOuBR)==gjuz>_2WV(MPeFg&u zCCP_O5aH<#EpO&cq;)lfar)xZo?p~)x^blQl?VgP`7dGgYgmxq`_(!80QRWaXmQY9 z3{)_SjWnb_G%WjF2_JaPJ^z@EwvdP6kJC*J(htG$|a6DqDn{=6!t8IsG>zu;Dw+9(PvT`D;)w=F4Y>drRj?@JGAB-6fyHp z;e4;4vgQ{c1;k(LJajM4CRzAifFkahgD~c>D%o$mP*(4m-`NtTWQ8QSD*{&Kmb(~aThODRox5@hpglwHk5Cq=$%ewgz=?Sm6Zp6D?rR zx8-v1cx(q6OSrblb#UM3rUQY!w;Z%i15mB6_iVoh(uG|A^A4aHdJKvzu$lMDOd{_K=V1;F&RBP#YFQ^ja)u8tcSN<1?|vp80X2j<(xS>Aw3dZ(bDptS?O| z&J=YSz`5qNLdDNd2c?4H2;a%UE7?w`=&Vns+mX?~&K*TIYQ`_%;ugahc>JoPi zjZp&b9%KXvDGwxpKSwC9p9 z%1)nWi%`9srwHl;I`Ok2$VtlyFqF<0Ya;UEt;;^01^m%Spxj~ke;Tof_EA+~+3axfV4p@3dh-FYY`2Q?=;fGA))v`MP1<7qqrEE^c z0n_*Gt4RitHg2|zmfT5=v$Iv7&P=y$8BcWpl}}Z%;X5w~f_# znS3i>NdRJ@VyE8RTU)QX9-`iRT}{HQPi4F`)GnjcGq#HrBUYH-x*+*HxY6GQgz_WXJ4L{As zXO==$VxBYr89X}DE)@cE7m8FroX;A1ywBDT6Ud$_-MAgN^?KFc5`|iPBk=7rCG6G0ta3;U0W-D8R- z1&bknWeYV!K zEvly1G?9#nWLY(f05Zr#DGBP{(^6uY&K_Ki_cIxjlW)Z9mir~=tY10wWELfdHbE@2d$?irs)KVYnB7^AhaP{RG$O+@7e{qs)i=3jL=! zXWxq4mWgOzzxJq)>aoTYaU(QOwTK0dv&81vWMgF8I3|7bQ(oSTcbv87x12M3^rNEa zD>1BFl5yDZCgV}Ym!RtOH@|~0eNHAp87NP2wsNse4vs%#(HgU>W6#8tt^niA*zo_^ z|534lDg)~^hZrNXRU%HgvE16)s&R3|HKJghn5iH6VsJQegf-1q$xCF4Ibp4z{nWOQ zWF~YaF(TJ*1hVH#hush-D*fiizIhB&8oYhKPzyzZk9xH_^n! zQu6A$uE#L@(p+mTOGdkaCW z%7y87=vm6$SIj;{4ERZQlmnuhL$Xi2;FDI9S!n;Fg=Sv&J8sQ^Ur-dN;KKM?XI{jXd6x zbLjmFBfTMsB?h#C^>?e^cI+nR@ z8?A@0zHWJTt`f=Jl@no)B@O(&xN_gUtvz8>)gsQe=t0NS)i?zyDLa|BL{TE?wf+cs zSOf5J0Al7O4kXHH)25;hy;4c>C8J-W_NZ02q1MTgaVWylX;0-TzUq_{dpj+AJ33CE zzOa%IVS1RY>6GjXDvxu}tcA!mX83`1hH*{gf%SQTocZPBXbi<#P#q_SoU-4;e^*L` z$r?;F877mfeYr>ah)l`}X{Ib0pb3bh)b0|*Zq9U0!@S@(5yhQax9;9O@6Gyjues4> z%Kk@I^r59{t=UCfS(Dczim$wFXWR;jj5?;k)KWu%j6!L63$k^da_E+CZ9H6twB7gG6NAwK)tSy>G}4fXI+PI1tz83sY7G*B~n@e&-;9ejb83I_-Lp^uim zwyFE5$=sL{fu{-d(gw(6Z45}7#Ky(I6Vn<%bxJe&FgNZod%7ZZq?b*)Er8DLly9au zpWeCArYUIp(SOOMLJn3+C4ytM`|dqj^O$GC`OQGe4ek*c+N%fuT7}v%}vetvFClHUZ;>E{EN{OR4 zAyBCZ2Zwn<(X8*sr-w>o^dq}OwJf?9jY${TzM74czl`<<12^LyIVctk=l|2Qv`4FK zQDba)`6;KAQc~X+YR7z`#Q4H@Ye#_HW|m>23WhZQ;Bt3%rYFx=prgt9XbicuhTzLy1E?9-=-T$xK6IQG_m7zx3DzQ`DOF{Bbwt_{EkdS`NOI5* zI*cjF&dYOs_sh10zClBsooAHxRqr$;Qhn3Nf8#Wp4h(g4e6$JNdTK2xCq15D8i@bT z&64MR{~98lpJx%i+)G}c3~+UIMcNeHuFDyxcSV@WYKg~ml*7sEzgv$e&``i^1sO9Z z9^M3iHq6GoZihxATb0N}oY_E1Nl9rSgnr5CJ(qhX5{c9~pdXTs*~_sySIS5lqrc8P zdWO#zq4KYO{({=N4zhJTWK_L(2U}c{{~1b?`z4iMK0Fu9J5pNX300rsau2LI_e-le zhoPE-v*YoZqVvmTFc)9?`t-CUnOn!sOU)hf<@TK^ya#acR|^Lqi+c=Qpgw8c>N= z+#^=91*DRS?eL)0323DOi;_8XOKwAW|)g8q(n7SzEDMtahIfOV(In9 zDWu!UIJ1am5OH?vVYmIn_L~TWFOK(O>4u4Qe#-&tYs$7|vGk5H>(6U}vk^3(yZZXX zZoj5~?k0aTJtS{gG^uPHR$N?6^%_U&*;K^Rr!y64S9(0w;?VI&OjEY$%D*NKs;H{Q zJcTqfGBWN}fOPp2M7tP6H&@rB*LAANR-wbYVYLE}hF}Fl+_(SzM;LbD|NF}S`sMa- z{?{x2>zDtzJy_oTN*sfs=wz;%v^ZOhKS}Vm+WtFO=RY`@mLFlc$2%LtS@4`vXtt2TDY6a^Jq)tZh|+spf>NZW;77ZJCfh9tR}WFBybY_udDsj-y+< zgKR}G60W-d4UBTn5%@d(K>SLG0OzSwsS7ggXz{vv6%g+EYK>+%)b=G*9(8)s$^o&D zlCJy3w?dq!3VM?E6d!UbxemUR#aT(+Q3{3x1a>Y?_p(vqaJ=P!ZZH10E3vnNlVkt> z#D&t44DY>-oWb%wSGrvr!sNhaL%Zr!I3Sm|Rp~c+Z{7PHmUE_ODCwHy4}VN+6O)8e^*!fvE~{|y z)z&_zqCoFwn`(}PokNE}=KaDn+Y_IWy(sUtdBL8|GHtLx@NClW%R3S{vIn-Z_-a+Z zOB(ffihD)2LeOx9Y<9=};Oy7wwIuz#XX>pJpg6jr(I7M+V6@vU&q|fkrPvpOoH|3i z^+Ho`RGyyxrcT_tkoT3uM5q9qQ9R9;06FPN^9DWv)Or}n90(#xE5`zHVOxZ(tZCm+|WN;2iyAF26DbA)tG}i<$g0NMe)+ z+NS$^Fh}Z*Kt1RN{8NyOeyt7V^F)>JfDXVvH@OkQ6D)pbXA!(29NED?H;QlSOL?0S zyw|62aeEbQt^G$rc%S^Bm$O#}ui}#Zow7cD{8&Vk4tTXoZ6vr;Uwh$2rx0c?G_O2Q zv3&9nE9v)O7DW(j#%S1Uy8E@)BUMXK!k@GWTJF)ER%WwmwgTV@XcB3w7$4;7usRGX zM)exxg9pcw08+McwQ}Gqp@98Ul&AN?ESnLeMg_uc@T3A?FHZ*pvDhNj?KvO5Bvd#a6D(AYUQsL`(sfBk*8JzW)EzQn2c8Ft!&nKW0ciap=PxT7Ye=ZvH25J zpf)m3lzvDB&ebKQ7ue`uSoA@&;jU^Yg*{C1#spD0Zeo&&LYW`f+fyw>9ZvVN=TO zp5Pr32t+3=yc!jFAht{C*}Y@Ur~GM2zCH%3ZMR>W#*j1@TiS%G_2HUzs@@n7W5MuzPJ6Pm>punU!OII+1-hF;8X$N)p7Q+8$>utbksTp~GY= zk#swuk9zlZY~)QUy?HJn(wXYh+;@w7#D>9?*_xNpV94(KF+IC~WMjBeA;z$c$Odzo zzBX11z3HG@JtN1CJ>AxqL^_;ewYhk(20xS!JW6>HEd*%`@3>ujSZY)PnqiD5fsQrVogH zQ7WDAnQ{}!UHI4}mMABqipL9duNj7HRORHCPm}hpH_;bU1Xt|0-LGAW2+0+{%{k}r ze1ocpEjtgjbr73aU$aWlgOVb%ZWmQTZFyRn=qPUG`g>$74=o>ewCQ+m8VmnN({63u?c@X)D_|NI_9@o^#NWK3cf%TDia!+J@>F zbAro#?Ix8JIH81HDMe^iY?Lb{(p08rm#IFjefM>4Y}Z=FdN_mSa@oXpD*C78U$*`BWmpFFt{To3xjEtQ6-3~yh{v_umdbPAeP851S%R-D!3*p7H;tu1AO zF84++spva5*UQujzD`7!VX0~ z!obl{a`^j6gYB4H?h&1?Oe?qmG)V{&a5v<1Hy{n0L9^vC_iN>2nkME;hS|1HdKSz^ z7LLCySFr6V_WV&?u_NmQPSYa#ZXB08PgnjH_c04})3V%-k%gt7iQ>sIFWwc?5!ed; zS{vNozN()R(<>zc+$07kuH4!o4xQRznT6r2rM_s&55Zd_ToLBt8qS5jQ z$HrLmT~&zRlMWWpPuC5bqvx}mvbyklzBUt&IRwwlo;8f+e^6xtDaa5KWoxMJgUhAE zO|E9iw!_1dzMCg;dNg~Q&TlF!o3CQ7-?#$eD@Y4G#~_D$sjbjWbfr7>V*&aavTr;9 zwT?6pYjaPK{bZx-Ot#>u6^NDK|0W^vwDrKy@Xl{k^UUT*(|d1PiC-BN(pHH%^0Xjo zQ**-3T54Y`UKXe8ONauRM!zbpFiIhAOq8_HUgBb#Xno!uA0>aoX1M3R>N>yy^<2Xl zxb{Ga=T*6G8CbQ6v_M|TV;Mq`@&6D+a4ch_| zYEn3g^40QH_tiCtd=FGW4Wm)@~vO5=YNiShNva-EA=jFiR+5aQ;Ny z&nC`zA@EuGSYpFkpr^(wnesOz!0)GxYK`3jc*!3CT&)^<0_$MRvAUR4U z-I{TiPgszB*Gh*43J^1h9OpN!sRK6dC-I#?7C`zB7cmPS)8)BNNu#A_Hg1r$Lp`Xj zsN%^ck(uj2?HA`@EH|YwEgF$M5&g_&cRr|CJl)HttC+S{Nd)+<{Z6ggwX! zTt)~RRsACs24S<;WA&c}NUV7Np`LQ}$=B;q2WTFZh@FEk2UqR^BF9J~KW0C;S|~)s z;_sRAhiqqKZ}ZI%yeTgGlc(jvL?X)qeA$QK*$=Dv$rb8X59xgg{HE0Es@rv(gO`qT z^wYGU)pL7-&6myBUR^+Ix+EX@reb^rS^*&}fpi*9;M}(XP!r^)8uJp0ids&_Ua5B} zKKSilZi;bWu-gyU?0T6&hTKDP;|tZ9J;tO4rt|nhLxlf9r|aGJ^Mx8|1D_MdSjHvq zec)8XF_T=E4X3>ELtomWAXZc+QE6#!oK6(Iru;!inqdP~r>Lk%a(CQOy(F1F8&RDa zo$0An_4+w3WBK_)8>MT5x!?$sfavz_okp)K#!lC)HYmDD)GfafC=jttiD}l+lb8RX zii{ieo9fI+kCV4jIrDJlt0cAcc&A6%^(UbJ-#b3GP%+Og1Wl1)@#Q|%A$Q$S`CKp= z0}>BCw4q>G^nfK<9OZxL!p|-bw0HO5nWgQ4Os$6c=UKWeUyUMWbDpna>-RXBr_H(p zgM+@$j5Ia5Jf2LJ;+e$0n((Hn&YGu#NzZi%8N9{6^!g?{F1-T%)9q0YE=@WbuOm_C zW63iB4!I?bFBIK9s~WQyl)ZnrwJCMuVmAXN?)A~ASA|+2X}6_+`tOa~26540*@R+_ z;JTJQ4}^oW?ndrYOqLv7eko#N(QuFFyP<+jxt9sg_ssP4O&njN;>BT$5?&y<9(BrA_QzM}75f2)1)IIG_CMQ&*zDiG`2 z{nD7GW-*uA{Qwln2O!hfGjH??f{;%-`7#k&Yj}mKrOw|PifB4}I93 z8-r#<;wUFC%(;q$Q=X3^syE$FUthQINa*w91qZ^uZi`lXS>&2;MES`WM%20WhUn<% zr?7W4GIfq!n7@YrWyM>53+gcsk%!3U7gWDziW6Q_e07CmEE!SaZtUl^5Dwsv=PGcN zdw;e*&W?DTg^{q65m!F`kWTbGpTn1@6Wv@j?O*1EN|sZ@Y-u&TqERM18WB4sL)KFw zjYsHb_5>W|5rvUu^eNz;DVhZ2qoFOEM;(J_HYVn4J%*W)rc%oH{vnCk|7`Y_U!n9ikuNQdcEJKM zV0F@DnOQcCder5tl<5X~>0P;$S2(?hb?+gj-NfmJhT|`iLHB~akMRijI;8%2DaZOT z;=&Y`YWAa4^EB=pk($-;UZE}G;WhW@ZWxrD6_OV@^!p<+%APif3PlUey!UlAkWi z)KABVEnj@p$!lq8Nj?hoz5h3e6oN7FsEEPVp$m=y-Sr|@K);rhZa{K}+x^8&+Xj3A z^dn^t{hSp(Uv&E6^g%EV0dAdOaw2wm$8ET41mr@GiY`bvuXbT76LkNclx9~eGVCB} zlSCdc1mW1vJrdvk%dJ8|?(60=O+61iX*EtcuNosCUBK$#tHyp^z(9umf$tgcp> zew<02XX`BcHjJkTd;g_Lo-JFABk)4)B0NO_>nB#FMM4(K`4X9;a@X)t{>PonH-5f2 zBv2z6N7B>MJhyzid)PRxq^RiUa2$V-xyZk!-~Mv00`9_!oHBgs&Z2APnIxO4an3Qv z>CS2S&n3eUpLH6yeicMESsD%z2|m9X9V zbfV?mf}8f^Wi3x>US2$-tLtT%5{r9`$cPzfsN7TF)FfYhqwi~zENxDzf$^5A{>}7F z`A`Q_)2^>|XL{811NNP~c}n5)n#LG`hwaZV{*Dp8m*BF7rFMS`9J%fG zaP(uU58}>q0yRGg5vWBxOw7@@^BaA9w1FLTTmk>gDRRWWe`9U&=+0X9hhJXygkxtd zXpbHGDGg?FX^cjy%-Cjf8)~OMH7j;DivIe`_{<-`w%84@ZM~y#xkqp4%?-<5n2kBJ z+DNtWSX(Qded$qlcDf^zm_CqJA_BT$Z~%1plV?QJ5V^7W`R*6yYt3SlM?H>Ubc1hN z+)4B%>T8J>AG$Cf!s(uZ5;z4-@`d^caft-)Q?OQ3zQ9l%(@u_R7E-V(arvtOjDKlh z#%7%Od6IM6Q)I$}eMm+EwadVXx@3p6YU8=d0clWzGk7 zXL!_@%6(=O@Kqtd#-^qxM-C=|;bhrAC{0BX>SIn|JRhlko*HeqLc%^PFRiKyBHn9$ zEf|BRhk2Y!fT$J-1g=&t_xO_7Y?}4p0h=>^=}*E7+))?=Q2F zT25cZnBaXYO|mfaV-5JIS{ADm?-22VV%$)M?bB1MKB=Eb_^}2&?Civq&iVZ@eoPe@ z_yQ}MyW%UNR-RZ7nZb+f5@$%k0P8jSTANauVy|>fAF6JxAcXw0 zdE4{S>9B8V$==-5yg=1OTtXM{j7Z*zW_|1U5$AdKJ1|kNdoaqJyD|+1SS8JtR~8=IJqxBqTPRUFV9F#L=#F-N1Vy>XAJRxj0I9o>TvysAK5J;214QM z-qQS%ACxu>ZrXgg$SG2I z)1?m>^1#5lYM2Z-0Bg%L{R9BXW;djv}0gj5>$Jdi@3 z)A;$(S~v&HZm^d|Di2P77pMb}NMCR%%@hb^@Y1Tb>ON`{O=Of=scGl& zmA7|)c)M9+j#?n2%jG`PZi)Qqz+6!yC!e?xkZhIv2b;L6zOOT0=3O9d6Z7+6o8xm( z%D{`c3P+8sz0OqJMyBVGb z^I)K&Ph`89z&oAv;~Kc5Nd40tSPdP(>&%oN$D`7u!^>5&4?mpN`9h*KQWN}5tLz73|5?v}|EdVJ%YHaVhw0+wL0DRS zxP#v|sq61WwIRL_zI)HB8OAOp2sDb^MMgKvTnxf0Iib7r<|}j}n<@Hv5&mbT$EP!Q zkFRUR$HzAgJcgiydV6k*bUGdM2<{(pFj znYPS5Qq7*`(O%d_(uRxh)-{bKC7rHa9KjfqJegHJa~Ij4_9fuFJ?E*C7bOp53ZpXL zk-q!@kvDaB`gjymS7WK#bT>mkov;sT@2F>mFr^s00B*^iRrmMPnX4XWLy*kM!z!jU zE4S~xlvCI?#x!b3QcSus$j5r)%Dtit;KawMf|&1mu60mS zV_Qq`GVl(5^$!011bzpMMhaPU39xX{8+(KkGAFNfKJA!a!8`~f`&PU?Kniw@Yo_!2{{du-kW4 zG5mBkzida1?JZ?JWu|uw@tMj0wOt{x-(6a$Ualj+k~C2%S}RF7t+ zG34*lv8z}YF9_}5Ih!@;E^47X=N;3Q1#W&2HgG3KdHp2^v{e4G$bWhIppBeGzGNq< zW~W9rX8}wu3_7Qyw4+>4gREPXU64L~_RoQL;CoI;`)5Gk>E8L?c|8rYfrE6o(4O?8 zgIBuLiJ5{Ua8oFCJP*9IZUWo*MJiZ`b$+ef3*%iGW_h!FSFF#?1P~hL?%?4Y<(bWx^wCcdS z&Rqce)$&$F6MlViz6Qr)bu#=41uAz816=b#s|7Nz@KG_xc%n+e~ zNJjTL;^5aB2RkDL%(a*TkVWi1dyUos%f7qE^l!gKi>}oQ2)`pKJ zl)$ncct;9=+Rx`jVI?Owrv2!N@K-*^00vekUm;onWp?i>uCL4JND+WCZ9mvf`)RBg z0S4i{b$aCzlb=?z|Nr7Q53dbUi}l&8hPX=~4) z@1h9}zC}RPK-;y!K1MmQFh|jZUrMVrqMsY!hFKp-1ER0bMuve7Sn!F>0@Y;`;^0TX zVkg+-)?ZveA?J#KLI^z$u;LCuT(vxjJePqKC17C>$U-Bbw&2sCPCC5WjmLU6Twov3 zTHW&{tI^wP6^8b=?{X^sAIcC0;laBy_CNfDJ_BvV;M=gt%%m8@Ydepne2yyTfsCqn zhQ~B=ZseU92B&C~mTS3$mL^N!7M%*ZhB@qOM{~8vx6T@OUA{HrzI%DDUI>p21CJsa z#kf^ut;CyG8*RB!s|%LIAR zmf;6};5jB8NuVVMymqUcZ(Js@z*+xcG#fl#V&mVHKrY(!foG^ev#6A=ZR@JY0uQ$p zdVM_@_DWn_yqEBHV;z1<%O#yUSVfgbPUX7TfyX^c$dacqw<9&Ibc-6P-e$2r&ixeA@#}Bw&<0bjpiD!Cw;ju4b&Zj_-4g}3%l4; zhS>7LddwOXJhyN?p;yeUIsGb_?l9K?n^j7Z4%G1<%d`}1bu=L>Zs5)(>d$a^5WARS z1Zsgh4if8)s@2B+i~!1DnT(|GkcR~KNTtnbQM4S0E zL-wcVWiT+zij2OhS??t9=n-uD&pm+cn|VOedx+8#dnP=2%jl#tl{d(S2nf3|E<+jd z`TnAfZU`QC5#)4_RyU8fzDLy5pdkFMXW!HPtOE5ltcS&X7Gd|&Rf+m1X^ZfQ~znXaIWkje*jm`xw0b^P(-yk~dm8OT?4xJXJV9xz~OieoKl~;B>#{yN)GU=z;xt_Sn zij*l35&JwfTA+mVQZWPY=+wfSjeHJ2`*ecXvt}JRLhCEQTB?KU@bUg{WO|jFH~F~A+`^FGN|O8%T=`6 zd4sSvkr9C!aD!NU!0*8^I-B5(f`;TXac@Bow*(^^d_8{<@)O4Wn;kYxS*$?B}*?PYhp zqd+LjOK$`d+eJQQ%2;bo^fk$bp84IaoQJoujUgMh)EC#7NiQ6bml& z^!N7ZR{Dd+=dtOQml#^q)_rxRAdGcR+Q-Nuw?A>_sL=VZ*kktwn|$7EsZINrp5Htf zBi80~Gr2QSw!%h8_3Plo=bK_53SGgZj^QIX2slyWQv=zJZ-qTL-_~T{VUTq)tXJ|~ zEB#FA#8*@F`z*=e#l&>6=gmoU$;;V^du?{rqBT8yzBV%x4k9#0i`%E*=vIoDIfXmq z5H3$D|Jt-;>der6VX*41T(RIqmOv{NYXWAA*emAw)7IeU6~MUHFeq=Pr5g8n4avV@ zEe2zRYGaAQ+H$U!owKd!56u(vJ#*sye5hHgS|LtPD#v zTkWd-F1^Td38mf=-@yLFoJcX8l>xMF7sY1Ei2r$RtxZ zSt#%RT>@+xRAumMJAE7k02Oz>6ON|xH4a3aWoCr;-?3;&yf7LLM| z#eZ=Lh?ye)_rlQaVD-$Nfu|iX004+%#z;f*3S7~9f7tfkU$mXyNv%t8fhiK4LyNb; z12}`&z4IT2wvoyWrb8O&TAH_wX{eKLYy*U^DgOmRQE-L>g%E&4a5e)O9{?o)mN|k? zY!&$a&n%1`14um>z6nmkMfLFy!lE|+`WMjr%C}%Aa8>x9y|a`=pkuxV0Fnms+D@-p zaNPuSm^Z$?@{9<88~!$MBIo+%_#DPi8cXmQjGw$z`gX!a^uS;RAS=k}A&daFF``qL z?&WkHvH!sioO<9s^nW42^yW2gD0`!x{69Ai`^!$%f{J(qPA%Gh&tmNIIpYcD-rzHL>~ zCjng9z6Gic3o@@(NV1b+fY1!18BRz&^VfEq0Zx@%f)UlPUu`3--7^KoFL{Hf@BNSE z4?;$}Wmfi5jA2^<%L+rc|MWK61~Xt`r!W`9e>9}^;9roe%>Y35uDQ=$7$!Tv+eXD8 zpPl0^?v0W}EPPB;N-Hq|Px`H)lez{}e17&HEqa`1HBOAN%aihV1+5n8B-8d?EK|6& z%Z_{D3d*Y8aIpcvvT8gJ@NIxYK~b#S==dD2lz9X}Q9M(iqYUb^b4Pg|U78WjF5BMh zuX=o>Ub=nnd5v6^e=*;usGweFPL_-7BQRZ96S^p~lq$supq)!CAUGpjqz_WBmcai1 zXR2T-tWHjqx*-8qNo8C!lHK)YZ;V3dGe zP*~CZLQ68G(*7+s_X`6hXHNUv>;*jh(?Lkp+y9Q^S1SV4!dm?fRYw5&9RcM@<{0#| zX7$&;x1|a8-z^RH;%cn%2slHxG%QOm13>ca^Zx&pB1b=+6V!u`d~S-umXzHeQSQC< zP0@R*J@CVrzs_P|-HOsoJ89#Z#!p2U+`@lAYvdC6&*|X~9Vm7E*LekKZu=M&2b98u zj4r`pYx@|t+2iegDd;VOz6%JWV9F2u>VH6~+qKz0^uUwsfZie}=egxyB?>gMU6uex zWN^S89Y6YhDP<)m6P@9$+;VR@Ok4k#nT2_w@BxkNy1@&AZ!C+dHl6xdmu6&?tHWvv zu{xVlV2lIp-y`ee9}rb z9&$TBT>gC*K&rfEMQg9ib=dU}Oh4>p5{eR1k}Nh{d>Xthz=-=I#~Ti~jZ@3h^lnM+ z((_7O=E8hnY*PQm`sSDep$AC9(sXEcL}8RLG+IR%^YQiC9V~S0vjh4BRbG^2?=O^$ z^-aHiFGo&Yhbl74t|%K$8*@;a*(H!F5Gtf+V^tJmHNEMjIa6%o7I3#ip^3Fr)iCp^ z)ogRop(bMG71Kgna|AccJ+h<0TWBxymfIk||J)F5FF`9KAtlz~o}`V(u%qbcIv3|D zt_?9>XwHGd?|Mg;yheU$wWrgZ>+q1<{SGlZ_7=gHP;2~0kYupc#f!P&@Sk%B4hi#J zw@b17NgI^!WQ)3i{O6yPFA*nb) zl4(x^W+`xa_Bs1H>6%5zvfH(a!AG>0M_!dsRG8(1+f$Z^W&*143KW10Y zw_*1LUk#VXiIDVH^Mrb>BWZ|sg_WP_r0hPjK9tYI&77^gY%XE4sQ$|K#|C)Hb8Z0l zsK52}7H%lvR32Lp8rkQubBU>QgOwkWr#orc9nfuxlqFZlkSLc5Tn$N;UECvir*+bp zV^x<`aq0vI4UueaOoxYiE;?|Fo1c$LgsS#)?VkS~oUtgTy@o zH>^eiPbrK5`UHLMufHo?#m`11`-l254qQNDHY#ys>O|Q5_z5${S?U47fHZ}Mn2GXS z{#xtjkmml6hOgb<3LQ&&_C~+T?zOWs>&Y@0z}5JQvl;pKHrJRff1DGwk@z=)k|pAA6YqJHqS(rPY8OlzZl2Qxf z@Us?jFRNB%2w|hwqID*Jt5w9^BpPeg<~S}*_4*#=wg&X?9gfoW! zcgu9A-Z`+g^hfV7Y(A~2aLy1AJ<~dg$d{WwyR#n`^+xGcPp3Olxl6@(wbm-3J`~=M zW4!5)2+--m0i3&8Z9Dp6uUo@8N~Owe3t}P)W9U$(%;+BT{AI*bxGD3D7iFb6p#i#a z2x4Cb@TmujILMXBF7;} z9M6&_b^ONZKQi~1^^3=Y7SsB66;?j{YXwdMcJa!OJCgmb`uE4YP8>EG9z|n3)Vk#- zCi52-)bmq_Tk5VN>7S8Cs3rNhRx1i}SraH; zPx8a`{8#-cONsGUTN#gE7hVACu3+}JA94kv#8|I@Y%oH^iseiRs6I{d_fTVa*g9Yy zRZoyLfp!E~1mFv@-3Cz!=^9dW2iY<8R6zDVZ6M{2lT&Z=EP?+cAeGSbIpvuIcORfN zwJo;^kcxb#V@-gr?7l`;??ymDOb{39bOOMbAX*vsCk&91U$a?Z?o=C~G!ey|uGvre z#}+u{aP#?nH$Mg$1_Y{xKX&|xMv(D|*&1mNCce<8%~xVRebGtVPVxm2-LH|RA7rhGzaziAuqzopo!npe?i0JPd@S^=H`0`%IV`+@+C$uW@29`rpMxw<8 znMXzqIKrRrk0qe}39{gVB0t7C_H$98$fAZv4ZxLCUo9gDG7L(MYAQA9jDFQVG{-v6 zweoud?q`hTsaRRWfw5~&EA|G|xse>zze3YP6U8Dm?nzk6Dzy>%aAo55k>Ewv?fl|K zHMH@?td+Oiwx3ysiY%%gXw3JWTZUnCk9l~Hc@&5`V*+wi%iDyUJXPaJPJ~~MT;QJM z20E&%I$e(g^=%^k^IaBnU>I7!+Atl9-JO?v+lJuxWT z-xp?6C62aNs~<7Fb!5xSI3M{X76&pkvy0Y%klLE)>UdE?iU{%jd_2?Y1&w@Mz&)5p z(J~K#RdeH-)=w^V&VsHS>oPY$CHg~*b_BR8#`TZDjFa=Y5V!`VK| z72#FN)Sk$S8S*4*+YwyI=Ft`wjt5s(6jAsWxA_OFvkE5Cb$>jg^=D<{tJ#+UqgZ>MkKM7uX5yxPL@1SQg=pZ56b_mnexXn2asnip?Z z311xikSsWC_A(K*r=HhgtkIH`B~Q3FLxY(&Ra}~R6##B&_ycp&$+M$&MM<5Lefz#E zbCGU8`z=MP#Oq4GVU-gx6;HSD{I`Q_(h`|L9ifvwj1PL&;NavLhXpv8Oc@qg@s0Y= z4fjb#gH`7eXaRX|J~X771M*W%r9*3%6v4CZgXKT#8p4$qDYI78Trs*t3aTnekhWxDQ&ndW$P? z)8?3fx|DHhZ$Y%Fn*ti^cZCtj@LP#&W}&|%)z;EWPE=^J2QxZ3w7A{_w$nZX*wzTaEBLrSiGkWOd{-z&DxTBx@Sm5;#;8#A?`#aRL zeUyxtoIAgD`6Mh?I%w!RTTd288nFT#2x9cE=n{Z6U{A#QSIZN_m%?jCm5k6WDRh!d z7Q(`PShY0VSnx;7nM_`Oofw`eT*zGcJ zWmFeZJ@L)dLBUY%>amZRzH~;pAl@<=SuZ>Z{q1u4=hI0klg~sGJ#>)G`2QhN{F2#` Wf9i2}B~BS@J$85Xa%pr9yzw8U3-Nsb literal 0 HcmV?d00001 diff --git a/ee/ucp/images/service-clusters.png b/ee/ucp/images/service-clusters.png new file mode 100644 index 0000000000000000000000000000000000000000..88294a76ea34f3e766b65ba5b482521e5ab791d9 GIT binary patch literal 34572 zcmb4qWmsHI6D5S;p1|N9+}+)RySqCC3GS|gYtX^n-GXay4=%yoeTVmZcK`2>f$2N9 zyYKW=cU7HpDne0S5*Yy(0RjR7S?ar(G6V$V5cm}f2LrxBeUDcU{s-x-EGYs}HGzK! zZhW>7mJ^16sEtK@F@grS;eUMBa)y9F>HT;?Vp2)_LqLS)Nr?%oy6c~2!5R__%s0h) zo_A`r2WL_!i5_vB;X`{m2`@86N~?yY|>ZAN-AI;EPHYj)o2 zzk5iwUp0E08Axf&RJjm3nVg=i+qs#qbF*4ZXg0uy8)1hUrJ>Lz`{9Iw-zph8ntoi6 zui;`r>SL0n)WrX|Ui6g?2yPVgdsPM`~bTAnDgH+F2o6Te{`t<>`p8lt~z*3JMAcC@4iIC$=>7 z^lHix60wAGF)=YoNl66-XwWb)3C+!%g+)cma&j@U^-WDh@nn+9KYz08wfqRs*48%l z)YQaoZEI6jR|h1grjD_}!ongTBPZWSJeQT1Cm#Cx`d$Sc?+8Ggu@V#e;}Z~2laU2k z+t`@3B_@6q7Z+DjQ^PDQE*@h;BP3*~ws;_%GvVzH+v*ETtgNgYInT?>3rI*zOiqeA zhn&>W(vlkf;*QG9%se+Y_iZvy;8%BdH(yghLGabpl__pjjPoXrqk%iX|9QxHQ)@Cu zka4!6qGH$U_bX19Tfxx4fZiP;DJkhNcp(nFsAy=8T3`)N_}x7`loS=?Ue-oON0a8F z9w8TdpCKOpczb*AdR$uB*(KkHY^)CsO6Vh=!@9e>4_j1KSEo)wUQBrV`0Um1?e4nh zqHYi{8;dnx5mg0wgFszjv&9N-yHbt1F21NOfGUrpIqF9wAsr;Zhcg@v+x0=M`OW)R)X69LDNh=_zD(ZT_V)Hyo=bzgqHi!HBqS`|003b09zJgJV&a0Yg;N*RZ|7dTZOcoN zr)p7+n=R$NjV3JgT=)+!CMIT`cUj3fcbPn_%Tb376ZM56tK1zR%4q{j;9?2+X$*J-%CPeS)n_l1 z5Ce=dw3$U$k!B%%Rr}c3p-9O}tV(VmSpaY9v-9IY(ZxkuUL`e3zkkG9w`rpxpJNSe zXSP`M9hXjq`dH%%SPyb^z5~VoC{+L^jY-%bgXvg=zAV$ zRLVulK~5$*!`c@o0S`P1IR7pux)q!Y(dTCVus+Y`J$LVaUTVcZf;zYk1sv)uw|ZE+ zuyvQX^=x76fa3eL_1yC~cb{Lh#e3Aw){*^WtGCy^-W4|SDC~n8I#l-9bFqBU!@uR; zw;|`lvFp)y?{6X6X0+VPPmFvnC)Za@`8c`c^_w4?(B_1Ha~*PG_Ho&N%i|Jn+czH8 z5t*IfuRF{xBs=nk==y-i-1W8r-&dw_zwbjH0U4pOPlQMtI0Cul_lBD5ZKJ4VC2mzR z7f9|Fp_8F@1#WL^KT!B`wzz*F0olDdlF%ECtljl9p#dHZ zLGHQ5kDZ7#8D*CVHAF1OALgkKUQmyCpkI6uVYvWa(>xOD-0_z0yw}0;y`ekZM3@a^ z-}C86J&r!=(B|`l%kBE}HUFmekw^Qr?GbCqK1ArGxjX;uGSUW=V)bIqIpolGem2z5 zCzTxJMb$~jn#!)6E}F2x^`NcBsyjlY$?|o^GsvN`bKy?dzGt;qXs$5N3h?^tRSRwe z)xP+fAm_;OHx*BYdj00UaB#aK!bSJGKTGBpuSvQMHE&n@I4{j}r%an^v?)U?8Nn?H zgWqQ&{PvcYNAPlyJC{2{R+HKMqX6&$n$Kytd$Q6PHIdCHYTdC>{AI z-0f}T2(PB55g+mpi__K+@xH37JMwo-1(=UyuDI%aeO+2rwMHEY{wT6zbLUk2tg6Z> zdTRBzbud?N(61rnK5u_`M#mVxp}KLBC*wpWB_%6q{$Q%qY)U#gJx!kL zk#d$nd^P!VJQLr$J|Qn<7E0;?9l~bT>z={yL$kcx#A}}Z6)+?K;cRZ0VB#xpprocJ z`tEb?gK%?S%zWu6O~Z=8o#~!AIy!c^KHr>BpO~1y!xg|KaCuT~HGg$HyfLZqF{qB) z8L5JsTbum|NMPjt!gv5*dOWQE#i*0nv{Q`)c<%iIA49~NQ6!(4Tfib3PvCVwy`1Fi zGE|lSrV<{nVSKvI;WO|Jg~gEi;Bdh{D7wo( zl_s#YpsDZM3##r^YomDL;ugIZCEPfZ^_3p zNqqDc=(#~-|CUWSUBERsG&Gw;t&&9l@f$i24<2Q5JMUWadWwMuWl-xQ?)-1IP39p1 z|IUw}{RY{q{0`F6s>CLQ8T^r~U%u4;ylDWq$HDpeMseQGhjZh0FBPaOzZxl6JWPS#m=rKHI0>l zA?aRz^fN#f+^xum1{NtRBLkOQ+@MAj}+;shUUuaYhz=RQsVGEedhU}(9*~C z^>rYfS8br50i#yog!9eKO@UEgD0S(RaN@S6vNEXwU5EN}H7m4$KVFGC{N{>+A>ZyY9KfS zxEfel*6TDrq3*;Ss*99p5#rn|3Q`e$qm41)*7N}7xt_G@ImQJ#C2Mb-ZE?iUYQfI;8h z*|mAg?4e?1wu|nyrqrt_nWX$i=!(IlB#hBNf7Fz3LMR5%d#n)=5R&LmAsy*xsCN)R zM8b>XqU9R8cUoM|EUm3vO7g<-bkVXK$~ue0S3b#g12^p0ejPiZG?`1GuoMKe$_l%u_GNW_x_qpW37R!oH58}g!M$zv>;1Y&_4{G!P4$K#y?|i;Ks`lbOw3ymDiTGFAwMYV zkR79hV&Jkr;%kH3xxSgr4?{aU^8KwxcaQI=Y)C~=njRBCl-&bE#(mDb++N7W!%LThxZHX({{D=$cDZ|g@SFu}IUOyv zd$O5}--Gn|N1Ujx8a=Ou{>Pba2qgl*`6AX#_e_rFB02>VlC)iy)qozNjWn zQ8CyGl-#Fq@ntm;WoimK0`Ks-sXtdF*tfcNHDF&>I5Nkx`K^f2eC`M_%NYXT9p#H%8qx*W3S^7(IP&^Dr-wp2p33bZj+h?tm^|Ng`;0!Jf1GQROmK3SBMb*iUS4YFbcN=*P6N?`@7kz~viC zQ*L7>vp8GXSq?{>(Eo_2b#oY6+2H$Ef2GA)Fa+i)YN5J*HTK+L**R{(ZcWs{VOcy( zKC=+cC<4?TVbma-U^z~}oi3}!{*z^c4Cc7z0<9Glu(>>kWORF)i~RR~dVj+%e-pw0 z;pRH!nK{PDZ`&$;zk9VM3x!ZnjttZ{qQpiM6ENzYWN9gn&7OIOz+6>s(H#;X#-VC# zy!+JgpZiEF1Lq8*DQ`WRJ2T5FhYM!cA(&i&FWw!)qcf2wr+;;R*E}FZ%Ivv7E2=IC zlr9qPu!24bdkgkELWkSIBYvHL3GW_e(jHhI5&q|OlOT((Zs;D@jbva^9UNk7XP563 zpIUBhz2^$7q1)=;+B>6Y#>2%6fnFkf6^B`;qEAgJsm)!*?!%`Jc3$qVa=G*7IpuX# zZdM_NL9~1!cF82%Dfv;8H%V*>V8B?L;f~`{oT_uu&ksGz()_AW>Lx$X0tK=RA{j`{cjD{Y%*f&hEz4% za<^2J>Ia8tzS1d52>F2_n!)ngyf}h&xiW?7kL7w4NfnUHAJ!Z zSQ{F|VeZ~Aem-p^Jj0BP_^H66acEmCJDZ(a7&sCe6P0&)*+)&!8U}XLR+?gP{2fm) zhnKj7Ckk$>HJW!FnX*#J8+|pOQF)Q*uo=oqN^)0L?mT53z>f}#7yg`{lp*X^ttsv2 zbH|(>iU4J^1z7>BMUU{pPn$Xe4s@78pdV*Bf4M0~Af<<5<9wqH-r)BYZcGt-DQ5dT$UohZ-7CuJ5!ihJSjG(B_mTBk zPLGc$L)4n$4C0VUxf_$SO?lCa8e}d{9{#O$Mh!c7n05XT2$= zwisG5)hK^jcQ#f4rpUYX(QMe+T*ELJc%T-fJvHL=1xpx~2-*A%bcBl6nw_`70l z4TYUuC8L&4Z|_V3-LV@H^uYYhVS1!j8xhl8TIsu ziJ*v^A-}Fd+w{;{Z`7~`ooXFoFG&IIW+?`C7+CzD)241%7Ed`j{9+D%wb}9%#iI=B zCmQ9nwkB_kgCwx5X=G2uIqxlf5mL}G!R$o7k!t;EGDzb zH8eC35N&cm`IKx{-13=RwF)7Qxk6D(HGv1R&dyPM5||RAisXh!b=P&Wb|4lUgkCDx zd*rrV?AITS-mxzzHj0>o6PxW^VMe@!#=J`*wFHREXj5cA`Xgdv7Yms_$#vZx9a%4H z@M8!CgxyoqX_@5ygpm9cj>ZK)eLAb=xD@jf1PEGn!_MvxgTXyi%~Mnn5K znz}9oRa8(QcK7M%!`;eW_JyI+>ID7zmtwBn?ZZg$ov*S$SK3Ss`SmsiHSA?2p7ZJ< zzQ}*Ep_Ur6C{VnYnXUHxK#F`%xyF9i%fLqgXW2t~bjoz(gqkI@fKWL4q`zNGT0ubr z9Ha=G{zML7Qmc*6bE-hxT5m(ton`JW_v!2%6V^CNcg7*jNA9%3`|*r=bsdk{-+TBq zSyck@^OL6xs&YkOfaBF!V6DPu=z}sF41V$pZGuQ8dnSpfC)4S1sRr8#HuB^{2e#ul z6)@el2Znn*810CTb3r zbvl^zF)PP+^+#~ zrhMff-AAs0JU^KRFQV+yYI_n>aGPLDk6_Fue^H)OW-MqLi&94CaL?qA3zfpi{h+VK zo9+|(c_}C_h9lFVkn*16RtB$4u0dN{M{GxYF5(|dyknE?GHGAH#}+a%P%5e~k z6&GMMP2ZDl+_M|_-1EO~G5Qt8cE4mGL`9kLsTO6CkO3dIx;2{v)?Y5jxVdk^iSqRB zJoCo`Wf^Z{4u;o*kk%fcAs~Y+T4fXC2Y@&D&B*$zxH{eLthTZ92R9vK+T3DG=hSH zPHt`=Tc2WpnT94(A_lk6_7)gDPWN;X)wsL2B^=B5gGf9ijN0oXtxj&)s=YY~x<{m~ z19m;ylVPUbFw}t)vzUq@QBl!k3?Hz;i;0EI&8eD|@9$z_%t#veiuVKrxE#mO4$p@K zrL%&8T@ys=tiV+gzs^RbUwH1OqFTUdb(7wuVFce!@mJc zO)5|DzZsGv`w1FoGg)x#VF8r4M`k}JYCS3$LZ{V-ii?s;(|ZYfOKLwPSm*0!QoA)cI6k7COyp0!4q&oLFHM+zidGh$rr$In{T$z(zKl zK*z2Vb%#WIDb$yrZ#f!#ndE+iQD|XK;}r@BIk+PFXPaZ* z!*uzHG&7F?;U`F;J<*I(Uqs(ZziVkCobuv{6EpM6JC?8dOorYj-%VNjAerpX&DJ5{ z>AVy$T4j}A+m*5_0Ouvoq|fDeqKUH%qq1IB?zP@orU5=uc7|e$xt;$}>8#~fb!9i5 zEs19np0Rl^FqWA~WIp)}PHAvSBj;zI z);@dR#MNn|UoR6q=*S8`!?lwd3&DI?a<_T9;?a3h#CJ~RiuH`nsfXrgUC!_&{X9Jn z3E-dJ0;xY8o=L2%p;rAvGJ(6=>!p(MH0wgH?Ct@s8(53dhUz5blPaQT18!y`)Y+)} z6W$z(*zM4UUfkl5>0_Es(At<#L6Vf3(>F{qPp>XE9@)()OEW*2v0@|c>T(4qzw84W zNqKERqdXvfEbY>Y?2@8*s`9!RhVa-#?rmGG)2S@I z>yK?-d$8JrKiYTvASBS+Ute?38Yp3y7VAFOmQ~g-z?x)YO=N=T?KNIvC238hSwd%e zwB&Bpit#Ptx~5=X+@xA0e8~ZYb7p#5z0EI}U5{1_b19;Zxpyrg8xvXJ^U-gQJIsbD zpT0_~5VY_9^;_E8Qz$)b6$z_i=~qANa>vU!Xex<1$VoVOB0;3RR+D*ss!Cdg1sO0$ zCegfiuHm-19}pD%5Sb*9N~cIgU7w^~MHDK?Qq!~mjN}QsK68~O>vOM&ggLEPI&0IO z(%R;ICkYQ-6Wg$8oY?@f%>r*YJl{0zL1{;x!h(HBDXe#h zf`-<~%l!IEM?EtTIFZ_LAtuV(m&Z z+yn7R?8BE!>bi52Px{?D@fo{_;0z0U3QqaAu`5Ei$Y}7Vh-qNG!ANi|x`$U<81x?$ z%t!s*$MihFt~C_pm-usJ>v~lZ7i(4WU_w4>F(kcQ`#Y>_AJ0}a4l`2-NZv0|e}|Ru zch07KW%ZywHI51L3bp>)bdZYbt+Xt*R3&6kWnc-1zqn3BWHW3jGlC0AWgV7(f-&~o z9>+QK51KTjTo?-^l&=BV^j1)fPbcL5Y?APm>;KAOdm{XK+MbCIFoZ3U8$T58H!Wh0 zP0vj7J1`sHL5>xQo?5Zt3SZ28@IuG}X~&YxVUev-YKS@fSER0p%*g#i@yalBXzr>k zTulLHU&VpDBdt&BI*Tc8%q)dMQp!#Uoln)###ivMBOoAvF&DGvVt8Z$UoXfhm{TNw zw0@=H`8mWT(z5d@5^(k`_2(w%>z}$POrv(5okJm0M(sYD{E!k*vaUIk{5AZUT{<>*MzF z%eJ;_yX3J#(D)hpLc}APho$$@CLVq3&~|l9Dh~?K2CFBU70o*9OyD+852d~i#T4HD zYNDdnfIa4tkdPQfbNWcqvGMWgM2FL*RaCwbaQg=Kii((G{Z`C{(aQo6n*fb+%c1Eb z8VVfsQ{OXZr=T$?w3qG0E`0%PoKuk#DUHe@Jr7&o3}m$N?Ztb}#2mNNLWEC;k`}+T zuAtLn?q^d@7*W+B&2HqvewOF3Ty0&}QY=BM7vBP~t-fA)cgu!Twdr?eMhqg@I3yL5 zXE8byX29%0^lYQiW{_PqHX}}B`yp!iPDGfLg&aI0ICgrpV8&qX4XsEgp_4?T4(N=q zgw;xM?I3-P`R=VNhJ%AJo-QCKpEx!?qNH3Eot%srmETHDPhS`q_{r?}C`m(oriV;& zuVXL|f+ive9Mx#8NxMaTdRY~-$-uOg$|=yZ=P{=5w*nao^7e#gf3GR($l&n2w;dxl zq1G()2}B#P82me>Fu*Ln&HK*3=8M$tmQX^>lrxrx=-AP*Ho^1{_R-fwJ?ezi$1{`t zRm2+A~C+=;t~r=o~ApWRB6o>VIf zlQxh@P#y;d=L2WotJk5!%SX=ii0#UPVuIoa@rxoLbV~JX=Co`rVMZ^_M6*^{4rtL0tbrg6NZ~ z=(tr?|4KN(=e>M;ys|IIbOITiS%bE%QzVQ0xOC7u&p1e%C-y-!}6k17F$aUR>b-czCh z)|M2W$EJw+Z{>rwt{l z%Kfz=A}2`qQ20<$SJ7Ok6Bh2WiA$-}G?6EfO)}bR5XmqUB5rpFCTU%tJSv5D=j)~Q z2R8OV)9S=m6(qNRP7`kwB11Pkrl)8zhg>G^Z%N-l9hqN-GHLDdzbIwTnbe@pvPD|2 z5O{7*`{*Y@nGjWM3#wk+-{vWih0VT+7Rfcv9^*^qYOyo_q!}!&A5qoV5Hi``Nx~RJ zW4CclmW*G`GQs|5ox7W%?&&p=e5Bhdv+N+fwrbYJxz#R;JU14#KT!y#k@Rn0H#M>8 zJhRk`r5vMyKo0KRsX@EHmX{sbAsNRun}9QJp`cq!?qZE5eP&NdQ5mn}wt_P!8)X?{ z+z50BABp_mP;*B9>gB&(qMds)g8H;Iv~W#QX0~nST)W&FXU&Up_>A!P{$Y(SLu!1A z8X@z}Y+d+w>Ht0g!HNcoNe@N_8LtRW{DKTd2MH+BIpk%aTFc&r> zW-UreTeYM*@gHI`xg0@@HrFT^85K@7T;}%nRdw_1;2f3xXIWh#zanEWm(C27qdFV^ zQo<*(P&YS>vam;dA z!QvxCJ478sl9vu8?a+Tv>kGn$G!uVWnp&bqlZ1waD*A}-V799parat_MXT`}lMo6y z`yhVM%xB&IAqNbw=-WBZJMS|NzL#u|kM6XkMJiyf63i?{MB{M%G`kjuxey zn8}Fk0)hFh8!#3nqe9%$1Ukrp)EBbFE4$xSh&M}O?k1eG{?dk(d)T_qv;b0 z82y;u*dD$?hN1@^u&i}?F_LEqD#Y@;cPDsKYgW8wtxwX}5u zu|^g)q5>ds&?0;h7%uS~RD;V8`}M0LHU^RmHoFXtq*xNX)v#eYXA~_x%~O~TUq?Q8 z><_2~Jb_AEd#kd&zHjR7?fj7wJ(!Ud8z#BYa1%FI=YW2A8i7Lsk16{e#IrIstKyo2 zi{~a*ogEYuWPfZ0hSe6{5#ZsKni!yqJnelUA0IsvE0I5xPvb(6W7DH68IdwFVA0QS zD@q22szh(Zk;h`Gh}r5fJtAHfcA1cEkwk+{&22dr-s_v zR%6E8l<9&tT`T^f-fd$iS1?B^2}>RVesCPP)!;oi#A(fDnl_!uEM7?u504KIrWc%f z>UF0qVGf|zX%O-(zr%2bfz(2BCJX_X|VF_Gb!1sOz!DdV5`T zrLQNtQ-rL)dH4B4Ln;QiSLiioAK~I!?lq1LufKs3zex@sLREbO8hBsRH%97onfG`* zIXS5+w<|dGqchThp>E&%drs4TVj8U7CIkB{_yC>shP>)2M!^wmSGNUWTkO5#} z!REnqzEf%9a=isDHI~-(U3;A(W454%MA$iXC%U8}Elrq1(+Q}W;~bPwhX5x3;XZkH zTAd6V-TbB>^HP=im|0&5zVdIIj%M6YN$!%nDMpbW94bmKGg;_#zFU>5a$8ty|K&sJ ztjmQaDSaA$BB_XI@?6wf83O|Yi!$&7!rCs}ZemKa`TkQ5x%2tb0z=S=>rV!cxYQ|5 zC#GaaLs5~rl5mo;dbR+W5E7s_@TG77?zodunB;>@?&JtB*HYFO_XrX1b#hR?V|x8_ zG0f!TQbXz0p6zk^O9r2{-q|$MrlK5A(6}XG1tpVGiGrD5;e!ugE`sIhR+Qb+ynmI* z;Nl1vgjYI722W{z@q2q1Nqn3fh?$%`W0}t8OD9JtC@*DKJw!`GQxG2neR3O0vG+0@ zPj=IXDoCY+Ra#b+5*R^s4z}j;-#etis3MvwI$lz2_%}?s4CmJW0v4u|D|J*1sR z52*n7`5a0pWf~;7Ho3q`2J_!7CO)E2>>PT!VOZO6qC;zIdjClphQJ^ZkH=L(-8>46 zCmtT&9^zto`UDdaE4HJfQ%d67uV0L=<-H{PbEPUt$;pNP(@0oZQU9lrI5j*ok&&TY zzWc%OS13?6AuCG`EZvii^q``qj>kbgFXAmhj#>9V&*5?uSvF3q5*GL~K7Nu0GGhSC zZ)nM^eqtp_j&~o!KM)!VnmF+eE~U9O_?fUZQV=o0}t^%#W+#8({ko#JUt8{ z`27KD;Nx{!N3o^`-5PbD6BCY1?6m#7OGUX2l_qsk@I8~mb}6@jNp?{Pd;06#n#Ah7 z5aF4?J*9}}IUPwb*o3=evCa0jFL3T53Im*yx_UPzJpQ{mGZ}{gWU${nn}36bzK1vhU2`TZ<8WVEj``Bx z0B?VnUB6vMcEK$N@ZU+|Zm5?iK1>1vIk4>Hz;cNcc_B6LHuRh%r_7^{wIyXGzrYvu z5!EjrspLM$E)(${I&Shq0(oy@;OJOOXL7_LfaY*>lH0L~&&3GrYeX6&9VNJWU31%z zYhH83Yi(^EasKs}bb;*d?rz4q|5;TSm1w5cI*hRPDNE>4hZS3AvbL%#AVFNB-$`v6 z9bMXbGGL6^_!G?2v(k6PT=4co`26Xg@6%!N%r>w0LrpYtIMFlF`$JgtYa|;64Hrrt z=3@^m(RW%DXv-lW0o%_bRgdiR?sxsB45bG};&>%}zt^8Ut|w_Pga{lkmD8l+GT4V) z0C}m<9u!69j=L3`t1hNm^+o_mO>J$hat)Y!D6jyFWWLy~wkYWzk1=*9EpD_r7xQs2 zF~xN~9npH^R8>{geR{a)Lp^-B+_}OgA|k>;yj-@(NydZ}!%xOjzkw-PV)`v$zskkq z{153*7OzIpaXO;bvZ}7KbpDRSk?XvZitt0ToS<#7RU*ZAR8f;}l$2vH(H+(Ql-vnO z4LUCe@siTgzQdy6$34P&AUxuD5PD#leR?EZ|3^i}g<>^K3)ZUE@pas$e;4ZyMSW?QZ8O`yx<)#enlqSC_o!9c1U|`vcBlVPRv=K35}@b$t2wo?c#V zvNCB*Mu8oie4N?v=fom&lAd@+kW$q9rY6KZETF~5bub&=bh;|;*k>}bIMmKB*I}{? zHAf8&Z&S$VnCG9At-h+09mHb$lpqlkhJW*WK5dpMM@=URAqu>n5=EV^Y+k21S2L^@EsZDK?TsKtP``D7po#FQINw;JXZd$u-Qs0I|1w-dZn{iktb1 zMDNU>3&%O08oVB9Twyo#I%d%ZsIwxR&lJk+xe+%lNeH=V*0wOZ{Mp`sC3N?vP{^jE z{j7^h-=$WrJ{^QA@STv5a1=*MVo4IZM_wriOVht(DurH$;u`siVDxjpZGSjA%X=&V zulhfqUEvci@Uk4HcE1$T!J^?L8EA$LGnO@z;<}@?N)mdA`No|a(vzZsm?QYYukAOw z^a!g1k8{0Oy|4e=tU6DQTm?Bfv;VM9+WKYR76D+?r=#az6`U!OO((_68$ND1WBdg7LH`GpbVxshDjsZ?C@^73rv z$)F{==x0Y{RW55RXcnA`34ecxNB#zT zr4~ni(K*>tSJXUcU|Oh7lWlyZNrN|XyZ_XvL`aA|i|Y3S>A>8b_7;bRj7vt=2LI&n z4rE%?M|=-B5r6MM7RY0iPmvP%S2TB`vP$+Bdb@hwsL7 zqTydAqPnLW%l?`9U+30_z5rj`*M2UJ)EUA7ha~?z8_pC+u_)x}b$3G|?OOO7*v8Bc0V^lx46X=zd|&TM0kjLh*c4?+|^B&Eu(l_7gOc z$R|Xbl?E&2-KmhkUidM@9m?-v--R(CwUe!dMasW^inS+)BWFSW?W<`-WjM@LLZ?U~ zq!I^o}c9-UR8VV{{J$4@?oLOQitzP?)9W4PV-J4d&2N1P0t(YeF#`jcazHKD7NF zY_coPu43(cE|eJcB(0M^Zq;JKn_)wIg8e}skrGG0rPxcCRm!T6^W4nb=LJm<^&a1F zGTag>6$8K5MsLZo>q$k}9Uy(pYO-BtzEl{#sW-+q)oq#>xtOHP42qpHV~Eyf-4PPl z-cQV8!osv)b`WYx6yqEXAfUfgT430Q7i;?~m0So5ixmbgP&HlBmC#KQ1a~V@U2+bd z|6m9wLtvVK6dv$EZf8^CE?xLG5fh29*w0PU&xHjPmLa@HWELL-YzWih03h1ZFOXUc z=Cud-jdck4!fqoGK2O3=pXol9ZmyL~=DRJC>?_9+#Y>WK4eQiY#5u$PI|98UIzG{& zdcZwGc%VPxKSFyTB8$1yZaeHs;Ro@Bxa_iL!Xk?|-a~s}9S+A@2IIb=fGrAZQG7j^ z6{SL@fFyR?U=_A2_PXz?|1}S3Yi0O-Ny1~`dNcdN+mdd(OA%0uyd{y|v*AwoVgrW@ z96oQM7^N1VYIbMTOa4l4A|HnTV{=#u;X>R8_uB^S6%@E4;p}1UCX`~)nGFWO^XAzn z;pFCAXch&aD&>bg=I(ksd*0pOp{Er$X=pOW&u`obQx|6XWP4X6WGE2VNHtFII*D?px|Q^i5SHwb}Mk1w<-DZUk2q;_T`zsV~zoF^~fwt$g*ebL!r5M!^K)3koOC z&%10K>4f!r0u^4a7G3)43U|-F%os&9#fD`uJ`Y4WHlSC6qEsZl)O zYiJa3MfHA?JNEp=gFpp|xWbwRC|Ve{6SqJ!%8DTBFj`Nz++@S~=;<~6QwH#he51SL z-%ng#n(QKl40owM{pycQ0T57yinLTtTynZ{yD^en?a*Rgny}(b{9n?RHTiv?ye5=O zGt6FWoGHCJG?1(7avfGxQ`cLI%(?`!)(&e}UYb{oik7iBU8QKMx3&IH-OTjZyN4Wu zh#>Md)fHecY|9XC44vP>Qxq(3W`^LZ9M2Inkg{@k6&|msptG949ZR0e4jPi+gr`9) zBIrQHF*Sl)z+6yYn8`DwQcWspC@_hv<5yj-@t{>xSBrSsZ6o=sSc4AGZ&zD;_I_XV zdkv$AC6ZL31g4&UeZxshjj6J6u{uUx3nzQHDR5x0+54Ms5p!G-BI^2RzHA!zw49>xdk(Z3zLG{h;ZTRxe~C~Uhiu(xbfQT+ z7wC({xPo2S-Y`=TQFQg+I1Z4c3w!O*$g~t#RqZ(V zGR!OqOXzGG3RAW>%un74`!fue&8#Mu*3re$)gEhTCF+=#{$O5H#GtAPg`}8ad2xyfsaC2wv_$odgU}V z-)iBYdbR$O6oD?t^o=Ys@d@@2B}*8?znKW2(IBzvU;5&h*90A|!G#(!4&kS-E0Z6Y zMsH}7g@=FYy)3ilwJN}LVJvX1R7|wo2vZQjc=F)G zl44ZxiiQyW>FLSHLarn7nD_BQr4uw3KWHQqlCij|$mYS_L+Pg-GVfkmx~pRYxeQ_z zU0M%ng~Uw)aX9y^7Y$9hDFnKxxy=BBtHWKYT*3*DPji8KjEzFfn;b_3`?|> z{8Kb|wv9z%2#6z7Ny#u7Z@`pU%q>IhS>XqoZk)GX^=aOiUs4B8hlZMV2a|pLyN_sR z4gRuoEDmnTS{YyTlot(cxoKy>-a67TYR3k%$>1<_C3t0=VS0x!F)*lfQoj=7%6dFL z>H%d~)?iceU51SuO+z7S@XbnC&!`XC50nQmP{t{kKC>bytEg0KrrO|u!8}*jCht-` zbaa3O_an5^sy{R8&lxAvFnn`M;(_Tw?Oiv((7G~3Ke~;Gt3DO}Y~Rf6>`z)?oA#tq zVFxJT?IN{%W|Huc85;V5wiHUCvZf1|!!OC+_|u7Gx$FqHtgJK{8vXNw`|ObF8OOjQ*XxqxjS6frm|I>~=WyHsR1nzy~3zJtNcd~PwVG+{vU z4-(1hR*rV0@AZm%KKjshxl09`_R(c6L45acUB4Of=H$|N$o!x6cDRo3)_L{R%}Aov zV3JhE0mAA}s`v%_6)AA-z}(CV%`CWVuMomGogR(os}v`rj*#Gqpe$zcJR2Qp65vmo zn1S80)NzxpK(#YfK#x~A>D%d_$-|=)u_$wSkWRmsd0N#{=R0whynK<4hOUA=&rj@W zgdFe3X@7~rq%5Db#HfX7Rqg1egO*qq^YAW^6h#{ zd!_080CWE)nvjs5<`fM6F5*#h)2l@GB;K!)YU|kF9CugcDb>dB9&8d%OiQZ_0zp}@ zvD3Az)EMaaRJ7h$l$1Q_2{a)sWo;=%-})1CVqxvpeZsAibGK*#f4k55pqj~ zkegkte8^?pj@&(uuN?|4QO)_*^bU!-JrZ6z+9w3Zr(pDaHT|aalW@+oPr1`x-Ur%l zod7)vkIu<+u8LUO{9~cjC{PJD%J}m-Z3*J;B(%TuU-rvywuyX;>3CUx*sgh{>AyeV z(NI?_Do4+f01fO43K|gW6b0@R+fBzc!*`HHmelDo=_eDv^*gUEtnF_76M4U$i#<4b zL>e8QC?0_)J6t-%@Z70)82K|0k?jE%j=KIOTxmFlSo4}~WaHz>6nHrDYIB^nU7;4k z=!GZjJf?^b=sZ|ttcw5ZY4jL~!)CWiRoB?LMB4d9;eDgKAnL8JTw|)PHI*^#Pg>5u ze}MGGIL0v=+EQ=|udTyatq%4)BeRuj(l+*1DMRcL=f=#Cr}H8!zvq|Zbu+U}gU+Q5 zsfME5-H;MlC@u9X>L7xkPIt`u*FcxXQgXDR`7x|%4w52h@=dv0-}E}fWJURvO7zMh~Nr;-8RmtUKw?_MPjqidL^ z_Yh=e7iWWdKfPM6mS`SgxTrRq+)AjZu=>25nvXKlC@Evp$7i|*pk#4*sTrvT3_L_( zy@?CH`@I+3{=J(@3g*gS;m~KZtS}7$UYNXXZ`2UK1HAYbdc=QCv4MK9uem=ur;NML613^$U#@ynt{KtJ%Sz`KP5U> zTv99CGuv)YUKL0lMvJ+MgLG-XWgR88Omo zqjoll@+~B{HOkxj?^Ot!m(!=UR%3W@HOa4zRlVVjA#g1q8FG$JwVsetUO*j^ETA`% z@QVw-2=>0hFQIx0@+qHI|y{{LL>+p!+y^p&1z3_grQJ_V|N+`BrGvZgl<^z!%wx33->R6D{&Wzn(NH zAk}J_TN!n32>p<@Y>6V1Jyckxl*u*~={H3LBVE}fTfKZ8z$_8C?kXr)cjiNJzU2ZX zNyN2XfY^hNMMOIjbU0jUx*R!6OPSc7eLsqXZ5N0k3g5DdOKJ?Y!F5wH zSdV;0yG+z=rRm&GaAZ7m-}S$&#mo-HrkK1OjLy>@u+vN{-aD(QH6lTveZeRx&_&4n z(c9Z=3dj8stRca}$CK>J8eOh(J7xb7fe;YrpsDmsM2dd8zA@4NXrW zL+8nK#>s(?{UpLF1N&75TGW?z!zVFrv(IZC78Au$qeH?7X0F2VBYFnfpE1`B@9XBt z=GlL)9dXpxHGsVAwIxt1y8-}{*&2f=O3@AUY1>Gitf&o#rko9=_%>7qmsZH(xFl3CwC9U@BWMg z0?FU-GCd0+%Q4wGsCA$e%+!)UzV7Ne+#!-@gJLY~=g(CCE0MIqFVf~_Es`y2Kuk|E zm=cg*%*lObZLayg+{S|?7WI(-^A|Pc`_=hx8&njI4Z96Dsok9D6F$%DdIzi7svr@J z#Dm0J9n0A>sJiFRdfH&weSmyn!D!WTr=-G+mrZwm?~K!<9=?jf2Gvk76H2MYkN3v` zzOxecwqvVE?~IIi`p?YiU2AP&UF#hxNqNR*jPOc)8_eVWXNp`J$?B@E1$#y(TADd& zlaV$iwgg_@e5=&tWHKpIY)EeSd=e%h94(U$m4k@LiR8qQIIwYjKTTr^YLkXoD zlF%EF{-fQg@bItjkp9v%#?-m;s9|-Tmt$NON6)|Ty>kT;R zgo7ULMpSo_YzYPwV5v(J@h$CkR4&Q#)TMdf;bjigF$ zOA`lSk(V>$kL8ZH-Ad@^Oqz7A&0*J?=&>^$R@_EUjLwcE8<#f6q^pe$rNHw`7!Qo( zu6E}F^GPBjki5gEDtQ#dZflyQLqbufmy$8b6}2=%coAtW&Q|%-b{YvDY5G}^1Ah#l zQ%CZAkE~yOz1yjHeFm~tZaROQZNCzgytw#!c0<2B(AcgjX3w0VJetkwi8^>&ot+m;FrK=H=&$N1pZjmK8+CLm3_-Z97zP&? zkFmqAk(LJgRkI3@&17BY3sBYARX=kDo0^(}bW9+CMn^@>9T<24q*fhe80wB7b%w(ZsMc$oBLU zueG&Wu$|Z1D}gg3pi7d8g((NSM)yFY*Ud~rBmSS_mUMOXQ~Xrx47tu1LPnqRwfLtB z1j~n5kSMx|Sp%@z92Ev4UM%S@Pf{4WCp_Hr$({X3S|qD52}%ltM8#03baw@An)|{; zJkg<}Q|V?jsk`bBbpFuD!-N>!+0vIVXzjdb*cAV>O#yLBl-kNY{fb~a_{VSBay_MV zauNb5(M<9w$v=_JWf5l=Qc~HqrLyw-z7PceS!;8pRV~L-7PH4gu|o|V<44tF;y-Vf z+7b$tNL4X&j~!?y3Zm4qwY6`~xMo4l!>4RN7*zb3-btJy^SSyqBvbs2?RQ#Qk+8GQ zBbGf^C=W6`F?Ay@XhdD1JG>zGs^EH>e&F>QG%M7p734PWb{Zs2W1v}1eK@sL3xIqn z_)?@$qirTbjWFxoMU8QE9AAS^l?#)QwOaE{L9bY|KPoqvn{H@_I*cbk%}{Y$slc|! z^86(DeCibLM&28B&yrk53UBW|rTZ*|0 z=pSr;?^$gxdGlD_tYGbd6iN`>r9n1%;zB@RX&D|BowQi{S-{(FNQ$%{#b463gz+`2 ztaNkZyK8Fwdgu53my|EAJhy^4rQXVm-*r1eEL_aC%<_VGAmU0Y6*ejsJ;rc6b9-a=Yv zcZMICm;-xrv`4ZtDP)&Rf6yqy`)q%I)V1AXedlAs#_B4Yl&djDOM6F$c!H$A4K&k3 zOG_&zng1ghKC6!~mV&T*s*SC3R`xPZK22 z>!L*7fk+Fb1*Z(pxebu&#FObgH1+jI2u=yqb2vWaHIba=H+SiOvPRdYyh7-j%}^3m zjj&Ws65*Cg#7O%(@gaiX^LGOz2Wg{&Ss4Vf3LtoKc65yI?DvH0BbV!s$}dkRrIK}5 zuvuQE)Q^L327PHF4)Y3R;3xTdnAhHZ|2aK7rheA&6QVNbMOck^BuTFL`=8#`X1&-W zza`H|@mLaruOqtiBpHoS-uYF-@f`{j|9OYZ>e!%9^R?6@+euM<2U{M2ZC)k%VhT<+ zIDod|J7Kau>|!S&d#|U-*=P#(E**Yb}8E2GIDiCjvg3F>C19MS+TZOkq{0K ztqFT+DMv%Yazmr7oL}!_%WNrM5e6(_qszUfPj1*0R+6>V0e?e)KHd4!-BbYV*#; zW<)+WB+plczGzUJ2Qr8>Mm%7<*FYJxS9G~RoorP5H*1E7Of*%l!`YQc+0GbA za(rN5MjdL+imRLbZ8ZY1D=>HCqiqO>dyaydmKc*NZ+c_iCmU~Cp;Nck7bI4`;)x({ zuxNZMZn{j7>E&md$ChEh%6wUB)7Sy?AiIulR7zVQ=YOVy&rsfE4;|Z+E(g zk$L!x_8!`A*om%oNxA`QqnVtO*M2Urj*hLSIsSL zQSCk}!8jGh{e&6q5XOON+-M;Fm|lI7(s5wqqnUZc-Oh%CX1Ip?C|f4dZj;H zT4GI71QRNU#UyURFW!Q@+I-FJshuB}?fJf~x53pcsxOMTH_W`$=v%ILznz_=Wldb% z_iu!g0w;9Rb}yk&l129r>rru%yLNt_E`nyP=-nIc`-_4{aO&|^Uf!RRYg;1cu}~td zcr@X=zg(}{eSA2Nw$e+Qs&^_JIwgX4r+^*dyzpJ=>Fpi7P4NFCG|0^GX+3I|C8a9g zkc@}nsCoDKpS)ldQolZeCO95-aU8wQAI&B8`>%I{6 ztfn+ijPJt%qq<+0IrDRF`d9d-&T+XU^n$`EA;G~fIIVEkUOi(G2_v8m5ud28y$&lz znI8=gfH_oSIYXQD+h$6)sa7jTMP<=nILLh-$)??7+?ztx6jqJ39`BO7CK18U)1hko zt?8?Zj@s3{gQ1(6pOV}xzRu+UKJ~k|-l8lFBz!Cyg6QYHrlk;>1+=DKK_SEsp|qEx zjLe2ChxKm{RxXQ4td@*!$-LWEkxOkkMukYPx!C9eDnD~ag`nkhKGpKX%z`AXjyh5h ze=Jsl4@R`Mvs3joK5avPf^1pGCuSfgL%UBt4VJzfAv--Kv6~-gQwi67v`#xws7k%78r#YkHga~5 zygbOJ0%Q5*`Qt5Gqd7^FOa>X*t{8ROP50SUhIU2S2vfo&i$i& z>I+AD^I@EbdQm`j=(y#doSYnAO2IQ<5w7ReiYL4B%m=s5*=1i$+?s%mp#;4<1uas{ zB-mTCg9k10i6r5wa|k(_->zgZZ9(lYIU3%ffLDBUmNh|TOL7Z=?gv5 zmqty>h&92SZ}@H32#LO8t61$MGO{rz*BDMt$2&g+kZy~8{=`&eiPCgKA5Bix&xZv7 z3kDbD@wt(w+4RL?o!+XX&(pi$Zf8$%T3-~4h04eb;XNwj$-+dCWR|{vzfXSoH_a#}oXy%@XI((owhM(yUVNX<-? z1LrpyWU9Kk(D4lBq>1mqjt!TJQPz49TX(<_G(i+8=JRlmxZFuWXr;$)!@ir zo%zLgA6J#(;qjs~w3l6`q-?}I`@n4t*N)BNVyLE;oxc+yA+l8*P>kvO>QwL=W%{A* zmt6w<-BwVuc0Ign*#$cxx8dok?o@p9cA;(lb0l_aGZjL6t4`v`(l2`NO==8nah-6m zpCfM~X>xI>EPbD1+1@lge<-e|6iCYaKrBtFt47%~u!~3Gi6tS_l3=F=C zLBmVr7y&V9Bt2LeTqbbAh=`NFD14+5WqOCmL9Q**Cta>My)fAQXk`kn^BiI`*G+MGR)~~LCO0lDi6vXlbJw+He0#zyDy zJ%fSy-96jsRJa!Hyu3U{N=os6u&f|bL8rpUq~K#b)-(gV7Jm?1fAP!ZFiulsh&f~{ z^&QBWXZ4w@4;_0(k7m-67%<9U-jZoXp$7O?>tz@8R;;6`yufH`k{&yBzZR>S25_<= zW6-Ca{bQ}SJ1diU&iBt183or)eu#PmHZjS){48pwkM%N?)GRwj7^Gh6EIZRgk&&rV z_&m_I-VPRNJ?lvYpg0bHE0bm{(tKNd)@*FfZs*_p)4J9CE^tH$i{-Oy`Y$e*Yf^`X znRhSQTV5Rc-XLmgUwUVofcv%~EM^$E9OSYJxeR)+`SgU52ZxgUu{w!TO6Q*}mjL#D zu3%7T$izC9h`8AOv6PmEzQU!*#k2e4-el>*pYn*oGFl)UvaLY{T>@WrKGT!uJ@>su6S*Hywb~81 z#-;63|^?^1$tliKJnt@U8t?qkRD|3}<2(80XGx=feAQUt)OQ z&MPdxUr<{1YLC+o#&dn#FDuY3jriie#fjC@10#hsnElQh=Vh@#hcE$}~5}8Sc}klE%iy&^!Q;(dA4! z;|wLWp2=%!CY1LB32oJ1H8jnFFEcZ9;y+~F>)@F1aMaR@ihr!Jzo=Fufb+@&$@!6$ z9pK4!aDvvPMWSyEq3Z|E)2CK_kwpKI2?0jPdTZn}k7*CezvTN#)hLTHa7#k(0M7p0 zTb@g4In{PVTo0 z1_!uGq4!K@gTp!l7njDr8S3il3gS~bU!k{X^*{QMnVAV1Uk;izD!7p@_(5Ub6xv{< z8K;Fd@8%}k31kS03_LhzyflUP*QM}kX>*}nVg)AGc+{( zkK%WfVnzXTSO}DE{~K4XB3gCmvYeeqd1 z$>aR$n+jXNFuIT0ta656qN$nLKjZ`OcurM>PA7J_<;BFr+?5-*>U%ieuMxCo zL)Eh22rJa2Qv?L6tsjzsD7HeD<#ugjLpp+hJqb?0<~zgudHJmW`!`l6_m|7lQ1Ifi z)e)JXb67N~fTXszHW!A!7)QSS*^c@=VNmc#24+HI@oRpEH3TT$*NkXCP!_VsicYf& z75U%~j0_H{e?>yxag|Fht*T-NcJ1VsaZ$y`hs$;gi{pN=2X$Vg?+1lVO@i}?5icZ) zNri=lH!i8djy8H5o^fRwbCYqOi9ZC>{CqxZNJHW|aH%SCj=ShIF5-v+YkD=pJw6fi z1ZStFpF9CW>QAWUC3t3401Ql&LjCe)G+qkTgRGxeAsbUl3VBuhuRvxo1`^+iP%c~- z3l9gEU%Ywz{g?B$9) z2)-u?Spzv?1&Ya2P(e0HROD9)c%*g#;&YE6GRK=IdY%9wl)N4ZgUNfO6C4PqKWaaw zo(K2x<;%&R^|l3;dy4F>(lawNTo`z8q|O0>fdx*{Wo2c;nI?6ZLGLgA%yZeGdZA7z zp6r!XDPT)~E3tW^k}3Rh>%&>)6>!T>O4C51BzTzALntfX3UGNx0sjFe<4zg5QczIP z#84u$P@hJB427!gOnHv)!)cZV%&Om)*PU>USQUGqeNjtp>lp5&;x9x{_HGZ`RofrV ztB^NSSh(Ff_s~K5U$WUwmeH$Yh2x&%)GG2Y^zyJ+)dM; z-o_!tS=3<=3s}vqT>hX*9WjAC{n16t^4d5LBz=u=FfpuzI3U+##KuxK>re8lF~i)U zS(55ST8TLIcI-Tf%rM)5aVIg#C)D>N>`D~|2?Rh&mNChJb#=X+Rn&gJZ&zy)R_kY+ z%-(*dQP|CBd3~~3E6n*5=>u6v@PuZz9M8*PNx~4*WGZR9)vn;FT^OShrWc`_l3H4y z;=4F*U<1O8u~=S5w|K2b@eSQYR%)CTil50w5>my;%rf`QC9}Mg6uX@t-{{&tI_SH) zo2xM^I2~(oKV`Ev=lY3&LFqMxCwavofC9A=#w#+xzSmZixvdM(fe|Eemp zSJF51&?_b48TgNum-hC4AHw@3%H*OIm7E!Kt4J>Sdefwx@)f1G$y?=lmXL zRzN-hvd;XQZjf${(v;86lZ;O6jMlbZU}CqKTU#psuyh*8trZz7BPYTpQ)$1N+{gVh zUSoMnj4$`DW6jD(51@J9ycZ=C^UPFvR)p&RHs&ISen^C@L~txwpR9avQw`Jo)2=3| z6#TvQNeVwPx2e61-V{?aChgR)ov%Wo_VcsbtR?nkvFS(LBQj0p^ zbha4p@YfcohC>sMJ}2yeqH0sZcdBHiF+?U87O1(c6Rvda(yb~BqdvH6&Ht4CCK#-q zUN36)tEpKqAp%GB=^^_NQ|Zp&9>@H=BLEj=*Oa{EooE$V*!2g2i^wPN zb|n%3p+ja|hLTYNC9x_!I%O9|ijJw~)D{YQ2s^VxIc=2iL|V7p_agmtSRu67{ylwc zTJ0AyST6s>c{bb@s$Y;Nph6wv_Gs0A`J(w3=7f#y z_!p|hdH*+ywG|P3emgHouad5&afS$b>8Uh!3x8tZW}Hb%4)_x%B9qOy2`NhqFvc-^bVkR<3ghFS z0^nwi)f-KW*1qR?vB`Nv2)T zJ7_DYucuyIp?MoE3ZuGaWi9hHta&c8ha-8C$o=49M#Dm?B3{s~8h4F< zS|sfK87dVYGYM^?$xp_&Hrcail`rfX5eI8GQx zx3;D_Z!?JIlAhw=IRMb-J=Y_Bu8;xgOESK2b1g4=WBwNYww$FxP!u1(&=S%4W2$Y` z*P$)hP4*CLTk^!hjQVwxe`BR%Ph5z>okue_S%Minp91 zv|XK1bj^sd5%m@Ej@YjZ9F>;u*gIsBY3%ET zbD%5#Jn`V|67?Y)uKOa#>=isVVw9!kHLTyoXo>`i(yZwyO8FA8bO3ATm zlWvCpJ zP19M9Q@ulWL1s>!lGf9)nH$5rC?aBhzz`+n14qDG9SycMwvz)lOS>+sSH_wmczk?u zF&SSV(;SX`Q#;)P@3EugT!rX|2>Lxgnk9P#$7RjEX+nzTFYfpD^7HKs9eaU6e>M)2ZGm8XCzEcHP^p|H zH^V~UOv)Pn9fJbB@8lKQ2Yc=4h8ID3$cW+I28!$x2PdS0bVDE0s$X;?*A$fqSlQU* z0$9@k^wd_H$^0M0C1RIZ|JP4x+DXaLiZvQ0G&^R`(zoxDGV?P!Q6?%&sc*755}Dl7 zgC+$CNA0lP+hjJ*>5gk^YZ9HX6w@Y>9T^F16n5D^f7DviV~@5=)Wl6^Dc^8rF0@^- zHq_CP{qf_*S#S!RJWs9dZ#J{xoyvXigj0>9Gi9q}Rg2PEBzN9X`9Ma;KJk55)7P#k z7T$B)L(KC`XQ|jZUU9og8@PQ0BJgp22mg?5Y(#D~*b(wk&R&vO}TXDuysv5Od5`sU$&Bg#+|&i>i~ zbR^>79}PMi_qu4~5qG|syt=qkJOp;c+cWj2VXXxii#r5Tt6x>lULGTsY9l0YVv;6t zTvMDkLggaS#LvS)j$H0rPH)78fdpHH9YYIPG90|#)CF#H+6}w9FW(#yy3ti8Xj8Q{ zWw)8pcD3BeE0_gULv4o&#EDNO&#N7>Jp*Mms-r|I22~61noupUrt!Xh{mSEc@isgn z;=g4VzVV8qwf|?AMqgyzw_0t{T-u_MA6=qylf<%3dG!@%@9S~#q}C~;6uQtwR!Y1% z4}Zl+aTQ_HcBn8CU{W7?qD(qr|2miL`<3zT&rYSE-pSMcHtkQc&y_LOJQ?I}>cVc& zA_YtvO977c-(j_8uEtmj(;9<9{m8NrdFtsQ$Mwq%JXwh$FE%?{q11J9%4q`6;AzK0 z6os;?oG;IN9mTqLGGvh4DYCG~jCT%cNG3Vb*S4xQ?k^ly*%0h}wI?keFcW$l955@j z78WR36e+GV+%t1<-}p9KGCN@t@`GI2yt6asf48@_u_>;t)tEQ+Pf* zIbaRHmQ5&gBo%ai5x#zReVX_wr(Y;H`+#XQX_^IzTeK_uUehYTInR=Cf>L@rXCq^1 zW~Fy_RdKQ1`xZI<=w7mP% z968X9uKZS7YVd){1RWXPO(jc$)EYIj^vRPaxa8!OP?yY18wv#hF>&cz3}re2_qbWg zm{&HywS%^JSAYZQE~eCa;E7{L;?_f_{5}|%i{yYJh+utraY3i6>m5C61IVM34%PUC zaIsk0M|rP5JX8%k?s^&ZTAZQ@J=$cP%Pg`__b%_PCX-t5 zN<8~xa~Yz{ZbHQ3f|flQ{oY&%fyKPgQ|lY=G*+UFb9U*AyTxa{`S5{v=o{qS!f&c6 z+^h0fobR$=tdW)(MUqu?zJA@n$Is7qmK4~g-R9_`wa8z8WSd%;k;F{u%5^-+$0L_m zJM8>@j2fB_fU$rYnG8Gd*WMz#+bI&u6BE5uJURVgnf*Fsm(jrWPi}(c*p#a89Sv>p zF01g?-38kR|&A6cJL3(X3^z;z5we?0pUOwl45t23H zZ%j;b{{0d|DX6%jBGI@E>V5h9Fz_G2mQSt%{A~Yu!B%1e>q*avM`XYatx(PSBGv!% zPnD3u!omW1NzPxlo0+$F>wA%O;5bTg2_@y%0r@vX0w4Bp$@uNX|GBMX6&2B-)ri8w z!@-8pi75c}jZFi1d>&wNy)-aj{@22lBL{DBH8qHgtnB|(eTakKR^Z=+QuXt)vX*0w zhk+kY_E1kx?}dL5Vu>7&`z(q;kPH{p#pVrX_v4G@xCTfR`Da*xGCEos8eoBg`p4k? z`)jPcjf^tD@6N0b{}yh|Th|#bI6cuh6v#ix|}- zN)>utIq*~|KY!{2en6z5b$*f8`43&-Vl4YREWD$B93l)Yr@}^j~}1X(^;B>GcqzZFYU#O zR5Id!r>-tEyjl>-gbn!U1h@dho?Z7e;UY=yot$BcDXFOn(1h^upmlri7PNGn{&nLc z2~sITg4u5FHRB^P!_Y~rtn&NRTpAiH$u2^GFFAX%M=mXRdVCz0vjMV1iyWPibf%$B zFGK`(QoKhf6`+|Ii$YYX{d&|cf2Za4pjkspr$V1LcsoH=GzX7aXQI(*+iJQ{*-?A% z=EmdtWs@^w6fhPS;Bgpd4i2V+EUUM$J!>!*^Y8-IQKSr|!E$9^0DLRxSK>uqO;PS^CU2p4=G z?;SHCJ=n)jwnx+G4>y5_GT{)eD+;1~x#&tEBP~5)Th&TerLL<>pS53@_C9{rm^#dh3&?rp(!UGxU z7^WW^c_B$fnI7TfK367;Jk?Er&747 zl~pmWX&4jB008_buFC3(gx%q&3QLTOT&CaM0$57Ic9(ZoZP473_vIo>Bsgsn7SB#p z%f)1oPu``_^q{;EC@;BO_I-s4%hCe46W8nrFzghjC}n6ypW z>M5lkJcl(IoDCC(8Kkw(*4tj)^ZI=C7Q%Xm7T48YtpPCRQsoZmHtLnY8I4L1}#RqYQRO~9|bDPVHHc6&wM_tIfGOcMn*<2eXd8aAkj+F7C{ zfLK+wL>|R?f^n!TI2DFOkmXH<(jvnyRGYxR1EdO6#3rrPI=J7E#ViQEv#lim>vIXi zRgh4QZIlF|b}lg;!CXTe#>^T!lQy@fXn2Kky)~Lz*~$XoDJM8a>46b#|?nD#a<7uhM6n~TL%#Z>gMM~s#$F9SaA{r^g%dc zkRAjbLScE6#4c;ZZ5cimYW{4Cz+?G*ss-#GoURaC6DGu|)%%Z55_6Ot5c{`MUaMhw zDmi}VVLT|r2Nc`lu54?)Yo5R+PUx37GC4MR1i+$A?scM7C4`#538@ta47b`Yf0QIn z1YSdyWyyR?7A5z7m9dNWzUT&b(kHs2n!P^DEBI# z=;CIDl!4w2D`Y(KR>ti65xG6)xkpHQYt7wk#-$%ujOWh2r}z?g3;W%L6(va<^7%Kp zOkOX`2J$ig<+&r$hF2Tzn#-QsmlGL|R#)WqEa))br>iLe>}p#8yf%Dt1b9<_&gbSH z`DJDv5Yf8^!YoZRG%iGGw9g3CMd5hDa&gfVPy2H_#2Z#VhC8kB^LMZ48KUVhK7`Dz zq*seO2>ZO%s~&g;p*JTsch+-;n3G1lAGe+^lwa*`VBkVNAlmK_6^2LUJis0gvS?JZ z$0X&aJVfi4{6jfrh2F8&d(42YS*R4}yZ+P7*j!RCejpa&-om^9FA7oDinTxR-vP_T zS2tr}cm#aw20By(RGc7^#pW0N0&&-q*?yNCQ})K@&RVtAE5{3SF}LD^UynUk^l&j- z;Bl$l%Be8mVz#?$cJ}&OsmLfI>DTW7f91~=>(NL9G7sAkoBgtzuN7p)wdZouzN3bp z-UsV0YP+Mo*y?EPxOx3{uf~lRlxlouFOr|*M}yIhR_@Tk%~O2zmLK_qn#F@O;xhcs z4;8+hGn3>R<63HeMt2#035!^;IDO(rv{_vAyL5s>lJT5E`b_!UY#6cHr|wesi)x+J zk1N-4Vwya@j756kZRT$7MxI8aWHhHO0CQ`~2%)zh`V#%+6m{z`O- zXbCC=YTIi(lz?-6-hhE0j#^xsO4N=bI)?hdRfxT z4P;@GlaC(l5ZMKi%81K|Q|j?`a(nUx=1i>qHP>$LytkbRq}BroSNn0Q_URrhC!z-g z?ymtLo(p5U*HfCj=f3nBw!h$skvG-=e6iwpODUtEWeV%P zFRKr6p$^9RWfm}CV%UhP$H;u{ZCxQhB0myYVE5rOq_{@tr&e8Cvd63^U7NQjjqVrf zzpRNeJ8HSYJb_(8^Ksp9+Q9oHAdEAm{Y?GHyp00IfGVGu^+4ti`KKN<0C0*DVX|z z9tVEpj+y}!m_$rtqOnk(KY_1H`q#)~iR=#ts$u$b#i`dz zW~?T$D&(djOd=X`2%CtrM4Jivi68$E=5X}L2Nsp1GRjiN7Y)2VV+WSXB5-}2sUMb_ zr-7?qOh~pnE@KO~aPCAwUw(#-*3QCkSM|nnV*|a1ygo z!}^jeu}6dIj=OuF9rgC?4N0j*U=Hw|#Or@O@?0gos=ye|0sTjRu9ps~d%lbXD<39gaLnmG=t(+az*y~v4 zn%(rhX_PWTRllPtiXSHAg%1c%a?R|PRkbm#t5I)l1t6lC`|Y#0T}dL1%CZc-Lynnv z$5)Y0>ts32x9mk@W=U;KH*+Oj?aiVc((xVUm+OKa@Dd=%eC zVZa135-DgXzuyax)_6e7tg(-A?F|>YlK^O-85{~ZMvf$hHG(A)%1$KAa0u*oY;z)s zoVY?HL1Yvc%wx^KTzCYZzH11BK8B8wu{u@IbRa3&AE5v_c!adR4?p~ViDOV=tm*_> z!7mWN$&euR_3;L%t!GlEg5;Eu&)^=@h<|USw}(7@8%ZH%oNPNy6kw5GtpLZOA4b>B zk=#uiXc9uG2amg04$RK!=Z1oWeFzixVKwb-*^Q0CfG)u(R28eiUCRjSGKDJ)6<4<9 z3Ic; zRBdR!GYWK`v&MP+Xgc3E)l`q?{=`2r8YSm9!Dz1h6NfI3dTTKW_Bo)15f*EC_mY&T zkN_|RV)ye)Q09@jS^0R7wLF`fasK<M4+u#@h^Qgk!Y%%M&WItTEzPa`sYFqmO$ExA2FU8F28;4}-8b2$D1uYzmzhVUL6>DoYA@sQL(M z9SaElBr>qFCdPRKqa4I|LpWiB0;LQ!KD1PFLptxesDHX{ploh!qjlP7U({*NPDoqe zRZ}Mh8BehE97$`~gdUZOKXW=kV_@ccCHMe*LQX(o)`tN6L_0^T-Hw%coE&{_cOyhY zW23D~b>hm(QdP~G+V&4?Q;tN>vbpDy6Lcwq8Z_h^Nh3dZ!G&-GNn{_0lBF0^_bP;K z%{wv524h=m|3FcBkMuCSxM6b*lk1cW5QY=a!Se$XKXW6OSXbw!xL zkA;SA7HtGerCDT@f@VwgmHdEhXl8RIbEUxyouAS{Il zMwFg$^)O4_jzdrZPespTtA^Y`1cBPMK{AL00ls=m0L*B!f6s^b#CBLu_Zg|dop(zj z>-yZUmkDJN?mDO94Gj$`_KZzNRJsp`lGQbtGyz1=+NsVM$(SL#wD|Z*xI2fcD!O_@ zsOy0e4+rM9wiWqj=z38PZN|7_!U_+IcmO~k85<=xe$(}s9|o7t-EHGkX@DFn(gr{ zOCVcog!?;-ffA4lzoe+BDBh9rLQ)uKO;$tCUM;!Id=9OQQ+O_|ML0dk{=>436LuHB zyCG?>Y_N+vMkF`V)pdND;_R3pL@qMpL<=#{`s@h~ z0}n$=c?J8SXfJ0a8zv7+R}7q&NK?IiP1QH#(R7~FLKKHTd!E&V@b}(~&j#A%)`mGo z{=JK#;b9;ZldpU;i5E-5$H#YadA#e0NgeIrT%AYhtLo_Lz-7IFHO(st=fz0J_315T zlPrs9dhgg+(!!#lh3j5oxulYOr}qhT?ZaSy*~>v^UvN&U9#k46^Vx+eAzou#Q^Eur zR6l;jH4f?L;jLG*cE`ZO*H(Myjq~H9DnNm2H}g@s98`{N?C;8U!iw^ExYgbL>f6%z zjXT5CM{Q)7&Nwli47k+;Ljw&oTLRQ|=?MweYa<*|*w88JU)h7L!U|N?j?beb%UMb* zD_Tb;5oOBjazknz6*h-RAw4rQ2LwVWpED|={+LFQ;H#LenFd)Iv)My5>8T>yM3-<^ zezQt{m(@>V+9B?X*9H{N|GVu}*MSIa!MD=AI8^K)%J)n4Y2gYAk(F^M*dqf>x#bHQ zCaf1qxI*v}-8@l1hMy{6jUJ42O+;qaGnXHeOdlMIl#n68cL*%%&GrO()q|<#B$E(9 zsKcC&Qumju{SE}Dj*;8RX*W$djj_FYqL_nv?y6*iR500?l4S_#3kpp~eU0G{P@Jvq z{qTE1Pf@9`%gt#nVv@9;Ry<98*+Ro!DMadVF!Q&D{w~)Wo12qg-~HOK!Ot$v|J3$q zB9y4BLrli~*6J<(TB2g(wZ-?h(hVc9EVJo%raxPBDw(fS~iOC>7 zVJo>bXM2O*g577sJth{GNCKfZDP@3u%&`bF^K<@mdskA&C6x9JN_kJ$n!*r!dA4j| zoI90J7AA#i?n$^!Uea4Y3&TUT{Z?6-3502kbab+U2OMB^XCni~MwlFGL|IMa zXAO<%d|ew$N(H@Rv2WSwHoqg;c@}hEj~r_`5@#qW6cn=I>r@t(@W(BIjJLP9`5Ah)Tl{pppKxt3mPszFI{z5V-c*}1s^@tPVzSD#4g8zw4V>g&)Hy+wZp5m!29VC5s^LZ<71e|!#KBiYyIjGi%0BAXe$GWMNceBpcAcQt?=dqqv-;EEKnmk$QV9c$ zjT98R<8?Eo2MB$AORaZlzc@UVSllO@1p}S1Zy6P=0)qSuPtdyw1OG18(-cW;Mv|Qp z63HLrO%GmMe8`|HmrVpUxTt1+49&=tzboJEc(|`~+GfksR3{9v{%b|RbZx)3Q&nFz z0TV^>;=+Y%j7gMthSw1_G|9@!s<8HiY5qg0Pj!A`)i(kG{yCiSN6QrEzx@T=&axjr ze%#nUP#Gp*&vleigy)`@?{g*FxOAeF!NK2QNmH4#8Z!R zj3k1cj}XU?TLnO&U!o=qkN--eqkT5V37%6e4}*?D7i>Jbo`h_CnnNvJc$wz<&gz&hu(+iXxuOfN&i92mapkD{y$aL?OFu__^l;qjDjQsCvC?K;-u+HdY*LG75V#YLPZJzjt~*Bgy7*O zoq2wvrMv9Mh{+9hDpdE&iotzn_7-^Z1lK`&OJLpxhZ4cxMZ^5fn<)_BvA(-Ho|-2W`9J}XNVGz`j!uI!eb{OEXaR~^9d61EjQBhIj z!SPbdk}7}op&H4;*f>)uFnisj;o#={cfsubpZPDqgf2vbK8sR*etytcx&V!sp8P8# z9zA761%-HOL`nslCZtC<5R>0+y=3LB;oie`9;}U?~Pc!9tw>`8gOoP|q=tl|c`i&H-R@1An$4)bjto pp}7shOTSJ*T^N_ugyoUhBl`YO7$OlcT?R^9D;zRZ;)V8-xV-6^n)f|3!{I z^b-Do;H|GB|E6w+@&w*^>ma8k_vTGw3dWN)GQ9oHL)FCl%^U22|1Ja~R`t(s-b4tg zDaySETAX#Gex_6b-@Tp=O^aQyJDBum9Wbhh9YtZSFgu8zCtsl5A4MimdU#MmRcWmF zM@AeHJqN^4T_z11G6&T;TxYDWPG3X5RaLD1Qg7~D<88ivIbFJY|6%#Y$G2CfJ5$_Q z^>ZmJsFV^_<+T2Pz7P;$DCrS0v9S|_N?FzQ-*XZw>1C9EHHP2Bs;1Yd3vZ^C0!rXb zMx|kSJwhcl5GWenGmY^7k&ff!_y8D)pYAg256w+UbqkfbR0x_9J!ayt{Wx*hq}{N5 zOsomzJDYE13qxVj#41(ISM+|s-TNdTZQI~&v8xUZt?5+cwn?Tisxc51psGp#jYSHD zx5ICGk#!EI)46dvQuLCJT7p`t0<^aZm18vvAQ^vriPb%R{oJ93vIRWw`X)Fri1JD(@(#3^QGI6f& z^{-`WT((XwGl;NA5c5G5OZ8k<8&SgoPfaLA7x4)a9=u!cRsMxAq~^Gl?xPG^0Hrt1s%^PLGR z0lKT^b}^1r$a9?Hd)72-vI9C!OF^74*jC=9|3wIF=ZxUuC!SEI9RT?6mkgvCJBM-Q z?eE1kz6g~PMu27Ee5ri!<>B{=4L9kokSlYMoy7EPihin_M~B6h_y5gjsYbq^SANHX zQ&A1&>>UjFr#$PUWr*$fTF%(zzkDbTO-b6Klz0~dG_dl-n8Fu?_ZgX(9L>4kya@M? z$SxSRH1glUHxxmFB+ajq;~&4juHbx0KT|4^Y*+<2vUC~%ON$!|wPQ;46d8W4RGox} zAXucZ+_Bx39OZvSb@J*=!hjq7W8>PX4Gq5NlD9u6g4O!v#y|1}?ckG+s!6|?#V62$ zGVeS}NB-!~%F*t{QL)PMuWybDTR*m@r`willCTp`{E)Rt&(4edbEW@2D|2AaFOL_S zh>LwpV5Cfc_sXkz+7aK)=K|x(OV2{zC59<*qt4ikm^+q0DJ^EucYC7|^;%I>+oIJ` z8Ot)?%~<Msr205P$#Y%hD`4<_+szcNL|$Jh?M z*S;Ny20Q{dEk#*~zm=2!H<&)=(sbhK!TD%!&n+?*jU=y3vRi?wI+SHIA8c*Y4o%Ew zfSK3b$;cc~k~*KKWd>u$I5Jb?a8Gj8vd3eKxBn6~5@_>RyX$5oZ>7~i=1!QJKL(^_ zFcGi7ppz_PIT#Cy!tgmd?N9B~t(N!7e`%a(>qhfOt*rUZ zG1;KWjs``fj#q^KIdrXz+`N0Av8XUC5B74zS?Sd^u!yKkE2)&O=tm`4^3nr2@#G|a(vvbdIIjaqJX8GTXU%nPY>8V6G0s~}j5>9*&sizoKA zGu8tuon@o=1K)FIu*J5h3$u7)_hV29?}f7zr3@R7Y+0>i^U^WmuyrPB))5a#x`c>$ia}?6YSGW)q zeK3#L2|G5dk#WYd0ES@v41{UI9wh2|#?Wx{inPre-xj?-1YH&t!QM*4QvJzN^|UcT z3eGCoXtFfYkA-bJxd}7FFABAQ2UM*t8C+Q{B{Avyo%M!K+rA9a zfs+l^P%c8E!<~s+hmxA|IZ7STza90KS7j=t<&-~#Gx$py!XO7Ctq_*pR{`=o zQ=1Y7n|iQ~j_Mw{ghP$=JB-7n9UL5KwgEi;f}(O-9@I9AATX4)^~{ZTWb!kI*7bnkM;_0`$~$^ zgSKeurBK;&c-h)6UM64rk9uDe_NE(MNJqE5CWW%Ctma~6WT0JamO;pX7j;AQW4_9= zcf0Q2S-D31Umjm`gi2iou3+cE5YG+IZH9+AiMrtrBsBuP-ps{?(flQIXrffw3uL*N zAjRFO16@X!L`D+YAJGwWg%3z_e@O#q_athaT;@Npx~QYaru@nMl%LGmjOfO{!XtMv zON>r|jwq!Ni0?Xv5^@Gc+u(DviS%^ZmJc(CErPE(?9sb8JH#vmd>-b#wNIp@3OR+#|T@Ffu&7u%G9ig=8SJc&QzDmWaErA5ZF5Enw1MSFm+`nWj2hl_bQ5p zkH2InK}j!^TlzNKbSg@sdm6vdVs`vvm(-JB>Ip7}c2w|ek`W{r4>OW@o!7-3Y$u#{ zUqQ72;-}uX-qkd3{p+>rvAHXfLW(zeTuv?+XSU2XDls46a5vH+Y2#LzNB18v^&$j2 zpl90t9~hNtVttohP##~SSQOMR zr#q~scQn!ozcGbrR9yO{J+)`yC5ZDBxHPZcC2Q_R43e}550&NAVV~b``Vetjv@PA3 zGva4Ne9F8MXFMPVCAm>gUr@)V))i<0fKQfrHqoQrUG2c#Yx+CB_)!Om@Q-ZGSEroq z%45bV3TzXsWJ$)C$d0WZw#$)Bk(l8z3?+mW;IdF^1eZvue2)!i3w67ViQ`aMB{1>SvC9s}?P8>l-( zL0J@ScEc=oWgDoBo~Mf6EAaxu@69V32hPTh9>r~1njQE3zQxYBIR7kSO`Zye@QG=^ z;*gVO&LjpOZqHf85f#uJj;W3b|EBZ!?f(?he!6DQu5KAgR|nvw@&~psfOy={Y;-hP zja^z1W(bYxti)=$eIeUMoee*L?M7b}9Ej{9icuSz{n2#VFu{k3nndXGNE-|TkE1bY zcXy-TPS_@7Nr5+3gzFWjhe#pm;0Uvla4mNXH!1mJ0Z@N)uvB%9K%cV)wz4)$ z2v1+^G8$ahxOApe%d9dMBO}p_Egs!yN2?F~O5qD;g4N2w$5)%UuEyKy!}yqjdFEoc zd}BK=hS6^c&&-U~mS#%P`ibxj@ULY_F8KXUDdv$k4NE+EQm2_a8;-|hqk>PG52ML8 zNeh%5VPx8*4p(U*ZW!oI9)E*T-SYQ_kcEOHe|XVf{##uxI2iD17(DZ8oLo$1@XM!i zpAaM-we_PMG`9EcaN(YiFJYNP8)2(R9=!j|FMRs9hSljE*5FksXO}}b0gcJ&P*OA1 zS0bFxQ{$5ZU?S|A^fRP{e0%A^Pf&Ena!1>lw99l*v&Xd=sx%|iD1ndd&KSihG?aKt zdO05CQpf#C$mRzu+(?}NtBQA;)yaD`GH76!@x*DQ*O}80*$i`;!DN$%atGSA%h8V4 zPB2Oq#^enqTifk#>@N3`g$$S(9`eXR{IcxDj!(P;xO-7JYTaMi!(ZWT?>2?p9&LmC zglW>&!`$D>av?$deB^1muP~GtUQ5hTUwTqX3>g*7m(eUy&nD6$<#-#eTXTS!sBj@v zP?Rv0t~$UA02!|^0p_8-jV>|%R4T|RD0`Z4^yQZfO$pI%6b!&7F;G&0!dLu3IU60M zR4)GqB-B#izAjdw4k-i>+*%up3`V$I100ar*F_wdax9xoqi+ zVJ|7w`Xwt1ii)A<*UPe4dZ7G7Vi?;$?`y8ep?Hw#&zQ^N3^s?yR~HAum+k(Wf&DaF_08xvHebdn)OKL@C!^n**W?6a@!LQGRlRt zJ0eNcT(1`NJD+Bp+@8+(S=1#B!;qY=5DMg+C4;jU1@9AL`&)91G3-`C@lsxRadGJ& z8#ps8kTsd74ek>Gr}^LS`vYa9!u@Bwcb%(#UUmy?C>OIq%6TNC?4jf+6_~8^?zf6b zMqjw-e z=IQCtvvJUw?1a}^k->){4Z6LZ)j5VA!-WlrXp@PZi76+b$Em|%2--O!$6J?=PdXhk zFK0<;!v0FXzl$R5f)w@UG02lLnM@o><93s@KR$3a(^?if;k137Y!p{oZ8hhi9>lM< zYof}xKu#J@qc4_EBQR|ptPw#_^Z}_ob^O-B#SE5)^1KIYuZ5d9IlwX@OkicIm8o#-4=?PudF8n%;i^*-Rx*P`_@SGeRW3^nYIm-> zoGUJRMb5RffrBowWMab~JXUr3u@`mJ&ax402GviBgW1-nS|Y@ykEt4hSN8q2nN$=_ z4n_{;!d%n^^RlxD)jCuIx?NidvNfKlf*6i5OeT}|)wyl# zEheDsY&xLV^+VA)hS7$I%j6F2E`!!z$I_MARQ;w`nRR-g zp>#81A0Z|9?o-fW1|J8;_U5N|??@zq8>c~Kmkr)eYHXHUB&SF_acy-F-4U(@KE40k zGL}@-(Xi~3d!$fPjO+G#pkq`G@E>x}(D9Q~*kU5ERClP&wApEoOe~q9!a`Vi)e+Xnh|_v#&6EGNb)a;@@0@;X^V&Pij-B=~v{= zkyGf`b|S|+_fCIJ3NImTP@Z7s7!k;y6Djtz9%UU2=nA3S*?zbY_In}F68}-Av(L7+ zoP7YObK*=4GvVfx7+F1#e~8@)twvip02?d&J@QV?$b{OgD9Y(gGX9rsMb8>_EC*_A z*fuvN*xWFXl9n)!`}05f>5$g@YQCb8ky9n(s@ts(VxLqfrH92(z0hs6hyb=o`YQ*3 z#@aXhFLSuc4rbR7pFWQM7f$S^F?iU7|7(n=QX^7Tro>cS=6IBrYCfHdzu)K}IY)LF z#4-OwP~wJ_`>R(Ro%WeZqwG)w)ihJ#cuO*&XV#>uz=4UjIew__?&_1M`6c?)%;dmY zQ<>#=@pSlBs3eqjr0jXG zr|o9SOs!m<|Ek*SThSw5lW%JtJDxeSD8JobtI1jxfGV=1wS0b*_^Fu1F-aR> z{4^*spEM4Xcmm>ldTQKosC6uVBDfYcBsa8u6ybY@LK+$5ETXA7tu!8J=>3U?)>%cuxBNS4K0&`+XEERx2q9&YE?ZGv1vwlY$WY-K-$A zxI4xZHk;pEXsz;}mk*71Z0Pt>eg(&#N_5M*VL`Z3Q}({6R|FOfkBteTdH?QJFzisO z*x2PE;cH&qtvA`Q%q_Ep#`AVl&6F?6$Zzm5>)>Mu42@3K2~dm`VeP-4>=`X5NZq zR7SXpCO~gM6ia$L|GO`j2eFwud-mLT==c}5n-UoNZW~8XhGk1Bg|y_0%Z}jczFELb zXBdv4RJsMqwc^P-DkV@gYWK4lY9P_o`hs1;+s`veOCd+j3D2~{%5cA8E-s>R`%}Sh z1ftjQIBLL{3EP|YO3#&XPI95Y0xhQx=N4@W;-Ow!Sx^fzCD|-dCZ*JW(3XkJ_qW8D zYhK{*DO0YKnvAf^#uPqj>^KItgjSX~I868^>Yk$Jef|>H&5sGUkFRwRa+@B5GD{mV ztEDqpg7r|moHnwqx3q2;8SlOFV^Dm#j&aSz4#KyYxAvA?>j!CvyL%L0ZPKi3y9kw= zhow_c&^>QE3~6S0@!#g#>36-KI2A8;O!YOR*EINvXnf;Ft8*UhnQCn(tPbBQVB|dM zf#<8PgfU%SM~GB3Anu#3jNyXMfr-$nY}MimYB&=O?q2f{h@l2dJk=N#;oTP5-4|iX zg;b%52*_9PN;3KGKqls0!&Rj}q5jh3ol7B6bQGt%m;fZv=fs~P87|vr{JwG68?q6i zG%*HuE&`~AifovI>@MGOypz!SVV|Sh5E2e9no^L?gNwst8ZJ^~_sR@mKJ7Y~>2dK` zN!pLqvfFSkHmAOP$FAEcoh1v_b-ZC4Dg@x2ARB_Y0(ymHt)^w-e`R0U?lj@g{o|kO zP`j}!x97&ALJwM4ke&5={7OBb2!|e1v_r+VMsF(gJ8hGG06Px&=K2Js>FM=(TIMyl z_J%%kCTaWv{B1w4Wky9Bj%d;M(^q-Qvi?K7H@H^A4<+@qunE9lwae07_-g~kYJJ1; zGK2rxZ(qFUi-*<2_9hX2ItAN>o}YVtYQr z53ZC5{|uSL+i0G_bRtkRV>rET2)3?2UBhiv-#iXdw?w#97_KL7q|8O&B(Cd&|0INP z1~uyy%j4J+(r3x3M=Pkw@nVRngEV)^qG7x;%6EYR33x}t)K4e!(sqq6x#i7Vs$f%} z4gJ{a@0+)Md&cu5MLY%Wvd@$&qLKNxNdsNEt}msPA?XlXjh8|x19;9zcXd9^e!cxM z0WA~c>e~9-gM6ChRVq6B6LG~imI-nr%H2){eE6s#E4pIUFH!T$kdPo*QX^_Qu_|Ph zJZb5lKBtF|Vr)}GfCu0CpDs!*xoTh{-pg*!3j*fY?bG`GMwG^k7?oQ#cEN{?vayMY zfzzL#;6=^q0M*=&5+23XzGkNNl0GbE*?iP*Q-h7y1)qrlDAx`MlhTNSG8mM>r*XQZ zj9f=Rk3t0JZWo@}TIy>L^%=2~^Am+Vv|d+1QyXuJh!V8AE{Nvha^j{(QnX7wDoLR) z`zMacU%rS(8*5w9x+^`0d(n~P03-@l6wXLbwdIFPWJE{mqmaqJOY1Um!`=?o{ipvt zjWYD{ZaFjF#kRc{rIhoxl=+7m5~o~t^|iTB%=RT2Wh=vO{gp}y78YHjdU`N5PCDLf zMKeM-N6RlOh-fs0Av zyZQc%iQ&9b(2(f(El;urU0+|`U3}4j8!f&NdD6AW?EaAC^Qw`0fCWAECQFT%_(U^q z>XFr3boKfSE-{4Ji2FIK;pk)IE99uF6-6h!SC~m4v{xJ|4wQ7uAS9+`Sr?cwxvY-= zuXeN2wghzN9i1#f-ug#}OPvT`s3Sj4ZJm!f^HNrZhV*ow>Cw+ACmUS;xjW|^4)}j8 zL^+cGa(KkWV-t?1xNHa&rf!R|B<9_a2Y3yZYzWci`MeHHGcoK)*@@Nv43IO&_9TBdX z_C$U1jU9Uao_;{q;@vPL`DpEq2KPcyQZ6}|+}~yen0h_UjXI&z_`*IoXU_@`UT0r0 zpq_kkt=1{OfgX3l&ZP`-O3s3y>3-G~-_V}X@Q8P3aT#4r8sXo3m+UbeV)~q?#n@13 zTB6qO=9LMtJ0;0T)~iI6J%ub#kdn*aO}v<gXO9PCg{rAlB4hk}$DBl< zGI*ZNpCqhg-)U~(k)q_FDJRn<-`h7DEB zV3RvA7*{PnPsl&Ul`P@CJ6}uc>1oH-SJF#{=P2W)_IHM-uV07;<>u4JWC3lHmuGmzV@H^l(x1KKR!N+0xyf< zCEE$KDdWasx;d>j8`msjN;0fr`>#KLioaE$6BHJv$3?@`s5kxNVq1P$y~dwO*0!Od z2x{iQS9TWt{P{^Rdyxu9MCLks(FdK5ba zFM<4#6yLu~?rwS%Z$8Hxq9T#cSia}WJH9)B^U6#>H$!9R{<-~M&3v&n)Rg7s8y#k)u5uVN0mFRMb(|g zkVrMgq1e>+OY700tKHGma}f$^1#HXMcAvp>5q|mHp%4i*$vbySQV^tWi}=`6l>!pmJ&4k1zS>J zEA7C#6Sn$@{Ye&n^Y!bo*~PHP>3Be|fXK&xoy8sBFCrh_$Z{8P@6e(i~YS zl|vk4W~eFUP1U3=IDH0L&Q+Sa3=YV@G@8Z!;x&0p&TPo}Hlq6`b|7@h@2Gg>fC{== zczkWQraPrc9IwiGeYgX9@~WAbiDii-rp)I9^fO1tDzd&*`;y$Dgv7d|D3M_ZQZwz) znJtm@tM#xJa(nDn2eZhhJ0WNOpl6wk_w5)SVK6_PE_ffV$z-3%sjNg5`rB7ET3(C} zc;VC0beR)3bmxM~eUb$6S~UwaVB=c>KnJWu3h#aC#tv2lqR1GCgR?B}?!W1>vS416 z_~9kOKxRO$(Qu8R!S)Ub%=#@e^+ejz6>?JDMpcyuN|?Y`NXB^dy+J*}gH0m_4xw0M z4^PCsZBjDhx!IsH6l>ZCv~gHK)oH;rW}BcyT1u!(>2)%l!h zWhx@!BqeTYriKJB)G{GdovXxX}W-5()UOw>VLI z%vx|0Bm)|8mDJ4Pd)6sZq(}qP>q$#>&)HpYZDY4_4~Ur*;F9qix8lhVl7eM$DRFA{ z(6)BaU%jft>ict=Z({(zkzqYtVtCN;QnaB*2Bh(iK8J{s-y$YNa_4^J$Z2qP;}m#k znsX2#G1F`X=VE};(5G@rnkiAGf{vOmRanlEp%eSEHlm{ik?CClWBxyJsX@CP{nP@f zO`4cDoc^ul;{#?ot>E_^Vsk0x{c-}kwHCV*OjwqSmPc2)etQn6oxjN5nSe)&5u}AW zan132=JK4G^*mphEO7!E?g%-G<)d~^^XV~FrFkaB8d}2?teFh$NFcspJi;(o>V-${ z#Wu}V8SP~J_2y&FHjSc%5zRkJg_ZQbBQpaorwMO$_wE2KlzAMZK2ZuQv;mhJ$JLzo z`(--kvyX+8nAl1UT)dxY-t!EG{kZ5?4x{}#qg^it+U zhkmd%@mBep3)@7wJROA7m|R8s(?^bxf6v1$m96G1fXkj;akCtwPt3Bv9zttuiHU(; zNpJEwV;&Tkd_|R_Xf1aGPFXY@$ZRNal3vyitV6T+O;2vlkjgP%P~`QH)-&QB2r7@g6!ZN;i$*z+l(x@ujy~&RQ<{`V)ONGm!7t3-afM z&TN@#1dK`FA|>7Y@#O!Pk2q*rn|5A-b&SC8|db5AM`@YrLzA51cNv7b+; zq$c!VWh2%`RrK_-r$<W@2B`N*Q@Gh^e}hO{;@Yl0?|Y||2mM~=*wtsHhv4p=rmgiNN$E$1 z0g4y)+oapxD~`k$l*pap>g+a#V|OtZj!ib1r&`+2)LQh!3XMy)Q9M72t?1?^{4u#@ zy+ig4F(Umy)eY=wCc7UCklEM{_w7)!Z{?F>EYztBzAyUsar*u?A)C&Gyad*OMvI(G zpb@kyNu#7j^gq*5&eqa00?Br%e0s?~$Sxb&5spd!5ff?8hRr=LXVcri9ebc}>foC1 z93~X=v_f%J!a^<_hRT3vz@QT)bhEs_(yEHvot72wi#BLTbOB;O`fd1gug=VlK3-Yy zJ01eOos|GLB*2u@oaOa>vGGjG*0dQEUHB0;Jx_4pG<{czrLw`Z< zr80QgIW06ke~(;D#4iz5Q5VjCU}GD4{v7};8H;4H?(1kqVB#wHilMxdAsDaU=l!TP zOBbvZ^(T1zwQB=kz)M3<9}7+rQnzO6WTO-;i*EN~$p#-D(+T`LY5-t@wRgWWofjwx zDGRRD_vebGHz4IwK_u@&m|B3F+p$Rc0y;x17SU%$mzLxqMWil4WI@8nA2cjZQ`#FF z&`A!m$vszSZpaXRn$4tyP*Ub^uXp%;EP7Q1cTBa^_fWq|%BvI0LkcfHq z{ojUV4sKMfhvK~7mt*tRkuE`wgqRPhD!&q*4U<8oj%QzNUgy>UJ>FRfW&MOqEgmo5 zao2U6S7u`mox&;#1`iR0o;@8jB!_8SCDmnsw zAkRvp#+7u3EulW_EA}>2)M4Y-uD``Vw82=-g_Wzq6>jC6kquJI@q`duN|ebF+Cq)^ zg(M+*G|JkcN?LB$*^;_QK;NX2Dl2!V5^WA@cHa^2rf~edhG+%6$Bkf)WiOEJREKTH zk^RxtG!_v^JDFl$N4NJu6o#U^Nh3?may|ae^Tc~*8>lgpdbCZ5PWr3l^QA<_VzgF~ zS!sSI@m-`HqWG*lSok3hdYI6QV3OY3(LmmNE@t~Syr9o7xK%QP5;UQGNaI7zI}$+e zW&zVnxiGG5_fRD24XN3-rjn49;klTFd@;ET?s>XZwT%?P$n&OLIT)88OSSuFoN*(2 zWKzy|hxDx+N3b$JCa0jAuDZXu19Y4706aIKCY7OP2;~G)Lt_ef-T#`7B>SFvAOg(% z0;qsr=i-Av1wf|R@IQ07br;xsOLb^Vw<>y!GKCr?e?#)AF^kv)uEBhT$azIGt1yrg ztN>4jRbl5T_M?$7xq`I7qF@i_qlXt8wzk*amsKBEuk!d3RyZTf-KGUdfq|&k%=vH0 z1yy)od`dd+>y3rB)=KcdlP0kT*!*hcD;Gfy9QfpJEU(?~no?m^s;R5#II4CuzExpY z>f{zNP+wt_VKi->&?R(M6kNjoSn%L}D0=BqNWkTWhxIsxjOj4puI&%R@%l2H;+(zL z)wP=l<+V>V{?h7!TjaVL-;4Ppk1pQecJTCKS8K4OM0i8X54%jwCOyZm^jgQZ>oMg{ za&J&2eZ>C9<7j$LjK9=0Ka6R2(uHv({Z)08l7mJfKdd9|tQtwrY@SB0hC;n(MCgLat z!*<+t?BvPpki5N3+o!yh)rkinX(6fditg2VA@g;C2$A8=O@1lf!YX6osN;_3laSw5 z{NqYdif`d4y>!uo%~``xS8`@=fld=JZ)nzr?nOd*V)P}rOR)Z55Y)r66Rb8Ply}us zQyKNprMBykmeZ^Cbf4(6p*loEprh@B){LaL?{i~S+(|)|it86NG|9@QXkm@8;f9mX zU4>Tgp`MB@WMt6t@Zea~8x2KHRvZ^pX;KT=3ucriA}@Vu zZzN;?Jw84z=jzI3SYvG6`sdH5D0#Zm^){UKHuup&sUVL_h@4LXDn8m<+$84YVf_pO zmH!gOnv%Aq{dS+v7LjLqQ-x9#8d;qErAi69dV1j=qAo*#>EMuCP=!OPTapMNwy;!YRu=hAu_LEN*9wrvCHc?sG4Iw$tLu7$%_z2@hzP|_ zoTATK5r61^9iyat2{EPLoUo7(!%s;?K?w<3*Na^N*NMw~VK2diL_{U^^*BNI=fjm+ zc@3U>%BNf1>o;MJ-kJP{|MT2G&5$`0I;j=_DIr$uAVSJ$WJCmFMrI~i{owi0*YDp2 zpjuj5!0Txd=mbYSq-EJcfEo=sI)qkyNlApr?ZP0h_XI@pQZq@zi@wz*HX2J`7Rgcw^>l;e2omDi|I`|C3EKauWn zd?2Po7@nq~2R}g30i&9#nX^+#hzmK8AslDSJ>1?yt4cyj#a7vbJFi=n$<0}8?@6J5=Y_P-PTB49hU*v{zEH9EYP=5-w>Cq=DkV6GPv za4V#rp3R>et%HJx7kzk#eJV8`;(a^ATpTF_8*FqU9(wzMsC}pD+H>ujow6h|Qf^dMGWXNDP736< z&5yK^M#J*$0$=s5Q5W7{Ekncoo%O_)GlsC{cG}WYV^}Ofg&;$w$*y!sv6;sb`9|pJhlpYJMeJ%oKcBC^JxR4uB*J1Pt_*>wfImTSVlH>LTv z`cCijNb$ecnUmr(@WN1KWPfEEY3KUmp}qBlZQk#tq)6H%s(j;Rq^I#6kK~S-!c(sW zPs2&qIp(IwDZtp)&HakMnG^HLE&y$`J%$o3;mF-4OxM69c{XIX?JL`n!|a#xq}SD=EFl;gkqFqKjF(8zzU|9CRCyb^x92))C^{s+yZc}C~y zh1$b;@+0GuBs*mnUDOzdi{Lemoz5{4_w{J^ryFceb6!-MuE$Rcj6!4$IJuyHk-I-ap>HeM({*kt2RAlD1_ufo=j>JU4$(wP`ThGEB*b0{qjUd*3no6{Z*AO*&_ubCqq-j z7}7VRftLh>ECaG}y6u1e=>DtoFF6KH?o7?5D6y7BS9na7s>YFK>glA7oO$hbEg0_A z7#Ko+WNLW+`e~qbbj9jrxGQ>Ymz+S^IE5dntXD@FEm+m_|MBC+oIE+-gEj5*jXmC{ zloh{8?g|FlPe(MjuaK*==aBbC2~3$Yq0kA_gu@Cuyi*ULq>)8TEgCZlU)Za}l20C2 z6WIZ#y?v4eN=nQ)6qRg0Z}bJi`X$1oDOXi?GxpLMmf6?;%2~@%PpE@-JUbJoA*=)= zp0>JnPN`~p9=3EmBB+^mO!lm$WIe3$tK-MXNq=_pk(Wd@hHQ$DWE~^A@C)-84yXlG zU4)NM{*G>qFrRKL$CVBQ*BDE_Uh+*e?zGqj?5jU|{Lo20z5dx0Ogh8Qk=?|Z;bkql zkPX*+lz;8RgxMKexV5rb!UtqrIP8UEY;8!^IM~iBGYiBQ_WeL)-0edLCw}u8DJp=2 z^IzGA?hFb&G!noLcxPux(UeJ5J=6y@PqgSW5+q{ZjmmBcE(8f4MI*jJA~1A=pMCND z3&9S30TdN&n=ugyJjyd5B73xI_eo*~^x(h?( zAUUY-GTr>|Xb*>~+k;_2zW88U<=dtV$1`N}5Ic{+y5 z8T|!>Qvz;V+V}Gp8m#=dW~65)=^;_E#tyu(woDNp>keUjOlB=3AX&kWm|W zNG!~dt4{P)(`B>!;&MnfOUv0I8;{8?uk}oLX91amBw@d;X=7JK!P8@uVfOj=jnkz? z?H3q_IXIv&dhte#L#!c4WG(bT!Dq`8bwc_Q!Qij|@*?fge)_N5*v?jrgx zkRk$VHk2Tw?!|%m`I(}TM^v|7_pj~uC?k}v?c?R9_~@^eMYaYk_e=I%Aa)o>AQF!^ zVZk?KPY0{n(DT3byaJIpajH|_ss}#&omGa@@v&QeSi=gR+b?Sjw7d-(q2z~ZKv+Yn zbSo=iJc+zQ*Q;&CkGmk@Zh8c~cSvmLD&uo(g zSf~wtzxf54VQ?=Q9a|It=i@KhXuAr1ESHy^Js;7S9R;)0<61-GSp{<@C{=HC1K_m9PdA%+b$$w4q^dkUPXGPOQ8s0-0RXNkh5G z

^)tA8)XEf=+nP!3jBOt1TcbJ?RKEEGbu&#mj}sr_6QI!|awhbZ(Xf74S^!HM;A z3|rKbNp}5S#i%MaJx6_VK6f`@AE5)gt4G|QOs;TAn0$XjHKoV=S^YF=Va^Y}MSVRVdcbZ$BPl&oKi{0zep&$wnZp2IzSDy!*k!ynG{FM>vF7%z3Hr{xGjHr1$vScV0NAI)1pV z*L&H)8T_CR=tAp7Q-mgoCzmBo0wP}FV_s)bfUkXF3_G~aW0S!h* zKIEKlWSR7smSrb5I2#{3tn}D^kgIVCgV79r&uhzNR=|G0()>z`e&wyzOq^GnlF>Dqomm zm%S{4puatN@sAxwlJV&$$BZ*t@t;A%6pn(0NN~aC&`51(5?TX8a2@Hr#PFQ%d(o!D zOf6IBh^a)Q-Kg7wPXDj>F8_-0_NI<|5Q@;!72cL$et<{W8-j%ffy~E(p1=;$W)poI z!$?8$pRj+4XwA)elCTM7h7A{#)8xG98EhA9xO%LK0l2Va?&#ts0GNJZ$yz^j?fkW| zni z#c%N7IRDdo$*i4LRxOr_wk?p!_G2=%)nx@?`=)}2tiJl?uVv9Z*-|V!-%Vr{JqRi>IziK;_%i(T=y=qI}>Tjy0 zxpd&5b^D*F^Iqz%=0x&9{VO5T;kb>~TKfoAAhnA)xK1Tkq)d3Al4R&0M&vQvwl#8UsX_)-vNyB945AksWpz^xdEq)pb~z6JuHg zw=k{RLgiG87``<`BNHn7z5oFMsqF+hrxP|^%AC=i5a#sQSmp1B7?!+R+Rw8x?&80+ zq|=r-v#E~)4H6&BV|!K9(6ign#+4%nlU<~rx&j4{?N8oufWuMZrtvi$60!G~5>d9O z4{VduXGscMP}zj(E>bywn^^MsXQzX?&YC`7nL z$M|=A1?=!R2q?}4r0OMLJg2~y7FgV=Af+2D`8$vBvz~ps3uobE@!VcRbcFGNWVgKa zAb;KnAkPPmH={m&ob$fuMmt{@DH+K{oV#B%IR1I9eIo;_VM1|wBLy1IRp28xw(%eS z{UaH9{k!F6mun7P4%(fN@ZQ048w9Qm6j2aaK){xo1~1t+a0--;-+f9(h5-x1Toj!*?*U)3^5A@stIJ0u@L9K9rYK=>A)s%0`7-f(V)cc=I%5R zxGXXwX-iI-cdt#U7ICjA_JO;{AwdM9Zqhx%;&=^ZK6|a3BgdLQaJ5ievaGN5l}zG0 z{1y;;m;U-uAOR&;virn1YBqHk2@|;1{r7a8gC>Aj<5pp-Y6(XyL@PebAz`afYR0Xu zbSqL#f~B`Ir0K{oBT!u@_9Kaz2apu%<5{k7wW7<&{1LAH0+c4L+RAxCRBPbE%vH1z zpLk^JSDmJdq8fgi!lj^I1IvwfO1Gyi-=|c$K+l>?&*JU%J!_=$v-x6iK7P3`Z<(+= zOsF~n#$>6XvUi>qjBI2FMCnfy`G&b?4;6Dzy-~+ySoHZMQzcha`fk(EF|JfxUclIm?XaDy zsZU*S(O@-rReG)G9n3R-Lj6uL!&0*B5lcIEK~N@>m;|(9iebrI3gFXP0ranVJ&W{M z6ZaX6%-qBc8+N@`e)oK?I2r+DH1e7Q`iI}hgsx+$!FV!Kf0Z=<_sRn0lK;)Y{l9uU zf!#oKgNuotaEWM+fKbbTwU=V~9O?+lbV?`!?(G`&2M|2mEMj+pEa7 z7=S>m;8`weVZb5T>0!|H2gpK6 zo~Uxvi_PSB^%F!*lL` zTmH@*)*D_@^4{1uw$*(rlPa0Ptp}BCErQCaI|LP59XFMSn2LQ;qoQ^>|xYpHs=UM%L>T`wa&_;U77hb{fcdPO4IUmIJ|JLQ z{~}K&jUrE=t-a+q!@bqGWUpm{H_%3meWx#$2wT|lh`G4OwlY$LKMvDgaBpNyV_5i) z%qm$*b7SCI4UXmc#f*2K$HTiYy_(7qzJ=-8YqZ6Bs3 zc^r03WSF~WY%N2aCBAZAXf3CDj zdo9ia3)D6NHhq=rYV81gcKHS7xTzw0K3h4qnb{wWKdR5S%RLwLyKtz_3A(>B_~}vB zy0E|mZPFKZpMO@UPUB!v_-h)u?6u^mEDA6xxnyMM-oAYc0NjJGS#rW+xPN{$AkU%% zQ0`s>&EYq)&nI@JZO5q*H2(ke^7t*fPs|Ogj9Y)7J*|_xy8Y`m!c`(B%EL3^Z?mYz z-P)g0@ZYI`3*>v?raG2@FeuXjAln=YAz_Xc;qL=mPH$^7&2Rc%ZKP-MQgT`U%dZtX z9Tm{X&}sP;#=2-fThVi}F`{E);?$oV(tTn@QRkSwq0aLqfULE(^>Kb!Ocg4X1clUu zC?O^Sf!756EMM#NSNycXHIGEdmxz<+9h~)S5hvB;acFvKon>bOKO*;=bOxpfj!R0G zMtSc8wj@?RN#go4su!tC9X}g$GdG;K9-!P&k-65<<7ga73ehSsqn6>&!>?}p8`ke; zkx}d4qIKMPGR&c|O5c|ezcD!O_-=X6L)AA?=jDLSk7visdsKgfmHWgSBO@vtnaFAX z)WY;I?Tf#``F>gy%J%i0SQz3FL#(X5D!|sgKt7AV0YyD(xV2IO@4aC?`q$Y0V|dCA zeNjIHKkw&YTq=Sc0Dr-;Wu=Y?n&Up}IwOjZ@3Z};e0?)@x$M5}vrdR|aRAk3B8t&r z&I<0jCn->fw8$eO2<<)D^Vz0X^!2p}Ce^{~2)Og~c(|G%Uv4@6&i|GfACD9^@DwXr z8%31eE>tomyF8H=**3!nof-a_HrI3xp-Eh{s zsG$G+=8)NSYaM3D?1~e$eJOeLq|nXbCLz!YGu}5s@7b1)OA@WhD_1L!?aFDjl>bGw z?o;IAT&K-!8YJ>K`}5FHK=zvv^LX+u2d$& z@u+c*ATcY`1Qiz>7i)TeZs~qHukfsCNgKS83b&PjE!9E&^V~wB)|8dLBC5}IvQom2 z_Y^B6f^Lk?AY@aQNCbwk5IrlL&cVUzCWUPYX}RsVUTG9rxLd6<{^QSfz#bn$iai-W zPCD|3yReAuhWo5k`T|Vd34$8AGI05J;fS33wAY41*pjU*^wczbK5&@W>66?Rjd%B3 zlX!W&L=AFZvgPK9nQL^B&fp$>Q)vE-37Top^FY46&ateD%+0(51#PE!lUCQhF|H%$ zRhvw)Lfu`=<|fL7(Bq2M>uy`9e>dTr@p;x3*R+x@cj3y+JE?Dp^Z< z0jFTY4x5?;I_2cGiuT|Z#&AQtlj;&?A)erMiXH-9Z|%yocfTkr*VcJY6!TifCdF2c zaV@3Sg%tFn#*^yjK|A){gmfrpd?0(`5!}M6^@GbgS$CTY{mF#P1i2a|gRKssr2A&~ z+xK=Su6zN@o2WfFYn|h&PzIOJos`BLC^h_;Iy872*;@H?4t!^@EI2_gSudq~|e6uil+P4|N#iYq?o1hjBjzq@Bv}_WNSQpR-cU(wSJCTn?EZ}+;9G#44 za5Vtvth(sK&+_s_u0h^_m9kPw#*%FE_&oYWIaZ#{QoVQfB2 zOK;X$$SFNFi~Uz`R%|zWn6RGM!lpy>(|ZE3xySf*Pl+XZTNgu;evWcZ$lI0S@uA_B zWz-C@+J3_bCMWlOCaAi+?Rmr_p={L8+PE4h0odwOeK0&%pN0N@|M}*r`{cZ@Hd#Nk zf+!tjZt33_qis}u|LlG5e;P21$)KE#mOYniLIaiX8zO2M9*#)QNP%fHK~@IyWT(6C z%Rhw_f2?V*D{kNM`6_7P@$;~2HTEM%>y-@-5WJ<7zTmTp4jwjYo4tL@j3-Ry8p6ba za6QS{$E^_?rWGGa)Sye|2i6XKmz+22cLZcj$~Y<%i(kzP{L zw%6QuGYm!jAtEma!`$HsagN61_XxU&`B>~y)}x%>_A*CNr|f#ot8u3T_w|U`z!J31 z35J!A^K&`o{!%RApV2m(yYBXRbqchPUK)Tvoo}N1gn@BDyU=q{1AUYZ-P_(gh4LdL zUW?-QMNH7I>hwaWrfYCih^Vdq4FOijE0;}H+r;0${BM?4g%AI3e#C7mb(0jGTiIfw zFNqe>mbsov82ypqZ;IB}SR(G}QjBAot$-iwY>l{SZq>rC{rPjT9q;lVFjM7wPF{jg zXN_Bj*-ZC`yjg0RC{1I4ot^u<2Uf?^i7YG&3pmYM733keymCpRS!L<-Ha+_G`s~7y zl}No$A1&K;fC9W-5E=1yF=dDGaY+8AaT&$>jZ$K-o{!?SEID`mZC?sG+{8n9w)v;R zpNdL8H85ay7%Z_J6sex-p3kL{l0VQZzT(EFBuhib#U2S83(c0hy_yK3{r2tK zCb>nINDns$O`O27OAd?XFTX*F6?4G4RtVdG#%-u33vJHDWglUq3LQf{kLtW0-3kblw7NA)=!!s;V*QyS`(|B*6V_={R zvIe^Oi(BBdkZ%E*VeK+V<4unLrJC1fm5{?ELF$6M^ZHM9X1qh-{jh$g8*<-QePS!w zxh^)yJc&QRY6i!N(r4C9v@n{H8+l;6k}as&j^j{Om&FAR{jFf`7={1bzPw`RNI)NI zMHhKzR!p@c9J=H*xanY)MzXp)8n2Uvk1(i;wSD;+R#D)VcT9~5g*+LF9V{vDE?vTL zlD73PnXee>WTXr*l11Y1<<=}CIcwbp>#R&s5!B=sDzx zO#QM!8mEA;^-<2m8H1>Hu=Uu<8!eZAWR9ErL+{fW+$3{j{ETF=iwxz8D6_w@04b_QE6p-YW+q^ z!A4pE2q?%)jQ>Wb#7oO)GA$)L<27(ny)FuD{r^i%W~g4{gy=LPE{tW> z?q2VX`K8-;B9#Qfgh?nMyI+&Bsh8Af7y<%5-i>=t-fhWP&IUb*sIDBxzoru3Jw-p- zH(d@V6LAIP%n~;(sP4>k(R$7sNhm~oKm-DyDk1o)6E5M-Dihd<%`t5gi8GfSx z2F&ojmWSvq*SY5jmK(pr!K+JE)R!X(%(Uemy0x*&g{96G+;F=NGmM{HOmksP1vRLNe)ymzw!pm!lK5@(jM_{O$x@)NZP&GSg5`y=oE`)C>FV+n*z zLcfj=Z@}%UDA6hN-;My$nZ@{#aVdo`Zz-&k(~2m}2zQ9d-*(*Q2UuW(w(l@It?^R~nj9~LmTzyuenVpkz9Hwv}SD+QT=4)v{?OHAN1I4T|qI4AWm4h+?+8pZL-Rfc9k`#Gd(k z2a^}RDXQnCyEJt{!;3O+haHpEcxW+Fmw81ikuU%G!}{~qEv4hK!zHFvc+V+M)__rZ zawf!&HV|v+LXcdGkz_%p90h$dt?*|nzPopG4~0g@VDIjQ*;Qd{%Wb|p>dH>^v_5OSB_!f0s z1_7#&amQ`XJ);TEcxNGpl-^j&l{z|Hv^E(JN~u_yml=tdcqg8PMD|-EDA@8^YC@gR zJ9Se-Me08w=Qf{a&(YCt8j>p~A7WTyQs0%Yc#%9NgId(DG02QS z;!>zLkCpV|6I9cE^azQx9LzM`L;6VuF7KSf>hj5&QQg-_7(I-YuXFp|DX@pejo?z* zzsi$|}!S^xnkqq)aF@jbCW8wY)HITa7$yJb*d}?6)*= z#8PEniJlje*l80a?}EjT#o{yHUSk8-rSq*$n? zzKsCH=;7%_PhDpcwtnmzYp~7Us~7pGTFZt_7PM{=1`4Nd)01t76!yx4)=LkECw2g? zKkzGRn@;QKZFl!)AFd~+6RJ8#zV$GIsWn#KD)n;vHVv*vjof0CiyIpxcg){5?<_LI zW2s#bmM@ucZfC>jd%Il5K98ZRGNtOKLe^=t8z$tqU+0VH-fpsFAwj{fbF`-<&(zYn zg+_j#=Dgf1V&!I!U{o8M^~l%%pabY{6lJiY`G?X=Mde6%TTJ9iZJtB@`G`8AfYiya zWXuaW^Jm=ZmtkHy>Qs;IP#50=B!@#cg__&E_Iqc6IHs(Jw>Mp25v{4Kd|Rshcz|jiz<>d?cWl>rYa%ZJfVeW|C{9y?>~p+6bf#a21ExX0jQV3DXg?B=b79XPiX%W*Ptyi)icY{7G*6R+hY z3h7>XK0h@by}ZbtlA7MPf1y4sCG%q9Uq?VC(%qSA#qf>e@UVmu@hO7^^Hp+PefD=Z zAMJl0eW~X7UIWoeW~>m6dud4^LuV{F&_hXn&CkhL_n>c;Lqs~nO^m895V<~(yD_d@ zz}PWYGXY{f8G}6;Hg=l%S@&my_NDDbWNphg^dMGG%No|zb`I;hs9&?})-$A-g^N2% zt>pV3a+<38XtWi_R)wS97<(ag^L@cH5U`>13^QGTeCRf<8_Myd47 zYP?qSo@~|(6N!=-pVJPG<);^r>UTPv1J1%Z3WT8Wn?$nXjEQ$e6E1tr(?$<~KF$xu zyo!#Z)3wAwE%$X?B;(-1>OM&V{DC7c#vYq}jbih|{2<*`F6@-8c8A7Xa2U&R#$|MdkUf@kM{)oQ5Oa`rBZSJbU~aYHF1nWo*c@{cAbJ=^SR+Rt@o(iKM90k|y4hv7w$6o;_P zhs7&52o`FP5}YS-!UpulpSmx*Htw>OCO1r*$7QW&K5|AS&&*oa-0xrm)!L>7rXI=6 zpn@}CmGGrNaoN})-2DUs(+q}XoiPXMZpv5B4^y@Ewbby${#+xFR2UkwnVlr~5lU05 z#TM3wo5G3S{;l>&@J6N#73)`?CF2*>D_DrYzff5qZ+nA6SK>!qZ*q@v&XMe%!oNpN zRCYm9YUykmD&3(>UXj^&G0nfJW}06iFu@RJ6X6Ixl7~!7OCN&!5y`K)FyUo{_x#no z$aQTm!kjWfK<0)ze%+x5Ow7XPWt`g=EhL6&ur?&+FMWKq)b&@>d3@uD#eP+~8hKcs zz}F>3IzcFQHc##}7 zp$%@X!fy?YmGM9EG0-gM*isF+!7w71(4|s2~ zxnb!~{@ALCm!bUmfWmo4pzWE~Z;CnEHbj)#wDy9mJU&Zi$0#Ypic7N)+>^nsr$F>L|56N1KQoAK?OTTtjFolftu=Z?rwHx>7PaB z;Ee*4mw7QcPVUsF8`K$;-ojO1&PumH87-l(&lw(uJ7;DACT!!$4ICY)7GX3WqfwxJ z$8h*9e|C;h>_(EvO_lgdx*MnbV^fB$cN|wI)ER?VujgKFbw_81DPNy0GZ-^n@oMOa zMiCUYX#ehP`;O+mF0v7w_`}U_^ipV0d1Wkl)eCZqmWv+gz;kl)ejSm28yH_@n8&k~ zWfTHUD%Bc~Ssgrm&$2aqYRU}*S~enrYhJq!-L2!|eNv4vXzj-R6!S1X2jQ{iZUy^1 z7>uV+ip9|V`u@9v!dH@{6AXNcDe@G-W361Zz_A4>s@f`Vcg}TDFywPx^0y0mp_|Op z;6l`sZ)bjnTs3~v$g!NKT(4&NpFkNcO!lI zuBrFr6Fv{R2&P@-{;}9o`nb&}D9vt4iwa3Myu;SeGFP-7L}Qw<*zs9LjeCA*up$Q;ZRSGxLv*y)1dcL}2an z!0jxY((-oU&G`ZRJtL(fj9{Fk&ydYL_#>!(1BstLgBZSb12Z|kigk?Rpvq&-3HRqq z8@2CP_f#A;Qehkd`9yA`#0{S+*-sQbM{_?Dh^{TTVR zG#{&EBw&IFQ8PFWP%}L4!%lN>s3bh}wSD{}gaG~1N2!7Audf}X@ zDLMxqb3i}faf3S@3sOQ62CH;@V|s`CIEbQs`sHPk0aT(U)qX3lFAPb<65^N(*4>3m z#mYQr63fm)#9S@VlV>emdx&?_+BN!EO;`rEPSMFHG#{UB8q=H-h5hhM6HSSEF%xt7 z;*!j6E=IPZ4hNiwA(slqeIDngupW(!BH+uG?<3mz3#9YlhetkJC+oqCS^IipX9Mi` z>g*1*Y#!no5^a1XCr7`(NYBs3-&`*qX$M7;59zuy&O$!VL={+3Z}m~*TupHoPO+io zJ=1=<(rXVVSy@_wM10Yb4AT|R%e`9W8I%;54?k5ho4=CKvb*GhTTA|)3-E zWlHcR%uyanzY_4b&tILHaa;!}$x;s-NsCQJ%c!k*p9xxaN}!)x+_qK{5-#o?ii~L9 zR+SEsA1hg$d847b$esi$jUR{i&^q9qWvssW=T@YMv&eqzg7niIW8)1FJHr!Q%F|G# z9yubv)zJSR4EVn*=^$K zbhp%w;yJrvcDU)jgv-r9Sb8e88#vf8DfF3cKoNTAMJ)|HAZ`tWcGiVo}4}+skdQ0Q(_npb=woSAHBjO^HntH<#QjmrWJ-f z-5m9UOsbX@09nq z_HQ={g0mw1u=p_pcg13`iF34Q>hR&WQm9S6lpNhAgdlP3UYb$Y*f(r0d<9hfbm4_7 zE|Dv8ZZV9C%yYQ-7_d zYC0^qDbt=i(WQtZkb>EQ(2PZk9Mdsp>+0GRKUyMUxoCU-ZvA8a95476|NI?##pX-0 z>bz{~ti;>Ow8ZhUh6^@w9l}HtzS~yMclFvgXx$&4gfS&lH8ZKVhs2Al_xHP(iE6}G zHnm57#)u(IbgwL_?uDLQp_W^UC(5R;bND!1Re{!4~=@A z9)+2;)&lL*GOi!()a|f%f(Vb((7y$g0s;%I(g+ubgI87XyI)epiEU|cUZ~WXguyx( za2`0H$?_r7HwjjzNCx<$M^cIRJZ;P)=YqFRa*(SQWP$HCdxP{_jK-Uf7_n|?pe zpSC{N3tLyi`&sYOTzu0^DH5pvuQ!bv{km>|mmx|ySH2qyEi021CGqS0S3kz4bGnA# zZV`e~Nz1;33Bu9I$=}5X`40~KUBln0nh+fln{SiC0HRmI&Ju@DOw^f3l&H}24R}vj z{}Q9UBAw19WRSQ9! z=+CH=Tnqyx^arPYJ3ePI`u)o2nHauwx7?I|kmp(7k#`OzOBB?g!xxZ|li}F!=fkbj zF~@52Lt^0rMHYad`pEV|4UY}eGYfLMl+_C$vkhL*;!++(d*h~ztyedY$HHPrNZVWZ z8H@u*U7n>F*it0F|Hc-U5dF%S!9s`o7}qJ1Ftqxe@6m!dPp83d&s@1AGO(4Ziy*i~ z4NlAD0%>0B7bg6ykju%)6l!5EzJBQCOnSiS1(zvbMke1nl07YGh+in)glN}H`^;K* z-)04mkENj#q~3&$$%HBA=1fv23f`!e4}F3;cIUP+sVj!kz#?hUb03V%dX|Did}eED zlJpb7_`#YZe)K(oW?R*teMFwM1@W*@mlM=H&yrUPwm2n|$ubq#G))l(Ji=rw`#wRi z+`&*N)Fub{?cKcLNC~sFgj+zTYCRDs%0xXNJ6M4Os()W$H^| zHec`N>%As6nS6!N6{$_m&eu}1pSA0aA1YtrT~Mw6YSsIG5&a}PRWA&CU2;BqAe@71 z;vpDLss=SG^D1=pd@LTVUF`(X`j_GAn0kJzXLZQ(wr(MY>&R4CrS{X_ zm-X}Wi+~dMptz{9<8^?o-U-Ip(=vd?z>NtbcYiV>UHr)Dk{tiag2YZ}B0>N=S^z%}*QuHY|o z;S;7b6dtT0)o@+YU89EEK}Sw`l)WPR-RD_VxN4)LXyzU4T3^TV;rbR8mww;FyT%j2 zpEBz_I84rL$A-fBP}b>Jn6GMN!e|v6M=ZlEyVlR!a%~Vg+F$-z+@U-Fss$yQ7e)2Y zFKqpyukzZTyG1*GGH=@Jj`+ysOR$Gi+OxtfzeZ-+V_qled@V#xG-}>T{p{u^`8|!B zB$aAr$ zp@@_Q)TEw}H3Ch-;5CfmX(fYeHk(~BRTlZfteA5BSmi=)EZ06oc2G)&7=9qqso zbHXo<6^iRf(xJ#0oOln(^c&GuX9@1@Kq*o;YEeoEV;U>gUc&*X$jMvSeVaY5t5sg{ zzAh+K!N|xI?fO#fONu}T+QBr38Ktnm)gos?XaI3L938rg0UcvafVgPqkMb$Tp9&cU zFpMUTz1b`J;zmQfmtdhHsbcl*>0{}IvPtR5fDMfS4ksZz*VUi<$mjq}JU;e3wmeH5 z4i)k#vkBL&HM)^4xCG5joVm5#>@S|jte#7*z0|S9>aE7 z|CS2TMB)+k)dHS5Wohatxidf#@sIjDXR&1)lYM^IcgoloG?*wFC?d1q&FNkrxRB`H zaJug8lE;`VdL6~ln-*F4oz#4d5I2`oukA2VF>)ENp=BZ6ta7VA8$Myn?(&OAwBC>S zVCBST{cA}!;){_zZjfW3a+n;>y<$(|8;2i-W)0ElleIeB{U9)AuKXJHap1gS8rmZu zfOeGw0DigTbR;n|A!w-@ul#Q)Muzx}6-r7*n*wKZQ!N$f&FB>0f-yLt_W9Z=!_o_B zIo37?&0;hkNnF?ZMOW^;lBYb9=_vY3sRHA&mU3miDlVkqKDC%bMx3+?_;n0v>7JZm zU^8A~ol?kF=!tjp@@K(-zVhLVU15uqau0I&MF?WO2(7s1d=x^}a^zR#oWJ+;cE-N% zO3Nt`lY7lIe=uQQtW;aj;Lrp&#@3A0`$R|4mhoxKZ01Y>G!zbRT-+GzHNl4lGbDz8 z1`{=1ezBW$X2QtYBu#hob-T$M&=3teK`REP#^ zx$eVW7xr1IJcWkP?6&@K+y01dpw0uR1o%e@BYlq-(r7mS{IL71i@#f2Ppcbbqrvm^wEY9rESZWgep)>1@sk83DdHN)i|0#c!Y^6U-L7=T z+yEEVsvYj?YGCy{6yW{wvvP0V1vnygY>Ree*9p{xULgPp*!Ga@#BAy2yR+^Ap$lk@ zGlT0>s1E($rcy-BBps9jt~82Y7fJ~hn_y#r@hZHzGCbTG3UzlAEjS5)dV+0r-YR!k z${_kfWYWfTvgt<(V)wMa)z)i#xP_W^q%~p;@Gjpw3??SVGe&z_lu)t7<>cYYyc{M= zu>P8p_P`&0M{~Rd%FDZ3xVInd-;%!l%6K!V>5g*2b=z>0PeF4QG`wln#NjvZ8aBAd zi@qtKn~A(_9TYqsOzOA)3Y4aDXBr${wJAoZs9Fxv9fBp$C35o&y((Z`@ZBCdUn5r& zC%&rDYI0!;-eYRVLbvJ&d3t0(;F-54BM_=_SG4LzRaJu<}o| zesS;J=~r9bS{HY}L?v+hC@6zsQ`1w&<5_T;4`E=<^^7Pj%PlSVL@Lu}I&xtJ;mSxu zoG0SGDM>y)ma#QN+jpCtAqPN)3>0?=Ednp`uFEyj>4wX-Y`t1>2^rENCi#Sr`t}9W z3%Rn?z$$-kxBesQn2&-GGu|kG;OpVxk>A`*X5(1-r~r^wSW`nlTRj)Xrl-Pe>gf7j zfQq!!39;&+44HOBD(?*sy*gfw5T&2oQZTaTpuE`c>+J9w+k%|9alUUMz$W9A1&F9X zs{EJ>BJpI>@uW$e83BO7x=+QCfn9W!3`Bkxdp*I=(Frh60Cl@KR0aa~%~846uQ8XM znth3f8vr3Z)@cl-kiyB|zeDzynu`hwp2A$n8yg#yng0Fzr=FZVong3-_%CKW{Uoc1 z6)Ptv=aJUzb+{7uiYWvj;#wTTq2J5O=~nqI>5SBSb_T<&BK8j+rzi_5}gd_)}0= z((lJxF)3&u;*>>Ha1IA_EzUqNXA4FDWnS zWWf`GAjNuuit655XpHuoH^sSONsorhFq2t=o1L8D0-js^hy%+1p4 zYv0j48M>FymoDPxu6n=8I{bhd8EZHW;~}uZ}uCtbr7e zRvXTCI$g0z`nstotd!xve;+`a@!6Rbk`pY~pc2uw`nBf3uY#((ij0n9MFiAS|NL)~ zGe-JmdVw*HIm6J&3&x!1eS2hMDWV^A%WK^;jpf}cGkfLs@UO;X1L{?vM@IkEqDAj`%xd(1*CAm|x5$ zT-7Mq>oM@#dklFub}f)-?Z~byFX|q@R`8hd9O%v3$Xje3*qH$#gkSDs9u&tmXfnZx zFJy-q6lOcRc$ak_7{+pSo8f25#JMt;|EWpsR=61@Tb#Uyq=WEueD@~Ccs`LqUJl$T zS9aO>+R%IGP&*}B8EO&HXY+j)Hdh2lAo7yr4F8;x|IIkLGQ@_!C2lSAvhl>HUR7ZnU zh@KXdqtR+d%1-tDeARCej}aop9}PQ|YHj(M--{zsa`d|yKymNB?>@P2>v)PTA85>M z;cz`n@)G)=$G#f1vSkWWEk%zhMjPG43lg-;H0o8*na)^YMXMH~maU9>DTwS+sb(u(e%og|*3LmUdsRn#RFOpOg?EbuOf4^M&si(pZSx?N|fTIJRF3aNiveNSxNd-#x0 z&h}nr_nWY4kUp#7ZI+xfGG89M0oJqBKD<+y{eR9u8=`k)}kRGYzzIqNhqwtXG; zSbuMGOv`U2UU))#CZCmpvo!e*8p?6^s(R`#pKSj)kG;4(Xg2QqHWS(q*?*- ze$~|6saU3+{@za)MT071o_lK*;jGO0e#PLmSKlRDO>S>i;O~<+wdWHY-9C&!)zs7y z)H9C%(^nB9WrbgnMlnBJ1I)jb2_53$W(Hzi=(ii;tO81-UpG!D`vxi9#S>|8EUnWg z&L||`ugTVfNiBC|KH{PSizGU?vRBfJ?x;rLRYMwqQ=uZH~UoE$p8uzUFERpLQ_2l7dUp&~i9;azQf(vj|;k$gF z4u~vU4RPR8dP}`Y(K9;#3 zD!mI1muXSk9RZFuIp5`4omTgkozqAQYzOXRO=G?nXQ`A}q5WJQ#M#>E;r8E~d?y(B zy!H!mC@xcW)LCm_*7q#PRbZWmaHlrkga=3q&Df^Bww5sK;-Dw*G{VK1 zRugO^jK4LoOAy2buW#&I80?F8siN{^cs8;dBxi!z`L6NTSu*ReVqq?@&~-`-R-j4f zplaw1d{Z!piLZVbh)h^r#*K_fb-V?n(R?tIpYEzYS{2RCbi*UVyxy~%E!l#rENInF ztF_>bYqoy%Fi!+S1PcR5(sX=h&Fa;KA8_-cTqQKwLwMKXWq|~drX9+DR`3q|atMgu zP_X5Uz1mR;8FXd+*BDM>^YRZ7Vf&Donb{MgCWqibL{F0SNR13f$Wj|VoW!)6Z|%Z4 zO6D*zaP?Ie2j7RfGe+~$X0dm)DZ1Q^CzsalE=jjQ6hj%xps?mg`My`K3|fLN7#0pB zTF)Y1spV;*6li0#c^?YrLiq_HNl8Q;#ec^hOqZ(Zuvt*S@Mt+*d$oO+i! zzkP!W%KVv~E$r;1#fxkjW*@GdEL9kK1*C~h0U2t5V%D3tZ_Bh4JTa zf8y#8e#%Dyst^;@tb7Or0w@@ln*f!;h=7_3mOv>SZ*P%hClOUOwLj(BDSUt(VuceL z8ahzU%FR97iKRrr_}J*~c*l#kE>WBkO`hK?3S)5tEK*`WYiK(pfrs3ee_F z*k%^Y08c+I(u(ItzzT!+O4k%6m2?IGJ_m4o!!C*i(a;vhQvL6Lip+yh$#7?0gCTAf zk2lDaePJe?6IIH}5+N-$9Lr3OLwP7Kg$)G2fqqlq+B)emouR7y?_^2{pmg{6FyhA= zn^QHIsw#49!_h#Db@U@EpyEZc*jmZT@@ke~&goqW1th?)+!nCRA|9zD{~2FvWukaR zUf%7#{E38DqR*=5LT}rRtwv1G`Ty4)h%9f|U)(tGzwo&l+Xp$I79oyOz}PabN)&prx_>KYHdxF_0-V)17+aOPNh)_t~%1B<5}TU z++9z0H9uHO;sIrv9~+AC)A#x)CvQ2p)MU{tGdJGbs4ZJ_=1nR>q1hw>doBmE=itn# ztdn91yo6#Boz@SnVJcdtbc^ERyu6}-p2713sT*-x@U7T1ju7QMiconI5naGsoI#zL zFtsMSTU~u(dNOXpQl-WlNYZCO1X~yoWTUoogk~)@S$Zpk5<*-=LoR^g2u(hDJ9*^T znuJlwq!WFO>A5k5A(GSTsXz%@$O%7CAh&yWYTQMs_OVvdvv{Y)j_Rj8o!9Jm!XjDL zl3)ayf_Zz>Cpz&q^olS`CYGhpT^c)+Xu0Eac^$1=oPdgXc?Y5%^&>mJ?5tSeD6Yor;gbi{}uXM+H{ zO7YV(_9lnb_yGltD8-^$ZF?`T)z7Bzgs?c0&8d|?p|UP5tlEJeXtzhkq|!K%XV^0KrN1?cYM1y#8^~Qn|D5X->cOkFQO06BNa>O zad1B08e{cNHM6VmY;1vHUgDPYmXSU)Z_;{pJqP6@5F2g0K=taRA>eai(|WB#2*JX( z%!@#HN$BWi+qTCZYcu5zohY4-RvakCl5Yq&rvfY~04UGh+jHQ|6!GpaVbH8F5^cs3 zLm1Tc?R%L6HDJG&b0>u3ung{!@D1q$#2tV>^x9`0rO|CiceJXS*p>X?>ExHK4PU+> zuW$@B(>%(USI?xP!`=V63`3wc3nz*#s*Z21#oXN8Ea)Lg3qZ?0$r--JoUQy2(|Ufc zf{7;4vil600vjw}Y*OYs!w4<{lMJr;*&cRfru4s9CM-O@QZ?u1- zRsBiHOBb!OZTBe;Sh!ze!=-Ues0{ z?rX)Xc3h0oFlrvUe-ctK32Vi_UHZG**ZJIW`yYiO6Oj@twb;QjhOnFtP7C-&R)MD2 zCqgVmS%>YimTYcD^?JK;!YBizK|Y!82g8VRZsW+-`X31=%=6xSMktnE0hPX#s>;CpEN1d|hTexp z9&Jx+6_qu5&KFCr)ZIM~+*@7>nT?l5Xk=rYQO+|p2L7cyUHp?BhUW}X)Od>u)FQF& zSJ2@ntYl|nLx<+Kej}M^KO@RqT8zL%RVpr>hy*-oUo8XHsF%{A;FEA%@J=HaIr$mX zf)jZ+R=GbP^!p@6Vk~P4ygkW_;1vGLsnS_pOXE0D^i{ODR;W#6bO_lXfY zO!9==2OCD0O_mQmX+^U|aP|fbxOwb(oIix0_%SpC>FJT%BPm#uXhPT@E$<&tfGqzy zir2HmeDruF8Kv3&)0IlR&DXMkR5I`Bv9GVM-=8*ZemtPL*7;92-PY0ZglOKDZ@C!w zl7xmPo0gZN*ZV!lQ9FE+7!JimQD7jw+YDESB)xu|2cbLd2m1m>7GoXF&IFD*cg$mN z)=p7tJZ+z&1>74%p-#l8mE7DRf>O&1iyybJVS>~}--or&Gn>S#QG-{cQYz=>>da>j zO^0Hi{>XXBMY?QVfo6 zk$HtyM2|P^Mt#OHGOSIXHMk!!4dXR>0g7;@%naE6AlT>;Wnl2E$FsP_>5YzDuuog= z|1L3mmrz+Y;A5K`{0GQpwT>Y*U+4|D$c}-UX$5HH(kgj7%K(yGO5LhDIwld)xB*ni_km2f#L&`(NUXF#9oeH)f04m~xw;;)G@5g()O$dA7g+8so= z4Vp=v0*rDCKjwue(F!(ut)+Xf#0=&JV&1QA*D z5X{l#rYuBuCh@PN@i`H?29$-G%_)qxbUHYjny0Q~rD)S1_!@zx{ipQS4JSxRC#4v8 z@qik@YhZB$4wL@B9|26}|4I`;>HmQXpWHrt`uoNSDNX$H3Gnw?NmH>(-Yn$*0CORw A%>V!Z literal 0 HcmV?d00001 diff --git a/ee/ucp/images/single-interlock-deploy-3.png b/ee/ucp/images/single-interlock-deploy-3.png new file mode 100644 index 0000000000000000000000000000000000000000..1c059eab6d1d362c1a0687adb18ef520b237284a GIT binary patch literal 32339 zcmd3OQ*dQp^k!_^w(X>2blkDov2EKnIvv}#jSf4!v2Evn`!_YOQ}Z%a^Kfd{Irr|` z`<}h{t@YhVB?T!&I6OEI5D-KeY4IN*AfQLUs|^MU_{4vS*$p^=I{%Oo1*w@KI04>3 zn2X4ZfPmD;!@nCr0`FlRq_vzuK#&IhU7(mW-vdBEe2-ua&h+_Zuv5`^^ENMsrOz^H8@ay6@80Mldq!a_cc+i0(D%5c1zo{($KTM5j`~y)3)5I*IgE%6 zz3p}5H5X@X@J;u9&b$vVB+Q5~#&gmv+_Q&_oI~W` z4h#W|?i7^++3umK`FNA>KEwwdXQP4ck`Mum_8-}*yc3|D{oogrjw?6yO%zAq#5h82|(}c;-ni~Nm zK~CmF!4U=?6Mq_xkQyoVC45ON)r|bM^O?tVhS4lmx5`D_lcN8sxIi76R|X>B~R9qU~2BlfwsiJe9B~zbabv6?$J==NC87U?@LAQ<2aZ>2;pCEnTxc z1oSPfEK?n`kciq2D*8~-5QZ}mJeA}-t@P@1yf-fbQRee)*u6q@oj+$Od1?Q^kTv|2 z&0jYiUPE;H*hI#MKPwKuVo|>r-dPCh54uX9;BY!#Xw&@MR$_;%pKQ;4MplO@w);KV zH3_z*3NRr_n&G^lq(*fe?-V%ZST^e<q^tRG%tLl`>|@j_iZt?cy@D>cKD8k4T> zf)u^W2UoMbbm14B*+s<^kj4qpBtl!?p-Gmc~&f{YFN8Rr-IRtSnclCv4Ds)Wh&^$Sj>gg@ z6<022^)m&Dr2l>>{y9H?%H?an)88?Qv_9^g&&Xo*2SLCAdCl4UPAI6~ou;-TaRu-- zb-qW)3#}A$J(FIeO>N-Q%7Ze``@HO6*m<2&D2Mk~2b+hrTHC<5#`$&@DS<%nv+?68 z0sQf=vfGAT7=uo?J{||5a73-Z8N@>V=aJOA>f^d=9>&4Z#6&Ybmn<}h{=Nrw+eke9 zibV$vGC`zW0umCy{%IO2yWU&Tr^~Q_wvE7l%rB6f0!Mo$BxG)JgO1p@S?Tk&HvJ&= zNhp!rub~uo8YY-NW{j9gil8pM>-KW=c8r~QJc<*4e;_%YjVxHs;*`ro9y`gu`!!DB zX5cI-HKj^uYhcB75W?~0+09{{`Re7b6}(ouhXu#THpiF%1PK|_UcMph2>-+53gBo z){R?@U@4-A^iO(r<)l%@Nbs|=4mv3(W5eAoJ&VU37JejE!(_RWk?S|v6l*U~-VWej z$r|a$?Td8X|xSgKBAyzjba#(T8s5z5f&VZ`MmZe#F^%jh_wY$QJU{{BCl2N)-3~l z<<}r=CPzRGYxL?WmJACU`rigs%@v4hm#-6@K4qlFV8bt0>=;2+Eq_}r6CcxswCq)6 z@u@&Y@%#<%6Wy=psF*V$WKxmz(OmxaZCCik?1n9Q75^*}fv?Oim(Qr`eRt7Bj*sW$ z8eEQ((TX<#<2u*s41cH;fNvOUpPQLy_DFjESBkHnnz6Qm%hHgf@^_$OGdWPLW;mUORTIWx4-cz5eJ+PC%^;V(Z^ zmJ-qfDpHZG@zI?V#y~==Cuarp^SnO<+aEqh<+aPK|1L`50cNqR12}t{1sQ1OL3)~V zk>-D>OeLh!Y-G9!CsOGI{Pz}kSczEJjBVoSrmk45k=S-ll1F4K;OGhR4(0M~a>Bn) z(8=Sov6(h;mmIUI241q6rvasWMm3g<9pGKseu&58HaJ{5X%6sVCT7+&9dPIlB(TnM zLFxgA)3#XaYt3Zyi!n7f%isX5%i=eQGA%03vKO@6pplt#X{a$RgSntj&| zJ(ofGlZ@%Pwq0&t?@#_Z>h{^3XQ*K{T|2w%`|cWf)P+&EF@p(aM`m7KcM1Zc!&{_{ zC2}kZqN9XewHwYKl(&7;8spvE`gS>^W7{gqdi2CTFR`@3n=a#-4QE}p2Y2@Vbrtmw z{NCL{h5Ma4y9jaH$9?Dz_y z=EVLP^(Ddm%|=@2U_3XFxVI!?;v-S8*d5?i z9h#)*E$jKL0}I6dzL6VF0F#EEBDrd2O?~w@_C8nA4IELl^}3#cj|Yjjd{aBOv`k01 zi<-q+J?87q@Ubk@Ib-i z2wx|*uMH5ug@EWa1hH$|tefy>pW&GoOs88wZ-&|wL{euIjRS44PiDF($#s_oXO5(AR)I$r~Fs2N{ak(I~Pp&-O97FM2WZZF$F4D z@C6D~{kzp4wDw12WV}B-2NB@0V)+N>p^y6XdGc)lI8i`yw=Md6p6Fhf{sL0tUf^6? z!O^OtSS_UJEc;o)6^v-@pH1r^2S?N}ZxX^^8UyE+=<@0H4s)bc-by*+3Dl}N`TpBa z7h8XenCr~U;V=V~$YgSMNS=?cY7@J1jOZAqz}~t!VcAf57#&Zd zhwCMb;#4z`UhPEE>+?9U6R-cT(uBXMQ3##`uEhgG;JG^sy%EgxAGfoqLZ1G6C7-pL z{n$&N!LXZ`F%Czzk=2p#US76ut9;}fOfZ7X!<4rRs5ef>G~sfyQRq_C*fB#js-c6< zd=D&kH<9m3d+DPZ&j$-my%ZI+CcVLosP8=;WY04?QN(zymEQLpb}T!)?pP~@i3|5C zL`oRUqcN^yWs5V$4fJa61w6^5v&#|eZ2S1VHxrfkK0l8B#0&vEOC%W*5UF{@=W`vM zh7rOEDl;4D<#Kg7BH4RB4h+2Z_t<(lJgZ%VJD_S=MS8szjB|9kCuyN$#Q{%!{UkIq zo54$KArRLUaD&Eve$|R}I!k!JSlr>e3e_1GRhwGI^ReGd^~lX`8{#C$rJ)T}pAWjx zdKWvmi@}-nn4b@6Hqtm+$E)GHe^efF49Ls^Q!cc=YTU_%N}qY0_2lmlQHb)kx1W-| zsBIRIkcdUWW_roh&}4d5C);|A8{*ESwsi&nP2n9+(mtf>hP-0QVn0wf$Y!WA;yXt4 z@RmLO%}Rv+D7k9|D}Z#Pys6p z0+z`6+U~iW%W0iNm0HVN8VUEI*mRm zc*^#E1@m|8cY~wt*LX6KFH^Ann-C)6zvm0LcTm2m*HBUroAx7yje%7GYpH1*)ZTNy z)V}keuXV#pB$|L5Ye4{tEHNSo7)pbHoN+SKDj*S{GHb}Wk5MiVH0ZhMdUHBAsF;5J z_Q1`fXmHlg(d8T@EtPi|%UF~rw=1?FfMKlK7QEd%IL%bxb?mx?jvWa(ov3`+kim7l z5EamlH~1{p&|mFK?%OZM@hqZq`!3l$zdc+9-k;sTZ?Iai?&ZPLecZPG6e@RZ&GcJ$wM(?G zSTh}|lV71sgdEOH00r^47>$cfAC%-b^;O9}fqw5(V9HFljAbXy=Cv7nRw+|?VKZ>waS5|8yO2>*L8FnqY0l{b~ZxY z5sI(9wv;@#Ck{(NAbO4)wd4~fMdZYl#zwZ}%P1#18RAxV6moA6^W$Ej9WCG9#TP5O ziKYIj4Zs2OTjeO-;0Kfg`1GT)*G&x={|a_@%8ry;LqI|Xn2ZijDhx8-NH9YbLGr_H z^U;9(GT@7p17`mSAY%ky9UIgdJ|~Gs%g+aYiiKXPHkiE+b;R`6#E1{6M#diuygB0( zYqYi#nd#Q{@tPA7Ey=|~i(^5FYQ9FunQQLG)x5fgn{7uXMs9A?xOneO;=5Y5%!hE` z!}3C!#nCOVMfg0#8UI#ddmMx|`?Y^b<#(x^rkjlL43z_j0Vn`G@?^bAz?Z~FT<`k? zIsD>;p!4s+2!1x(#os<9mV4X)uLG^3)Y`5FWr^1#tDnKmv9?b0&_te=n}^_mzfclN zcVpL5(^neju*!kf441^P9YHpN9gCHL5XROn>8JeaXrh*}t~qxFk?Y4RRDO9@$db*j z#dCTV?H-O~!@z4bTCYtyq5WruBM}s+2+!Td7`P}*pd{a4A#VN01($>pQJpgNs$3+W zSHy3%b@QM-j@=sj7ijs~D>oO8ByABY#1SeNcFF!Vx8p>R>JUZA!<@EeO`Y2=0e4cz z-IsYsDbP)Z*M%jRCCOtU!1(K1@HyMkPcQ=5{hupG##WZNG4re=^s z5%fBiUi*(JDvVNsI!jzLA^h9$wEDEH`8dcx%<6Bud2fH!WvZ_q(fChfiLgLH_JdkV z{YJRMl6m6_-{o}YuHSy=U0d%Ed?#s|X90}>mC4IMZt&|8)v+O%&Cv8zV%$-3QA-ea zb$k6n3&p-WTR#YqdpsU(}JRD8HW=m%x?e*O*~qzNn%5!G0}TnsAmsM5sKCzteL{(?3$= z=ZWR!&WUlT60Sb}S|6kgkK5?_q8nPr@?^UvA$+f0w1-n~wdUhd>}3^b?yb0W&&b07 zpa#8}e|$cVJWV-|LojX>#Qw!H*R{5yg2Jk=xf^{^ARkh!sta+iDrv@kbi=LnW9%Jw zZ6sim*qfb+TR7u8sO@aqSJoq1T`gAkJW|^+y#_j?`B@S%J@pl;Z(n`n0JXQ`E{XjT z`)(%yTCG6OhB*YDaKO&^2ljLbz5p3>?cI3&m$R(pU5S4*6mW0ZYtpHSs;Qv`=-2K)p*23?o`pxjJ_++tD zYcnafX9vk_z4akq)uMVEraw=)B7&#h#A5I2^v}MXz5gi5>_V)NbBtd?BwTNFjAiQv z=nMyDCyIaqUeD=X*7%|bLl{*KyQey6J3Y6~ujmCoRE)fNiPa6hUeFsLbP_D^vkjtuC z(M#@}Nh0{AdhjT*+p9a90yr*5_=Q+_%WjREAcO^d^|AK^Kqwa!jeuqN2tm79!W_w_8)%3<|6 zWHqTy?1aj?^f4LgA2VzrH!1=Z0UAW!S-c-<_x})PP!gKsOP2+k(i8HD@#9WtHpBbT z+zeE6$)15R^FKMXi-!Ckk$U)u!;oDfbQb?TGS=K%K|ZID@7&eiW>@bgVDI=-@)u{=x4UaY;B(1!gznXXtc5SdbhJ7 zBe3Q-A3mtJB}U$YiaOSiL=9iLXA;7OKtD}UcB*g{S63?O%{;$Y2iv5K6w@i+h5!I?- z%R3eA%w{MiR|rZ2Bnh8xOIJeA{{gyxh3nNBTIUGCl0zX}4c<^8>?(DCCphYhpX*zP2{(>5-WrqdQVSfq5f!H+Moanu~fx^{VYJ zOp2!oFwECUvL8>(q%T+0JO!sqN5I#YYgP4L!6hCjYGRSX#+QohPm@dZ^v-(O)70&3 zBE8NpIfoFPk=dz4jzJ$qRK2#Up^$=u0p&7p_b$T5LuUnrNs~wn!E|U#lF{c~ept(& z9#(PBEAjM-lMrHhl_y1*?|Lzs!5fWV9p}Uy7{c6Rs2U7Z9Mj&wcKp(A%~t#6h=eMY zq}Ghn8v0F7Rg65Z-H+LEMH`m`7J2Pw{XGUhp^f|lU(dIBG52|-`GK_gNi1b$$qN+R zf7Outu&oI78M#DQYR$}}G-+Ct)kB^{-jzrj_gLv2qBNy&a#o#M@84q^0L_cxa&k@w zdbZE$U(Ji09^bk>q}rYD`E!f&%d#(CXD|{I-y-D}?Kghn*ZJM;3nW@%N14hahCF~h z(blK5Xk+G1D=^($Ce)E`uyLA{ps{;#+rXl}_ zNRfqN>|2=h8cw3#r_Ik}3O12c$Bzkl06<@kFTj-`gkBzAf7F`vLNd`&%3WU=9CuH` z&0E^^kdiDj87z=O8)*62G(Ao^RP+(K&6?dB#lz&$WyVx1J-8F!39DH;`EK{3C4|0; zrR$^alBC3!d#W<;WtQs=4ULfVnQtGe)xDqH-8Glh*2;t-&>Wjmq8AwfDM%z0GOJ{e zSxC2TbptVm^wQ*>{Lwycp%M1*YA4rC1|I3s)5zVGJEXz?PPpHAs3%QrPxXx2-8<3u zvv@MOLr}x?7MBdV97U`uk#%r&%;gVg$JO^01YZfmZxN=LN6P`NoWcf6vH4Lke0^)w ziK7v|;w^8@Y7uxsil(!p5^gJCnt50aRQYsH+xY6OTuPtCV?evTP1;jjaj(dXP3s9j zI}B(^J_aHj#zEU%upfGVR@hwX2l;iNnPKkw=TBtUy2yz0YL_pGt7_;)6`}m!Gfj7P%PDr9-%`BtX*Qi6PsT=fyiZ9`q@)o6;!&8{#@Wca|P_?1?WI+ zE_;nIesj0bw9xGpG&eQa`K~tkoK6PVV!9pwX-rT*LL8ZH23uW#e^skk{j*YU^X%eX z5Q15+o1Nj2Kl*IuDngkD1{R2DMQW@pPmZSpDD2`jcK7zG54-h~4lNS>XZ=a)R>0@n zGFl7AuvbpKsGIZrC~sel)bT0Sa!T_kf7CTbDaH+{>Nz&i6?>8SuE_3v@O z$S%fx?WB%wJ7cg$0L$lEJ8j$mSLZyK_z54MXyz|UQWSn%D0-Z@7ehCZ4(;b$+@`zf z5_C!qghmeTEB)!K?c#Yj2=7C=YQ&WVu;0+(WFF_swGEHnAVU~f_J7^$IHUCo3RAjgegBkSwvWdy z0`FEg^UBKc-6#l*PFAwuP0j!*2bL+N)ogQ9Qq-)37T!#+ZkNWZ6pw(wnQ+-b*Mc5d zEg{87Fut$BlZSYbTj&^fFS^Y5%15u3+Li+xJkd26SPst=-ZboH8Iq^szHPVL5}BZ4 zs3*W*CygU#)=SuV!t}*)S!LJxerpdOvY0jWB`GzLi)J_G9I2TapPsJxcSnn&IA`;Y zcjo=(4H{s1PUl}tP+iW$ zq>St>&x=uKdJ*CYV*H=zTQE4OJxPr3-<^_hzo*&&H9TTgwon)hk}TsyPEo1m{L%1xuTKl!f#*L)MzFHKgm;XKPH&l# z+5NVwbEe-t^c~uFp^HNmh)&F_7#0ZBq**BjCSx&dR$Ph0Jz-=Pl6{<{l4YVZ+*H3y z4ttdUM2+QB8Y-|(J|UA@*hATUu-8^F+*6Ce{#FEbsn#f7UAp63&BQy6FEJssGNoUA znzt6Y+9-~sGFgp0bJ{SkVYM*?w_G}@+#x)T-&XA$*+W2@TV3Cz_8GvY+IATg0J>q-sk$Ycp7 z(xoP_cp9>&+;ODR)?e}k?O4d9Oh9Uxa1(v^Loo}E5_+9W1`YOi{O4b}3kBSsb_z&f(n^q>?7dMDE?V+we)^~Riwyl5hzWEWA-1(m1`Py4 zY4;eKv^d*)o9Ge~*cQV6T8voLucc9tl&9j&rg|T_ioajc$Wy1g|4ih_cubv}76TQC zVR=gaBfGfe_+T^8B>@AQdd5#4+RL$X_QP$(ifOJL4dH`Z-{mE-yEYv7QR(wWeKil%aOf+4%tL$AW9~k60k#M#3GVIJ69h% zdz4Hmn^woiANCJJq_kHa(H@bMa#&@x$JCbXV=LBUJ_aW z|8JT8CZ4mesRR>fgq3!W8)L_I-4QD@;4b@^<$*hI=558Dj06+Bzwzoe+fF<@G|OcB z8AUwFQ;F#aKbX{* z(%^}G^6A5HgW1w|8G5>uKkG5}tyuv3ip0t9{wYOm9xp3pww!_#8Q1+F?Y}R|j^{;9 zta8NI2ow&Jd_jiW(I>j?+S`4Keg6EQRuhVE1K(SvGW1gcR{td#X}HdI=j2!zw=CJj z*zO&y;smd1-{9w>jW3{?R90m9J20_qqt> zq>vqczvf+L*A%p2bPfSwaCDmUwpn`$!%TEcIB?3NX`Q)L)pPoDkXNBRip&U#Mu`OQ zu3=m5v$8g~^$~9)2wd&GxkFQ%W-25BluVzqYHoqbymC0FXdUG+HS$K8*4D#JQ75}= zO^H;<$~nG(C)_BtR0|zb1(USsO9bCJuT{Qg<2Vr^f9#`OK`Rl1`IDvwRq|5n;_f)> z#X=Ey^rEj2ElhTTOiMMk*&j|~w%|_GH*>XMXoE8L@;`( zw+VU$Kj5PptKp}7nYi4>(_Ty>f+f{HEcc28)W@Qgw%y%>Rps@GINHpTO6(JYu3Q9z z>>QPyL@_Jh+g!L?=4doiTTue~KpB3ZW`)5V2m4Q7-z0HK2PX@=&`jzDBeaffQmxqB zk3Gu!d6I9E`p-Da&^sHWfh9wbk_sFCP~C1IWRh8St=s+upb|$h!YP1t6n%5rML<9Z z{KhmiKF_0r*9EoG$J_sOY2yGpGz@~==El;PG;i9wXfwWO;$gRe?yFE;+8m%3eFklS z`&93b-naH?TQD0d7(&Wb6MEG5Fc5e&1ne9lo}{SI66hSKUa@zsYxc+;tZ#F{vBZt$bsB1}y7W*J32_iQ5Gq0CHhbo_INt+uE zjLh9^SsM4yA-@hjz+$VQ*8tGAEJMaHOIVi7lvOG2wPtJLzZgqOo zUui9>ER;JtI^+~E5!+u`75h=KvIjZ4!*o;DYF#4}(&?NhAYroNou`UFocAZ@f70be z9|&TOLPwW;|DN+RaUf{}({bKupDq^M@m)hNb3=ngO|mnIyOI1xD&x#$JTepV$GK&y zK^cib5j@1hO8eeAqlGSZrha{xfl`C`r&7D5Uuh;W95}oVevF}d#kRh3hbq&;(N{&g z`tHMG_d>(;iv{)wyGQ`?948zY%AeeOE$(Aq$M@@d0rII8J6)!u6X!35&=)++E8tO2 zI~(E__U>pSzSWgWGA$qZG!_i#0-&yTCUWXub&~g))y|ANbc};O?^osh+N}zuTGWg_ zNtQ@kG1^QoP_WGAxqQEz{Rw`UivZPIgUuc&+Adv@Voc z702|8e8YEfiysc#c_@km;n$a?K?v|~n3%c(^dT-mQQssT^=pi?ujE+N5_m>yLL^<^ z-RZ8&n8Jq+)hSe|1G&NKPsn5Kv*xl?OZt#w0rp{mU^CsnlHos8Nw-0bhi=ZkpS znO7(cig=1Ld6`bA%Zrf(Xxu-ez(A>66<_z&rOj2i-`4N z=ujmw%+&T1tB`)R-iUR5JtOzjw%NwOzA8nBUSqOw2_H;~FUXon9UgCK2W5+#?RNj$ z!%r(z?ySfC@<>Z37s(!~8c2*d59qzXRuw`|h+!oXMqWN80+3aq`;DONzU zTcJlOu^%O*V41igh}E7^*biPgKPiJwcImaL(m@$hfB!q%sQgH^W7J}hUg@&wXr(K% z9F}Q#QL1qaltFLN00q-w>tS1^xUnCKrbHFDT}g-ZCt6{IdPR}bi*{ROwTKkkE_mi_#uJVca!<@5Hm~dh-x1cAp}_Fd_w_}j zZ;Qee((|_y8&tizrN4c2n>8kK$lMX#$Mrm!%H8I*sRaKulYul50t(dcPPEAPH|y6Y zD@_i8jxQGma+!GmFt>MQ(Z#M7vO}ncUS|U;P_bgw^<|aAJu<~f1i1bk#uN6P{gJez zz>Ri*)a`K}6h$iHxJBmVwnYCf*zxWlRJk$sC%mCZA^w8Dls)wqZgZ|peu`1mragyG z6}{G{erI_U(Z!gBSQxuTxe&du2CLk|lX|lDfyq&pw*b3S+6mo51(v|vvP~YQ?A%*j zeclq-(|h>V)%-atoBowxO2C%!)&cFbUwhLO`H`B3oaC!Rjf$O`wWqR^fMC5$tU)7{&qz?YT7>A#eot8J#4>+ zsR?!%g6k2Q8TE`nN7$vRI6#c-UKzbD_6^C2K|-dcd{sncF;^xv+{JK>QK*- zUpb}Q3loNdrxy0zdIF5QMI;=chZemb{jn+nQ zcUK#0oGJhoZQrd__ALVD!P)msr*^nI9QW+5-^K{aeqI?WR$vzs^`AA;05L}-@EoJC z3Uv4rLY%6-#8briwdHna41(5e;Uz71a>pA|3>VJw&2m3=Y@dmwO#mHN;ZPx!x%CWK}6^cwT5Y^?MW|)7LzZT37Y1 zv*t>P^`MCva;#eZwQq!jGDGO;UsmawNb(P`L_M<1H zu;AI#p4djHo%8z7UM}UQ|U?~{BRNuig0^q0@KtK#-{t*EFd)6e%8Gg=y&1c>Gw z+9`_p|I*vPuDXkf*TN~AcC9ICX%npgKVakFbs&Rwll1B7DFrpPRLiED&Z=$ers+fq zZBk+)>5UB*2`YjLHK}rt;2IX=k-Tt%vb>(UIu*e8DHqkWigc{3CXD2&VUmf>WCUS+ za*|!0jr0%5fBEMnJK-5P|F4g>o*w<>8a;Xg--lG6=biA8A2sFWCnRHyX46UU@9&RR z*6Mo67XM}DhO-cu)@UXg8XD^A69b{}v99kgNBNVt2b0D1^?x*n)@@sJ&%5qsE`rWo z_~e^8Av4A4|I79}bs+c6Xk?Lc+DS&rvcf?8A6Lys3gDMnA@~FZ^{C`BNY?FpyU*(e zk=T4+T^33Z;;q96MMS8?!2UrJqTbo;L*@}M2^VUci;JcN?SAh!QhRzI!`KEHbZ0>H zAd{yqtW-YR48rsAe3i{=k!Ei(H6=wHI3MlNInLqlZ027>=~Zrgx`XZeom-_p95QhY z1*oJAnsa6dtdglNVq(FT-$sNQ$RZdZxG5=z@5N>&CfKYyv$7I219u5_lyV}cmCt%o zTk$LR69RasC4TXc^YOv=il8w^8Co|=-| z>w~n;FqSjMjdBhF_U3X)Rq*r{?)sEP-313T%(TFm)Q92(MYkAx$OFw7&L~KgF$_}( z4>$Kp6S`Q2B_?_UFh7O?x+{=RY0{ai3LfILJZfYN`3r8xmd22p<+>nSRLNA1ii&#S z7}5bvCC*qYO9m8E&2deVk&uL%NK3~Szn7By_-duq#`rM!tLQe8XCOT9o^3Gf87e@4 za)dlm!2_LR(DK+pqMH%x%b=@^a=Df}yverQHI^vszz6dwxZ}qRg9NQN3|TPhg`q)w zTlN6JbrjMaeqpAYffd;$@Y5;Wa@bI*dVMZ^A+lS z@k254P#ol?*Gu2uHWkJonp?X)kCe>-Ja3}(>lZ#^gRtCii)R`Et<7+<9kL)TbOXJz5D^H|#(>=1E_^l8Ri92c=k8QxLs=-l{Uz$DW@6>1Z`a?5(;=h%RIOKuP!bWKZs^ALB(cY0@HXaf}xmB~64VQ5(ApVX8LrKvR$?I5CQJ#EP+p9un zZ3RwR^euo=z z`-#TkbQaxF?lZfLLpvC0HVtiU3jUR+DzM74{~E23zN$hE6^DYhKBP;Cwg#Aclzh$R z($eTs{*jza@r~QN@#lP-atY!>Qz%l<0bD+K{0jbG@()QSxa<#=wNQz6PQgH#2-yoR?-p;n)1E4k$(#PcZM0giBzs{s9HS z@?-r$*(0JJD_3N&A?l?Db`_6iMj5V3p=lxUFJzpmLg}E3D_IBvBk(DdRnU$hXM)t2e z*POHM07QA}eu|)b4tcAtUmSt!wtiC9kg9Ynec z6Yqs4@8K`sscl;R=}g*IJz!Tj1$C%kJ_?$zQcfocD{KFKr<|O_c-eq}N%e2MKU9pI z5=k6LY?HQ<*yRsNR%}u*hu7x}nJi{0MO4(S<})Yd<6hnOZr0d0w@wX|TD6Jk$;C%m zhTxaUl`C~p>tH;{`ZN5t+$wo~FN`gjNGLenZ~&|mLl@;9An~LHJL zW_!EaEfL6zk@0gr(Q-N$d8_a^l2P}{(tW=xJeX)yNC7fg!Z&<3ha1-4S0zo^7Zwi8 zV)@O)1INYPflL}*&&SB5yfivsPkjL{>!jHmuF8HFx}O=F555cMi{C2U%LllBdPmp@ zBhs<>YuG>+!JS|&-x~$*&fLdAl1hB4L9TlPu&=7-h`>FApzDe0wv&D~b?|Xjjg15G zSJun?LVW5!%EUtdrPJ&~`oxU0S;kob{GY2@K7$5!_E?mw&NBgCjb2W;0GtF$9>VjE zj~1sLTB-7FY6#H;q_wGpMzA#UbNGc^2^{#5(saz#$6KS*x|re^kp7beiXHZ|c(V4&Px|xvSmid``-|!yv&2Ni z{;wv}zcvhl9>67=?Enw23qbEcG5$*yNGLJAiCQZ0LR$%SApThBK8QsYNwI1vw3<$b{m^Q63!chh+v=!k zxMI57@4fP4s3yYPV(I(6Wp)pPo0iA~@2}ghdz4(GAgd_oCY=k?&McNz1G&tK0W49d0-(K zkc+1Tqz0`o^k@7AQ<*d>4bEEgDle-^jWm(UJdEJ}_P(*$pzHb=d0T_^SH0Yj+j^t) z>n%-t%{$91R#YAu$jtkRD!zg-#uwBSBqG4Xb0XdT6?r7L#6@aqA?&yXmeD_&hXZ15 z`pd$+rCf=gR#P~!oC{K`b1Y(~DLAo# z>~}GJktCxP8g9mFR?vcotgQDPRKT;H6Q~9I0Bn8J2bcp=O<+^73kWK6bs0w*M^B@m ziK^C5M6$^t)<+m-Qy$ervwrNC$n~cIFB?%n#iy38sz!t zBdyy%JqCUzYWWwX-RtvD0~L2eCeQoAf8_Uw>vjUhd4wcX9znC=!jB(QTs@;zwCJWw zYlvpVnwEXvVajG|ROvm%KOIaY3ezC1ITC@j<_t}CYI|}MNesNv8nLI<>h9cjiR!DT z-e<`}dwzMhHM@?k$4_&!GG$$G6O}zaX>`c;Ri`Ch>WQ!J_Y$9G3)sp=SX^VED1nUl z3teu1$eFdz&a6-F-xMAUGWQ}jByj~I+)jqdn%=f4|3?DcsUlZ=%j9;hI2qN|(lKYC^>8w9xJ_j99cb&*8#4?T zK=*-6Kzan&_Dtn)=x@E9pY{ET+wLq_^WOcNSTc>{2SfdJ4x-iIR83pdPm16Na1L^%lqjWbsWmqU`+cq#r}*Bz+4xkpo~vK z+?JOFZ?_zVl~6f)3+}2;;yNd4sIFva@q2WY2V+#hfKg<(wy(+cjg z=MtNa8&EdB_k~Q%)yHCdm+{bz^sGrm=e{u5Cu46vkLPH31W#91}{Gmj}G%ir7~( zG|FO>$9f0<_;J|}e(0ixrSKHb_h6R)2Il28yf|BHuT8A~0Bor%a9#*_YL9P0=ErtUY;+9FPjgH@xR*GWUPH zc)A^e2a<0JiT8$Vb)Pe@9a6?Swb6yT#Q7vLWra>sjpmr7vG&C_-Gi7SvZ~ zYHHh4I}91&3}yKZ!fo#BT^-^qp~(-}iaO%YUhL^@_WsSA--P$l4wl*^AuhzgUO#Ll zwRqH~d6nu*sYIxEP=cF#n@jsSNR*2)9MX7{d0(2DqS?Uf=?nq=8NSQ9h>Lv0>`cz; z4|pr8?PK?Wg15-vk9*ivI^$&>eErtWsa#4~^(xk-ID_k?Y5_%D_9x&?DO*$LM}RXnXN9n&#N>{PMbzTc;1>kK67egRqb#OsfI90)Gd zHQk6od%!_nV>CEEaC=X0xH&#>j^%A*?hecvrhaKA$3n94bYh3@$54AgxfYYq0}eYp zPT0E5QyucFo{@i}yhYAj8_E5K!?pA=XDqNeW+{+;z>LPj?1tOZ(XZ_d!ci6Dy1ktjh`m zrSs=xnvAV&btVmwx{9o9v{sjXEpHrW+VZk`vg6>u076d7aBSPuTwy*CWWnXK$ygnE z8gU=yZe_IOC;SWepX%N!td1t?8VtcTxD(vnHCS-BgKHqTySuvtw-DU*KyY_=cL?ql zG}FA__s`tU#oSD;NI%_Oz3Wuf-nDD3wfT973^!5YYL~U(N!$H**5HSvgkCPcrt`U! zr8B%GDGDZ(SGCA6wVtwh9Avx6!9?#GcwdFQJS}#n2)%57sx#_^NwN@n+)Mhiw4Z9g z^hxNYW;iRIRg#&x?K1E^?LbA;b~_{McvP4=!tD1btJPqhfVRcG>8+~ov5(b!zhbpt z)q2kME!O#RjD519IH>dOu6p1j^?#d(b0|%|C>-XLbau0mgIqtRR9(jiLeImzx{HqI z5iPT9N={DBYoOT?AXmZ+``P^`60x8z@H)QIiVBYOMd*_%U>TA=Z-Kot$n+9a&n5XPfbq7Bkg?H z@Y=tfRZLAxL{FlEBQ4-p%HoHZU&h13Q_<9+}bAI~28Azg>G~W+pnhecg36{m!boeE=U*RH_MBKY)BckRbYzm`G;e z_X;NT*h{#+9%Uxj9v>cNonIjl650&s4CW^#?KW9hQdCgjGLn{-cBYB?mcnenG)U+a z{TMs>qF;#rFYRNIRB`ucHv#0>8Lv9;G92?vypK_$m> z7ESDPn{WzV)E_{|;j~Jr&}(g6M}J%0d^0WkZDiE_4PVH&%|gff^=`4Ss!BoM=MI!E z;8BNWjqcNSH9$}YbR>a8KlhiTf~37)QA~-``I4C{SgW*1gU2T)@_hcF7-xUZvc@y2 zcszE~v|BMaQk}pZLKw{!RKsv~u{&y^#|X5IDCQ2$&t9jj%XXcwa#To$BH3Q&%|$I3 zJ27-hSvR|JLK%$`4MLl)t2P5=RMXH1hL`-pjBp*a!H?^1o1Aa3cI|g5a_MaSm|Y)& zaW@GpwkG&5fZ%OHtHrtWO8M`g(3?>P-@D~~rOCLeF@{+4V8?eKSiVaBe=iFO@?H3K zt&_rP3DUjzp@l!v(=FKaQb#HM-fnVZaEa}^AWUPpB-HeJq>=F4_4RWsng)0q()d)= zwJJBa6>h5R{`TXsc^&t4B?RQv6{)|koEGMmDfAP3BCfgI{Prdo<}Jc`Nb)#9hEbIm z0K#QvjyFl*cF-djNYP6YIs`v%m_G^g`KR7r4H7f2TGz)&L-GtbPbGl+3muOb{m_|b zx&e-N)=?6qBwU1zId2%mP88B|qiX^@xsy1EYGEi10|O&w9*KG5*Dtc!#_+%4QBJjS zf3>u<#^Uoa)xO8!vi5kZ`d>s{M6v*40yWtvN~mA?x*jCDkq=0aj(QciZyE#drM3B7s(P} zJF?f?tJp7Nntq_zBlj)OfPp}oAkv9hco9#{#%}F5D{39@Q1JF^%yciysTt3exCD|U zxmsKge;S^XbAX-qn!_NT@)?p&8f)JHFpzM$h)9sgqw*pNW6gu(mqK>d5Vufofgv!> z^ST73Beo=A>IGy|Gtma7&Zz$K_@gpw)%Ar7v>Z4mcP9-&%`dxc`nZJ^MNc{VeFjLPGDweNR{IKI93uW}FR z(1_S+NVrMlr}dM9j@QG~1k4*s@wCP&F$OO?I6!K-bt<15q1#OY0!gpp)Ye%F7WW(@ zDDLNnP~QvOF({wHAfiEQrPgbp!O^p(O{RQ_7=&PS(QjDqeNu!N1*eX}V4|szMhF2~ zGRyHOsttTtGXBKA;mBhIbLe<;llxEC6-Z~J#D1q}5$5EWfkd!8oO}V+pfnDDX+@Hi z*7KHfLZ92|v-LXB05@(1tFb_Ag*Lz<=y^j#!!39)zzOac5rRgnY)BKZg@kzB6eIvhJT zoUIu&hyP6)3LGgH<^iL>oJ(=GD;sD5)eMON4MkJ_z9GJ(ER=KHmg6gIK~V17ZE+DE zLj ziG)F_F9E%6Mc6In{2`!!E)G|NXtS~2_q66GYX$ubL31SjtCpumLsZkR$~dnI8;$j znEvL}F8-$S6bQol_NH1C92}#22i-U^;%pxsf@cCdTB0r7SqRc#z;c#GE(z~rYeEx~ zn#;a^L(DKD*EC(1d60^-G8&I%0ME%nB|FAVeiRB}#8$uTFW7K83IDHtf9$si^8H=_ zr)n#K5|o5Hqreg#q`c44vs7A~LkE~FvIWRSVdwEYe7rRdE&2A*H`6c*?p2qSfjaa; ztO=jc>o6~j&twPJ3=fZuivKs@^yRp-c6PpLD=0&)q$HpOJ`2JYLwXxWzqxclzzzYC z12Z7&^Y+kr5s$J^ZD3c{N4f??8uhv!`^hSLdh6SKz%&m4>^Wsp1%W_R#{D(fUT5Ic zT5t7A?e8rr-BASjGTqXLU67vupHRkVGgWB0KaxB!OF$M^rG@IKJvj{tg}F)mx>)^t z2Z0@aAjj+6f?hApvLSai`=`rFgE+~+amyZ#6x$JeE7RPa^X+RUSUSgTm zz|Yx$hK4R`ey4<5ivpPt)JY8kpLxyx5?kF?SDUSHXf{O#Trnu}a3cv)=WG=c}|!-xX)P>x{LI#{gDEvtP2S!Z}b9f`W*xi&&0+XF!Lcr}GV%##q=u_@U7HeHPEv)Dn?vB81WfSQSTY zThFKtvYaMN$%VE(?NNGYlzCtmX8vC7@|&!gTy{70N!d%mmK=5Ynk^lD2#j&p%$I-c zL1gCW_4^jHlC)*Dm0@lyVT5{>fFco%JH77%xB;B^e2RFG1u^R}1{(;8106-psJBPI z&Arz9>8O~^c8zCtBAQDIj-|pv?pNGnHUR;FJi%@#GC}lKKEe$U)3Dz>ev>n8;D^;& z1U`XVY#eq5qGEGmU^KKw@NQ1kbnSN0z;7LCIZ_mdYHVn7GIcnKdKAaNn-md;i37SW zPVi|6j&)#5f)x4a-U z$Eg3p==ZhCX9uxCwFlp8FF|r|T9TOa;MeH<;dH(QuOy!RRvn^RiA6y8SM#g&1g^_* zWtJew?Yl(-W+0%l^8)eCz#{l?uh|Ecat#KG5)t+SOrt(3LY>yQfdvT-JTGgT8t_?2 z&2N%F_Z0A7v-9{G?-L|HFB@5(_DNe8UgS z=CiUJ7y%+w^wPd89%GXl>VG#aZMXMfmS0-?i3^1`afUt+Wps;^UpYAJIP%8ydrnWr zrOfTg&zhq^0X&@Zw-eRt;Xv^jORCK986n8m7mKHJ{0!}n5Yx~z0kcQ(&|mnFA;-w88`cbL$1EA+uT~EV+Qu4@k2yTcuM9dc zxLfa4Rbk=dq_KGEqzdcWWf}ur5|0=C=1hA#?n%ooQY;Jg(qtW0>3aD{iIqO(qMgd6we6kIW0vj|NTtCM-= z5adSy_rKYnRhc@#pD;JyMLNq!f>>S(R|fMs8s zF~Vg*UUExD^BJd+HAcq+4dUT8iQMQ_hnz9#(L{G3WfKZ@y8xgC94u-*wWAE!yloP- zLFJTZT@a#DbMF#PG7ey{bkQJl$xE5Of%QUgeBL`lf(A--O;d+j8bY%1=?Ta|m;4mQ zU=w@C4ulv^9PI4u$iHdOjaV&Iu-=GZi2ed{E~LuggS!bC85vzU(D%S{V(|ro4eGxK z8X6lT7f+B+wYoC&YrlnP0rwNU-w#t(WkeYkX|JoBHMg*UU!JkRPCAYJ-gqxh5GR++ zH_wa;sc4+0NJkl&$Y?^|83ub4^7nHa0M#G;_pkdqPF*gIU-C^eo&+?(Gdwo-qg1tc zBp4opf|+?za~jA?zAI(@fY^57Aw;i^(rD5Fg{|AVZPAdL(7dNNB1HyEk*j!A$K~Ph z_}SFha0h9tTb|iQG!*8&aa=X4YK7?3MqzF` zzz!gH4Hy$EiEO5*63Aii%pw|!^nMqSyHzoTv@r%?P~JNuuY_7*hi$g7u(==UL^^ zz4X8i>B}7yW)0CUluetXZyDjlEio>aPEf?Ku7vyo`fe>ZV@p8jvgBZW`n#)|f9aI2 ziU`~L^Erk$!;h&OVRPL!Sbwt*-B5O++}s0~e>fLGT^ijaHo5uSMR4 zwoSvl5zTe4aVL~UYc!?9qg?uHKkGL?o|+vVZ{&5Z=l`P^7#ua%NR*S6OKxxvOS$aL zl7c(J!aUFqOl{hjCF^{LBF}3`wVS4GbkQSEz`-9W?r>6WG;c7v#PT#(c2SP&m3n`w z?O)4V45hh<&!Xf$up!4lS4o?JKQadVL_y&=b6Dl8Hg>~YQxqF%P&Xdd=k)m*DsIe{ z0txY!PKOc-oM!a>*V-G3(QPCk%76OU$or6}Vpq=K#;uw*{PV`gv8~{F#U!}ZM)PHZt49)yI->#XzJ_&TKm(psCNVI z@uwIv--{`&TQ@Ca^)WGB)LLtRyLqy9-t?n(sR;Gp>JuoFYs~%BTwY8@dOP_ zR(Q!GmIH)EVLk)#P;hi1T@$4eQYFJMaFP^O!ak&rcqXmbc#MV#c?`Fv~g#Dp%ShnqfW1C!16;RU6yCKAMwmB+j@DfM1tU zap8`Ltk8E0SOpdCs~)67tMmWzf#MaJd_ak>l|?f6-_~(t+n9>z+)EfbuoDvhMKq{E zZxE6~e(L89O^c6bn2gS%gl5u)?EYD^6B)&>7Yvh8@Ynqjz%tC5{bn{-G4iFICDo!E zW7j6h3V=iqa~8AGGK_PM?ch+%j&yc1%#9BS+adg__E+HAd0nFPrqo4vMcR#LZ=lVF zg3@;DA0c52g?V1rvLrO5`4x5PmCAN>(mH{6;_+s|M9~wTx-Cb59h-NK)DDZ)D%A#U zBC9@yQ({LSMZ!z=9nVHl;uqBdb2}?MEC}87O_yZ7nbvmeNRUZbIJaX8WAqi98v2LJ6HiskO*YX_ju5mXl`dyU6k?|2Kwb zkV>|9;KWW!T^46+6A2(zv|3+AuO14X2XJnbBl|L+#~t+CUFD!s&uI@^ zNErH?FZM^5y6!j_mhTG?pC>haUjErICt$$pm)m~DO_SJoYlf2(YR`&w)mbMj5 z3kf!UrgGtl5qwhBM3w!L=#R_F(7Oc{WTm%WCLyiEa*}X)&o&!S%Ua@g83+rdo-c=E z-n44U{|t=5re5pL9Lk;^Vj$fsExC?8_(k=nkXqJTcH!_sRh3M3%Iv zmltF3mS9|L8j}IX;;=;Z>e|WaX@X;v_TpwE#}J=l6s>s{mv!)?9`k&vmB=6^!0+c@fs{LwZ|gZ zdTA7Ov1Y{`??)7eS9nXr>1=)twPR+xXGyp?UvT%lIKqj1vF~*8?zti>&jlE=;T2x< zbuCTPHJr@We15W9kHtCiaW-t`)@;l}@vwn`bh@i#a`Q+y>Klm*RJ@%gwOOjyK>`|0 z%1jzp!n*droF|V?O?jh9wS7^pVl=Q7yC0~-nkm_?5iqKpP*raI=^UYd0BbRGNyK?7 zhcyw!aoV=i?--Hemxn+ohWG1<9!o5I*Td6*P{^g1%%i$gCN3hY?4!mXt7Iq6H9?r} zPmFI{8eM#^7TQ(bRidGr{wM9LYK&%PF&q=>zi}A8zZB7PGtHm8l5|d)@iLYx{V6sX ziF-owE7hhhr0a1Xh>}Uc?bhA5O=$-S8(oQNKByype%PdUNvpNJ@)*KNpG3+de~|r1O$kwDQ~I^{a;Y+FSye7oetaAplk&Mqj>hNI09r zmxohh$2p~9+eb<`vqN8&kHa}P(yH5yMO{9~C2M`rVqByazy7234KZ)+nHFn(8bTzu zGY6a2SF-o+w;nj=BzjG;;K>WkjT#zPUTDV#-J%km z)z)*AsmUHG21b{qvC=hfUtlz+iLY{F4<+ifdG) zZA3B1+mgu0`a6MIszH-Ov$axGoye~6RIKvo)m^9zt;Te(3rixtC2p)nIhRP1UbA*% z&0e-ACKx5H58@$AZT`gbH+eT4eP8*^Ndh182~zk`rYG|Y48zjrBGI&8*jT}LbXb2< zkLgXawTo~s+T?OA0<^neOG*ZhzN|gHd(Q!0$1JM~*kPA_x9 zgj2a&d9>X3T~{#+zSG6p)}dFIj(Age!47{;0#i!NT@ii&*3^3i<7BmCr^aKSsU)}^^Rgl21f)zqh#fT0u1;VK_33aiMWMvaKJ>XZWlx*3Ci>L%1+dki-4 zoKltgnUi`lN5#zg=egac<2#MxI$e`CePVUK78d#WkKIq)YX0*hp_BsR)i~83Ph@b0 zL8Bg(+WpyDJ*eL>(Md);_#-)zwF3bjrm#b-!?BMb`)D#U6eMT{l{Fl`LJ4ln9Lpkn zPUNV!aOHyaqglOjNF!%St3btwbOdct%j4s8{XVo_4gsf*tCFlsFhZwgLb^OW_Ks|R zQ<4_~Rpzmk<}K=*R~evu!3fnRXd1g_zymTpV&#z!DVFCdb2m0+Aqc1Ug}~Ou0Ns>~ z3^*-~dSmGej24j%P;Gs^3wS%HeIihD{~Mt_R8ynu69d65adcM)zKk#J38AxZa5EOc z;>sc3GQgB#2~t)0NfLD8TkR02p9~?XNX#Yr=a}6{i2xJb6LAAu0Bn`zaBYTl_&wq( zu`pHM{G>bATedKA@8s!Qxi~&IphlufVb)0b^QV4@%ebs(n}lD1q{)snS=4-_t)`V$ zBbGswns2%KT~12c+oeC{aZQO;YUB@}s;lD)y2Cc2+q6i!vQf!XZA!+i68T9mU!&&z&U)uXA)CmOw|rVi1@IxUeY}H8mmEhVy*v@>{ZW=7*u2 zT9xZb+ziJohmn+0nNWDl z8v9<~7?~5(%6Dc)J+iRsR|)L0`M0p<@RvqgHbvM->;e zCqK&aVz$LyXrIJ9a1pL3OwuL(<0{!dvq%YHjB#`yuwPb$ets>&S5@_2&bTybtWQHm zpiN6;bI&4nOKXa8r=NfF1MvIj^MMEmB44`U>X=a4yARbn33U&WM!7uq{-8I>O}`G- z5!J2C*RFTyxZh>{+%$ap_e&ldMcbUX3KYe?G^5B=Bi6>Kv>M>zln!!1CfO>_0W(}v z#%az^8sGC0b|*Duvt$V{tT)Rx7ifMPiTFke2aNn3aH5>H2f9>wg@ol&Uvo zj~gQ^x9C*%x6&_;EL(nosh8-#jKi|pD_v1p9##7kR`1jblXJ8Qo*NYa%Q*NwYt?LN zk(YA_ASLCN@d#;{-QfXjusBabY%WWp z4+!W<7%DM;!{|Ri%@$1l{iVJCU?oyAa*#j}YB#&B)dC4an7+Q3ib3D*C|RpxOM5rO zIGc7ys_{LTk=67D=i{krWKND!U3L5F|K^_rA!{d^lgvVs739ZLn30DsG z|GHE$Dkk_Zd1&H6Q^EAZx7Kscgwg|T&{EWVPb2i_j~%BM>R|2`MUkv+fd#zzD2@q9 z?HSe4todaM1VE*TDPpk=6XPT|^NUQs(~qoQ>U&Id3VG_^SW2k;${PDLms9tnIc=H_ zBV9}+0!lk1GH*+@$W7wZoDF1>nmv&ezUP))ZZ9dPLk}q1Sbi(J%E_rb_=${zeYx-v z@t-T!zbi|K%`EQeH7kCf&+cLQErg&=dzhdkf*z{UpTAo09dGo%f(a9Itjda&hlH0F zEtPTjFun(4YhznMK#{y;04phktpTIhR?8)e5N)~Ao3`p&UJ5BgO_d91`);UT`|mO> zrE2V~+q_=li_NtxINlFn8NUKbpaOei-;YrU<*+ik&YjjHEZD;dzkx78l zvkK&qGI`C+j@mu`7jEqo{TY;&$Fy{CePaOWfVP1MRyIt7 zeQ2I8xQ1t24jPsw&eZ<6OsN-HIJ@2EJ zTenHQ@S(k;+Fj4xNyge$kvyIrc*^xTvkt3B4|~vVh=3Wu$S1AdP^Z(v|5F1uw)-_A z+rrCYfcCoemJPSn581n$5%T8gJi{tpB^udQDXfdUR$;1f=5HG{-2mj3QqWY_MpQ3W+MZFBg1C zXGxK1zTaW;SmkMZ#7WN2ye17LhA|d1wP7^ua-~9%!I*0@U*BJmB`JUf8YNE|uTvs9 zD{OALLn)(N%_=%uWhu;bzzv|kBKbKw*B$$Wp=XB2i{?vwvU6YV0)(L#MV=e81v73v z5(j4;M5an})THJIg(+Wse;zvl6w$vX_jagzOur6)pR=lO4(bs)R z82*Noyoqy{wyJTMRs3CQNZlc9(r0eq!~(S*R!3Pn_&;-;xR6Ht=7#wwJ++I< z8DQ1Zi)R%sxKgschxHUn${ijAzVhbEvkX4E=xZlkx))dt53+Rdx2zqv>YMlzaxnxr6f@2!``Gmg-b$*x4Rh3+`6a~AzepDMY9Dl}@fw0<6m^(6 zqBiQ5YbK_@ylF`wtjuN@z;SQ7J0|A8y>XY4Vu3^AK(-)S6svi;Bi+sUUs{9wSkeq;@^=S zy{0xnt#On`#}GE05+A&$33WFV;&~4IumCI8T}lRt7IM(Y_!Sj5y6DcOoU>a{3}XjN zL5ze46&Hyh5?Vd~`>6JVL@K#vdreVLF63gcDsF`*VSQC6Z+P6vmiy&8sbhB!Voiuy z0Hw8%?4`pR#zT*T4#ic4JI+#*@s5J~f|3!;@6W+R>ikv23_U!b4xqvyyb%Sg?0Kq! zs;ss*EO^xFD8@IbZZht;PhwxIWON;_Pg#l^VBSVvpMc2Srwwdw)E!PLP(96L9gKH) zBLej`1Wy>3w5u}NlTe*uLxaQ@w%P)@_Yu{`xjVx(;4Y{PTRV*3|F>tQp%F|Yv|T5& z?j$C~$LB8)`7yNy9C%_t{-`gpDsR|RvA%6njgfob#<;AudV2rUV-n@y(GQ&w4d`zP z-7xCxrg<_q;Ng5g!oj5kRPDFSY{p}f?=;&NuMcK17+Kd_bErBWO_2;i!LC4S_3cX_ zVbcr2drcH-rxWXf#hrsPkq1`*1uEdxtsW8=3F!C7kT+ph(8E5L95XsnjnHV+X}kF@ zZ`pvN7Hs(`gOFtwn>VnOZv{_JLzvI$(4n>%k5p_L?-?JE0IE zXboD%&b8;*Y;Z@g@2#B$`ju%@yJ=Lger`Aax`#*!2@$3L8iSowXK*s)y zxZjOo?AGK+>C4#+P1K#$)w_Xj9j*pnU`1^%oZMY|`CF+MU5^|sn+L}P?oJXSRE}zF z*5z*p`2+Gvo}!HR8eV4|qi0D-3+#YXRo0pU8@oeu$j`kG8r7-%^y;Ha!6qIax7MmQ z(oZRtxf-szcg_rB%!dYc9ikaH(pNwe zrvcKTqscP+rSV%~v>W9pf$^UV3l!FEL>{h)E?lK0M@3*~IB%Kj(_XtN3B&`V;s1%nTVNC1qk}CjHUTQGk-@kP;xK zCiP?c;kmG^Y@}i^hG20+UG9I=)ocK?4HE|^s&_m72c{LFz39-?f8;r34Grp;m>4$T zwAG>c<18DxXej1;MjDPM5IB#=EBELNkG(O#5Di87?`qR3BXIehNd^ei{MY8YrVS>9 zBum^Nxrc`bkR=U9l7G*I!(UE>&I5$I7(ja@lHp_y*H?n| z5|WAcClCL7QaG8btdVqrP&PCEKg}GtL0h}nxVQt&mEb-&-~-4A)hzPc@$^d2F)$$W zfWr%*R!%$|tP{8K2XyDWz&oI;o-UccjF_JcLNlhrJ2)h6+snwbeVuB+W70QZN|5?} za5@TIaP&ML?iM-PK-^@5P3>M3&1{LPzqP1^}mRl8-6_FSls6=9W z>2c3H+WDl7k5BOZxUD%c-r6Pqn8DT@S8B>Fvq1J26N)M>Nw63nK-`1HI~|koho{2Oq3IMPzwZrmHt$ksiCfkP=k2*+mG3RLu$4}qNs-PkQu(cHrGTs4o5?pR z<-e4ih<2OVsb$4PPGQLg8$kfOhZbMmfPw0!%9#hk2^C_DGYm~kEhYhveATJ7r)alI|4>Bqtf;DjSkm@ zH><9xLx{&DgiUVqDE7(s%-9}rbndU0#Y;8^;emo{Qz=iB`_oW@RSkl0aC~LZ4q@+J zIqs$g2Z(9tGv#v$i2&EP7BpxI1h~QW5Y@flv5!ut+rKQ>$Z5y<5}c#v+{3cit$(}- z`u)0+`2_Rq$B@Rbco563KNr6-T}9#Xtxt}ZDqlEuWGHp;x=1Pk|CSzow|}v7pX|Sa zW3fiAAkqmCT1Op#%u{>I11raZjJlS_Ytkf3HD9W}f!9h$i^su^=QRmM#2m|P3OH*IHY_g#(KbfYvn*Vv|TvNqntD83h zAb=`vwNOqgxX|+@s_3fn^Y?lntG!RjR?$4CsTui_yK-QL7M|r_TNb@=YAIdu69KA= zc}E@+!A9_qZB}Xq#=PWK!5)*q*d1#X_tqSC1vhoL(mpirZydX*DC^M2D15FD327Gv);=)W9+1g$$Zm znj#4)wK&`KM@0wVx5k(}q!8hi;1Ekt^^su6u@#bUU8eRtsskbMi3}UIf$GngAHlHm zvx;*mLn>}bzg-B7UA{Wk4qOZ0d6p`TE>&I-O&HWWF;$)+`nlRS=e)u0B-RC zO=$88d{K10qfR^V*}s%AL5UNEJ5r>XU`3!S-j4AxencQ|)7XnuwyIWUqJLHPww$kg zXc&P%!5Q|o;2rqoRoWr?xqQPgTdoCap}yTPl-a$7J9D{@?{m2t;!|ddC;Kd}_QR%i z3CC^;apjKp@6n8(J9q}!=`qo$=sNc5WpD>aEisNE2vlW1o*~N-v7WZI6%0x|!6GgU zWxtinBaPF9^E%N-`+_kaonKx=EDS=ZpOjBJld9Fkp7D9SjWP!8FHkOUIv0vz?J-xw zGZ(O_i#6O$Y=blu2$Gg|;h9B6ym(-Em+4(Jf%8Z7(kaJSd#Y0N5Q3-LYX8GuW%xV9 z3}YY8rg=ikv~LH`n2jVLj7(LYe!{VLdC#z8s6u-AATsPsY!GcQZ*=-#{v)f<+NJ*c zqOub?YwQENQYYEWhcYb#_g-cI4TWI@h~_d#gR;;Qj>51J`4@wObtSKSHe5f*dUb%|wMQ-y;GUrCzo zZJm_?e5f$UFzsuETr-s}NkV&W&Ww4ka<^c`Fe16Ht zkopBBh#n*4iCUMPS%a ze_kOXoJEB4E-n4bzc|-d+qV5~p-X@BzkUEPZ-AD%m>|7+MLdA8=c-w3>a#GN!d?O* zKr-7V9YH`_g1zcqf&UB>jxxB9?ERfA<^ccWKiga>u?Od=g5SFc)!Ly5=+pm9>iWvh z%bV^5+y#^tlq&ES5^v3AuLR(K?@|iW-ng3PD1YX28^pkFN_ev&emC?3IgM~-) z+qXapDvI#Y;prZ@2yvhpBy`lhvK2n9zrBuHHRcf&>ov+5I@%OWg8FPTDkeL>r`haQ zOW7is4t5{?)SEYYXAIEf84(~2Y7p_;fn`|!LFae*%%IuKdl;|>t;%z1u3ak zz~gDZKVp1I9rE4SquIO3Jwi=gBWmyjO|tE4hkk>$;LA57FTX#P(Ac-ql7u9y^0_AW z*$QDM1;sMTz8%X&QW$I;z)w9h_(MZ|Bn;qz$fi`IHVsPuxv=os@1KVC11t9R&?VmvdZ1Y=SxD>>dR92_@wZ9mY zR#mQ7tlWr1qqME&M*X&}kx*4pmat#GkjC@BfE?lvtiBh!iUoOj zM(jqR-&dFB%CK!DSa_k zmAu>vf4rr->jPC~<#wylqqm@zfr`ut02=~|NJpZT#7i_B_E;fW!Nr7nRb|rXYktyvEO}pz}u`&lA|U z&+Y9o_2Vh_M6kg{=>J`m1wJY*mHJ9AZJ;D@LP`VT0x}CFOfHi{9X+c`c<2vLwt}?O zp)LRCSV$DAe)P_=uV}{~z5eomAaa3B$ zW_65dJRb@PnqJnjU@M~mC|^JJ3ZRx9CK~SZ_xh0%EySgD_TGt-5$trpJciF{d`**HH=bszHC0k1 zc>J^d`%{6#0Ay>uD%;F#0SU9lPK#wU)%v&oNG!)Q@FL7T9G*MRcM4J;e?S&>zkCrO zYWvcE$HFSwbTSt*jy?qGtRLXXKKE>e=Cs>zbXUo z*VWc3gtQ%e_2`KVm6}ZF)%r7;LkH*(WNK}uq)}%)W+UE&K0F?p1joO<%YS|9K2;@{ zm+`&JcKhxlJ#1R93?V0|tgpo!m6}?@x$b7H*E(nU8T5l1_M$cFNE^$x3$4KdV2dZ$ z=1Z1|j|)x)i(vr1#S>uY%(A`RJmRQ%(?jMF1+Y{vE76W>*qk~hM&<;HC?+Oh><9Ng zq+aDC_Np6^Gni?n$Yt|vAjtvyCzK@;@geoVYlf8{|6VsW0NtYoN@fF9s?jIuG>AX8 zwwAWZejS&g8)iP5qeMo@^PF|o`x!NZz>s{eUsKr!R10n;_F?EREClo|ggG>-tK&IO z=wqZFsA*_8xWE9`{J9F#u0joBqm2ydm##jD5$tjo0F+8D0Q`>$z5i`qw#RlNWwxi5 zhT6htnG05tw%5-RJM%;{0}sWJ7GBgDwCY8AAqJi0gBuw@*c28Rr#d2lEB3y+;~t>r zC#i=u~@pg5`h{f4=P%ER%HucyRVQb3$wLfg5!tYGb`L8t2S2yF{WJ!_6-fcV|c<) z1li&nTE1LQ3?km*aW}1zjv&jA&rB`hzE^gBj~-eg77y4{oXmD~wAJZ9Pj-RX-3Dfo zPYTM4n1FWSoNas{0pCXUUQc8lN&&Q=3<_wE?V|VU9XPI;ABL2dEnkImHbb$HA7>0; z1o{Vn0ZW22M)54=svW=V^-XAIZ5eAG6cm9hQQz`k zD@mA|41x@8IgyXRNRHX&XDu{&yIdQm8U->4*zbtv$`5`FjEsx}tQA#x5H3ShFCBxq zsns})QE8-X7!6zYM_PlURs3UI&!&Xu1r*Zq(tkJ-frHc+dP=~6cK8GWcE1+bIcwUx+Uww1?9@`UBGSJ_D0)qFM08dx{uxd;#ZO_-Y zzDA+%R{po`GnSPV{Km%2jMkd{cAn9aTN77QYoYW&3{&Ejv4r*~DYyu}_wa*w>&kQg z2uDBl`QQDIbUeB?V_Xw~zmww|pHM#Gzy$V+{N+KBY}+$68z#2v&@PfAWL98gK^6V= z>3!jZlGu3K9>l7%A7-PaFUR!D>}(&MDH5tz5`k97-LZYLI;CmJjMdrBY~(}$!T{uNj*j-q=X@+Z4dwt z%%_e-!}@>F{Ix9atHo(Y#G&hg`R`~ttfUQ3pjkpVh>?PJ?4!9cbs2c)syVl)wVcvD z|L;yITwcs6^gQtoSNVp=%l z<1!rh;wJ(Ni#%QN>53vC+AGHs_w*KFmgM>T-m@yLx>fI7ZfmoHMCY0}U^p%&hQ)(` z!D9n0w$vOEcNyg<#~!KK_eYA-#PgB$^EYV zg2zZ|B@U9(PDvaQ*T3Ll zYkpzK#$3mPU!dcC78}swjXA}AVNc-FlcQ$6q^zb9gU-}RWIO*e-#PiI1wa7Wy1-$z zuEpG))_d2}REmK4xTjT4M7!P!vu!l&PpUoZ&kup7SxBA=AUzlv5n43}`|)ujnIE&{*XBEk%_*jmwkEHAevCv10N|j1 zzehr{}mxC_F!~E=Hvy7S*^& z?PL|kwi!wJ7%FoDDSnF(`CyRg`uv6eO$z<+nB{TzqvfJ+-eGWsYI~}Jk!_L=gN5R! zzI<^B`Cc7sT>rUx&LzrkPx=HVfU=WgVKJV8#e;nkMA#Ih5;9eOQsTCx4C_h89=T4k z%I@yo&hh;478_RJ@qj3z-wyPGH<%$`MY&S3s68T~BR>_NH^+vW7Q`Zd%c)9FzPD<# z6PLsX>^=*R-K!@#?PY6Se|kuTZn^HFatNZ&^%2AlyXZVMjYW`N>hF+}mSpx2v*W}+ z8&WKGRjBzU>F;Pq6`tL>xEk}aX~)ndeIa|_HtKqr<_$)FhmP=@NYG_jZ_3Kh(N>7+Gx37+D+}P~|3z`vyz$oUWe9@Y~(+*cM?#O7}-6Kt}4=>GgVO z&at?pU>Y=>=A%aFf${H%NoWdF9q?%n1$Z`frMy@9q|X^mb!M*HXiHYz4rW<*|44Fw zXmqoG%>$=#Eta}vb3-$Az9mGo-(F)E3h@qwqk-utV{v0^{Bq2OJU8xo=DE%vVaQkv zWX4A?*7p2YJKfSFhz}Wl25F~U^q$`Cj;e3=>0Nq3EN$LXznGYiw%6#nFDG-7P$BsF zJ?XVPTu8*E?p@TEjGmr)+}?J=I-f~!7AJ-B+es(G6+ zfeW>8&Mb$cdXs@2iFPgS_?UWrpVfB%`<;}6h+3}P6cc__WJ0Q*vE?k?;vsJH);o84 z@i$#1)fmiEjz8taixVxiwjw`5kJwx7QDbz>WW@skXM*od%kJwm8)C^8<>M*v zhYQyQF(qV~-_pY>rC+)HK>H>!8on9LI3h6jBHGr7I^Sz$=?xE^Ok9w#qKah4H8Y+1 zGsCee3s>q{?oLWj1%3JcVKW9=?TO$1!QbzFq`dO}6OT|dopQ|ZPewPZc*z#4A4>^zni+Mptog zecaXC2yZ`<)4ttblJ>KNaxEbG0ZtZntl66u+rwBRnRv7RrtCLAUZeb9Z6cj{5yh_E$u_MwdFKI}HUW;@SI| z{A6JgoAdmxX`x2Qt7~^Ub<;QF#J=cOV@A8;$hiJVvCG5~7u{inD+t8i&z+zK09@;C z<=$U9X2b~dURu9r6YG|Lv~1OYfVq;KzBZ?6u>-Hmbgo>!r$H3{;8nY>Uz10qh(62v65&Ma4 z4hi#Jo%vnOzfu%O*gt3Rbv%zQO-_asD&O2qQROr@CFe*3;IRnFH0N^%rekNu%Ds;W zZ*dbtO~z&CbAA!Ix>?XzcD>`N68oA{E;Lp#MaDN5e{0RVc_6$1c%JkG7p6G7BBwbnS$)e=V{qtmAWE48B%Z=@>$^_!9R*qT@gtO)b3v+X}-MjvdK|rTK zx5wd!A*$e^m;SA7LC2PNXdmWg)F$&fDIYYQKn_JlVheSzc0jt5y zT}04s>j5ufQI+v>iUZO)-e~Mw-bNv!T%>BTch2PJEd`jhZw8CvZu+oa5ei;+mHFQO z@v4m+&N#jtb$_f`tJq^7}_K)K1F-rDIX zxq$>^hKfpolS3_2NT=qk7^*qgEflV)43o;dug#nA3S!WFs;X+%Uml7Y$<3q9))(iX zhgZN*^;KJ>0pQgWsVjl1=SfBI+6lybn6!j3zw3-XxqN11A)zbm8->A2^Gg&{t#wW3 zcV7K3l+}P)24efdKOHacNA9~toXpmWegqvyQ`GcuZyL*9dahfigX z3;wOuB1=J~Y3t{gEjElmG`OJ*q2m` zMgKq{2dIOZnvmV=#dgK6BixaheA3}m;u;o37L;+k=*N2B~*3^UxEyorn= zFtj)q_QF3m2eJ-)+|Ybcba2HnaKCb8Mwe)g6eqDv^r{N+$u_0vsJRd|x&<@-SY7Ux*4uuX4lO}Ew}^G>~6 zq0`!E)jpyK*plS!20pH>zH`WmpqO4Pp*bk4o}}W01k@Eau<=PCFQ9io*|qL!)0xVw zCzd=XHd|R8Xji2-hWl(;YdU>E%tLK;SDj^5^vV$LjhyyAtzFXUx9BQkpW4Ir-~&(2 zB}d|_UHYbp;Kn-ryXRdCEQil4XRm3?ssN@CHBeN>NNl<@=PcFoLiy7e*w{1_7MAL9 zb>YcGE7}5Rq49mHH4A?rV4De$8RCwo30cJ&DVR-yj>3$;jO=LH;pANW`>fb)f!C^w z;*=Buh{Z5(o^&?U%rzef{a%&B2*4=g#qzvT>cUQu6L2qVfWIz$-~pKP9*7$ci0_2= z&T{!xLi+4Bb+GKgwoQ#5CJ^#3%A=e7`jg9y%jq$E;vrg031myo+!`_71 z%oT2BnjQmtO&coIQ16kd)kac~rAq!f1V*cBhKBU8((#p|A+TkcC*S%yw!$39srk>5 zHYjhdZL@n2%3pPK)81tSYFMOuqFnWggM|9e2yIbN=>Qd$-i9V+nl=cVKd@jMn)=|d zx&(oiQj2(L!`&$n`XMW)LcQ>u2^+c#(uWVBV_F07Sd*qH6^p�WhZg6*|f4#G0pj zMPJp5`qs{3KN!PSuIv1VA+(GVMp2278>|b~2^TGZpFm*$?javWQ5!6XT6Cv>e4avd zI&DNz_s5L#Hl_M#Z@yqgeNn{2indC`P6uV^#{ss^v|ZZ2fi*AJ}mIIq!?1pTo6D7gDQKJ`Y?r%iMB%qVFR z0hhIJT`LX~WQV+a&&X@n!5%|=M_yBpOTOaPPl(J})9`t>ODkI~_Gd?oSvN)FEhl;c zn?Ej_QiLqfziQ-JBM20B;}gXAUEmm5_M=>41mXI;HOHgeh#3(sbJO81$-3^I=ons& zOtCCe@V2$~tV->^Gp`2hg>he%o`G8ia>>@xQQGAscRWSyo0MY+O`vd`zp7Sl@H-VabpIyLiD!#8V@281czUzQ zN9UCk*y8DrprUxUEz_6}+-2rXTn2~ ze7`0<;GKAFxIIcnMV?4F|H#~Cdj^LOT+*qbZTTFsY)y_2@j8t3nBO7`QVh4aXU+ds z#F>^pyfsvkyTmscuu=*^IX!)a%t`OJ676~VA!mbSP3*b0`h{2set08lz2y#ub5r*+ zC2-urQk$Sqko2!$MUPpCuJ%I`K2y#0_OA$H;2G1*&%JJTC_T?s_j zwA2s_yu$p+km0>#Ht+4pCT_^0iX9(6zXI%~375=(BVJ?ibW=hs=Ssy|`!$KCXT){t zMw6-Ujt8P)pbP-4oNQblCOW~>G#*nm@a+irVt+J&lN9R#ScFYxd%8^u!7($^P(Pi2 zJ*Nb0g9dkdDQs_JyINL_Xwxw8A{P}s)IT^TBcL&LwV&(prfcj21jX$9cxzwW~q}urM(C z%A#C-uSwqBdX4;5s2kFPz}mRN9;07(FFZ^Fj90rjs1yPdRmoJA0+`2#lySZ=HRyoQ25ru!(7qMP@Pk=YPHO>o65usCc`h zi^@2JB6DrVTpts}^g$o^(lwG>Uoqc7Bed-j^!NTf|+SbFgHA;1Xvd6VUXnqZ>; zTN!s@8QPZ!lt~d+PYBMt5EWDN!ROqPkeyvl~ z$o}(h_v96XM;Lc|@MNSVQ{4e!a~vvS5bIvPEc&jG;R*wA&nl$Br&PZYjbnw7e<5Ie z;O?UtAeq&F@f#Eh0R}$l*D>&Z=lFn@XXr=X5TbT<1vl0C80h`IbuyGYe=PPOnwNUl zE3<%^YU(*_q@yO+q{XY$;M9P|L8yB2hnlcebN=_YaP@-O?&0F-(x@2PoFVO z#1M0Z`RJH!HX7?!wey_|@E9<$*2LJQ$VnPUJKW-eD+p&1 z5V2f5EBz45!R_NS%bI(uts8mO);$I`pvT# zT4Xb?8w^RLz${Mf(-4pbiYol{M13;~oyV}vV#!fUmLePPtY2B!{~+(tC?G6`%&i~4 z-FbKZ08F4J)Dye+>2SV9&Z%N>z93{Gkn156eUHJXAl9&YfLaJoXTXki+P+Ib&f@Dc zAYc?2dE`LAqN6jx^F7oSBQ>`7PD>Tqu3PWs^zM>ThiV|7uXVa#le3y2OcZ0Kg!f#7MlKAm*GKDu5g&|4^nABt`YPw+0Tj^gzynmi z+N^O40sf_{bIRgFCcUJzc-#-C*Akt&WK6Rl!0@Le4dK#eeIdGEpn@0MGx{$(a{^HT z5g+NZ#c=(}@hB!ynS&S04}LtoNX6{OYyy>>ukr%p($l=BoOY(h)i)XjgW@MVPqCfd zy;0pv_C~b;NdggkJ7aNs&60xx7DZY$kA`?>~!GEl&qr`oFCzaPrdK*IpwSExx zUHg}ri8;eZZjZW2ZfVGz-eD_HPp&z`-jcw#Ozmawi3aI4rCv)&?`1&gs~C~vVkw7o z)k|aJdoeWrV#e{s6wJ#n)Mm7@Mwq@se-9Jg^{yTx;Ff65Sy;1t?6iZrbu7Ghjs|QO zZFm1Qf%K9vOayPCP`lX8jtFXbhbAZ%o)ZqS>NrMOU#ZYG{fNZ^0!)rG4gW3E|M+3* zT^?D1gdR~aweQMcg_D`eA_XK=7}Yq}IHM7m(sxQ>mxe+o3ON3&VcS{4=J|v?&zt;~ zhC=_4_Q>+Rgd9K#2JJf57d|(+t0W0-{l!1nC}G76E4bnWl(kan?=*QrG^1cva`c%^ z=t`EFF>=WwC7pgZ%N3lc~%w9w?d%nGVByc;%J&*nd{#kLoi1%fKf9 zT^5&%tG);%GO>m*RuPu*Ryku2`UaU9?+F1nMZHfBz&8jy@BEu>FEHHwx+|_^bPN%b zQ(#T`QdW3`X`aN|XV<6N)t{H8(gxp^YTf5k7E-Kn$OD5{zg1E4OJR6|%Ze;80?@l# z>L?#Hm(4^YW@VLK7JX{b?{NI&FzODI2%+uO|5Z~xD-6UN0tB+$#QWfpTspK@7Q z?x?k&Spr}Y6&~7G9R>RBy%s#WvYa38`HkcTgNgLUDBbegb`w@(6!Z&>?aUC+>-5x5eYQo^xR@>xCpSGRz9uUYESRhu^yh&`hv6{IEe^F-8jhDXLUlC~qKuEnTteGn*g+mut=}moo#d zhwaYKd}C2<13`(d0~sF?6H({EG!735wi1Ig08}>R3WLICtJ#La!7$iNVM86bcYba| zSWxt&cv>Yj&Sx^11evc@9`AL~3HaZDoqS+;=YJ#i&-_GDP;h`g4Ivo;l#GSoXWYE1 zSWF$69}GPgPCKspcxVLJI7IGQ+i$RYEt3??0t*6K+`0|uBU#9@-B^-D)*;PF zl8$ZmOAxmg5R07*r!H!Le3)9V1XewSG+VkSmpy8$TDH4`PkV5u*6%g}7eg)TOkcKk7IqT5 z-XLceWNKk%P6AcCzC3L|lB!kgr;+L!#B?CWa*>!(>F1^fJjv2^5RMd};s#R0Jx%*T z`?iY=ly7zuPKid$a3=+95Pb_J-uN*aiPKv?3c1Puy;Pg=(!R%fVF!L|r%T2E?Hz{v zp&nu_))P(~PXI;nN-j7YGof#J{!8*Z?b3Y;X0iVBEzkt>&``{rzop#2NZ}<{4;pZr z5x%%O@||wi0z<~3tfOB~^DDek?=FH~JIKdyFvC_>dd;$B)-ca{e87!-#G&ZhM#3Rc zTt|zl>uqseSy^)o7dnOD?wdy^Lq2(TnjMRj*0j+OHw98^?9A^UAEN$W+`iopzMFMb zrFF#f9eS;3<{Q0!3TuMb8=%B0@)lMV!{LDzs5VD3(=cv}azbPFbo%(r8#&Wo-dyeS zgraUZA#2ObP^36d4`bO+(gjckg(?d9_b(u#`K{KVF~A6BGQQ`GYSTp15PMVCQR>Vr zWj)Ds``qztPDIe(&i=j&%Qe#ayLJuBml0feqkPXag|>!1R2lpJ(Y|8GNyiK&J1kJ@ zqYL+jNPR92T|qX(qeTk++b6&;6GD9XeFFQ(cY&UIyZfcX-Ip;D!u-x0rb&4>$O_$W zz8yn)lE~Z>dMYYSC`GpcjWy%&yw^pEy?x<8rd#qE2>B5R`0jh&3;Gsf9M9nWXL`E1 zz!TOIh!x(KY)CADFR~wW@oXc~f1G)(HPZcZw=xVu5-th0UlO!0v3lKB>mC6v$cI*E-9q?}GK(_|d z)l5dAkfr?9K;;72FO^SVSetkY1{7Vt-kD$}f^UYP<`?-xVo z(u0e%yyn|n0DLxhe2tAGeCKSUR8(NGfGbCcrJxAp8S{v^KztgXE(uFLkmV{o@8shf z%GI8pXgn4~n6%Av`#7h^5r}dMd)KTiVl8AP)-4kHKBhZ8!bk!F*C})>#HDND;&^t* z6y_n!+bv!1YSn)lKWHp5TS|%hQ4Mg*~Mpf(4%HM9QO-u9w`8$NaH6LFn zvo0@HvcQ}@sz`-0T$$klf;#Y}Nbh$TbXblPYtWD1qMy-r>-~Lnp}M$+?JVjeYCm+9 z`vt!~ow3m=ozl2Q_uxk~_d)X9Ft>B)JT6|u_~^A<+`Qb6mS{Mc-kV6p zDxL?xZ=a_h-g1OaMhCY`mqHrIAc)mItibzpz9&+irk3c0z-S+JJw1Ab#CuX3x!P~% zD2VYeSw^AS?4-JoqO}8>;D3BH+iDsSnlM^S99=&I?-MX*zUF7i8|Qd2e%o-0!%57` z663)ZNQ_di9@M+^A;47qTW2HIfZjEBdFh#ZFWsD=-)k5kbQ&qwAqDw{{Buh>Bydvn zEXX*gey;Z}#^l{-c?NB3&te-)_XcDGbA}QhxHUZM(l>L|RZ`-oPJ#I|I&QwZeZjJY z1e@%&A;=HU1e_D!&SRyOGz&fu2)sR*weYK%R6}NQ>}wJ5UYT(ftR8El(*s~SPHOyT ziq>rzjp;@?Z;+F0F)Ar*AW>>Ik?al?nuJ#stgR7am(7r;1TL8A$oW2PMk;5ul>am< zvBOAvBltGZL?Uc``%}&)8e#9edsesb@dMN1?O?}}E|0!4w+8ZN^Kp27G_bFKRYL{~ z3)})oGGf&q)2I1D3@re}a}xn|&-<2R*y_FKOt+GYH*Z#y^ z^wxuDhWn6SUG5D^@acuNFD&LLIkm(qBK_&M^K(L{b^+10k>z;=6YQNHCS1yFSS{AX zbe}cD9XOZ{L(OPiT{Lq>veOVtt)JyV3KC>ixJi39GeR-hZmk`XKec>zVkR;^yPWWv z7K|;8!4O9pj+$NSM>o;vbj*H8;XKO2TWVnrhiy<_$H1-2wU=7zAdV5jJD%` zbcvd=g88UftV@IK$YGnEnO;9v$D7Hh>9HzS3jotew(DH>L3rTBeftfRb33TnHJmF@ zs6Xn#!t`9tdE`F>hqYKTOJ$&Y=bLvKLx|aX)S@~1YxqHS zB{i&Xo}>D0NfcpN8Woc4gO<~`7QZIMiar(Vz-+l!m@a=^M#Q0Z+<+#Qi-V=ktl|kp z0VzoB)UQ~rO9w(n$uma{mK*-yxB-kl4)!Dtzan#JtMPS9Ri+g`d36_v-+cE&H&`|A z7D48RGg1-VCyx{4wn!?mz`wfB{<_p___uzg6_ShGuE4}XYM~A7uxhRU^&G&mpXS9+ za4Yt@#*_2&^99~}wuI|mHAaa+;h%|g_<{{fH0fG%rFzGggVy|?Nbk&Zzj_V3JWaR0 zP6M9bkb4e=!{&eV{e630TXFWIS%|3hpygpip1r<4*E9Cx@MuKnBJfZqt4E-AojB}7 zxXXmxKcg0QJ^zF?@ZArbm(VIFeJxwfZj>Mksgv}i16r{ z@hyc>T-TU;T@xaQ9`|^D#DH#{x83_mG2fax*B&rB{@(ho=2{!qK9L;?h!kT?zBTkg zpkSi8(e8=Cv=11sstk7kkeV7D-J!7VvJtd*nnLhzxEF`Abtvl1{hySDWRH7a|j7IqW`SVT5}UJrl0!5ETbDGfGyIm(EyE zK%dfTHJ!iV-E{Mq7-jA>!Rsk49JoQhrdvFtsxe@3T>$*j_|tD<=G&p!_T`$#`j{Cx z#u;&u>ahy6mg6HrMEb3q^g2bl$I_b?No6AqzetMtw=?VOr6YEDK- z#i|;@XE)*E<%jW0aBGp-{@k!Xw?{YI&kOt;lhtAHb+d}G_t^(#@83ioDL`#fAp+L7 zl4e-q)-S0o5S>acJ>o0qA0nz$OJONrw?2z*75%_7sT!v#%p_)+GqsOnR{ssCClcsuV@xH!l;O z1_lOH6Ek_#(j=b|;T+s=b@hVs^0CVK)m={&7%EdW3=^l{wHQS~Gl{f}jG=V;iJLDk zp2;cDlZ(~V(qW3d%E`#WdHGz>JnMBDwWXz!nb4R;=t}=}D=R4lgob{zPt@1LFpl_n z+Su5bsi6~@?~M4L4kV+aqiI|Yq-ev@qGFZk&@|UL92TTQ(YQuMiWo(#|MTF)ec~zR2-rV*#4Cr6WwOD!LC_d&=k+E?H}U8irv!ms(0_(27FP)y#~Q zv6^q<_)la*Q~PRer~#Pz$DzaAA(w-we(--~IGA;`=0YQzQ+u3yEt;{gI~q7`O5MHS zWS24;ZVq4S0gDjx%?~)*Je*Z7Je{Gstj`Qgb(^QXocAedONud?8gVg^;;$T(f7po$ zky=DPQ_D|_wewxSRsD-%8kcEU2)!up15_+`tN7);e3wGO@jY*=URh09BBggW{NF4r za)Gg^v>io84Iws!WZl)@$keTShW5EckqE;V%tv=@pEeYsO3p`EgwN+!_Zp7eY+6v@ z)@wS4EylTnrKeq*tvhseqMwz0&ywR~-x9$uWLkfUwvaZP;4q225hH(RC+o;AE}=%P zM3klBf&O{L==*4Eg$iOa_LmoX(upeZq&ml;e5fDy1qPdU#OLL@DYX%mP_Gav zKX)>@A--^vZS|I@v%yunv2VZRr_icNH_y;n`b)?8t8JMn<91i-r)$JHdxq%yP~)}@ z6&V&eGgv3@9a|ZF$3md*P*J(l0v!0 zVkhL*{pD0}i`lIO4zilD;lK8JmhCE*rmcQv-(`oo4P^<9NC1pj18hC7mo(^r<7 za;qj^i9yT2SphIgxU)uFhe#R!oJ0*eDL3?2)=SYZ;WmrSyzNEtin68mL5tj{o))c|qc z-oF)TI(;eeyS;TE8y}_04Gv#-kI~u{CmOlHQwJsm!SX7&jG7-0erO(&a(nXE{MD~$^x{zS6C?M%N z;>^!x5tfX)SMiMKTyT@Erjx`%kBAMLSo+231(7XZ*!?$SzajcT2jy-|@BBnGY;^Ze zC+gS~pPFOdf!D<{T*wJ-g^1f+roqF|%AF_cV_7ol;N82Ocw8KMAa0!3Z%gE^M60J} z0x-g}R~;+~bgFEm!Vu)!(2k_k?bP;(yW}DybW&kdE$eGXbO5QT+MoPjR9b-avatH* zX_WfzNXM3aU+A-YMH`eKmH~-1#Q1l*Jsg^zxT#F4al4i(V#EOeds1zZJb+qSx=`0VtC}5aYQe$K&76AgJZNXZ)RprWGbs22z)p`Bx=# z>HC)ZTZiiKgNq2CXo|tx4UIX1_;vN&!=1C3C=UFw zU#Rb159Y~UI_`CbA~iV1<)TFYz3FbEu$zqvq-BS#yYXAti*$7TK#=_+NWB7H>C8en zec0qMpaMN%je(_LWlWPcA0&$vYoI~ZCv?rDRhip!D3)oC8fr#+GfCoHthe$z3_>0K z+t2{6jG3ZrhspI*T&MU{j2d!P*SFlISB|3qx>TQWe%sfQa#$EjlZ-8CY$cgk$K8z# zG}dWyhCiJLOfa1)1LiB8x;nuJG4D<~6y0(=+${Xft)nwY#MN|~5yEchv>pnTn`}A# zF)L&{Q8zol-M^)YTWYP!eW;l96!dx9#!^506fSUH-DZCCvFHbagdo5+0BSo#oVP9V ze9+=w{~x6Eu62eq>ol&x53pk4Zz8TLS|qZ-OWW^xcUp|=(`0_>ix*UTx*|sCSMDEh zE!|rH^i)&!YiMDXyn_Yu;XgBkbinQLzaj2oP!ErFQ+t!rlI-&rSHDAt$n{-Rd~W|3 z=Q!kO%lJLZ!PC&7{wN@E3|tU;K##f>0(I!t&~l&)+10gUP;`7QDt(EC$L8~9^_uW+ zPB+*)Sus)e5+|B;izrbJJjzgsKh`h}eU?plvVTA{(hTmf8KP+)ql4?2T_=h$l*BvA z2OWR#l{j%S4$-LHZr~fPgapdD78$<9#L5j2fL=CJoH2ex!e_G%jo+yFq)5s9$aj(= zu|BLwu=k3z%XtKvAz`@VIr#RXX{T`i9^m<<=Sg8bYo-n-a~vTNb!bL2!`;d+y-REhj=)%BCKz+kM*xzSLNi7Jw$6BUjEK*f_gkTo2;=YHEagTNb!O*EmGm% z)Qg0fq!ue6jT)u*xwiV92QT&_E^-Q)%0U1<`f04i5$9rBS2F~+cmTkE{qc6y@r+I_ z@tjZ+;cR=K-sx@4a=YNzM@2p0(MrZaWlGYR$EXTN436n{ZE|gJ$Xmydj2#xlicKm&tIz456=er*)O1h{`_2 za6F86YN{GTo%%>A7#!RL{6oQ$oj);U3CpQOW+M+e<2hZ*3_IzsSyxLxn87 zYN0VC%_O?#L=<6TdrRv>3&uL~c4zlFnk}gkN6U_m8Qdf`94! zokP>JoxIox!$Ye z8#EI8VOH{p|Kwl|at7(NdO0Rq`X?vL04ei^TGtnD6$(1a2spLgGU9EJF@@9Q6oLe8 zWiCrlO|Na6Mg02Fm}`w%Nhek-AnmaI_S?@-<%-oTm#KdZtc5YXeX8oo*(p}rAf@=Z zz**Z>T{XSY1P;=s#llK5H)y$cC}NU>y?Jl6KG$%&B6V1-&NAUv8oC4og!|Mg768Mw zj0k2|X~lB!ys*`d?78TH=!vbl%e)8m+zDo2qnTlD{QNm}0s=!hSY|1&=kJX=pu3uG z82_)>T0<8`5mkRV7oq(!C*H{&d~ZfVyrC(IzFE^8?;j`!*NCcC%o*+g8MDz8oBoPd znhoe&?x`{lwV@t{p%XFE&c2gCY)PiFqw7==J7kLT1pHq$YwNL za?Un;+h33ZGEu#cCl1Bw;!17sJZKIx+-BlC1Zf!6k|pY}K&0Udd!j~KyT|FGp|6Eu zRp7sZ0Ot|sy^KmxtlX6S{#JKrX{Q&%tpuYCGY9qLYJW^p4rt|4h!XNBW6ui z5*S7G{{vMATz3>(m6N9=KC8EQ;B2%$hxkMrN<2v8ZD_aB44*LB`#l~cfTfjQ z%KH!0M{9l}9QOYoFV7k6?)&dy1hEsI|Agyn7b5p+UyVSYWIoydI?(^9mH8A=>&S@8 zO%BLhGyMvIQEyh;Y25oPj0|hOxBHUyyMvoTmi<{e8~nrSlM(u zlYKxBH3pMMZpPjMS^PRFgM#*dJgo{Fl&mc3Wdi$x65J`D6?!cfm~`MSd$b8Sz4>+v zL>6Fz;&8psfV)BSA%^%C`Q%$oF0h7kHp6^s$-r=&UQ2UpVGR>Z=`lJb^)3JM3{ARX zGey*celc7Z^W<)n6e`mGag?G*M0cXm2sp{)kT^&LIxrK67}b_)U@%|Ll`;`+7nQJF z=z{b!VP<)Hsszvu#T(s+I9!k=iLh;Ep? zq35c3PQCV-pEs5g)3%nqW&K0V9}xbXzIiwZoZ}0f>-$)bTAdS4$AUE;w*seI0%?@< z0ng&Xf6J#OB5z8(?lLJh@-JzV0UD2Zw&Rub^`KfJLGQO=$OH2}2NxAeKci8Y!A>YC zhEF@}ENR`2q_#EvLvB6fl)wY?fDH5}*AgD}2LO7osO2iOy>L;-D1@3YfK(JgTCMWC z3K2eCe%UAmFb2Wvk`Ey@$AR9^sO_DVrZSlCc}&awJZQS=dr`qaLWo4xY>S)5umwH7{Z+l9jJa{o#AL;a7ZH!`V?hd_%HIaI*Z z5gTC?x@VV~Gta z!eRF{DXtH?gdjvvN;k*jF0bYCMJBo*flww)vAWd2>^<6QA!o#43k z?4+(J4IJKMK_SM@V~)H!81ucKG^4SFxhu zPQ9s!fNjgAl=pRi4GyPaDF(pDp>ZMk<9(+4>Nu)q?~}6=Dgj^k(eYS@+H-$u-ByZ)*o`?l<|?eU)6`aLHP;O&s@*uP#MlIG47A!}Euj*2?m#@056Z ze~ZvxBWc)RKR&?y@z!qAn)Z{ym~b@06v(&P7862EQ^UO0JENQ_V1Nj$(k$77!Ym59 zqwOWdkCIl@)U~ke9xOVbP7Im+73_ri-l1O>QSg`DV8Nc|>ahR7F%$3RC6Kg`oRXBC z2JVvz`*hT;$Ik9Kr6ZYVIQf}^>FyWco&LGY2hsogv~VO2V}z&~S{-R)eIUOj&P zupPFAg&T0qdDaUHNZO~OBgC~R8@ky5C|b`shK4aw1uv^EURN(O%!eY_um^>g2(EzzJAuI+vpB5!Fe<>v+&z(YzUnDIL6iex9 za4A*7B4Eq^!T^l0)nx1|6*C3>qHlqn$C5Ts(^R5?UQq-!6z?V3`Ti6xb|wzsp5TL< zxY5+)Rug}@^}N;CN>?}K@PylULS@22YhJlDspO3Kki2nz37*9fDD6IJ)}~!lVQvDP z^Ekm@_&s1QupjrBiJee)%GZ9|H%|AMgEcF<$juHxQtqduZ?RT#l#211jbvYT_y;xL zFr2{!rU5va5o7S)YutA2fsTs4Tlc)TpX)yu1w8Jk3ue&R48;&c{>P5Y?UxLXVr4wj zf-jy+uU)a*Jw_F8aIaa(YW_60sZ!l-s{Ivxb9xO11&{n0pA8xoy`IU9$JAMwxpS-i zsmMp)s06_bpX%Q+7kpWhgIXWg!B>+CMH(zNzf_-8Z^oyNGd7!i)CzEphX(x_4_Vgd zHdwSS72s7Anvjl5VO6YzFedkqi9=0^8G~psi>|yvuH+@8tCup}5-|0FO|FyMP|K*e4o5lc5anxm`g1%z#&t2R1@Y?h&Wv;Py>-v-D zYDjsM&FY2setS`(HgU*YbK$+~p-u8U*3tP%QdZJdv%T>Vk}uvrVSIZ0*yNnYd1JO? zLEi9ECzH%-vz(3mi^FaF9ZRMt6sTz^48a(0W*kRYVszZ&JJf4r-);R#N>6XuD@U-u zJ@8|W<%`U3$kkxy58&i z`{h68oY`lez1OV0_FDISZ~A~v1}}`7r^8Yg9$bRSIk)4sNFH7DR{?jGg$rT{^%mVe}3pT1%^udkK?-uPo}*0Vdi zqmHfhtyvVZ%zLe!p>siuk-d{#ahvb14JP8>dqP#Lz(x%^xP;D8RV5W4RCPlcuZbsm z247{)Opd#<6nkP4!pdi~=VqZvuSz6IbeM4nn4wRFEe#%QZB?)abIRI@;g0Rm;P*hC zgKCSJf{8zX`Ye5iQSTx;dTinaGmQaQ!Zl$`m0iy3iSYyK*B;Q+-zkV13=4?<`b;O7LFg) zz*fk=epM9ITgQqzDjWDMGZs?qrG(1&Hq@AwcV;E^!)p|Qkhj91b@`l6wW$S(m(kGY z%FF`uhxbT44fz_w!{5{2>LzQ$^z(M&BXBBjgKAh3XzJ$vsFz(KVIg4oL6W7KdQndQcD9`GE#$xhIv+FvGRDM+Fb z{!Vph*(aa&{gVy*X-u5ZRaVyv+izN}Tf*)T%9)yf`GnH=q2Ixl$|v*X;4j#o4(}yr zqr33uNk1{px7dK9K>C;?<>)0rIn_36H}2g*49!)#*=;PW+h&LI<>!QkK4g1Te9sjb z`9X9{9Lx=G`Oe8Hgp4Ek!lDB*^d&Rz>?pCavet$xE)s~PfB|1MsDDD*am&sJs#b8e zupH!eF75*mRIzKIiQ`hp@;gITRR7PEJ^oiD1hBMq%tJ**#bZz2CxsR~5=T9Sl#x)B zz1jX=gvIE@N>F-%TV~jEx=T~G=4lKI=d>$ z_J5ZI0^)wkcByJBk*# zq&B(j&3=^|$@Ex`*qJWcxZSJbyLr6X&fYj3VIKrKYN@Vk3W2C5W=U7!vJmQ6TU&qs z{=KW??l2OUMrt))nzEZ~LfFh^%Yc~I`H#%`-W-n4VKc+lM0RX`J}tS+DChT~p>C%^ zimy=Vkjc__hDv!T-o)p>Z;!Kzp5S0o3eW49 zgg7bKYMZ29jT*xVAkhzr1j7Ff{rcEP(|VI`Bs1~&rY8RB9U~Q$PufOa{o#1Xwlk%g zo_}+~jscS}IasVG=6C$I6W4j%gK_e3wUSO>2n@`bpvHe+Y zSKBAXprhzoYJw_kJ5yJDxoFEyqp{x$#S#`3T|RfKw(!6D?P0dw7cr}v zl=YICd^^J>29XLjc)DA8ic0eBdXAbZ%JexNUs-rkN2A<#zw_yF%Zr%Lp8PWomHp!s zf?hyiAzzcAz;coqa1y+PTo$A6ZEQ*xwpMg&Elhy{CviTd3VkEHo&pi+9i8HlBFDCb~X z@<=gs=X@|GV1{Sqf<P-4Xg=XMAlKY)c4y@6u#93*s_@0dw z{x>92$Rhx2^wJ5T-1~V9^5HWkCyyiDy{S5TI?4;=$YdT?%dL8#MKTZzSvHPnBUy)C zGq+FsG2+F_so*b6fzORO&w*;B9hLL~8;3)xvVO4FprvV~tFIJojMvgSu&)a!a!dVjWPwF}6qT39|2<(WW`eaN)S$Oi{h9vYc#kuK<;u6QG2z za#Tfw%=P6@=X8{*Wp4PE!+V4dKebl>2tii6=te!3y?q-i^107iU6rk8VEcn=;$hC! zE5Zs2TLdzgBdUHIK41ipF?#-qfN_7*G^ zy?_1HGTRJ2|CGr1{jAsab2YB3*_k|r@*+`&3^1~G%|5eGt^1*S-rtV9IG3BvLdUX) zTQbT1e$&+b5mLYW<8jNC^+!wN?!L+1lScUoabJTupShV~k^~BTl{^|NTQN**{1Y4{!&UWUl zHvIZQn?w-MaYLjTOyk4f4$IaNtD(LRV!tEm={YFNPyXqxg^F9^5*r6lR+hm9KcpbxhaK99o979~W&!9r6rf^GoiJKdcPs z+n;#Z*z)~KnUJ3B#Yuk{F%J0MxRz$?3s~^pAWiV;Fw+WzZ)sC#KSS(B^!8SoSwqzu zrM(De#GbTQ;stM`Ap@U>{f7*nUIcraCKIdNSsrwdK zYI*EnHcKa8x5(*$I3o$f~SUQLfv@`%gW0Lh0S zWSQTVRA!u8p1!qKi7_z|Ih-Jr}2} zUggs~s@mN_BiLt$4zuY(OR~T3ny8g(c()3AMuoxMYL;c)q*TSFtO)`P=C+qQigF=r z24y~5)>N;iH-`A;(dT|Q&l<^oT)A+~<&C83{>y}w(SV5Umez92m_!1}!NEIZ&Y&Ma z2+e@6>!6RyS?|o)1m+$;Ki`rl(Jc=r(31);?-~2KWoP=uZMMnG*_m3cocj4R6{FYo z--JLbT@MQj`>gCBFKm`Tn{kH`wGD4Tm0_g@&Vf)%%!=u7dMlG5fd5e0KD%gx`aCpy zii_lA(H4MEU4FYM1OGw>mA@utj^uHogCg!|K@c=5z?EK)mE(xrzorVfM}TSsqKw-- zIoX<4k8e2^$Ol5iUf<~JqktzNAR2Sp zt7uG{*!sm{(Da(U<2v`|&nO(ktl$k#%?1AsMo&f-D|Tv-pJ^6vurAH-bQgcL^U zU3?QI7#fjH)qL2pH;PK>;^H#KAdO@@e?R)zdemVnO8Wg;z-4Q-{c2gAxh%{HFoEcopnh4xRoFj`t^nWVVr7z`FTg z50E2~G>nYwS@NnnA4!!(Z}Jg^I!(C#YMDsf4$H!Tlpbm1=;t+-S2xdPV%AJ^8k{zy zK;@JutTbB}OU*8vUZ)?0pYG3eTHRUw?@y!?vhQ^mAbg5gML5ftq0xCQki{T&5Xb0BbY2w_lhg;_C94nuP! z*VcM28kfB>0PEr~^4_64yI6d$ji!6LI@eU z-gkEws}FcIomk@24?L`F)|;Hd++&zw0lLZKyV9>lTf znKCSVNM2Vy0GPIDQ2!$qp;6uFUzu(sI3Xzo^ZejRH!9UC5byI2iU2!|<07#Kv{7X{6I0s1>Vw{A>zu&bH0&uTSQ! zi!v4ZgB~=4QLx^5)dSm+gs_ks`86}j?afUfN%C0e{9yz>%SB=P8H>zfN)k_yCt)f< zwFm=)P(@c)cVHK~f`7+rF`i+ab^+Eamvu>3R8TKe=+2i-h)Yhkm_qP6%SfF zdiwfGZ^}_VEkP^BS~c;tTrg*p649u!P^>f{TQwC;$}{{&EIr{Xz(!OcvxXLcMJNCt zQjMat2M?Oonl$w$^p~610(LW8g!s%%cATd>?EN=ctqb}~U{k#cfaTo0^KSKV=wN=X9NW#D570nihaK08=#4?A;z zfs81in>WT2SNT0`wWGc8wn6J^x&&U>I5 z_Al8;ECN$$9pJ17#m+@)?(we23}#FFtD-GYAFsW4vnM4j!VImd#3fl_4V#`hn-F3W zL_a|w<~`;X_%}UJ-*Ad=%V~IH12wUbF{#Mps^lQM7j5N34H}3)Gw;}bYW`ZwxwKnCFbHF(NW$X;Ok=V)SA`Sn6a=4o@n3Oz zfRIHQhFMCXdJK_HXD76@upnJi0|1tn|5c$eJNZR`aJ8vOu`5`Y(@}t8%jN#wiuTEU z`;#psg7$n&HBsra7D1;4Ii1AJYYJqdwndMBwY-1*f4dn2*60o^EoB1Wgo&2`_77|* z6WnH61~nNlDUomeKM+v~1J$nGc`NSbG+q}MpwkEc)eP4OyBEPho6gOA|JR2b5l+PN zWx2UM=zt1}$ba_%AHfSip{r8Y>E4}E?9m1vUF*S2LPN% zXkY?IQRtB=@)41Y$DkW1-kGAiP17*Q<&4O*j)t=FC*7Nt78EXviO;<|)oQL$UAA>| zd7H*z!qUI)7C{BfD&6Qktc_;&A3&7gkzPKxB=8ycTV5v8$+vy^dB-E2yn20-)Q{vb zUjhn$dO6BPV0fHIe(;BF^TIrRjhg;6k2w#RUiG;eEO~GY4A7ITsU^xtATvK(4xg|c zahm#kQ+(ll9|)jxF>OxQp5O+a3^RdOA9v)`@-nYY{<=mHPO1&5QKKF7qJQhz=y@>T z(0V$nv2$lYwx*~OOi9`JSS*QuP#;VZe#=SP zZ2v8`XpfA?->z6HPZ^boIX;vZ4TYmB2Ss}G0gi{L1CRx#wX2$;ik@QqfpgQDT7T&? zL~-0Ju8|oC+QMj++tDJ?|8AdGAsV^(M=jJ13^cgi6-PN9s?yaK0uDY)JpR6a#fqPr z91u)K*66n1<#(L|B~2Zu6w=>Wp9-8TLVDPe(TEb0+qozBJ z2K&5(vpf&b(Y_{Lg0lAEfUZu$2N1UI3IWYA$S&*!#FH=k`^5n5i!gtB`W@PZ{Y8H< zI^iGm-5fz*lXk-EZN}t0;t3D>oU9*y%uOQF{M%ps41*e~HVtsw8!1Pf@vfamJG`0Q z!|Oh!7IefdGpjw&VtcjM|AJfd`PmV&FxIT0nzxYNX(+BAq?~eB47(Ojts-t2b&$kd zpjEprA(w)mr=9AZAXtZzlQg+sI_D=zXdcs2IM$DHE6>Tf0wpYy zC#kRQc||yHX@SXs^x={qutmg@n{7|%<&E0kFRd=pW}jc7<)n&;m;~VlZ8M#53b2t3 z%7{Pce~8A#^zuVl zpUsFLU~SW3;tW)GJ-L5k+U}Hx3Zk=!FOhQA>>15a?(1!I$4ODC35#y5Kbj;@zgpfY zu%9lPu>j+}xI7i2RcMnzzrYV{!iM+3 zkd^0q%SisW7%KJXe>;mnC1AS`$jnhD7OE=u{Vj?3HA;7zE$bl9ycXivl&V3?`pp5- zH^KR@w=+Vk;4@7UEOEc&XHyI7d>cFQ)02N5K~l#@j6=2|KeYH}%#wA8GiJjSV~-*s zP9IL>)J2L|bBG+BtydxoF|?X=tXA8%0FmOYb5>-f3dMM-4qto}N1<7#!*6iE7yOpC63K$}d2}s^t!@W7++sw*r zbmDYRw56n(8+F-u`29ih;QpS@Q_nx3l6<5AcOk{iZI;6<@Wg1gG1nn9x6fBdK4hn* zhkmJJGL-Bry}BrTzLgPM!RmNjIh1X*_>6jd?(-aHWo+@08MPMCi+-`lFEM!aehcg$ z334eO*-mio?gC2ZZqwHIYAD-kro&ENaQi`j7qqn4O_nxH_QiG+iPC?8gD*I+FCviDLH^EgVRE(4`pwpF=O?rQ_ac+$>?x` zIwX{D+GxsyqjH$sqMQ%@-4pj^Req-;`fky!a$i4Q)Wf%aARIXo!EHrp*1osn&7RWBFFwf_ zl4vfd6y! znTKk;`zl~51mn|<$8i7W*T-OnA09R2+wV=Z1=uF+Hj1?JbL+4`0Ib6qe;iD7+c}}L?ct7=#F)$3!Gq61J_$yp^R!3Uoe9c+sB11n!hJCq& z^-JB09`PY~b5F9x)g8T7a-?AM`QJHV9*LFx_0aw{5l_L-eY7FIUH1~TC62WdqH;>Y zO6c55e{O?yc#UT?Q_sF#cv`Q$OY~{Hf0nB+xyg$7yG2_-17WFSq?R#`~=0v6- zZp3orbYE^u!#A`mm{pGeUFDV;{xUu<=$&6l_yWyWC4&`qsagGnDl>IsYQAq$@6-+> zTM5DXtBrMF3(TUwKholTLPkrdbzGjOp`giF|HaURy;A25FQ2a66j4vF$2ff(! zl+$${@*NlfEKX)M;aWi%OYkP}y%jn0{ova~8}ylJzs#nF&ZRwC)ZzYPM<>0jhS%xT zPcLQO_J_v2ZhOYti);jGeuY~>TUIsBy%`}xmb0FUBx%96@K)30_BRXGC?$RHrgWc`A$7RA)7NWM>ZeKoXfb$TWNU`~1skOkM#| z2>KSmxyQiUS>EoTZ-3kL)uDZ#vWrdhE?*qP#lZmu>4n=2$kt@g#BJ)vl&I(zGLJ^BYra|s_7rLDK!03zcla%)5nB8 zhI;dBwJD$NZ=mq&JQPIIs2XG410w5gnYK%wrLH%~Zli z?{G_rxb6vOwui7azVnLZt+0XLe+Xa*sQr|Y`AHI&R8K~KKCGvOFVM7;NZvBPlf*G~ zU%Pd=^T!&r57DJO7YRD&=GajSpd#rnIo9t?MK~}&$?ussXOs4|Y;mMaSV*zzPVUNr^Mu}%F zA|Bj_DG!$6;n@kDuQZ*13yU(mFGPiY^E@%wnP2soOWZPn zSS0l-q>jhDP6yd>P(9fLwW)eK&iyqJZl3(7-;}uVq{yQW>G`;-q%NPs$3IZJ%Remp zx;A}Fd0S${Izr0nmvY0(M#d{pvodOUq-@r^QfahJ#35QFoXq>2DKli8j`+QDwtO6Q zA3ZPOE=z`;HmtQIYLjZ?YYdmTutGQE1lQbV^2@q%clqHikl$yM@iZ!2hXX2ME%=}; zAtFzkd~QKm>)?bKgAUSzpT~EBtU1y_AogfflW!S7I8i9qLuL*z2hYf@ZcgsK0Qi7< z57<7vCwJ`V7a_r5)`F2&)CNEEY{M|bs);Ig=$wGE)jD>&hl7{s_QU=B-5IG(fl5L6 z;x=%FIV+nYc|Wq}l^5-0v9p;~u=M2%!a>Ly1|p6(oPP$+F)4?BAN_tFmP*~D#W1%p zF9G80H;jB5e-axlFAV*OuJ#$pr}Jf-&$mvm35N9_V5lOqROJNbs`*NyW-})TMek0@ zVBvd@%$LIv(^y$|B!LNb-XwSf)1<#N`}P|$Is?#-mezv(?D zcsK0ne-KC+j@r)tHQ55#1bihlqAFm3^2sAO=m<#J+{K4F_wRE0C312;(Mk&xJmZ}# ztcoxz?kKI|2t~99a43ui4v||XvPZ7aj0e2_JRP+0%>a%(5pkRW#>BJ~?x)i!e}#H~ zN(wWj#@z6NQEu_fQpZ~A8}mlx6%4Jc30~DqJG78J`iL_-tA|th1Q<~v^BoI&*)PSK zx<(OCulCUuHC#{U`H#F9N=FzWx`!2HR7R#B;)g;OZ%VJ; zwFR$-D2ox!%US(xPkGDq)QXNnA1R{>P?@C}8EsjM zI|mVKy{~)vW4XS7!wrQK8WAlz#_sHOben!D_)yv?4ij`-74nyU4Pu1=Ih;?keQ)>t zyG!Yx8pC@iu!9sMW5f%m#m=7H1u*q7p_^+m`cFZMw;V0tdQ~Js7qW8P9ZIJ{(vGK# zm9*mJ8Dhw}3>rxi*q z6h`_)zN9Q`58+4Yx0#RkFT!h$Q2Q_Y@qW&HJg6%$CvZ$%?hpPpa^aj$bwCp8S7`Np z+Uw|8KvIHAQ(bywgZI5Wvu@w8FJ*pawb;?XemwuX8L?DBmK?~Yg4T%K0w$>ZnJ0~v z`6Nd4;mCd~+CIK2H4fpnE*lkg#kq-8I}sT)_t?JlMdU`_Cbof7Q}R96B~bp(1xNE_7!mtB2#r1*a?Xs0%#ny!d6`a2hnJ+`GQP+ zk40*x&tfUYJ86FkG$by^Feu=+*=?M8tE#F61%`r%L7>Pwe}QW{5z2aOMCl)^*c6BN zp-UrX>Mr-S?%$n|&IICCUC=|syYK8-{fe8CD~FVN#rE_5c(#_*%u{B;@nivdL9kE#yTe*)CaJN=g{k-W-j9011s$)O&Al!CZ23RYG$n zCZVdwZUyy=6>)WhKC~rVX(IU<2uwGn+IVT#CGjSM5E=<9zFzM5L0bZ59=!KDQ;Ext zeSEkx+x=Pcce)6N96OBU*_dks|A|qWpZPCQDP=)Z5q=IHOZxNz<45mdw3NI1OOc~kDpD=zQ_svakRJAB8agZt9bIXsDu zjfr#|z~%-j5oS<1o~-x(1H~0j=C#5GE_9k>(Q2+co61)JD)>RPzf%*L(`4S*Hl&@U zd!7ot4(|nF?#%3IAMN(+k*~Z=pH6DSq|8cdDwT;a? zvx?n6M^O|Oz4#m1-;=kc8r&!}uyExT5*ztiqeszT(W=7&4Tlit*ee~6F8?wR zvzEzCOZ~N@Bg%4=y=3#!h~wwv%HUXQpw#LQqyY#n75fX&>W_7t*04AI9TkxNvCCzlc8qX5(u3Yz z`sFG{o-u{^zMcWSpI)ufp9Bu@Itj@$U&qGY4oFAo;EICk2(+7bAD#oMgMctudU52N zk>LSmNQHEAWwPn`M}+T<^K<}@`x5`pyY@HK=*u52otWTL!0eb}-o?1fk9OGs8$tC; z8HL!DpQsWHfoHdvJ$?@Z>wnJu!_m~M#CegElag|pnuvkQEJV+HJAf&~V=K2Kn3GP_ zJo2&0+FAJte8o9wQ<^uoy0i1bQTb3OBZ2d^A2}zzfofuT5Dn^w#F3IyJ#-IQdXNy{*m3rq+kEFXt3pZT)@9mE+TO72uoe8mKKo5tPPPVSOIDN z;M7#&sKeX^mKgalNXcMmRX-g4e3hIS-yu!KfmxRZ+9?~A8g#`e%0w!i|IsW;M;rOD z(4H);5Zn%we>p-!w-(fTS61!&cE||V6?FN72Nv zeb7Q65Lyb`oZP(K+{pfK34ca~XdvV=iHTBRw}``Wir~gFd0^frxo^xP`UQ>F`8Pp1 z;lFj-o)8->>V!>C-IeuZDdad`ZECn~B|h)#Jv$J} z&mO?}2p(Z~W~XAB=q1yH;5EG3h8cWZw`bIi-i*Fz>hPpv5@s7syc;z|+Su$k%v=I; z>HPOBcfgMlD9wa2!j^p+oN1QJ*#>65_8td({cz%|`P`_4g@cetWT7SlVd1N#put_q zsArFId+GWYx5@supqZiDCMt>76Zp1G+koFzx}yv?nmRRb?Yu3YPHW>NRW|fVqiIyf zG9cm3+tHbx4N!K`gf9Gh;$MTH-+hc^gsYjmUz84{p&v;4!Q+4iKU$zrYQXW4NZ{=sgOI1vx`ebs$#Y784TeMcq)X1AnGOB6j|JI zQeZV>l1Iu~Tdjem-m*twQMlVcqCUCvac8$Wr((G|;34w}wfMS&ifb(ipq#RS(6{4s zj!?s4{7jDd?EX%}w^|R7V!Xb^zbsaUlhGoaoVb2>m-P~SVbn_?C2WFo69n~n9jvAg z&VhWy5Qg~!X|Md|?E=FPAmkx8Qf%UeKbXHsEKjRu@J#?RNkZ}>ZeI3q%Y8-D&aT3# z&Z^`Ho;)^LB0x-%ZWS6L<_gc@k}gy)@={Bz$WaXX{n9Rj+9Tnss;QT{Uu}QyuN6}E zCP0zqu8yFw-cJxIz0YdXu?=rdXrs8U(*N#&kE^x+d}q3GcUVb2e52^EYfX7crQ+NS z#Z?h&-|+8WkV87Lh7xsQ#^G7j?p+I=`OhPs#mOcJCHW$*$gA93Y5?K%!xIIYRI3A9kT=P3e6Cxc66rL5*dB@I8f#XA8=K1LiyN8)o%E`+|lll1i zwt-5)@EQRo;L}hPe*ln$sBw07ZuvO=9$33yuu>!*pof;`=l5X}D9P{L$8s^j@dSW{ z`&Uv+i=c+4=2zu#*BNdFV9`eT*F^AG;C?HV%S20S*4>F&n}E(2KyNgV0hw0IH|a<- z3lge{c0iFD#`l-vJH0r1a&Jzs1qiYr_}_Q^w1L=*kx_81EEoI>AVe&%sTBVmA1{1Q z0WJs2+5T$@!@iLWh>!+a)Q*7u=>bTt8bgyOP|DAr8Wb$RO=Um6NGz}&t5dt075zH} zrVa&QUi>nB0;RuL2mlckQL$lX{P=7K8#ZugG+Uq@4n7kQ=BkUpTTWHH1i0n@+W9vu#Xun*Y)2<&(UQ@;rG0#3Q~Z`w=Nx2roA!k&;c=(MeJ0q=lulKw)n(Y ziAG9Q8!AHVKIL-590M|3|M<%&DOh34%gYY@5PuOL4={`Ygt(toYvhy#SV3$oJxqJq zn~V$tW6j-1f$L508E*xE0eW_b)y*$la%$fP=UaFZ$Sf3w9Uw+0FtiBRZ6lys zT^HdmAYfr}p`s!qg*kM1Z18D^acJIYppP&#c1;#IrWG)z_J2Pg#Xlb{s2P~cAd_+m z;k}=hqTDBtiOI-B?mP|xqs?@Cj+ztro6pX0| z-$qy|l86E7mbgV+q-Ij*gFk>;uYy_c_0Wd2>EI52v}35;1icKpIha$Opupo>Z9TJH zZe<5$CyUOfn@9jkRB97>^YW%Sem4!JTt^*jojxkrWRLc1(M&23x}s_0oExr2zqQYy zSze3T_p+&;E4p`$BWOm9k8I)VIW=tIz)&^u`@e|-`6}=d60C1jbx0WbiyE+{0PuZf zRRCa?T*>raRu?NRZAl+glDulNmY6SjCQ>fqk!B&fOAK>TZJJV7=Ww2XO{<&z20+!F z0XjU*s|k!V-r{adi@@e#EUje{6IJk;kYvu zC-FYg<^=s$O$}1(D}SZ@x?DU5zk4iFQnHF4imB`rM1*-to$&==+-USsV<{>pj3Kzjj+YWlckgkS=fQS;qrp77}G7fgQE1--qB6OiYMh z@W?AIOV1Y#$SuPG7aPLU4j{~m>S$z$;i7N}c=!@nffkVT6z^4NP|?DuJF6vFst$=z zvb5b4DYVLU9YSF-gL{(};{UVHj;nrR(s0TCbs)YxaM)N011BB@Jo;fMCcQT_w2Idx zpu7J!y`R*6eo6PV^P?e6YcQ@QgCug@1 zEG*>A-vrJmusTr!vx{I6?^lpr?F@9@?)#-i{Hn4&Dd zB{>SMU3gZze|VmuRHVxvjV~tf&eJ3y^F%_Gnm98})*82^L0d~RuccwYL38M|(IDtAurNz-<=!3SXGXB;+cdsA~kk!Fh3> z7V#Hto?QrkLevrC-M_=cfp$>-wNq=gAh+~z+*$3~Z-ZMA!-sQ<22;Gk&t#>Kr3xN- z@?`pqx&NP+*Z=3`k+=8DN=rGpl(@yj2`FmE16Yu4urX-)-{aZQP*5=aMN3Wl^3h-c t1gu1WhyL$qcR@oy^Z) Warning: + This should be used with extreme caution as this completely bypasses the built-in + extension template. Therefore, if you update the extension image in the future, + you will not receive the updated template because you are using a custom one. + +To use a custom template: + +1. Create a Swarm configuration using a new template +2. Create a Swarm configuration object +3. Update the extension + +## Creating a Swarm configuration using a new template +First, create a Swarm config using the new template, as shown in the following example. This example uses a custom Nginx configuration template, but you can use any extension configuration (for example, HAProxy). + +The contents of the example `custom-template.conf` include: + +``` +# CUSTOM INTERLOCK CONFIG +user {{ .ExtensionConfig.User }}; +worker_processes {{ .ExtensionConfig.WorkerProcesses }}; + +error_log {{ .ExtensionConfig.ErrorLogPath }} warn; +pid {{ .ExtensionConfig.PidPath }}; + + +events { + worker_connections {{ .ExtensionConfig.MaxConnections }}; + +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + server_names_hash_bucket_size 128; + + # add custom HTTP options here, etc. + + log_format main {{ .ExtensionConfig.MainLogFormat }} + + log_format trace {{ .ExtensionConfig.TraceLogFormat }} + + access_log {{ .ExtensionConfig.AccessLogPath }} main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout {{ .ExtensionConfig.KeepaliveTimeout }}; + client_max_body_size {{ .ExtensionConfig.ClientMaxBodySize }}; + client_body_buffer_size {{ .ExtensionConfig.ClientBodyBufferSize }}; + client_header_buffer_size {{ .ExtensionConfig.ClientHeaderBufferSize }}; + large_client_header_buffers {{ .ExtensionConfig.LargeClientHeaderBuffers }}; + client_body_timeout {{ .ExtensionConfig.ClientBodyTimeout }}; + underscores_in_headers {{ if .ExtensionConfig.UnderscoresInHeaders }}on{{ else }}off{{ end }}; + + add_header x-request-id $request_id; + add_header x-proxy-id $hostname; + add_header x-server-info "{{ .Version }}"; + add_header x-upstream-addr $upstream_addr; + add_header x-upstream-response-time $upstream_response_time; + + proxy_connect_timeout {{ .ExtensionConfig.ConnectTimeout }}; + proxy_send_timeout {{ .ExtensionConfig.SendTimeout }}; + proxy_read_timeout {{ .ExtensionConfig.ReadTimeout }}; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $http_host; + proxy_set_header x-request-id $request_id; + send_timeout {{ .ExtensionConfig.SendTimeout }}; + proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504; + + ssl_prefer_server_ciphers on; + ssl_ciphers {{ .ExtensionConfig.SSLCiphers }}; + ssl_protocols {{ .ExtensionConfig.SSLProtocols }}; + {{ if (and (gt .ExtensionConfig.SSLDefaultDHParam 0) (ne .ExtensionConfig.SSLDefaultDHParamPath "")) }}ssl_dhparam {{ .ExtensionConfig.SSLDefaultDHParamPath }};{{ end }} + + map $http_upgrade $connection_upgrade { + default upgrade; + '' close; + } + + {{ if not .HasDefaultBackend }} + # default host return 503 + server { + listen {{ .Port }} default_server; + server_name _; + + root /usr/share/nginx/html; + + error_page 503 /503.html; + location = /503.html { + try_files /503.html @error; + internal; + } + + location @error { + root /usr/share/nginx/html; + } + + location / { + return 503; + + } + + location /nginx_status { + stub_status on; + access_log off; + } + + } + {{ end }} + + {{ range $host, $backends := .Hosts }} + {{ with $hostBackend := index $backends 0 }} + {{ $sslBackend := index $.SSLBackends $host }} + upstream {{ backendName $host }} { + {{ if $hostBackend.IPHash }}ip_hash; {{else}}zone {{ backendName $host }}_backend 64k;{{ end }} + {{ if ne $hostBackend.StickySessionCookie "" }}hash $cookie_{{ $hostBackend.StickySessionCookie }} consistent; {{ end }} + {{ range $backend := $backends }} + {{ range $up := $backend.Targets }}server {{ $up }}; + {{ end }} + {{ end }} {{/* end range backends */}} + + } + {{ if not $sslBackend.Passthrough }} + server { + listen {{ $.Port }}{{ if $hostBackend.DefaultBackend }} default_server{{ end }}; + {{ if $hostBackend.DefaultBackend }}server_name _;{{ else }}server_name {{$host}};{{ end }} + + {{ if (isRedirectHost $host $hostBackend.Redirects) }} + {{ range $redirect := $hostBackend.Redirects }} + {{ if isRedirectMatch $redirect.Source $host }}return 302 {{ $redirect.Target }}$request_uri;{{ end }} + {{ end }} + {{ else }} + + {{ if eq ( len $hostBackend.ContextRoots ) 0 }} + {{ if not (isWebsocketRoot $hostBackend.WebsocketEndpoints) }} + location / { + proxy_pass {{ if $hostBackend.SSLBackend }}https://{{ else }}http://{{ backendName $host }};{{ end }} + } + {{ end }} + + {{ range $ws := $hostBackend.WebsocketEndpoints }} + location {{ $ws }} { + proxy_pass {{ if $hostBackend.SSLBackend }}https://{{ else }}http://{{ backendName $host }};{{ end }} + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_set_header Origin ''; + } + {{ end }} {{/* end range WebsocketEndpoints */}} + {{ else }} + + {{ range $ctxroot := $hostBackend.ContextRoots }} + location {{ $ctxroot.Path }} { + {{ if $ctxroot.Rewrite }}rewrite ^([^.]*[^/])$ $1/ permanent; + rewrite ^{{ $ctxroot.Path }}/(.*) /$1 break;{{ end }} + proxy_pass http://{{ backendName $host }}; + } + {{ end }} {{/* end range contextroots */}} + + {{ end }} {{/* end len $hostBackend.ContextRoots */}} + location /nginx_status { + stub_status on; + access_log off; + } + {{ end }}{{/* end isRedirectHost */}} + + } + {{ end }} {{/* end if not sslBackend.Passthrough */}} + + {{/* SSL */}} + {{ if ne $hostBackend.SSLCert "" }} + {{ $sslBackend := index $.SSLBackends $host }} + server { + listen 127.0.0.1:{{ $sslBackend.Port }} ssl proxy_protocol; + server_name {{ $host }}; + ssl on; + ssl_certificate /run/secrets/{{ $hostBackend.SSLCertTarget }}; + {{ if ne $hostBackend.SSLKey "" }}ssl_certificate_key /run/secrets/{{ $hostBackend.SSLKeyTarget }};{{ end }} + set_real_ip_from 127.0.0.1/32; + real_ip_header proxy_protocol; + + {{ if eq ( len $hostBackend.ContextRoots ) 0 }} + {{ if not (isWebsocketRoot $hostBackend.WebsocketEndpoints) }} + location / { + proxy_pass {{ if $hostBackend.SSLBackend }}https://{{ else }}http://{{ backendName $host }};{{ end }} + } + {{ end }} + + {{ range $ws := $hostBackend.WebsocketEndpoints }} + location {{ $ws }} { + proxy_pass {{ if $hostBackend.SSLBackend }}https://{{ else }}http://{{ backendName $host }};{{ end }} + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_set_header Origin {{$host}}; + + } + {{ end }} {{/* end range WebsocketEndpoints */}} + {{ else }} + + {{ range $ctxroot := $hostBackend.ContextRoots }} + location {{ $ctxroot.Path }} { + {{ if $ctxroot.Rewrite }}rewrite ^([^.]*[^/])$ $1/ permanent; + rewrite ^{{ $ctxroot.Path }}/(.*) /$1 break;{{ end }} + proxy_pass http://{{ backendName $host }}; + } + {{ end }} {{/* end range contextroots */}} + + {{ end }} {{/* end len $hostBackend.ContextRoots */}} + location /nginx_status { + stub_status on; + access_log off; + } + + } {{ end }} {{/* end $hostBackend.SSLCert */}} + {{ end }} {{/* end with hostBackend */}} + + {{ end }} {{/* end range .Hosts */}} + + include /etc/nginx/conf.d/*.conf; +} +stream { + # main log compatible format + log_format stream '$remote_addr - - [$time_local] "$ssl_preread_server_name -> $name ($protocol)" ' + '$status $bytes_sent "" "" "" '; + map $ssl_preread_server_name $name { + {{ range $host, $sslBackend := $.SSLBackends }} + {{ $sslBackend.Host }} {{ if $sslBackend.Passthrough }}pt-{{ backendName $host }};{{ else }}127.0.0.1:{{ $sslBackend.Port }}; {{ end }} + {{ if $sslBackend.DefaultBackend }}default {{ if $sslBackend.Passthrough }}pt-{{ backendName $host }};{{ else }}127.0.0.1:{{ $sslBackend.Port }}; {{ end }}{{ end }} + {{ end }} + + } + {{ range $host, $sslBackend := $.SSLBackends }} + upstream pt-{{ backendName $sslBackend.Host }} { + {{ $h := index $.Hosts $sslBackend.Host }}{{ $hostBackend := index $h 0 }} + {{ if $sslBackend.Passthrough }} + server 127.0.0.1:{{ $sslBackend.ProxyProtocolPort }}; + {{ else }} + {{ range $up := $hostBackend.Targets }}server {{ $up }}; + {{ end }} {{/* end range backend targets */}} + {{ end }} {{/* end range sslbackend */}} + + }{{ end }} {{/* end range SSLBackends */}} + + {{ range $host, $sslBackend := $.SSLBackends }} + {{ $proxyProtocolPort := $sslBackend.ProxyProtocolPort }} + {{ $h := index $.Hosts $sslBackend.Host }}{{ $hostBackend := index $h 0 }} + {{ if ne $proxyProtocolPort 0 }} + upstream proxy-{{ backendName $sslBackend.Host }} { + {{ range $up := $hostBackend.Targets }}server {{ $up }}; + {{ end }} {{/* end range backend targets */}} + + } + server { + listen {{ $proxyProtocolPort }} proxy_protocol; + proxy_pass proxy-{{ backendName $sslBackend.Host }}; + + } + {{ end }} {{/* end if ne proxyProtocolPort 0 */}} + {{ end }} {{/* end range SSLBackends */}} + + server { + listen {{ $.SSLPort }}; + proxy_pass $name; + proxy_protocol on; + ssl_preread on; + access_log {{ .ExtensionConfig.AccessLogPath }} stream; + } +} +``` + +## Creating a Swarm configuration object +To create a Swarm config object: + +``` +$> docker config create interlock-custom-template custom.conf +``` + +## Updating the extension +Now update the extension to use this new template: + +``` +$> docker service update --config-add source=interlock-custom-template,target=/etc/docker/extension-template.conf interlock-ext +``` + +This should trigger an update and a new proxy configuration will be generated. + +## Removing the custom template +To remove the custom template and revert to using the built-in template: + +``` +$> docker service update --config-rm interlock-custom-template interlock-ext +``` diff --git a/ee/ucp/interlock/config/haproxy-config.md b/ee/ucp/interlock/config/haproxy-config.md new file mode 100644 index 0000000000..53b8887299 --- /dev/null +++ b/ee/ucp/interlock/config/haproxy-config.md @@ -0,0 +1,29 @@ +--- +title: HAProxy configuration +description: Learn how to configure an HAProxy extension +keywords: routing, proxy +--- + +# Configuring an HAProxy extension +The following configuration options are available: + +| Option | Type | Description | +| --- | --- | --- | +| `PidPath` | string | path to the pid file for the proxy service | +| `MaxConnections` | int | maximum number of connections for proxy service | +| `ConnectTimeout` | int | timeout in seconds for clients to connect | +| `ClientTimeout` | int | timeout in seconds for the service to send a request to the proxied upstream | +| `ServerTimeout` | int | timeout in seconds for the service to read a response from the proxied upstream | +| `AdminUser` | string | username to be used with authenticated access to the proxy service | +| `AdminPass` | string | password to be used with authenticated access to the proxy service | +| `SSLOpts` | string | options to be passed when configuring SSL | +| `SSLDefaultDHParam` | int | size of DH parameters | +| `SSLVerify` | string | SSL client verification | +| `SSLCiphers` | string | SSL ciphers to use for the proxy service | +| `SSLProtocols` | string | enable the specified TLS protocols | +| `GlobalOptions` | []string | list of options that are included in the global configuration | +| `DefaultOptions` | []string | list of options that are included in the default configuration | + +# Notes + +When using SSL termination, the certificate and key must be combined into a single certificate (i.e. `cat cert.pem key.pem > combined.pem`). The HAProxy extension only uses the certificate label to configure SSL. diff --git a/ee/ucp/interlock/config/host-mode-networking.md b/ee/ucp/interlock/config/host-mode-networking.md new file mode 100644 index 0000000000..09cad3147a --- /dev/null +++ b/ee/ucp/interlock/config/host-mode-networking.md @@ -0,0 +1,237 @@ +--- +title: Host mode networking +description: Learn how to configure the UCP layer 7 routing solution with + host mode networking. +keywords: routing, proxy +redirect_from: + - /ee/ucp/interlock/usage/host-mode-networking/ + - /ee/ucp/interlock/deploy/host-mode-networking/ +--- + +# Configuring host mode networking +By default, layer 7 routing components communicate with one another using +overlay networks, but Interlock supports +host mode networking in a variety of ways, including proxy only, Interlock only, application only, and hybrid. + +When using host mode networking, you cannot use DNS service discovery, +since that functionality requires overlay networking. +For services to communicate, each service needs to know the IP address of +the node where the other service is running. + +To use host mode networking instead of overlay networking: + +1. Perform the configuration needed for a production-grade deployment +2. Update the ucp-interlock configuration +3. Deploy your Swarm services + +## Configuration for a production-grade deployment + +If you have not done so, configure the +[layer 7 routing solution for production](production.md). + +The `ucp-interlock-proxy` service replicas should then be +running on their own dedicated nodes. + +## Update the ucp-interlock config + +[Update the ucp-interlock service configuration](configure.md) so that it uses +host mode networking. + +Update the `PublishMode` key to: + +```toml +PublishMode = "host" +``` + +When updating the `ucp-interlock` service to use the new Docker configuration, +make sure to update it so that it starts publishing its port on the host: + +```bash +docker service update \ + --config-rm $CURRENT_CONFIG_NAME \ + --config-add source=$NEW_CONFIG_NAME,target=/config.toml \ + --publish-add mode=host,target=8080 \ + ucp-interlock +``` + +The `ucp-interlock` and `ucp-interlock-extension` services are now communicating +using host mode networking. + +## Deploy your swarm services + +Now you can deploy your swarm services. +Set up your CLI client with a [UCP client bundle](../../user-access/cli.md), +and deploy the service. The following example deploys a demo +service that also uses host mode networking: + +```bash +docker service create \ + --name demo \ + --detach=false \ + --label com.docker.lb.hosts=app.example.org \ + --label com.docker.lb.port=8080 \ + --publish mode=host,target=8080 \ + --env METADATA="demo" \ + ehazlett/docker-demo +``` + +In this example, Docker allocates a high random port on the host where the service can be reached. + +To test that everything is working, run the following command: + +```bash +curl --header "Host: app.example.org" \ + http://:/ping +``` + +Where: + +* `` is the domain name or IP address of a node where the proxy +service is running. +* `` is the [port you're using to route HTTP traffic](index.md). + +If everything is working correctly, you should get a JSON result like: + +```json +{"instance":"63b855978452", "version":"0.1", "request_id":"d641430be9496937f2669ce6963b67d6"} +``` + + +---------------------------REPLACE WITH THE FOLLOWING INFO??------------------------------------------------- + + + +In this example we will configure an eight (8) node Swarm cluster that uses host mode +networking to route traffic without using overlay networks. There are three (3) managers +and five (5) workers. Two of the workers are configured with node labels to be dedicated +ingress cluster load balancer nodes. These will receive all application traffic. + +This example will not cover the actual deployment of infrastructure. +It assumes you have a vanilla Swarm cluster (`docker init` and `docker swarm join` from the nodes). +See the [Swarm](https://docs.docker.com/engine/swarm/) documentation if you need help +getting a Swarm cluster deployed. + +Note: when using host mode networking you will not be able to use the DNS service discovery as that +requires overlay networking. You can use other tooling such as [Registrator](https://github.com/gliderlabs/registrator) +that will give you that functionality if needed. + +We will configure the load balancer worker nodes (`lb-00` and `lb-01`) with node labels in order to pin the Interlock Proxy +service. Once you are logged into one of the Swarm managers run the following to add node labels +to the dedicated load balancer worker nodes: + +```bash +$> docker node update --label-add nodetype=loadbalancer lb-00 +lb-00 +$> docker node update --label-add nodetype=loadbalancer lb-01 +lb-01 +``` + +Inspect each node to ensure the labels were successfully added: + +```bash +$> docker node inspect -f '{{ .Spec.Labels }}' lb-00 +map[nodetype:loadbalancer] +$> docker node inspect -f '{{ .Spec.Labels }}' lb-01 +map[nodetype:loadbalancer] +``` + +Next, create a configuration object for Interlock that specifies host mode networking: + +```bash +$> cat << EOF | docker config create service.interlock.conf - +ListenAddr = ":8080" +DockerURL = "unix:///var/run/docker.sock" +PollInterval = "3s" + +[Extensions] + [Extensions.default] + Image = "interlockpreview/interlock-extension-nginx:2.0.0-preview" + Args = [] + ServiceName = "interlock-ext" + ProxyImage = "nginx:alpine" + ProxyArgs = [] + ProxyServiceName = "interlock-proxy" + ProxyConfigPath = "/etc/nginx/nginx.conf" + ProxyReplicas = 1 + PublishMode = "host" + PublishedPort = 80 + TargetPort = 80 + PublishedSSLPort = 443 + TargetSSLPort = 443 + [Extensions.default.Config] + User = "nginx" + PidPath = "/var/run/proxy.pid" + WorkerProcesses = 1 + RlimitNoFile = 65535 + MaxConnections = 2048 +EOF +oqkvv1asncf6p2axhx41vylgt +``` + +Note the `PublishMode = "host"` setting. This instructs Interlock to configure the proxy service for host mode networking. + +Now we can create the Interlock service also using host mode networking: + +```bash +$> docker service create \ + --name interlock \ + --mount src=/var/run/docker.sock,dst=/var/run/docker.sock,type=bind \ + --constraint node.role==manager \ + --publish mode=host,target=8080 \ + --config src=service.interlock.conf,target=/config.toml \ + interlockpreview/interlock:2.0.0-preview -D run -c /config.toml +sjpgq7h621exno6svdnsvpv9z +``` + +## Configure Proxy Services +With the node labels, you can re-configure the Interlock Proxy services to be constrained to the +workers. From a manager run the following to pin the proxy services to the load balancer worker nodes: + +```bash +$> docker service update \ + --constraint-add node.labels.nodetype==loadbalancer \ + interlock-proxy +``` + +Now you can deploy the application: + +```bash +$> docker service create \ + --name demo \ + --detach=false \ + --label com.docker.lb.hosts=demo.local \ + --label com.docker.lb.port=8080 \ + --publish mode=host,target=8080 \ + --env METADATA="demo" \ + ehazlett/docker-demo +``` + +This runs the service using host mode networking. Each task for the service has a high port (for example, 32768) and uses +the node IP address to connect. You can see this when inspecting the headers from the request: + +```bash +$> curl -vs -H "Host: demo.local" http://127.0.0.1/ping +curl -vs -H "Host: demo.local" http://127.0.0.1/ping +* Trying 127.0.0.1... +* TCP_NODELAY set +* Connected to 127.0.0.1 (127.0.0.1) port 80 (#0) +> GET /ping HTTP/1.1 +> Host: demo.local +> User-Agent: curl/7.54.0 +> Accept: */* +> +< HTTP/1.1 200 OK +< Server: nginx/1.13.6 +< Date: Fri, 10 Nov 2017 15:38:40 GMT +< Content-Type: text/plain; charset=utf-8 +< Content-Length: 110 +< Connection: keep-alive +< Set-Cookie: session=1510328320174129112; Path=/; Expires=Sat, 11 Nov 2017 15:38:40 GMT; Max-Age=86400 +< x-request-id: e4180a8fc6ee15f8d46f11df67c24a7d +< x-proxy-id: d07b29c99f18 +< x-server-info: interlock/2.0.0-preview (17476782) linux/amd64 +< x-upstream-addr: 172.20.0.4:32768 +< x-upstream-response-time: 1510328320.172 +< +{"instance":"897d3c7b9e9c","version":"0.1","metadata":"demo","request_id":"e4180a8fc6ee15f8d46f11df67c24a7d"} +``` diff --git a/ee/ucp/interlock/config/index.md b/ee/ucp/interlock/config/index.md new file mode 100644 index 0000000000..f31a72e1fd --- /dev/null +++ b/ee/ucp/interlock/config/index.md @@ -0,0 +1,231 @@ +--- +title: Configuring layer 7 routing service +description: Learn how to configure the layer 7 routing solution for UCP, that allows + you to route traffic to swarm services. +keywords: routing, proxy +redirect_from: + - /ee/ucp/interlock/deploy/configure/ + - /ee/ucp/interlock/usage/default-service/ +--- + +# Configuring layer 7 routing services +You can configure ports for incoming traffic from the UCP web UI. + +To further customize the layer 7 routing solution, you must update the +`ucp-interlock` service with a new Docker configuration. + +Here's how it works: + +1. Find out what configuration is currently being used for the `ucp-interlock` +service and save it to a file: + + {% raw %} + ```bash + CURRENT_CONFIG_NAME=$(docker service inspect --format '{{ (index .Spec.TaskTemplate.ContainerSpec.Configs 0).ConfigName }}' ucp-interlock) + docker config inspect --format '{{ printf "%s" .Spec.Data }}' $CURRENT_CONFIG_NAME > config.toml + ``` + {% endraw %} + +2. Make the necessary changes to the `config.toml` file. See [TOML file configuration options](#toml-file-configuration-options) for more information. + +3. Create a new Docker configuration object from the `config.toml` file: + + ```bash + NEW_CONFIG_NAME="com.docker.ucp.interlock.conf-$(( $(cut -d '-' -f 2 <<< "$CURRENT_CONFIG_NAME") + 1 ))" + docker config create $NEW_CONFIG_NAME config.toml + ``` + +3. Update the `ucp-interlock` service to start using the new configuration: + + ```bash + docker service update \ + --config-rm $CURRENT_CONFIG_NAME \ + --config-add source=$NEW_CONFIG_NAME,target=/config.toml \ + ucp-interlock + ``` + +By default, the `ucp-interlock` service is configured to pause if you provide an +invalid configuration. The service will not restart without manual intervention. + +If you want the service to automatically rollback to a previous stable +configuration, you can update it with the following command: + +```bash +docker service update \ + --update-failure-action rollback \ + ucp-interlock +``` + +**Note**: Every time you enable the layer 7 routing +solution from the UCP UI, the `ucp-interlock` service is started using the +default configuration. + +If you've customized the configuration used by the `ucp-interlock` service, +you must update it again to use the Docker configuration object +you've created. + +## TOML file configuration options +The following sections describe how to configure the primary Interlock services: + +- Core +- Extension +- Proxy + +### Core configuration + +The core configuraton handles the Interlock service itself. These are the configuration options for the `ucp-interlock` service: + +| Option | Type | Description | +|:-------------------|:------------|:-----------------------------------------------------------------------------------------------| +| `ListenAddr` | string | Address to serve the Interlock GRPC API. Defaults to `8080`. | +| `DockerURL` | string | Path to the socket or TCP address to the Docker API. Defaults to `unix:///var/run/docker.sock` | +| `TLSCACert` | string | Path to the CA certificate for connecting securely to the Docker API. | +| `TLSCert` | string | Path to the certificate for connecting securely to the Docker API. | +| `TLSKey` | string | Path to the key for connecting securely to the Docker API. | +| `AllowInsecure` | bool | Skip TLS verification when connecting to the Docker API via TLS. | +| `PollInterval` | string | Interval to poll the Docker API for changes. Defaults to `3s`. | +| `EndpointOverride` | string | Override the default GRPC API endpoint for extensions. The default is detected via Swarm. | +| `Extensions` | []Extension | Array of extensions as listed below. | + +### Extension configuration + +Interlock must contain at least one extension to service traffic. The following options are available to configure the extensions: + +| Option | Type | Description | +|:-------------------|:------------------|:------------------------------------------------------------------------------| +| `Image` | string | Name of the Docker image to use for the extension service. | +| `Args` | []string | Arguments to be passed to the Docker extension service upon creation. | +| `Labels` | map[string]string | Labels to add to the extension service. | +| `ServiceName` | string | Name of the extension service. | +| `ProxyImage` | string | Name of the Docker image to use for the proxy service. | +| `ProxyArgs` | []string | Arguments to be passed to the proxy service upon creation. | +| `ProxyLabels` | map[string]string | Labels to add to the proxy service. | +| `ProxyServiceName` | string | Name of the proxy service. | +| `ProxyConfigPath` | string | Path in the service for the generated proxy configuration. | +| `ServiceCluster` | string | Name of the cluster this extension services. | +| `PublishMode` | string | Publish mode for the proxy service. Supported values are `ingress` or `host`. | +| `PublishedPort` | int | Port where the proxy service serves non-TLS traffic. | +| `PublishedSSLPort` | int | Port where the proxy service serves TLS traffic. | +| `Template` | string | Docker configuration object that is used as the extension template. | +| `Config` | Config | Proxy configuration used by the extensions as listed below. | + +--------------------------WHICH INFO IS CORRECT???------------------------------------------- + +| Option | Type | Description | +| --- | --- | --- | +| `Image` | string | name of the Docker Image to use for the extension service | +| `Args` | []string | arguments to be passed to the Docker extension service upon creation | +| `Labels` | map[string]string | labels to be added to the extension service | +| `ContainerLabels` | map[string]string | labels to be added to the extension service tasks | +| `Constraints` | []string | one or more [constraints](https://docs.docker.com/engine/reference/commandline/service_create/#specify-service-constraints-constraint) to use when scheduling the extension service | +| `PlacementPreferences` | []string | one or more [placement prefs](https://docs.docker.com/engine/reference/commandline/service_create/#specify-service-placement-preferences-placement-pref) to use when scheduling the extension service | +| `ServiceName` | string | name of the extension service | +| `ProxyImage` | string | name of the Docker Image to use for the proxy service | +| `ProxyArgs` | []string | arguments to be passed to the Docker proxy service upon creation | +| `ProxyLabels` | map[string]string | labels to be added to the proxy service | +| `ProxyContainerLabels` | map[string]string | labels to be added to the proxy service tasks | +| `ProxyServiceName` | string | name of the proxy service | +| `ProxyConfigPath` | string | path in the service for the generated proxy config | +| `ProxyReplicas` | uint | number of proxy service replicas | +| `ProxyStopSignal` | string | stop signal for the proxy service (i.e. `SIGQUIT`) | +| `ProxyStopGracePeriod` | string | stop grace period for the proxy service (i.e. `5s`) | +| `ProxyConstraints` | []string | one or more [constraints](https://docs.docker.com/engine/reference/commandline/service_create/#specify-service-constraints-constraint) to use when scheduling the proxy service | +| `ProxyPlacementPreferences` | []string | one or more [placement prefs](https://docs.docker.com/engine/reference/commandline/service_create/#specify-service-placement-preferences-placement-pref) to use when scheduling the proxy service | +| `ServiceCluster` | string | name of the cluster this extension services | +| `PublishMode` | string (`ingress` or `host`) | publish mode that the proxy service uses | +| `PublishedPort` | int | port that the proxy service serves non-SSL traffic | +| `PublishedSSLPort` | int | port that the proxy service serves SSL traffic | +| `Template` | string | Docker config object that is used as the extension template | +| `Config` | Config | proxy configuration used by the extensions as listed below | + +### Proxy +Options are made available to the extensions, and the extensions utilize the options needed for proxy service configuration. This provides overrides to the extension configuration. + +Because Interlock passes the extension configuration directly to the extension, each extension has +different configuration options available. Refer to the documentation for each extension for supported options: + +- [Nginx](nginx-config.md) +- [HAproxy](haproxy-config.md) + +#### Customizing the default proxy service +The default proxy service used by UCP to provide layer 7 routing is NGINX. If users try to access a route that hasn't been configured, they will see the default NGINX 404 page: + +![Default NGINX page](../../images/interlock-default-service-1.png){: .with-border} + +You can customize this by labelling a service with +`com.docker.lb.default_backend=true`. In this case, if users try to access a route that's +not configured, they are redirected to this service. + +As an example, create a `docker-compose.yml` file with: + +```yaml +version: "3.2" + +services: + demo: + image: ehazlett/interlock-default-app + deploy: + replicas: 1 + labels: + com.docker.lb.default_backend: "true" + com.docker.lb.port: 80 + networks: + - demo-network + +networks: + demo-network: + driver: overlay +``` + +Set up your CLI client with a [UCP client bundle](../../user-access/cli.md), +and deploy the service: + +```bash +docker stack deploy --compose-file docker-compose.yml demo +``` + +If users try to access a route that's not configured, they are directed +to this demo service. + +![Custom default page](../../images/interlock-default-service-2.png){: .with-border} + +### Example Configuration +The following is an example configuration to use with the Nginx extension. + +```toml +ListenAddr = ":8080" +DockerURL = "unix:///var/run/docker.sock" +PollInterval = "3s" + +[Extensions.default] + Image = "docker/interlock-extension-nginx:latest" + Args = ["-D"] + ServiceName = "interlock-ext" + ProxyImage = "nginx:alpine" + ProxyArgs = [] + ProxyServiceName = "interlock-proxy" + ProxyConfigPath = "/etc/nginx/nginx.conf" + ProxyStopGracePeriod = "3s" + PublishMode = "ingress" + PublishedPort = 80 + ProxyReplicas = 1 + TargetPort = 80 + PublishedSSLPort = 443 + TargetSSLPort = 443 + [Extensions.default.Config] + User = "nginx" + PidPath = "/var/run/proxy.pid" + WorkerProcesses = 1 + RlimitNoFile = 65535 + MaxConnections = 2048 +``` + +## Next steps + +- [Using a custom extension template](custom-template.md) +- [Configuring an HAProxy extension](haproxy-config.md) +- [Configuring host mode networking](host-mode-networking.md) +- [Configuring an nginx extension](nginx-config.md) +- [Using application service labels](service-lables.md) +- [Tuning the proxy service](tuning.md) +- [Updating Interlock services](updates.md) diff --git a/ee/ucp/interlock/config/nginx-config.md b/ee/ucp/interlock/config/nginx-config.md new file mode 100644 index 0000000000..e9315639b2 --- /dev/null +++ b/ee/ucp/interlock/config/nginx-config.md @@ -0,0 +1,69 @@ +--- +title: Nginx configuration +description: Learn how to configure an nginx extension +keywords: routing, proxy +--- + +# Configuring an nginx extension + +By default, nginx is used as a proxy, so the following configuration options are +available for the nginx extension: + +| Option | Type | Description | +|:------------------------|:-------|:-----------------------------------------------------------------------------------------------------| +| `User` | string | User to be used in the proxy. | +| `PidPath` | string | Path to the pid file for the proxy service. | +| `MaxConnections` | int | Maximum number of connections for proxy service. | +| `ConnectTimeout` | int | Timeout in seconds for clients to connect. | +| `SendTimeout` | int | Timeout in seconds for the service to send a request to the proxied upstream. | +| `ReadTimeout` | int | Timeout in seconds for the service to read a response from the proxied upstream. | +| `IPHash` | bool | Specifies that requests are distributed between servers based on client IP addresses. | +| `SSLOpts` | string | Options to be passed when configuring SSL. | +| `SSLDefaultDHParam` | int | Size of DH parameters. | +| `SSLDefaultDHParamPath` | string | Path to DH parameters file. | +| `SSLVerify` | string | SSL client verification. | +| `WorkerProcesses` | string | Number of worker processes for the proxy service. | +| `RLimitNoFile` | int | Number of maxiumum open files for the proxy service. | +| `SSLCiphers` | string | SSL ciphers to use for the proxy service. | +| `SSLProtocols` | string | Enable the specified TLS protocols. | +| `AccessLogPath` | string | Path to use for access logs (default: `/dev/stdout`). | +| `ErrorLogPath` | string | Path to use for error logs (default: `/dev/stdout`). | +| `MainLogFormat` | string | [Format](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format) to use for main logger. | +| `TraceLogFormat` | string | [Format](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format) to use for trace logger. | + +This is from Interlock docs - which is correct??????? + +| Option | Type | Description | Defaults | +| --- | --- | --- | --- | +| `User` | string | user to be used in the proxy | `nginx` | +| `PidPath` | string | path to the pid file for the proxy service | `/var/run/proxy.pid` | +| `MaxConnections` | int | maximum number of connections for proxy service | `1024` | +| `ConnectTimeout` | int | timeout in seconds for clients to connect | `600` | +| `SendTimeout` | int | timeout in seconds for the service to send a request to the proxied upstream | `600` | +| `ReadTimeout` | int | timeout in seconds for the service to read a response from the proxied upstream | `600` | +| `SSLOpts` | string | options to be passed when configuring SSL | | +| `SSLDefaultDHParam` | int | size of DH parameters | `1024` | +| `SSLDefaultDHParamPath` | string | path to DH parameters file | | +| `SSLVerify` | string | SSL client verification | `required` | +| `WorkerProcesses` | string | number of worker processes for the proxy service | `1` | +| `RLimitNoFile` | int | number of maxiumum open files for the proxy service | `65535` | +| `SSLCiphers` | string | SSL ciphers to use for the proxy service | `HIGH:!aNULL:!MD5` | +| `SSLProtocols` | string | enable the specified TLS protocols | `TLSv1.2` | +| `KeepaliveTimeout` | string | connection keepalive timeout | `75s` | +| `ClientMaxBodySize` | string | maximum allowed size of the client request body | `1m` | +| `ClientBodyBufferSize` | string | sets buffer size for reading client request body | `8k` | +| `ClientHeaderBufferSize` | string | sets buffer size for reading client request header | `1k` | +| `LargeClientHeaderBuffers` | string | sets the maximum number and size of buffers used for reading large client request header | `4 8k` | +| `ClientBodyTimeout` | string | timeout for reading client request body | `60s` | +| `UnderscoresInHeaders` | bool | enables or disables the use of underscores in client request header fields| `false` | +| `ServerNamesHashBucketSize` | int | sets the bucket size for the server names hash tables (in KB) | `128` | +| `UpstreamZoneSize` | int | size of the shared memory zone (in KB) | `64` | +| `GlobalOptions` | []string | list of options that are included in the global configuration | | +| `HTTPOptions` | []string | list of options that are included in the http configuration | | +| `TCPOptions` | []string | list of options that are included in the stream (TCP) configuration | | +| `AccessLogPath` | string | Path to use for access logs | `/dev/stdout` | +| `ErrorLogPath` | string | Path to use for error logs | `/dev/stdout` | +| `MainLogFormat` | string | [Format](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format) to use for main logger | see default format | +| `TraceLogFormat` | string | [Format](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format) to use for trace logger | see default format | + + diff --git a/ee/ucp/interlock/config/service-labels.md b/ee/ucp/interlock/config/service-labels.md new file mode 100644 index 0000000000..e7aa26206b --- /dev/null +++ b/ee/ucp/interlock/config/service-labels.md @@ -0,0 +1,45 @@ +--- +title: Application service labels +description: Learn how applications use service labels for publishing +keywords: routing, proxy +--- + +# Using application service labels + +Service labels define hostnames that are routed to the +service, the applicable ports, and other routing configurations. Applications that publish using Interlock use service labels to configure how they are published. + +When you deploy or update a swarm service with service labels, the following actions occur: + +1. The `ucp-interlock` service monitors the Docker API for events and +publishes the events to the `ucp-interlock-extension` service. +2. That service then generates a new configuration for the proxy service, +based on the labels you added to your services. +3. The `ucp-interlock` service takes the new configuration and reconfigures the +`ucp-interlock-proxy` to start using the new configuration. + +The previous steps occur in milliseconds and with rolling updates. Even though +services are being reconfigured, users won't notice it. + +## Service label options + +The following table describes the available options: + +| Label | Description | Example | +| --- | --- | --- | +| `com.docker.lb.hosts` | Comma separated list of the hosts that the service should serve | `example.com,test.com` | +| `com.docker.lb.port` | Port to use for internal upstream communication | `8080` | +| `com.docker.lb.network` | Name of network the proxy service should attach to for upstream connectivity | `app-network-a` | +| `com.docker.lb.context_root` | Context or path to use for the application | `/app` | +| `com.docker.lb.context_root_rewrite` | Boolean to enable rewrite for the context root | `true` | +| `com.docker.lb.ssl_only` | Boolean to force SSL for application | `true` | +| `com.docker.lb.ssl_cert` | Docker secret to use for the SSL certificate | `example.com.cert` | +| `com.docker.lb.ssl_key` | Docker secret to use for the SSL key | `example.com.key` | +| `com.docker.lb.websocket_endpoints` | Comma separated list of endpoints to configure to be upgraded for websockets | `/ws,/foo` | +| `com.docker.lb.service_cluster` | Name of the service cluster to use for the application | `us-east` | +| `com.docker.lb.ssl_backend` | Enable SSL communication to the upstreams | `true` | +| `com.docker.lb.ssl_backend_tls_verify` | Verification mode for the upstream TLS | `none` | +| `com.docker.lb.sticky_session_cookie` | Cookie to use for sticky sessions | `none` | +| `com.docker.lb.redirects` | Semi-colon separated list of redirects to add in the format of `,`. Example: (`http://old.example.com,http://new.example.com;`) | `none` | +| `com.docker.lb.ssl_passthrough` | Enable SSL passthrough | `false` | +| `com.docker.lb.backend_mode` | Select the backend mode that the proxy should use to access the upstreams. Defaults to `task`. | `vip` | diff --git a/ee/ucp/interlock/config/tuning.md b/ee/ucp/interlock/config/tuning.md new file mode 100644 index 0000000000..ce9b26860c --- /dev/null +++ b/ee/ucp/interlock/config/tuning.md @@ -0,0 +1,36 @@ +--- +title: Proxy service tuning +description: Learn how to ????? +keywords: routing, proxy +--- + +# Tuning the proxy service + +## Constraining the proxy service to multiple dedicated worker nodes +Refer to [Proxy service constraints](../deploy/production.md) for information on how to constrain the proxy service to multiple dedicated worker nodes. + +## Stopping +To adjust the stop signal and period, use the `stop-signal` and `stop-grace-period` settings. For example, +to set the stop signal to `SIGTERM` and grace period to ten (10) seconds, use the following command: + +```bash +$> docker service update --stop-signal=SIGTERM --stop-grace-period=10s interlock-proxy +``` + +## Update actions +In the event of an update failure, the default Swarm action is to "pause". This prevents Interlock updates from happening +without operator intervention. You can change this behavior using the `update-failure-action` setting. For example, +to automatically rollback to the previous configuration upon failure, use the following command: + +```bash +$> docker service update --update-failure-action=rollback interlock-proxy +``` + +## Update interval +By default, Interlock configures the proxy service using rolling update. For more time between proxy +updates, such as to let a service settle, use the `update-delay` setting. For example, if you want to have +thirty (30) seconds between updates, use the following command: + +```bash +$> docker service update --update-delay=30s interlock=proxy +``` diff --git a/ee/ucp/interlock/config/updates.md b/ee/ucp/interlock/config/updates.md new file mode 100644 index 0000000000..5cb79c1c94 --- /dev/null +++ b/ee/ucp/interlock/config/updates.md @@ -0,0 +1,36 @@ +--- +title: Updating Interlock services +description: Learn how to update the UCP layer 7 routing solution services +keywords: routing, proxy +--- + +# Updating Interlock services +There are two parts to the update process: + +1. Updating the Interlock configuration to specify the new extension and/or proxy image versions. +2. Updating the Interlock service to use the new configuration and image. + +## Updating the Interlock configuration +Create the new configuration: + +```bash +$> docker config create service.interlock.conf.v2 +``` + +## Updating the Interlock service +Remove the old configuration and specify the new configuration: + +```bash +$> docker service update --config-rm service.interlock.conf interlock +$> docker service update --config-add source=service.interlock.conf.v2,target=/config.toml interlock +``` + +Next, update the Interlock service to use the new image. The following example updates the Interlock core service to use the `sha256:d173014908eb09e9a70d8e5ed845469a61f7cbf4032c28fad0ed9af3fc04ef51` +version of Interlock. Interlock starts and checks the config object, which has the new extension version, and +performs a rolling deploy to update all extensions. + +```bash +$> docker service update \ + --image interlockpreview/interlock@sha256:d173014908eb09e9a70d8e5ed845469a61f7cbf4032c28fad0ed9af3fc04ef51 \ + interlock +``` diff --git a/ee/ucp/interlock/deploy/configuration-reference.md b/ee/ucp/interlock/deploy/configuration-reference.md deleted file mode 100644 index ffdcfbf82b..0000000000 --- a/ee/ucp/interlock/deploy/configuration-reference.md +++ /dev/null @@ -1,146 +0,0 @@ ---- -title: Layer 7 routing configuration reference -description: Learn the configuration options for the UCP layer 7 routing solution -keywords: routing, proxy ---- - -Once you enable the layer 7 routing service, UCP creates the -`com.docker.ucp.interlock.conf-1` configuration and uses it to configure all -the internal components of this service. - -The configuration is managed as a TOML file. - -## Example configuration - -Here's an example of the default configuration used by UCP: - -```toml -ListenAddr = ":8080" -DockerURL = "unix:///var/run/docker.sock" -AllowInsecure = false -PollInterval = "3s" - -[Extensions] - [Extensions.default] - Image = "{{ page.ucp_org }}/ucp-interlock-extension:{{ page.ucp_version }}" - ServiceName = "ucp-interlock-extension" - Args = [] - Constraints = ["node.labels.com.docker.ucp.orchestrator.swarm==true", "node.platform.os==linux"] - ProxyImage = "{{ page.ucp_org }}/ucp-interlock-proxy:{{ page.ucp_version }}" - ProxyServiceName = "ucp-interlock-proxy" - ProxyConfigPath = "/etc/nginx/nginx.conf" - ProxyReplicas = 2 - ProxyStopSignal = "SIGQUIT" - ProxyStopGracePeriod = "5s" - ProxyConstraints = ["node.labels.com.docker.ucp.orchestrator.swarm==true", "node.platform.os==linux"] - PublishMode = "ingress" - PublishedPort = 80 - TargetPort = 80 - PublishedSSLPort = 8443 - TargetSSLPort = 443 - [Extensions.default.Labels] - "com.docker.ucp.InstanceID" = "fewho8k85kyc6iqypvvdh3ntm" - [Extensions.default.ContainerLabels] - "com.docker.ucp.InstanceID" = "fewho8k85kyc6iqypvvdh3ntm" - [Extensions.default.ProxyLabels] - "com.docker.ucp.InstanceID" = "fewho8k85kyc6iqypvvdh3ntm" - [Extensions.default.ProxyContainerLabels] - "com.docker.ucp.InstanceID" = "fewho8k85kyc6iqypvvdh3ntm" - [Extensions.default.Config] - Version = "" - User = "nginx" - PidPath = "/var/run/proxy.pid" - MaxConnections = 1024 - ConnectTimeout = 600 - SendTimeout = 600 - ReadTimeout = 600 - IPHash = false - AdminUser = "" - AdminPass = "" - SSLOpts = "" - SSLDefaultDHParam = 1024 - SSLDefaultDHParamPath = "" - SSLVerify = "required" - WorkerProcesses = 1 - RLimitNoFile = 65535 - SSLCiphers = "HIGH:!aNULL:!MD5" - SSLProtocols = "TLSv1.2" - AccessLogPath = "/dev/stdout" - ErrorLogPath = "/dev/stdout" - MainLogFormat = "'$remote_addr - $remote_user [$time_local] \"$request\" '\n\t\t '$status $body_bytes_sent \"$http_referer\" '\n\t\t '\"$http_user_agent\" \"$http_x_forwarded_for\"';" - TraceLogFormat = "'$remote_addr - $remote_user [$time_local] \"$request\" $status '\n\t\t '$body_bytes_sent \"$http_referer\" \"$http_user_agent\" '\n\t\t '\"$http_x_forwarded_for\" $request_id $msec $request_time '\n\t\t '$upstream_connect_time $upstream_header_time $upstream_response_time';" - KeepaliveTimeout = "75s" - ClientMaxBodySize = "32m" - ClientBodyBufferSize = "8k" - ClientHeaderBufferSize = "1k" - LargeClientHeaderBuffers = "4 8k" - ClientBodyTimeout = "60s" - UnderscoresInHeaders = false -``` - -## Core configurations - -These are the configurations used for the `ucp-interlock` service. The following -options are available: - -| Option | Type | Description | -|:-------------------|:------------|:-----------------------------------------------------------------------------------------------| -| `ListenAddr` | string | Address to serve the Interlock GRPC API. Defaults to `8080`. | -| `DockerURL` | string | Path to the socket or TCP address to the Docker API. Defaults to `unix:///var/run/docker.sock` | -| `TLSCACert` | string | Path to the CA certificate for connecting securely to the Docker API. | -| `TLSCert` | string | Path to the certificate for connecting securely to the Docker API. | -| `TLSKey` | string | Path to the key for connecting securely to the Docker API. | -| `AllowInsecure` | bool | Skip TLS verification when connecting to the Docker API via TLS. | -| `PollInterval` | string | Interval to poll the Docker API for changes. Defaults to `3s`. | -| `EndpointOverride` | string | Override the default GRPC API endpoint for extensions. The default is detected via Swarm. | -| `Extensions` | []Extension | Array of extensions as listed below. | - -## Extension configuration - -Interlock must contain at least one extension to service traffic. -The following options are available to configure the extensions: - -| Option | Type | Description | -|:-------------------|:------------------|:------------------------------------------------------------------------------| -| `Image` | string | Name of the Docker image to use for the extension service. | -| `Args` | []string | Arguments to be passed to the Docker extension service upon creation. | -| `Labels` | map[string]string | Labels to add to the extension service. | -| `ServiceName` | string | Name of the extension service. | -| `ProxyImage` | string | Name of the Docker image to use for the proxy service. | -| `ProxyArgs` | []string | Arguments to be passed to the proxy service upon creation. | -| `ProxyLabels` | map[string]string | Labels to add to the proxy service. | -| `ProxyServiceName` | string | Name of the proxy service. | -| `ProxyConfigPath` | string | Path in the service for the generated proxy configuration. | -| `ServiceCluster` | string | Name of the cluster this extension services. | -| `PublishMode` | string | Publish mode for the proxy service. Supported values are `ingress` or `host`. | -| `PublishedPort` | int | Port where the proxy service serves non-TLS traffic. | -| `PublishedSSLPort` | int | Port where the proxy service serves TLS traffic. | -| `Template` | string | Docker configuration object that is used as the extension template. | -| `Config` | Config | Proxy configuration used by the extensions as listed below. | - -## Proxy configuration - -By default NGINX is used as a proxy, so the following NGINX options are -available for the proxy service: - -| Option | Type | Description | -|:------------------------|:-------|:-----------------------------------------------------------------------------------------------------| -| `User` | string | User to be used in the proxy. | -| `PidPath` | string | Path to the pid file for the proxy service. | -| `MaxConnections` | int | Maximum number of connections for proxy service. | -| `ConnectTimeout` | int | Timeout in seconds for clients to connect. | -| `SendTimeout` | int | Timeout in seconds for the service to send a request to the proxied upstream. | -| `ReadTimeout` | int | Timeout in seconds for the service to read a response from the proxied upstream. | -| `IPHash` | bool | Specifies that requests are distributed between servers based on client IP addresses. | -| `SSLOpts` | string | Options to be passed when configuring SSL. | -| `SSLDefaultDHParam` | int | Size of DH parameters. | -| `SSLDefaultDHParamPath` | string | Path to DH parameters file. | -| `SSLVerify` | string | SSL client verification. | -| `WorkerProcesses` | string | Number of worker processes for the proxy service. | -| `RLimitNoFile` | int | Number of maxiumum open files for the proxy service. | -| `SSLCiphers` | string | SSL ciphers to use for the proxy service. | -| `SSLProtocols` | string | Enable the specified TLS protocols. | -| `AccessLogPath` | string | Path to use for access logs (default: `/dev/stdout`). | -| `ErrorLogPath` | string | Path to use for error logs (default: `/dev/stdout`). | -| `MainLogFormat` | string | [Format](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format) to use for main logger. | -| `TraceLogFormat` | string | [Format](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format) to use for trace logger. | diff --git a/ee/ucp/interlock/deploy/configure.md b/ee/ucp/interlock/deploy/configure.md deleted file mode 100644 index b0f9ef6b39..0000000000 --- a/ee/ucp/interlock/deploy/configure.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Configure the layer 7 routing service -description: Learn how to configure the layer 7 routing solution for UCP, that allows - you to route traffic to swarm services. -keywords: routing, proxy ---- - -[When enabling the layer 7 routing solution](index.md) from the UCP web UI, -you can configure the ports for incoming traffic. If you want to further -customize the layer 7 routing solution, you can do it by updating the -`ucp-interlock` service with a new Docker configuration. - -Here's how it works: - -1. Find out what configuration is currently being used for the `ucp-interlock` -service and save it to a file: - - {% raw %} - ```bash - CURRENT_CONFIG_NAME=$(docker service inspect --format '{{ (index .Spec.TaskTemplate.ContainerSpec.Configs 0).ConfigName }}' ucp-interlock) - docker config inspect --format '{{ printf "%s" .Spec.Data }}' $CURRENT_CONFIG_NAME > config.toml - ``` - {% endraw %} - -2. Make the necessary changes to the `config.toml` file. - [Learn about the configuration options available](configuration-reference.md). - -3. Create a new Docker configuration object from the file you've edited: - - ```bash - NEW_CONFIG_NAME="com.docker.ucp.interlock.conf-$(( $(cut -d '-' -f 2 <<< "$CURRENT_CONFIG_NAME") + 1 ))" - docker config create $NEW_CONFIG_NAME config.toml - ``` - -3. Update the `ucp-interlock` service to start using the new configuration: - - ```bash - docker service update \ - --config-rm $CURRENT_CONFIG_NAME \ - --config-add source=$NEW_CONFIG_NAME,target=/config.toml \ - ucp-interlock - ``` - -By default the `ucp-interlock` service is configured to pause if you provide an -invalid configuration. The service won't restart without a manual intervention. - -If you want the service to automatically rollback to a previous stable -configuration, you can update it with: - -```bash -docker service update \ - --update-failure-action rollback \ - ucp-interlock -``` - -Another thing to be aware is that every time you enable the layer 7 routing -solution from the UCP UI, the `ucp-interlock` service is started using the -default configuration. - -If you've customized the configuration used by the `ucp-interlock` service, -you'll have to update it again to use the Docker configuration object -you've created. - - diff --git a/ee/ucp/interlock/deploy/host-mode-networking.md b/ee/ucp/interlock/deploy/host-mode-networking.md deleted file mode 100644 index fe0763c91b..0000000000 --- a/ee/ucp/interlock/deploy/host-mode-networking.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: Host mode networking -description: Learn how to configure the UCP layer 7 routing solution with - host mode networking. -keywords: routing, proxy -redirect_from: - - /ee/ucp/interlock/usage/host-mode-networking/ ---- - -By default the layer 7 routing components communicate with one another using -overlay networks. You can customize the components to use host mode networking -instead. - -You can choose to: - -* Configure the `ucp-interlock` and `ucp-interlock-extension` services to -communicate using host mode networking. -* Configure the `ucp-interlock-proxy` and your swarm service to communicate -using host mode networking. -* Use host mode networking for all of the components. - -In this example we'll start with a production-grade deployment of the layer 7 -routing solution and update it so that it uses host mode networking instead of -overlay networking. - -When using host mode networking you won't be able to use DNS service discovery, -since that functionality requires overlay networking. -For two services to communicate, each service needs to know the IP address of -the node where the other service is running. - -## Production-grade deployment - -If you haven't already, configure the -[layer 7 routing solution for production](production.md). - -Once you've done that, the `ucp-interlock-proxy` service replicas should be -running on their own dedicated nodes. - -## Update the ucp-interlock config - -[Update the ucp-interlock service configuration](configure.md) so that it uses -host mode networking. - -Update the `PublishMode` key to: - -```toml -PublishMode = "host" -``` - -When updating the `ucp-interlock` service to use the new Docker configuration, -make sure to update it so that it starts publishing its port on the host: - -```bash -docker service update \ - --config-rm $CURRENT_CONFIG_NAME \ - --config-add source=$NEW_CONFIG_NAME,target=/config.toml \ - --publish-add mode=host,target=8080 \ - ucp-interlock -``` - -The `ucp-interlock` and `ucp-interlock-extension` services are now communicating -using host mode networking. - -## Deploy your swarm services - -Now you can deploy your swarm services. In this example we'll deploy a demo -service that also uses host mode networking. -Set up your CLI client with a [UCP client bundle](../../user-access/cli.md), -and deploy the service: - -```bash -docker service create \ - --name demo \ - --detach=false \ - --label com.docker.lb.hosts=app.example.org \ - --label com.docker.lb.port=8080 \ - --publish mode=host,target=8080 \ - --env METADATA="demo" \ - ehazlett/docker-demo -``` - -Docker allocates a high random port on the host where the service can be reached. -To test that everything is working you can run: - -```bash -curl --header "Host: app.example.org" \ - http://:/ping -``` - -Where: - -* `` is the domain name or IP address of a node where the proxy -service is running. -* `` is the [port you're using to route HTTP traffic](index.md). - -If everything is working correctly, you should get a JSON result like: - -```json -{"instance":"63b855978452", "version":"0.1", "request_id":"d641430be9496937f2669ce6963b67d6"} -``` diff --git a/ee/ucp/interlock/deploy/index.md b/ee/ucp/interlock/deploy/index.md index 73d109d08d..972b40c8fc 100644 --- a/ee/ucp/interlock/deploy/index.md +++ b/ee/ucp/interlock/deploy/index.md @@ -1,13 +1,33 @@ --- -title: Enable layer 7 routing -description: Learn how to enable the layer 7 routing solution for UCP, that allows - you to route traffic to swarm services. +title: Deploying a layer 7 routing solution for UCP to route traffic to swarm services +description: Learn the deployment steps for the UCP layer 7 routing solution keywords: routing, proxy +redirect_from: + - /ee/ucp/interlock/deploy/configuration-reference/ --- -To enable support for layer 7 routing, also known as HTTP routing mesh, -log in to the UCP web UI as an administrator, navigate to the **Admin Settings** -page, and click the **Layer 7 Routing** option. Check the **Enable Layer 7 Routing** option. +# Deploying basic layer 7 routing and Interlock +This topic covers deploying a layer 7 routing solution for UCP into a Docker Swarm. Layer 7 routing is also referred to as HTTP routing mesh. + +1. Prerequisites +2. Enable layer 7 routing +3. Working with the core service configuration file +4. Creating a dedicated network for Interlock and extensions +5. Creating the Interlock service + +## Prerequisites + +- [Docker](https://www.docker.com) version 17.06 or later +- Docker must be running in [Swarm mode](https://docs.docker.com/engine/swarm/) +- Internet access (see [Offline Installation](offline.md) for installing without internet access) + +## Enable layer 7 routing +By default, layer 7 routing is disabled, so you must first +enable this service from the UCP web UI. + +1. Log in to the UCP web UI as an administrator. +2. Navigate to **Admin Settings** +3. Select **Layer 7 Routing** and then select **Enable Layer 7 Routing** ![http routing mesh](../../images/interlock-install-3.png){: .with-border} @@ -15,4 +35,169 @@ By default, the routing mesh service listens on port 80 for HTTP and port 8443 for HTTPS. Change the ports if you already have services that are using them. -Once you save, the layer 7 routing service can be used by your swarm services. +When 7 routing is enabled: + +1. UCP creates the `ucp-interlock` overlay network. +2. UCP deploys the `ucp-interlock` service and attaches it both to the Docker +socket and the overlay network that was created. This allows the Interlock +service to use the Docker API. That's also the reason why this service needs to +run on a manger node. +3. The `ucp-interlock` service starts the `ucp-interlock-extension` service +and attaches it to the `ucp-interlock` network. This allows both services +to communicate. +4. The `ucp-interlock-extension` generates a configuration to be used by +the proxy service. By default the proxy service is NGINX, so this service +generates a standard NGINX configuration. +( Is this valid here????) UCP creates the `com.docker.ucp.interlock.conf-1` configuration file and uses it to configure all +the internal components of this service. +5. The `ucp-interlock` service takes the proxy configuration and uses it to +start the `ucp-interlock-proxy` service. + +At this point everything is ready for you to start using the layer 7 routing +service with your swarm workloads. + + +The following code sample provides a default UCP configuration: + +```toml +ListenAddr = ":8080" +DockerURL = "unix:///var/run/docker.sock" +AllowInsecure = false +PollInterval = "3s" + +[Extensions] + [Extensions.default] + Image = "{{ page.ucp_org }}/ucp-interlock-extension:{{ page.ucp_version }}" + ServiceName = "ucp-interlock-extension" + Args = [] + Constraints = ["node.labels.com.docker.ucp.orchestrator.swarm==true", "node.platform.os==linux"] + ProxyImage = "{{ page.ucp_org }}/ucp-interlock-proxy:{{ page.ucp_version }}" + ProxyServiceName = "ucp-interlock-proxy" + ProxyConfigPath = "/etc/nginx/nginx.conf" + ProxyReplicas = 2 + ProxyStopSignal = "SIGQUIT" + ProxyStopGracePeriod = "5s" + ProxyConstraints = ["node.labels.com.docker.ucp.orchestrator.swarm==true", "node.platform.os==linux"] + PublishMode = "ingress" + PublishedPort = 80 + TargetPort = 80 + PublishedSSLPort = 8443 + TargetSSLPort = 443 + [Extensions.default.Labels] + "com.docker.ucp.InstanceID" = "fewho8k85kyc6iqypvvdh3ntm" + [Extensions.default.ContainerLabels] + "com.docker.ucp.InstanceID" = "fewho8k85kyc6iqypvvdh3ntm" + [Extensions.default.ProxyLabels] + "com.docker.ucp.InstanceID" = "fewho8k85kyc6iqypvvdh3ntm" + [Extensions.default.ProxyContainerLabels] + "com.docker.ucp.InstanceID" = "fewho8k85kyc6iqypvvdh3ntm" + [Extensions.default.Config] + Version = "" + User = "nginx" + PidPath = "/var/run/proxy.pid" + MaxConnections = 1024 + ConnectTimeout = 600 + SendTimeout = 600 + ReadTimeout = 600 + IPHash = false + AdminUser = "" + AdminPass = "" + SSLOpts = "" + SSLDefaultDHParam = 1024 + SSLDefaultDHParamPath = "" + SSLVerify = "required" + WorkerProcesses = 1 + RLimitNoFile = 65535 + SSLCiphers = "HIGH:!aNULL:!MD5" + SSLProtocols = "TLSv1.2" + AccessLogPath = "/dev/stdout" + ErrorLogPath = "/dev/stdout" + MainLogFormat = "'$remote_addr - $remote_user [$time_local] \"$request\" '\n\t\t '$status $body_bytes_sent \"$http_referer\" '\n\t\t '\"$http_user_agent\" \"$http_x_forwarded_for\"';" + TraceLogFormat = "'$remote_addr - $remote_user [$time_local] \"$request\" $status '\n\t\t '$body_bytes_sent \"$http_referer\" \"$http_user_agent\" '\n\t\t '\"$http_x_forwarded_for\" $request_id $msec $request_time '\n\t\t '$upstream_connect_time $upstream_header_time $upstream_response_time';" + KeepaliveTimeout = "75s" + ClientMaxBodySize = "32m" + ClientBodyBufferSize = "8k" + ClientHeaderBufferSize = "1k" + LargeClientHeaderBuffers = "4 8k" + ClientBodyTimeout = "60s" + UnderscoresInHeaders = false +``` + +### Working with the core service configuration file +Interlock uses the TOML file for the core service configuration. The following example utilizes Swarm deployment and recovery features by creating a Docker Config object: + +```bash +$> cat << EOF | docker config create service.interlock.conf - +ListenAddr = ":8080" +DockerURL = "unix:///var/run/docker.sock" +PollInterval = "3s" + +[Extensions] + [Extensions.default] + Image = "interlockpreview/interlock-extension-nginx:2.0.0-preview" + Args = ["-D"] + ProxyImage = "nginx:alpine" + ProxyArgs = [] + ProxyConfigPath = "/etc/nginx/nginx.conf" + ProxyReplicas = 1 + ProxyStopGracePeriod = "3s" + ServiceCluster = "" + PublishMode = "ingress" + PublishedPort = 80 + TargetPort = 80 + PublishedSSLPort = 443 + TargetSSLPort = 443 + [Extensions.default.Config] + User = "nginx" + PidPath = "/var/run/proxy.pid" + WorkerProcesses = 1 + RlimitNoFile = 65535 + MaxConnections = 2048 +EOF +oqkvv1asncf6p2axhx41vylgt +``` + +### Creating a dedicated network for Interlock and extensions + +Next, create a dedicated network for Interlock and the extensions: + +```bash +$> docker network create -d overlay interlock +``` + +### Creating the Interlock service +Now you can create the Interlock service. Note the requirement to constrain to a manager. The +Interlock core service must have access to a Swarm manager, however the extension and proxy services +are recommended to run on workers. See the [Production](production.md) section for more information +on setting up for an production environment. + +```bash +$> docker service create \ + --name interlock \ + --mount src=/var/run/docker.sock,dst=/var/run/docker.sock,type=bind \ + --network interlock \ + --constraint node.role==manager \ + --config src=service.interlock.conf,target=/config.toml \ + interlockpreview/interlock:2.0.0-preview -D run -c /config.toml +sjpgq7h621exno6svdnsvpv9z +``` + +At this point, there should be three (3) services created: one for the Interlock service, +one for the extension service, and one for the proxy service: + +```bash +$> docker service ls +ID NAME MODE REPLICAS IMAGE PORTS +lheajcskcbby modest_raman replicated 1/1 nginx:alpine *:80->80/tcp *:443->443/tcp +oxjvqc6gxf91 keen_clarke replicated 1/1 interlockpreview/interlock-extension-nginx:2.0.0-preview +sjpgq7h621ex interlock replicated 1/1 interlockpreview/interlock:2.0.0-preview +``` + +The Interlock traffic layer is now deployed. + +## Next steps + +- [Configuring Interlock](../config/index.md) +- [Deploying applications](../usage/index.md) +- [Production deployment information](./production.md) +- [Offline installation information](./offline.md) diff --git a/ee/ucp/interlock/deploy/offline-install.md b/ee/ucp/interlock/deploy/offline-install.md new file mode 100644 index 0000000000..65c7574309 --- /dev/null +++ b/ee/ucp/interlock/deploy/offline-install.md @@ -0,0 +1,38 @@ +--- +title: Offline installation considerations +description: Learn how to To install Interlock on a Docker cluster without internet access. +keywords: routing, proxy +--- + +# Offline installation +To install Interlock on a Docker cluster without internet access, the Docker images must be loaded. This topic describes how to export the images from a local Docker +engine and then loading them to the Docker Swarm cluster. + +First, using an existing Docker engine, save the images: + +```bash +$> docker save docker/interlock:latest > interlock.tar +$> docker save docker/interlock-extension-nginx:latest > interlock-extension-nginx.tar +$> docker save nginx:alpine > nginx.tar +``` + +Note: replace `docker/interlock-extension-nginx:latest` and `nginx:alpine` with the corresponding +extension and proxy image if you are not using Nginx. + +You should have the following two files: + +- `interlock.tar`: This is the core Interlock application. +- `interlock-extension-nginx.tar`: This is the Interlock extension for Nginx. +- `nginx:alpine`: This is the official Nginx image based on Alpine. + +Copy these files to each node in the Docker Swarm cluster and run the following commands to load each image: + +```bash +$> docker load < interlock.tar +$> docker load < interlock-extension-nginx.tar +$> docker load < nginx:alpine.tar +``` + +## Next steps +After running on each node, you can continue to the [Deployment](index.md) section to +continue the installation. diff --git a/ee/ucp/interlock/deploy/production.md b/ee/ucp/interlock/deploy/production.md index 228701b1ae..d2a1736aee 100644 --- a/ee/ucp/interlock/deploy/production.md +++ b/ee/ucp/interlock/deploy/production.md @@ -5,15 +5,31 @@ description: Learn how to configure the layer 7 routing solution for a productio keywords: routing, proxy --- -The layer 7 solution that ships out of the box with UCP is highly available +# Deploying to production +This section includes documentation on configuring Interlock +for a production environment. If you have not yet deployed Interlock, refer to [Deploying Interlock](index.md) because this information builds upon the basic deployment. This topic does not cover infrastructure deployment - +it assumes you have a vanilla Swarm cluster (`docker init` and `docker swarm join` from the nodes). +Refer to the [Swarm](https://docs.docker.com/engine/swarm/) documentation if you need help +getting a Swarm cluster deployed. + +The layer 7 solution that ships with UCP is highly available and fault tolerant. It is also designed to work independently of how many nodes you're managing with UCP. ![production deployment](../../images/interlock-deploy-production-1.svg) -For a production-grade deployment, you should tune the default deployment to +For a production-grade deployment, you need to perform the following actions: + +1. Pick two nodes that are going to be dedicated to run the proxy service. +2. Apply labels to those nodes, so that you can constrain the proxy service to +only run on nodes with those labels. +3. Update the `ucp-interlock` service to deploy proxies using that constraint. +4. Configure your load balancer to only route traffic to the dedicated nodes. + +## Select dedicated nodes +Tuning the default deployment to have two nodes dedicated for running the two replicas of the -`ucp-interlock-proxy` service. This ensures: +`ucp-interlock-proxy` service ensures: * The proxy services have dedicated resources to handle user requests. You can configure these nodes with higher performance network interfaces. @@ -22,45 +38,54 @@ deployment secure. * The proxy service is running on two nodes. If one node fails, layer 7 routing continues working. -To achieve this you need to: - -1. Enable layer 7 routing. [Learn how](index.md). -2. Pick two nodes that are going to be dedicated to run the proxy service. -3. Apply labels to those nodes, so that you can constrain the proxy service to -only run on nodes with those labels. -4. Update the `ucp-interlock` service to deploy proxies using that constraint. -5. Configure your load balancer to route traffic to the dedicated nodes only. - -## Apply labels to nodes - -In this example, we chose node-5 and node-6 to be dedicated just for running -the proxy service. To apply labels to those nodes run: +## Apply node labels +Configure the selected nodes as load balancer worker nodes ( for example, `lb-00` and `lb-01`) with node labels in order to pin the Interlock Proxy service. After you log in to one of the Swarm managers, run the following commands to add node labels +to the dedicated ingress workers: ```bash -docker node update --label-add nodetype=loadbalancer +$> docker node update --label-add nodetype=loadbalancer lb-00 +lb-00 +$> docker node update --label-add nodetype=loadbalancer lb-01 +lb-01 ``` -To make sure the label was successfully applied, run: +You can inspect each node to ensure the labels were successfully added: -{% raw %} ```bash -docker node inspect --format '{{ index .Spec.Labels "nodetype" }}' +$> docker node inspect -f '{{ .Spec.Labels }}' lb-00 +map[nodetype:loadbalancer] +$> docker node inspect -f '{{ .Spec.Labels }}' lb-01 +map[nodetype:loadbalancer] ``` -{% endraw %} The command should print "loadbalancer". -## Configure the ucp-interlock service - +## Update proxy service Now that your nodes are labelled, you need to update the `ucp-interlock-proxy` -service configuration to deploy the proxy service with the correct constraints. - -Add a constraint to the `ucp-interlock-proxy` service to update the running service: +service configuration to deploy the proxy service with the correct constraints (constrained to those +workers). From a manager, add a constraint to the `ucp-interlock-proxy` service to update the running service: ```bash -docker service update \ +$> docker service update --replicas=2 \ --constraint-add node.labels.nodetype==loadbalancer \ - ucp-interlock-proxy + --stop-signal SIGQUIT \ + --stop-grace-period=5s \ + $(docker service ls -f 'label=type=com.docker.interlock.core.proxy' -q) +``` + +This updates the proxy service to have two (2) replicas and ensure they are constrained to +the workers with the label `nodetype==loadbalancer` as well as configure the stop signal for the tasks +to be a `SIGQUIT` with a grace period of five (5) seconds. This will ensure that Nginx uses a graceful shutdown +before exiting to ensure the client request is finished. + +Inspect the service to ensure the replicas have started on the desired nodes: + +```bash +$> docker service ps $(docker service ls -f 'label=type=com.docker.interlock.core.proxy' -q) +ID NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS +o21esdruwu30 interlock-proxy.1 nginx:alpine lb-01 Running Preparing 3 seconds ago +n8yed2gp36o6 \_ interlock-proxy.1 nginx:alpine mgr-01 Shutdown Shutdown less than a second ago +aubpjc4cnw79 interlock-proxy.2 nginx:alpine lb-00 Running Preparing 3 seconds ago ``` Then add the constraint to the `ProxyConstraints` array in the `interlock-proxy` service @@ -72,18 +97,34 @@ configuration so it takes effect if Interlock is restored from backup: ProxyConstraints = ["node.labels.com.docker.ucp.orchestrator.swarm==true", "node.platform.os==linux", "node.labels.nodetype==loadbalancer"] ``` -[Learn how to configure ucp-interlock](configure.md). +[Learn how to configure ucp-interlock](../config/index.md). -Once reconfigured you can check if the proxy service is running on the dedicated nodes: +Once reconfigured, you can check if the proxy service is running on the dedicated nodes: ```bash docker service ps ucp-interlock-proxy ``` -## Configure your load balancer +## Configure load balancer +Update the settings in the upstream load balancer (ELB, F5, etc) with the +addresses of the dedicated ingress workers. This directs all traffic to these nodes. -Once the proxy service is running on dedicated nodes, configure your upstream -load balancer with the domain names or IP addresses of those nodes. +You have now configured Interlock for a dedicated ingress production environment. Refer to the [configuration information](../config/tuning.md) if you want to continue tuning. -This makes sure all traffic is directed to these nodes. +## Production deployment configuration example +The following example shows the configuration of an eight (8) node Swarm cluster. There are three (3) managers +and five (5) workers. Two of the workers are configured with node labels to be dedicated +ingress cluster load balancer nodes. These will receive all application traffic. +There is also an upstream load balancer (such as an Elastic Load Balancer or F5). The upstream +load balancers will be statically configured for the two load balancer worker nodes. +This configuration has several benefits. The management plane is both isolated and redundant. +No application traffic hits the managers and application ingress traffic can be routed +to the dedicated nodes. These nodes can be configured with higher performance network interfaces +to provide more bandwidth for the user services. + +![Interlock 2.0 Production Deployment](../../images/interlock_production_deploy.png) + +## Next steps +- [Configuring Interlock](../config/index.md) +- [Deploying applications](../usage.index.md) diff --git a/ee/ucp/interlock/upgrade.md b/ee/ucp/interlock/deploy/upgrade.md similarity index 90% rename from ee/ucp/interlock/upgrade.md rename to ee/ucp/interlock/deploy/upgrade.md index 426b8e499b..5e38c088fe 100644 --- a/ee/ucp/interlock/upgrade.md +++ b/ee/ucp/interlock/deploy/upgrade.md @@ -1,15 +1,18 @@ --- title: Layer 7 routing upgrade -description: Learn how to route layer 7 traffic to your swarm services +description: Learn how to upgrade your existing layer 7 routing solution keywords: routing, proxy, hrm +redirect_from: + - /ee/ucp/interlock/upgrade/ --- +# UCP upgrade process The [HTTP routing mesh](/datacenter/ucp/2.2/guides/admin/configure/use-domain-names-to-access-services.md) functionality was redesigned in UCP 3.0 for greater security and flexibility. The functionality was also renamed to "layer 7 routing", to make it easier for new users to get started. -[Learn about the new layer 7 routing functionality](index.md). +[Learn about the new layer 7 routing functionality](../index.md). To route traffic to your service you apply specific labels to your swarm services, describing the hostname for the service and other configurations. @@ -23,8 +26,6 @@ This article describes the upgrade process for the routing component, so that you can troubleshoot UCP and your services, in case something goes wrong with the upgrade. -# UCP upgrade process - If you are using the HTTP routing mesh, and start an upgrade to UCP 3.0: 1. UCP starts a reconciliation process to ensure all internal components are @@ -40,7 +41,7 @@ before the upgrade. If something goes wrong during the upgrade process, you need to troubleshoot the interlock services and your services, since the HRM service won't be running after the upgrade. -[Learn more about the interlock services and architecture](architecture.md). +[Learn more about the interlock services and architecture](../architecture.md). ## Check that routing works @@ -96,7 +97,7 @@ being used by other services. ## Workarounds and clean-up If you have any of the problems above, disable and enable the layer 7 routing -setting on the [UCP settings page](deploy/index.md). This redeploys the +setting on the [UCP settings page](index.md). This redeploys the services with their default configuration. When doing that make sure you specify the same ports you were using for HRM, @@ -108,7 +109,7 @@ stop it since it can conflict with the `ucp-interlock-proxy` service. ## Optionally remove labels As part of the upgrade process UCP adds the -[labels specific to the new layer 7 routing solution](usage/labels-reference.md). +[labels specific to the new layer 7 routing solution](../usage/labels-reference.md). You can update your services to remove the old HRM labels, since they won't be used anymore. @@ -121,7 +122,7 @@ the application traffic. If before upgrading you had all your applications attached to the `ucp-hrm` network, after upgrading you can update your services to start using a dedicated network for routing that's not shared with other services. -[Learn how to use a dedicated network](usage/index.md). +[Learn how to use a dedicated network](../usage/index.md). If before upgrading you had a dedicate network to route traffic to each service, Interlock will continue using those dedicated networks. However the diff --git a/ee/ucp/interlock/index.md b/ee/ucp/interlock/index.md index cd63d61bfe..d1ea689248 100644 --- a/ee/ucp/interlock/index.md +++ b/ee/ucp/interlock/index.md @@ -1,35 +1,88 @@ --- title: Layer 7 routing overview -description: Learn how to route layer 7 traffic to your swarm services +description: Learn how to route layer 7 traffic to your Swarm services keywords: routing, proxy --- +## Introduction +Interlock is the application routing and load balancing (ingress routing) system included with Docker Enterprise for Swarm orchestration. Interlock takes advantage of the underlying Swarm components to provide scalable Layer 7 routing and Layer 4 VIP mode functionality. + +Interlock is specific to the Swarm orchestrator. If you're trying to route +traffic to your Kubernetes applications, check +[layer 7 routing with Kubernetes.](../kubernetes/layer-7-routing.md) + +Interlock uses the Docker Remote API to automatically configure extensions such as NGINX or HAProxy for application traffic. Interlock is designed for: + +- Full integration with Docker (Swarm, Services, Secrets, Configs) +- Enhanced configuration (context roots, TLS, zero downtime deploy, rollback) +- Support for external load balancers (nginx, haproxy, F5, etc) via extensions +- Least privilege for extensions (no Docker API access) + Docker Engine running in swarm mode has a routing mesh, which makes it easy to expose your services to the outside world. Since all nodes participate -in the routing mesh, users can access your service by contacting any node. +in the routing mesh, users can access a service by contacting any node. ![swarm routing mess](../images/interlock-overview-1.svg) -In this example the WordPress service is listening on port 8000 of the routing +For example, a WordPress service is listening on port 8000 of the routing mesh. Even though the service is running on a single node, users can access WordPress using the domain name or IP of any of the nodes that are part of the swarm. UCP extends this one step further with layer 7 layer routing (also known as application layer 7), allowing users to access Docker services using domain names -instead of IP addresses. - -This functionality is made available through the Interlock component. +instead of IP addresses. This functionality is made available through the Interlock component. ![layer 7 routing](../images/interlock-overview-2.svg) -In this example, users can access the WordPress service using +Using Interlock in the previous example, users can access the WordPress service using `http://wordpress.example.org`. Interlock takes care of routing traffic to the right place. -Interlock is specific to the Swarm orchestrator. If you're trying to route -traffic to your Kubernetes applications, check -[layer 7 routing with Kubernetes.](../kubernetes/layer-7-routing.md) +## Terminology + +- Cluster: A group of compute resources running Docker +- Swarm: A Docker cluster running in Swarm mode +- Upstream: An upstream container that serves an application +- Proxy Service: A service that provides load balancing and proxying (such as Nginx) +- Extension Service: A helper service that configures the proxy service +- Service Cluster: A service cluster is an Interlock extension+proxy service +- gRPC: A high-performance RPC framework + +![Interlock Design](../images/interlock-design.png) + +## Interlock services +Interlock has +three primary services: + +* **Interlock**: This is the central piece of the layer 7 routing solution. +The core service is responsible for interacting with the Docker Remote API and building +an upstream configuration for the extensions. It uses the Docker API to monitor events, and manages the extension and +proxy services. This is served on a gRPC API that the +extensions are configured to access. +* **Interlock-extension**: This is a helper service that queries the Interlock gRPC API for the +upstream configuration. The extension service uses this to configure +the proxy service. For proxy services that use files such as Nginx or HAProxy, the +extension service generates the file and sends it to Interlock using the gRPC API. Interlock +then updates the corresponding Docker Config object for the proxy service. +* **Interlock-proxy**: This is a proxy/load-balancing service that handles requests for the upstream application services. These +are configured using the data created by the corresponding extension service. By default, this service is a containerized +NGINX deployment. + +Interlock manages both extension and proxy service updates for both configuration changes +and application service deployments. There is no intervention from the operator required. + +The following image shows the default Interlock configuration, once you enable layer 7 +routing in UCP: + +![](../images/interlock-architecture-1.svg) + +The Interlock service starts a single replica on a manager node. The +Interlock-extension service runs a single replica on any available node, and +the Interlock-proxy service starts two replicas on any available node. + +If you don't have any worker nodes in your cluster, then all Interlock +components run on manager nodes. ## Features and benefits @@ -37,16 +90,31 @@ Layer 7 routing in UCP supports: * **High availability**: All the components used for layer 7 routing leverage Docker swarm for high availability, and handle failures gracefully. -* **Automatic configuration**: UCP monitors your services and automatically -reconfigures the proxy services so that everything handled for you. -* **Scalability**: You can customize and tune the proxy services that handle -user-facing requests to meet whatever demand your services have. +* **Automatic configuration**: Interlock uses the Docker API for configuration. You do not have to manually +update or restart anything to make services available. UCP monitors your services and automatically +reconfigures proxy services. +* **Scalability**: Interlock uses a modular design with a separate proxy service. This allows an +operator to individually customize and scale the proxy layer to handle user requests and meet services demands, with transparency and no downtime for users. * **TLS**: You can leverage Docker secrets to securely manage TLS Certificates and keys for your services. Both TLS termination and TCP passthrough are supported. -* **Context-based routing**: You can define where to route the request based on -context or path. -* **Host mode networking**: By default layer 7 routing leverages the Docker Swarm -routing mesh, but you don't have to. You can use host mode networking for maximum -performance. +* **Context-based routing**: Interlock supports advanced application request routing by context or path. +* **Host mode networking**: By default, layer 7 routing leverages the Docker Swarm +routing mesh, but Interlock supports running proxy and application services in "host" mode networking, allowing +you to bypass the routing mesh completely. This is beneficial if you want +maximum performance for your applications. * **Security**: The layer 7 routing components that are exposed to the outside -world run on worker nodes. Even if they get compromised, your cluster won't. +world run on worker nodes. Even if they are compromised, your cluster aren't. +* **SSL**: Interlock leverages Docker Secrets to securely store and use SSL certificates for services. Both +SSL termination and TCP passthrough are supported. +* **Blue-Green and Canary Service Deployment**: Interlock supports blue-green service deployment allowing an operator to deploy a new application while the current version is serving. Once traffic is verified to the new application, the operator +can scale the older version to zero. If there is a problem, the operation is easily reversible. +* **Service Cluster Support**: Interlock supports multiple extension+proxy combinations allowing for operators to partition load +balancing resources for uses such as region or organization based load balancing. +* **Least Privilege**: Interlock supports (and recommends) being deployed where the load balancing +proxies do not need to be colocated with a Swarm manager. This makes the +deployment more secure by not exposing the Docker API access to the extension or proxy services. + +## Next steps + +- [Interlock architecture](architecture.md) +- [Deploy Interlock](deploy/index.md) diff --git a/ee/ucp/interlock/usage/canary.md b/ee/ucp/interlock/usage/canary.md index 138dc5816b..3462e6715a 100644 --- a/ee/ucp/interlock/usage/canary.md +++ b/ee/ucp/interlock/usage/canary.md @@ -4,16 +4,17 @@ description: Learn how to do canary deployments for your Docker swarm services keywords: routing, proxy --- -In this example we will publish a service and deploy an updated service as canary instances. +# Publishing a service as a canary instance +The following example publishes a service as a canary instance. -First we will create an overlay network so that service traffic is isolated and secure: +First, create an overlay network to isolate and secure service traffic: ```bash $> docker network create -d overlay demo 1se1glh749q1i4pw0kf26mfx5 ``` -Next we will create the initial service: +Next, create the initial service: ```bash $> docker service create \ @@ -27,8 +28,8 @@ $> docker service create \ ehazlett/docker-demo ``` -Interlock will detect once the service is available and publish it. Once the tasks are running -and the proxy service has been updated the application should be available via `http://demo.local`: +Interlock detects when the service is available and publishes it.After tasks are running +and the proxy service is updated, the application is available via `http://demo.local`: ```bash $> curl -vs -H "Host: demo.local" http://127.0.0.1/ping @@ -56,9 +57,10 @@ $> curl -vs -H "Host: demo.local" http://127.0.0.1/ping {"instance":"df20f55fc943","version":"0.1","metadata":"demo-version-1","request_id":"f884cf37e8331612b8e7630ad0ee4e0d"} ``` -Notice the `metadata` with `demo-version-1`. +Notice `metadata` is specified with `demo-version-1`. -Now we will deploy a "new" version: +# Deploying an updated service as a canary instance +The following example deploys an updated service as a canary instance: ```bash $> docker service create \ @@ -72,8 +74,8 @@ $> docker service create \ ehazlett/docker-demo ``` -Since this has a replica of one (1) and the initial version has four (4) replicas 20% of application traffic -will be sent to `demo-version-2`: +Since this has a replica of one (1), and the initial version has four (4) replicas, 20% of application traffic +is sent to `demo-version-2`: ```bash $> curl -vs -H "Host: demo.local" http://127.0.0.1/ping @@ -88,7 +90,7 @@ $> curl -vs -H "Host: demo.local" http://127.0.0.1/ping {"instance":"c2a686ae5694","version":"0.1","metadata":"demo-version-1","request_id":"724c21d0fb9d7e265821b3c95ed08b61"} ``` -To increase traffic to the new version add more replicas with `docker scale`: +To increase traffic to the new version, add more replicas with `docker scale`: ```bash $> docker service scale demo-v2=4 @@ -102,6 +104,5 @@ $> docker service scale demo-v1=0 demo-v1 ``` -This will route all application traffic to the new version. If you need to rollback, simply scale the v1 service +This routes all application traffic to the new version. If you need to rollback, simply scale the v1 service back up and v2 down. - diff --git a/ee/ucp/interlock/usage/context.md b/ee/ucp/interlock/usage/context.md index a8f4daa5ec..2c93a0e081 100644 --- a/ee/ucp/interlock/usage/context.md +++ b/ee/ucp/interlock/usage/context.md @@ -1,20 +1,21 @@ --- -title: Context/path based routing -description: Learn how to do route traffic to your Docker swarm services based - on a url path +title: Context and path-based routing +description: Learn how to route traffic to your Docker swarm services based + on a url path. keywords: routing, proxy --- -In this example we will publish a service using context or path based routing. +# Using context or path-based routing +The following example publishes a service using context or path based routing. -First we will create an overlay network so that service traffic is isolated and secure: +First, create an overlay network so that service traffic is isolated and secure: ```bash $> docker network create -d overlay demo 1se1glh749q1i4pw0kf26mfx5 ``` -Next we will create the initial service: +Next, create the initial service: ```bash $> docker service create \ @@ -31,13 +32,13 @@ $> docker service create \ > Only one path per host > -> Interlock supports only one path per host per service cluster. Once a -> particular `com.docker.lb.hosts` label has been applied, it cannot be applied +> Interlock only supports one path per host per service cluster. When a +> specific `com.docker.lb.hosts` label is applied, it cannot be applied > again in the same service cluster. {: .important} -Interlock will detect once the service is available and publish it. Once the tasks are running -and the proxy service has been updated the application should be available via `http://demo.local`: +Interlock detects when the service is available and publishes it. After tasks are running +and the proxy service is updated, the application is available via `http://demo.local`: ```bash $> curl -vs -H "Host: demo.local" http://127.0.0.1/app/ diff --git a/ee/ucp/interlock/usage/default-backend.md b/ee/ucp/interlock/usage/default-backend.md new file mode 100644 index 0000000000..dfe5129d1b --- /dev/null +++ b/ee/ucp/interlock/usage/default-backend.md @@ -0,0 +1,37 @@ +--- +title: Default host +description: Learn how to publish a service to be a default host. +keywords: routing, proxy +--- + +# Publishing a default host service + +The following example publishes a service to be a default host. The service responds +whenever there is a request to a host that is not configured. + +First, create an overlay network so that service traffic is isolated and secure: + +```bash +$> docker network create -d overlay demo +1se1glh749q1i4pw0kf26mfx5 +``` + +Next, create the initial service: + +```bash +$> docker service create \ + --name demo-default \ + --network demo \ + --detach=false \ + --replicas=1 \ + --label com.docker.lb.default_backend=true \ + --label com.docker.lb.port=8080 \ + ehazlett/interlock-default-app +``` + +Interlock detects when the service is available and publishes it. After tasks are running +and the proxy service is updated, the application is available via any url that is not +configured: + + +![Default Backend](../../images/interlock_default_backend.png) diff --git a/ee/ucp/interlock/usage/default-service.md b/ee/ucp/interlock/usage/default-service.md deleted file mode 100644 index b4d78ae9c5..0000000000 --- a/ee/ucp/interlock/usage/default-service.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Set a default service -description: Learn about Interlock, an application routing and load balancing system - for Docker Swarm. -keywords: ucp, interlock, load balancing ---- - -The default proxy service used by UCP to provide layer 7 routing is NGINX, -so when users try to access a route that hasn't been configured, they will -see the default NGINX 404 page. - -![Default NGINX page](../../images/interlock-default-service-1.png){: .with-border} - -You can customize this by labelling a service with -`com.docker.lb.default_backend=true`. When users try to access a route that's -not configured, they are redirected to this service. - -As an example, create a `docker-compose.yml` file with: - -```yaml -version: "3.2" - -services: - demo: - image: ehazlett/interlock-default-app - deploy: - replicas: 1 - labels: - com.docker.lb.default_backend: "true" - com.docker.lb.port: 80 - networks: - - demo-network - -networks: - demo-network: - driver: overlay -``` - -Set up your CLI client with a [UCP client bundle](../../user-access/cli.md), -and deploy the service: - -```bash -docker stack deploy --compose-file docker-compose.yml demo -``` - -Once users try to access a route that's not configured, they are directed -to this demo service. - -![Custom default page](../../images/interlock-default-service-2.png){: .with-border} - diff --git a/ee/ucp/interlock/usage/index.md b/ee/ucp/interlock/usage/index.md index a6080512b4..18c980613e 100644 --- a/ee/ucp/interlock/usage/index.md +++ b/ee/ucp/interlock/usage/index.md @@ -1,20 +1,78 @@ --- -title: Route traffic to a simple swarm service -description: Learn how to do canary deployments for your Docker swarm services +title: Route traffic to a swarm service +description: Learn how to deploy your Docker swarm services and applications keywords: routing, proxy +redirect_from: + - /ee/ucp/interlock/deploy/configuration-reference/ + - /ee/ucp/interlock/deploy/configure/ --- -Once the [layer 7 routing solution is enabled](../deploy/index.md), you can -start using it in your swarm services. +## Deploying services and applications +After Interlock is deployed, you can launch and publish services and applications. +Use [Service Labels](https://docs.docker.com/engine/reference/commandline/service_create/#set-metadata-on-a-service--l-label) +to configure services to publish themselves to the load balancer. -In this example we'll deploy a simple service which: +**Note**: The following examples assume a DNS entry (or local hosts entry if you are testing locally) exists +for each of the applications. + +## Publishing a service with four replicas +To publish, create a Docker Service using two labels: + +- `com.docker.lb.hosts` +- `com.docker.lb.port` + +The `com.docker.lb.hosts` label instructs Interlock where the service should be available. +The `com.docker.lb.port` label instructs what port the proxy service should use to access +the upstreams. + +This example publishes a demo service to the host `demo.local`. + +First, create an overlay network so that service traffic is isolated and secure: + +```bash +$> docker network create -d overlay demo +1se1glh749q1i4pw0kf26mfx5 +``` + +Next, deploy the application: + +```bash +$> docker service create \ + --name demo \ + --network demo \ + --label com.docker.lb.hosts=demo.local \ + --label com.docker.lb.port=8080 \ + ehazlett/docker-demo +6r0wiglf5f3bdpcy6zesh1pzx +``` + +Interlock detects when the service is available and publishes it. After tasks are running +and the proxy service is updated, the application is available via `http://demo.local`. + +```bash +$> curl -s -H "Host: demo.local" http://127.0.0.1/ping +{"instance":"c2f1afe673d4","version":"0.1",request_id":"7bcec438af14f8875ffc3deab9215bc5"} +``` + +To increase service capacity, use the Docker Service [Scale](https://docs.docker.com/engine/swarm/swarm-tutorial/scale-service/) command: + +```bash +$> docker service scale demo=4 +demo scaled to 4 +``` + +In this example, four service replicas are configured as upstreams. The load balancer balances traffic +across all service replicas. + +-------------------------------ARE BOTH EXAMPLES NEEDED?----------------------------------------------- + +## Publishing a service with a web interface +The next example deploys a simple service that: * Has a JSON endpoint that returns the ID of the task serving the request. * Has a web interface that shows how many tasks the service is running. * Can be reached at `http://app.example.org`. -## Deploy the service - Create a `docker-compose.yml` file with: ```yaml @@ -47,8 +105,6 @@ should attach to in order to be able to communicate with the demo service. To use layer 7 routing, your services need to be attached to at least one network. If your service is only attached to a single network, you don't need to add a label to specify which network to use for routing. When using a common stack file for multiple deployments leveraging UCP Interlock / Layer 7 Routing, prefix `com.docker.lb.network` with the stack name to ensure traffic will be directed to the correct overlay network. - - * The `com.docker.lb.port` label specifies which port the `ucp-interlock-proxy` service should use to communicate with this demo service. * Your service doesn't need to expose a port in the swarm routing mesh. All @@ -64,7 +120,7 @@ docker stack deploy --compose-file docker-compose.yml demo The `ucp-interlock` service detects that your service is using these labels and automatically reconfigures the `ucp-interlock-proxy` service. -## Test using the CLI +### Test using the CLI To test that requests are routed to the demo service, run: @@ -84,7 +140,7 @@ If everything is working correctly, you should get a JSON result like: {"instance":"63b855978452", "version":"0.1", "request_id":"d641430be9496937f2669ce6963b67d6"} ``` -## Test using a browser +### Test using a browser Since the demo service exposes an HTTP endpoint, you can also use your browser to validate that everything is working. @@ -95,3 +151,17 @@ able to start using the service from your browser. ![browser](../../images/route-simple-app-1.png){: .with-border } + +## Next steps + +- [Publishing a service as a canary instance](canary.md) +- [Using context or path-based routing](context.md) +- [Publishing a default host service](default-backend.md) +- [Specifying a routing mode](interlock-vip-mode) +- [Using routing labels](labels-reference.md) +- [Implementing redirects](redirects.md) +- [Implementing a service cluster](service-clusters.md) +- [Implementing persistent (sticky) sessions](sessions.md) +- [Implementing SSL](ssl.md) +- [Securing services with TLS](tls.md) +- [Configuring websockets](websockets.md) diff --git a/ee/ucp/interlock/usage/interlock-vip-mode.md b/ee/ucp/interlock/usage/interlock-vip-mode.md index 848e2f4d59..699b0ffa1d 100644 --- a/ee/ucp/interlock/usage/interlock-vip-mode.md +++ b/ee/ucp/interlock/usage/interlock-vip-mode.md @@ -1,16 +1,11 @@ --- -title: VIP Mode -description: Learn about the VIP backend mode for Layer 7 routing +title: Routing modes +description: Learn about task and VIP backend routing modes for Layer 7 routing keywords: routing, proxy --- -## VIP Mode - -VIP mode is an alternative mode of routing in which Interlock uses the Swarm service VIP as the backend IP instead of container IPs. -Traffic to the frontend route is L7 load balanced to the Swarm service VIP which L4 load balances to backend tasks. -VIP mode can be useful to reduce the amount of churn in Interlock proxy service configuration, which may be an advantage in highly dynamic environments. -It optimizes for fewer proxy updates in a tradeoff for a reduced feature set. -Most kinds of application updates do not require a configuring backends in VIP mode. +## Specifying a routing mode +You can publish services using "vip" and "task" backend routing modes. #### Task Routing Mode @@ -20,11 +15,17 @@ Traffic to the frontend route is L7 load balanced directly to service tasks. This allows for per-container routing functionality such as sticky sessions. Task routing mode applies L7 routing and then sends packets directly to a container. - ![task mode](../../images/interlock-task-mode.png) #### VIP Routing Mode +VIP mode is an alternative mode of routing in which Interlock uses the Swarm service VIP as the backend IP instead of container IPs. +Traffic to the frontend route is L7 load balanced to the Swarm service VIP, which L4 load balances to backend tasks. +VIP mode can be useful to reduce the amount of churn in Interlock proxy service configuration, which can be an advantage in highly dynamic environments. + +VIP mode optimizes for fewer proxy updates in a tradeoff for a reduced feature set. +Most application updates do not require configuring backends in VIP mode. + In VIP routing mode Interlock uses the service VIP (a persistent endpoint that exists from service creation to service deletion) as the proxy backend. VIP routing mode was introduced in Universal Control Plane (UCP) 3.0 version 3.0.3 and 3.1 version 3.1.2. VIP routing mode applies L7 routing and then sends packets to the Swarm L4 load balancer which routes traffic service containers. @@ -40,18 +41,17 @@ In task mode a canary service with one task next to an existing service with fou By contrast the same canary service in VIP mode will receive 50% of incoming requests, because it represents one out of two total services. #### Usage - You can set the backend mode on a per-service basis, which means that some applications can be deployed in task mode, while others are deployed in VIP mode. -The following label must be applied to services to use Interlock VIP mode: + +The default backend mode is `task`. If a label is set to `task` or a label does not exist, then Interlock uses the `task` routing mode. + +To use Interlock VIP mode, the following label must be applied: ``` com.docker.lb.backend_mode=vip ``` -The default backend mode is `task`. -If the label is set to `task` or the label does not exist then Interlock will use `task` routing mode. - -In VIP mode the following non-exhaustive list of application events will not require proxy reconfiguration: +In VIP mode, the following non-exhaustive list of application events does not require proxy reconfiguration: - Service replica increase/decrease - New image deployment @@ -59,9 +59,88 @@ In VIP mode the following non-exhaustive list of application events will not req - Add/Remove labels - Add/Remove environment variables - Rescheduling a failed application task -- ... -The following two updates still require a proxy reconfiguration (because these actions will create or destroy a service VIP): +The following two updates still require a proxy reconfiguration (because these actions create or destroy a service VIP): - Add/Remove a network on a service - Deployment/Deletion of a service + +The following example publishes a service using "vip" backend mode. + +1. Create an overlay network so that service traffic is isolated and secure: + +```bash +$> docker network create -d overlay demo +1se1glh749q1i4pw0kf26mfx5 +``` + +2. Create the initial service: + +```bash +$> docker service create \ + --name demo \ + --network demo \ + --detach=false \ + --replicas=4 \ + --label com.docker.lb.hosts=demo.local \ + --label com.docker.lb.port=8080 \ + --label com.docker.lb.backend_mode=vip \ + --env METADATA="demo-vip-1" \ + ehazlett/docker-demo +``` + +Interlock detects when the service is available and publishes it. After tasks are running +and the proxy service is updated, the application should be available via `http://demo.local`: + +```bash +$> curl -vs -H "Host: demo.local" http://127.0.0.1/ping +* Trying 127.0.0.1... +* TCP_NODELAY set +* Connected to demo.local (127.0.0.1) port 80 (#0) +> GET /ping HTTP/1.1 +> Host: demo.local +> User-Agent: curl/7.54.0 +> Accept: */* +> +< HTTP/1.1 200 OK +< Server: nginx/1.13.6 +< Date: Wed, 08 Nov 2017 20:28:26 GMT +< Content-Type: text/plain; charset=utf-8 +< Content-Length: 120 +< Connection: keep-alive +< Set-Cookie: session=1510172906715624280; Path=/; Expires=Thu, 09 Nov 2017 20:28:26 GMT; Max-Age=86400 +< x-request-id: f884cf37e8331612b8e7630ad0ee4e0d +< x-proxy-id: 5ad7c31f9f00 +< x-server-info: interlock/2.0.0-development (147ff2b1) linux/amd64 +< x-upstream-addr: 10.0.2.9:8080 +< x-upstream-response-time: 1510172906.714 +< +{"instance":"df20f55fc943","version":"0.1","metadata":"demo","request_id":"f884cf37e8331612b8e7630ad0ee4e0d"} +``` + +Instead of using each task IP for load balancing, configuring VIP mode causes Interlock to use +the Virtual IPs of the service instead. Inspecting the service shows the VIPs: + +``` +"Endpoint": { + "Spec": { + "Mode": "vip" + + }, + "VirtualIPs": [ + { + "NetworkID": "jed11c1x685a1r8acirk2ylol", + "Addr": "10.0.2.9/24" + } + ] +} + +``` + +In this case, Interlock configures a single upstream for the host using the IP "10.0.2.9". Interlock + skips further proxy updates as long as there is at least 1 replica for the service because the only upstream is the VIP. + +Swarm routes requests for the VIP in a round robin fashion at L4. This means that the following Interlock features are +incompatible with VIP mode: + +- Sticky sessions diff --git a/ee/ucp/interlock/usage/labels-reference.md b/ee/ucp/interlock/usage/labels-reference.md index 834ad6f13f..2efdbe130e 100644 --- a/ee/ucp/interlock/usage/labels-reference.md +++ b/ee/ucp/interlock/usage/labels-reference.md @@ -5,9 +5,7 @@ description: Learn about the labels you can use in your swarm services to route keywords: routing, proxy --- -Once the layer 7 routing solution is enabled, you can -[start using it in your swarm services](index.md). - +# Using routing labels The following labels are available for you to use in swarm services: diff --git a/ee/ucp/interlock/usage/redirects.md b/ee/ucp/interlock/usage/redirects.md index 0f060b7a3c..7fd9d6474b 100644 --- a/ee/ucp/interlock/usage/redirects.md +++ b/ee/ucp/interlock/usage/redirects.md @@ -5,12 +5,11 @@ description: Learn how to implement redirects using swarm services and the keywords: routing, proxy, redirects --- -Once the [layer 7 routing solution is enabled](../deploy/index.md), you can -start using it in your swarm services. In this example we'll deploy a simple -service that can be reached at `app.example.org`. We'll also redirect -requests to `old.example.org` to that service. +# Implementing redirects +The following example deploys a simple +service that can be reached at `app.example.org`. Requests to `old.example.org` are redirected to that service. -To do that, create a docker-compose.yml file with: +Create a docker-compose.yml file as shown in the following example: ```yaml version: "3.2" @@ -35,7 +34,7 @@ networks: Note that the demo service has labels to signal that traffic for both `app.example.org` and `old.example.org` should be routed to this service. -There's also a label indicating that all traffic directed to `old.example.org` +There is also a label indicating that all traffic directed to `old.example.org` should be redirected to `app.example.org`. Set up your CLI client with a [UCP client bundle](../../user-access/cli.md), @@ -45,13 +44,13 @@ and deploy the service: docker stack deploy --compose-file docker-compose.yml demo ``` -You can also use the CLI to test if the redirect is working, by running: +You can also use the CLI to test if the redirect is working, by running the following command: ```bash curl --head --header "Host: old.example.org" http://: ``` -You should see something like: +You should see something like the following output: ```none HTTP/1.1 302 Moved Temporarily @@ -63,7 +62,68 @@ Connection: keep-alive Location: http://app.example.org/ ``` -You can also test that the redirect works from your browser. For that, you -need to make sure you add entries for both `app.example.org` and -`old.example.org` to your `/etc/hosts` file, mapping them to the IP address +You can also test that the redirect works from your browser. For that, make sure you add entries for both `app.example.org` and +`old.example.org` to your `/etc/hosts` file and map them to the IP address of a UCP node. + + + +------------------------SHOULD THE FOLLOWING BE INCLUDED AS WELL? ------------------------------------------ + +The following example publishes a service and configures a redirect from `old.local` to `new.local`. + +First, create an overlay network so that service traffic is isolated and secure: + +```bash +$> docker network create -d overlay demo +1se1glh749q1i4pw0kf26mfx5 +``` + +Next, create the service with the redirect: + +```bash +$> docker service create \ + --name demo \ + --network demo \ + --detach=false \ + --label com.docker.lb.hosts=old.local,new.local \ + --label com.docker.lb.port=8080 \ + --label com.docker.lb.redirects=http://old.local,http://new.local \ + --env METADATA="demo-new" \ + ehazlett/docker-demo +``` + +Interlock detects when the service is available and publishes it. After tasks are running +and the proxy service is updated, the application is available via `http://new.local` +with a redirect configured that sends `http://old.local` to `http://new.local`: + +```bash +$> curl -vs -H "Host: old.local" http://127.0.0.1 +* Rebuilt URL to: http://127.0.0.1/ +* Trying 127.0.0.1... +* TCP_NODELAY set +* Connected to 127.0.0.1 (127.0.0.1) port 80 (#0) +> GET / HTTP/1.1 +> Host: old.local +> User-Agent: curl/7.54.0 +> Accept: */* +> +< HTTP/1.1 302 Moved Temporarily +< Server: nginx/1.13.6 +< Date: Wed, 08 Nov 2017 19:06:27 GMT +< Content-Type: text/html +< Content-Length: 161 +< Connection: keep-alive +< Location: http://new.local/ +< x-request-id: c4128318413b589cafb6d9ff8b2aef17 +< x-proxy-id: 48854cd435a4 +< x-server-info: interlock/2.0.0-development (147ff2b1) linux/amd64 +< + +302 Found + +

302 Found

+
nginx/1.13.6
+ + +``` diff --git a/ee/ucp/interlock/usage/service-clusters.md b/ee/ucp/interlock/usage/service-clusters.md index 6f8010e557..18ea84e097 100644 --- a/ee/ucp/interlock/usage/service-clusters.md +++ b/ee/ucp/interlock/usage/service-clusters.md @@ -1,24 +1,26 @@ --- title: Service clusters -description: Learn about Interlock, an application routing and load balancing system - for Docker Swarm. +description: Learn how to route traffic to different proxies using a service cluster. keywords: ucp, interlock, load balancing --- -In this example we will configure an eight (8) node Swarm cluster that uses service clusters -to route traffic to different proxies. There are three (3) managers -and five (5) workers. Four of the workers are configured with node labels to be dedicated -ingress cluster load balancer nodes. These will receive all application traffic. +# Implementing a service cluster +The following example configures an eight (8) node Swarm cluster that uses service clusters +to route traffic to different proxies. This example includes: -This example will not cover the actual deployment of infrastructure. +- three (3) managers and five (5) workers +- Four workers that are configured with node labels to be dedicated +ingress cluster load balancer nodes. These nodes receive all application traffic. + +This example does not cover infrastructure deployment. It assumes you have a vanilla Swarm cluster (`docker init` and `docker swarm join` from the nodes). See the [Swarm](https://docs.docker.com/engine/swarm/) documentation if you need help getting a Swarm cluster deployed. -![Interlock Service Clusters](interlock_service_clusters.png) +![Interlock Service Clusters](../../images/interlock_service_clusters.png) -We will configure four load balancer worker nodes (`lb-00` through `lb-03`) with node labels in order to pin the Interlock Proxy -service for each Interlock service cluster. Once you are logged into one of the Swarm managers run the following to add node labels to the dedicated ingress workers: +Configure four load balancer worker nodes (`lb-00` through `lb-03`) with node labels in order to pin the Interlock Proxy +service for each Interlock service cluster. After you log in to one of the Swarm managers, run the following commands to add node labels to the dedicated ingress workers: ```bash $> docker node update --label-add nodetype=loadbalancer --label-add region=us-east lb-00 @@ -31,7 +33,7 @@ $> docker node update --label-add nodetype=loadbalancer --label-add region=us-we lb-03 ``` -You can inspect each node to ensure the labels were successfully added: +Inspect each node to ensure the labels were successfully added: ```bash {% raw %} @@ -42,9 +44,9 @@ map[nodetype:loadbalancer region:us-west] {% endraw %} ``` -Next, we will create a configuration object for Interlock that contains multiple extensions with varying service clusters. +Next, create an Interlock configuration object that contains multiple extensions with varying service clusters. -Important: The configuration object specified in the following code sample applies to UCP versions 3.0.10 and later, and versions 3.1.4 and later. +< Important: The configuration object specified in the following code sample applies to UCP versions 3.0.10 and later, and versions 3.1.4 and later. If you are working with UCP version 3.0.0 - 3.0.9 or 3.1.0 - 3.1.3, specify `com.docker.ucp.interlock.service-clusters.conf`. @@ -109,19 +111,21 @@ PollInterval = "3s" EOF oqkvv1asncf6p2axhx41vylgt ``` -Note that we are using "host" mode networking in order to use the same ports (`8080` and `8443`) in the cluster. We cannot use ingress -networking as it reserves the port across all nodes. If you want to use ingress networking you will have to use different ports +Note that "host" mode networking is used in order to use the same ports (`8080` and `8443`) in the cluster. You cannot use ingress +networking as it reserves the port across all nodes. If you want to use ingress networking, you must use different ports for each service cluster. -Next we will create a dedicated network for Interlock and the extensions: +Next, create a dedicated network for Interlock and the extensions: ```bash $> docker network create -d overlay ucp-interlock ``` -Now we can create the Interlock service. +Now [enable the Interlock service](../deploy/index.md#enable-layer-7-routing). -Important: The `--name` value and configuration object specified in the following code sample applies to UCP versions 3.0.10 and later, and versions 3.1.4 and later. +-------REMOVE THE FOLLOWING PER --------- https://github.com/docker/docker.github.io/issues/8415----- + +< Important: The `--name` value and configuration object specified in the following code sample applies to UCP versions 3.0.10 and later, and versions 3.1.4 and later. If you are working with UCP version 3.0.0 - 3.0.9 or 3.1.0 - 3.1.3, specify `--name ucp-interlock-service-clusters` and `src=com.docker.ucp.interlock.service-clusters.conf-1` . @@ -135,10 +139,11 @@ $> docker service create \ {{ page.ucp_org }}/ucp-interlock:{{ page.ucp_version }} run -c /config.toml sjpgq7h621exno6svdnsvpv9z ``` +-----------------------------------------------------------END OF DELETE------------------------------ ## Configure Proxy Services -Once we have the node labels we can re-configure the Interlock Proxy services to be constrained to the -workers for each region. Again, from a manager run the following to pin the proxy services to the ingress workers: +With the node labels, you can re-configure the Interlock Proxy services to be constrained to the +workers for each region. From a manager, run the following commands to pin the proxy services to the ingress workers: ```bash $> docker service update \ @@ -151,14 +156,14 @@ $> docker service update \ ucp-interlock-proxy-us-west ``` -We are now ready to deploy applications. First we will create individual networks for each application: +You are now ready to deploy applications. First, create individual networks for each application: ```bash $> docker network create -d overlay demo-east $> docker network create -d overlay demo-west ``` -Next we will deploy the application in the `us-east` service cluster: +Next, deploy the application in the `us-east` service cluster: ```bash $> docker service create \ @@ -172,7 +177,7 @@ $> docker service create \ ehazlett/docker-demo ``` -Now we deploy the application in the `us-west` service cluster: +Now deploy the application in the `us-west` service cluster: ```bash $> docker service create \ @@ -186,11 +191,11 @@ $> docker service create \ ehazlett/docker-demo ``` -Only the service cluster that is designated will be configured for the applications. For example, the `us-east` service cluster -will not be configured to serve traffic for the `us-west` service cluster and vice versa. We can see this in action when we +Only the designated service cluster is configured for the applications. For example, the `us-east` service cluster +is not configured to serve traffic for the `us-west` service cluster and vice versa. You can observe this when you send requests to each service cluster. -When we send a request to the `us-east` service cluster it only knows about the `us-east` application. This example uses IP address lookup from the swarm API, so ssh to a manager node or configure your shell with a UCP client bundle before testing: +When you send a request to the `us-east` service cluster, it only knows about the `us-east` application. This example uses IP address lookup from the swarm API, so you must `ssh` to a manager node or configure your shell with a UCP client bundle before testing: ```bash {% raw %} @@ -207,7 +212,4 @@ $> curl -H "Host: demo-west.local" http://$(docker node inspect -f '{{ .Status.A {% endraw %} ``` -Application traffic is isolated to each service cluster. Interlock also ensures that a proxy will only be updated if it has corresponding updates -to its designated service cluster. So in this example, updates to the `us-east` cluster will not affect the `us-west` cluster. If there is a problem -the others will not be affected. - +Application traffic is isolated to each service cluster. Interlock also ensures that a proxy is updated only if it has corresponding updates to its designated service cluster. In this example, updates to the `us-east` cluster do not affect the `us-west` cluster. If there is a problem, the others are not affected. diff --git a/ee/ucp/interlock/usage/sessions.md b/ee/ucp/interlock/usage/sessions.md index 46f43b65a6..96e6f6a8f5 100644 --- a/ee/ucp/interlock/usage/sessions.md +++ b/ee/ucp/interlock/usage/sessions.md @@ -5,19 +5,23 @@ description: Learn how to configure your swarm services with persistent sessions keywords: routing, proxy --- -In this example we will publish a service and configure the proxy for persistent (sticky) sessions. +# Implementing persistent (sticky) sessions +You can publish a service and configure the proxy for persistent (sticky) sessions using: -# Cookies -In the following example we will show how to configure sticky sessions using cookies. +- Cookies +- IP Hashing -First we will create an overlay network so that service traffic is isolated and secure: +## Cookies +To configure sticky sessions using cookies: + +1. Create an overlay network so that service traffic is isolated and secure, as shown in the following example: ```bash $> docker network create -d overlay demo 1se1glh749q1i4pw0kf26mfx5 ``` -Next we will create the service with the cookie to use for sticky sessions: +2. Create a service with the cookie to use for sticky sessions: ```bash $> docker service create \ @@ -32,9 +36,9 @@ $> docker service create \ ehazlett/docker-demo ``` -Interlock will detect once the service is available and publish it. Once the tasks are running -and the proxy service has been updated the application should be available via `http://demo.local` -and configured to use sticky sessions: +Interlock detects when the service is available and publishes it. When tasks are running +and the proxy service is updated, the application is available via `http://demo.local` +and is configured to use sticky sessions: ```bash $> curl -vs -c cookie.txt -b cookie.txt -H "Host: demo.local" http://127.0.0.1/ping @@ -64,21 +68,21 @@ $> curl -vs -c cookie.txt -b cookie.txt -H "Host: demo.local" http://127.0.0.1/p {"instance":"9c67a943ffce","version":"0.1","metadata":"demo-sticky","request_id":"3014728b429320f786728401a83246b8"} ``` -Notice the `Set-Cookie` from the application. This is stored by the `curl` command and sent with subsequent requests -which are pinned to the same instance. If you make a few requests you will notice the same `x-upstream-addr`. +Notice the `Set-Cookie` from the application. This is stored by the `curl` command and is sent with subsequent requests, +which are pinned to the same instance. If you make a few requests, you will notice the same `x-upstream-addr`. -# IP Hashing -In this example we show how to configure sticky sessions using client IP hashing. This is not as flexible or consistent -as cookies but enables workarounds for some applications that cannot use the other method. When using IP hashing you should reconfigure Interlock proxy to use [host mode networking](../deploy/host-mode-networking.md) because the default `ingress` networking mode uses SNAT which obscures client IP addresses. +## IP Hashing +The following example shows how to configure sticky sessions using client IP hashing. This is not as flexible or consistent +as cookies but enables workarounds for some applications that cannot use the other method. When using IP hashing, reconfigure Interlock proxy to use [host mode networking](../config/host-mode-networking.md), because the default `ingress` networking mode uses SNAT, which obscures client IP addresses. -First we will create an overlay network so that service traffic is isolated and secure: +1. Create an overlay network so that service traffic is isolated and secure: ```bash $> docker network create -d overlay demo 1se1glh749q1i4pw0kf26mfx5 ``` -Next we will create the service with the cookie to use for sticky sessions using IP hashing: +2. Create a service with the cookie to use for sticky sessions using IP hashing: ```bash $> docker service create \ @@ -93,9 +97,9 @@ $> docker service create \ ehazlett/docker-demo ``` -Interlock will detect once the service is available and publish it. Once the tasks are running -and the proxy service has been updated the application should be available via `http://demo.local` -and configured to use sticky sessions: +Interlock detects when the service is available and publishes it. When tasks are running +and the proxy service is updated, the application is available via `http://demo.local` +and is configured to use sticky sessions: ```bash $> curl -vs -H "Host: demo.local" http://127.0.0.1/ping @@ -122,10 +126,10 @@ $> curl -vs -H "Host: demo.local" http://127.0.0.1/ping {"instance":"9c67a943ffce","version":"0.1","metadata":"demo-sticky","request_id":"3014728b429320f786728401a83246b8"} ``` -You can use `docker service scale demo=10` to add some more replicas. Once scaled, you will notice that requests are pinned +You can use `docker service scale demo=10` to add more replicas. When scaled, requests are pinned to a specific backend. > **Note**: due to the way the IP hashing works for extensions, you will notice a new upstream address when scaling replicas. This is -> expected as internally the proxy uses the new set of replicas to decide on a backend on which to pin. Once the upstreams are -> determined a new "sticky" backend will be chosen and that will be the dedicated upstream. +> expected, because internally the proxy uses the new set of replicas to determine a backend on which to pin. When the upstreams are +> determined, a new "sticky" backend is chosen as the dedicated upstream. diff --git a/ee/ucp/interlock/usage/ssl.md b/ee/ucp/interlock/usage/ssl.md new file mode 100644 index 0000000000..f7d81413ea --- /dev/null +++ b/ee/ucp/interlock/usage/ssl.md @@ -0,0 +1,225 @@ +--- +title: Applications with SSL +description: Learn how to configure your swarm services with SSL. +keywords: routing, proxy, tls +redirect_from: + - /ee/ucp/interlock/usage/ssl/ +--- + +# Implementing SSL +This topic covers implementing Swarm services with SLL: + +- SSL termination +- SSL passthrough + +## SSL termination +In the following example, Docker [Secrets](https://docs.docker.com/engine/swarm/secrets/) +are used to centrally and securely store SSL certificates in order to terminate SSL at the proxy service. +Application traffic is encrypted in transport to the proxy service, which terminates SSL and then +uses unencrypted traffic inside the secure datacenter. + +![Interlock SSL Termination](../../images/interlock_ssl_termination.png) + +First, certificates are generated: + +```bash +$> openssl req \ + -new \ + -newkey rsa:4096 \ + -days 3650 \ + -nodes \ + -x509 \ + -subj "/C=US/ST=SomeState/L=SomeCity/O=Interlock/CN=demo.local" \ + -keyout demo.local.key \ + -out demo.local.cert +``` + +Two files are created: `demo.local.cert` and `demo.local.key`. Next, we + use these to create Docker Secrets. + +```bash +$> docker secret create demo.local.cert demo.local.cert +ywn8ykni6cmnq4iz64um1pj7s +$> docker secret create demo.local.key demo.local.key +e2xo036ukhfapip05c0sizf5w +``` + +Next, we create an overlay network so that service traffic is isolated and secure: + +```bash +$> docker network create -d overlay demo +1se1glh749q1i4pw0kf26mfx5 +``` + +```bash +$> docker service create \ + --name demo \ + --network demo \ + --label com.docker.lb.hosts=demo.local \ + --label com.docker.lb.port=8080 \ + --label com.docker.lb.ssl_cert=demo.local.cert \ + --label com.docker.lb.ssl_key=demo.local.key \ + ehazlett/docker-demo +6r0wiglf5f3bdpcy6zesh1pzx +``` + +Interlock detects when the service is available and publishes it. After tasks are running +and the proxy service is updated, the application should be available via `https://demo.local`. + +Note: You must have an entry for `demo.local` in your local hosts (i.e. `/etc/hosts`) file. +You cannot use a host header as shown in other examples due to the way [SNI](https://tools.ietf.org/html/rfc3546#page-8) works. + +```bash +$> curl -vsk https://demo.local/ping +* Trying 127.0.0.1... +* TCP_NODELAY set +* Connected to demo.local (127.0.0.1) port 443 (#0) +* ALPN, offering http/1.1 +* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH +* successfully set certificate verify locations: +* CAfile: /etc/ssl/certs/ca-certificates.crt + CApath: none +* TLSv1.2 (OUT), TLS handshake, Client hello (1): +* TLSv1.2 (IN), TLS handshake, Server hello (2): +* TLSv1.2 (IN), TLS handshake, Certificate (11): +* TLSv1.2 (IN), TLS handshake, Server key exchange (12): +* TLSv1.2 (IN), TLS handshake, Server finished (14): +* TLSv1.2 (OUT), TLS handshake, Client key exchange (16): +* TLSv1.2 (OUT), TLS change cipher, Client hello (1): +* TLSv1.2 (OUT), TLS handshake, Finished (20): +* TLSv1.2 (IN), TLS change cipher, Client hello (1): +* TLSv1.2 (IN), TLS handshake, Finished (20): +* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 +* ALPN, server accepted to use http/1.1 +* Server certificate: +* subject: C=US; ST=SomeState; L=SomeCity; O=Interlock; CN=demo.local +* start date: Nov 8 16:23:03 2017 GMT +* expire date: Nov 6 16:23:03 2027 GMT +* issuer: C=US; ST=SomeState; L=SomeCity; O=Interlock; CN=demo.local +* SSL certificate verify result: self signed certificate (18), continuing anyway. +> GET /ping HTTP/1.1 +> Host: demo.local +> User-Agent: curl/7.54.0 +> Accept: */* +> +< HTTP/1.1 200 OK +< Server: nginx/1.13.6 +< Date: Wed, 08 Nov 2017 16:26:55 GMT +< Content-Type: text/plain; charset=utf-8 +< Content-Length: 92 +< Connection: keep-alive +< Set-Cookie: session=1510158415298009207; Path=/; Expires=Thu, 09 Nov 2017 16:26:55 GMT; Max-Age=86400 +< x-request-id: 4b15ab2aaf2e0bbdea31f5e4c6b79ebd +< x-proxy-id: a783b7e646af +< x-server-info: interlock/2.0.0-development (147ff2b1) linux/amd64 +< x-upstream-addr: 10.0.2.3:8080 + +{"instance":"c2f1afe673d4","version":"0.1",request_id":"7bcec438af14f8875ffc3deab9215bc5"} +``` + +Because the certificate and key are stored securely in Swarm, you can safely scale this service, as well as the proxy +service, and Swarm handles granting access to the credentials as needed. + +## SSL passthrough +In the following example, SSL passthrough is used to ensure encrypted communication from the request to the application +service. This ensures maximum security because there is no unencrypted transport. + +![Interlock SSL Passthrough](../../images/interlock_ssl_passthrough.png) + +First, generate certificates for the application: + +```bash +$> openssl req \ + -new \ + -newkey rsa:4096 \ + -days 3650 \ + -nodes \ + -x509 \ + -subj "/C=US/ST=SomeState/L=SomeCity/O=Interlock/CN=demo.local" \ + -keyout app.key \ + -out app.cert +``` + +Two files are created: `app.cert` and `app.key`. Next, we + use these to create Docker Secrets. + +```bash +$> docker secret create app.cert app.cert +ywn8ykni6cmnq4iz64um1pj7s +$> docker secret create app.key app.key +e2xo036ukhfapip05c0sizf5w +``` + +Now create an overlay network to isolate and secure service traffic: + +```bash +$> docker network create -d overlay demo +1se1glh749q1i4pw0kf26mfx5 +``` + +```bash +$> docker service create \ + --name demo \ + --network demo \ + --detach=false \ + --secret source=app.cert,target=/run/secrets/cert.pem \ + --secret source=app.key,target=/run/secrets/key.pem \ + --label com.docker.lb.hosts=demo.local \ + --label com.docker.lb.port=8080 \ + --label com.docker.lb.ssl_passthrough=true \ + --env METADATA="demo-ssl-passthrough" \ + ehazlett/docker-demo --tls-cert=/run/secrets/cert.pem --tls-key=/run/secrets/key.pem +``` + +Interlock detects when the service is available and publishes it. When tasks are running +and the proxy service is updated, the application is available via `https://demo.local`. + +Note: You must have an entry for `demo.local` in your local hosts (i.e. `/etc/hosts`) file. +You cannot use a host header as in other examples due to the way [SNI](https://tools.ietf.org/html/rfc3546#page-8) works. + +```bash +$> curl -vsk https://demo.local/ping +* Trying 127.0.0.1... +* TCP_NODELAY set +* Connected to demo.local (127.0.0.1) port 443 (#0) +* ALPN, offering http/1.1 +* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH +* successfully set certificate verify locations: +* CAfile: /etc/ssl/certs/ca-certificates.crt + CApath: none +* TLSv1.2 (OUT), TLS handshake, Client hello (1): +* TLSv1.2 (IN), TLS handshake, Server hello (2): +* TLSv1.2 (IN), TLS handshake, Certificate (11): +* TLSv1.2 (IN), TLS handshake, Server key exchange (12): +* TLSv1.2 (IN), TLS handshake, Server finished (14): +* TLSv1.2 (OUT), TLS handshake, Client key exchange (16): +* TLSv1.2 (OUT), TLS change cipher, Client hello (1): +* TLSv1.2 (OUT), TLS handshake, Finished (20): +* TLSv1.2 (IN), TLS change cipher, Client hello (1): +* TLSv1.2 (IN), TLS handshake, Finished (20): +* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256 +* ALPN, server accepted to use http/1.1 +* Server certificate: +* subject: C=US; ST=SomeState; L=SomeCity; O=Interlock; CN=demo.local +* start date: Nov 8 16:39:45 2017 GMT +* expire date: Nov 6 16:39:45 2027 GMT +* issuer: C=US; ST=SomeState; L=SomeCity; O=Interlock; CN=demo.local +* SSL certificate verify result: self signed certificate (18), continuing anyway. +> GET /ping HTTP/1.1 +> Host: demo.local +> User-Agent: curl/7.54.0 +> Accept: */* +> +< HTTP/1.1 200 OK +< Connection: close +< Set-Cookie: session=1510159255159600720; Path=/; Expires=Thu, 09 Nov 2017 16:40:55 GMT; Max-Age=86400 +< Date: Wed, 08 Nov 2017 16:40:55 GMT +< Content-Length: 78 +< Content-Type: text/plain; charset=utf-8 +< +{"instance":"327d5a26bc30","version":"0.1","metadata":"demo-ssl-passthrough"} +``` + +Application traffic travels securely, fully encrypted from the request to the application service. +Notice that Interlock cannot add the metadata response headers (version info, request ID, etc), because this is using +TCP passthrough and cannot add the metadata. diff --git a/ee/ucp/interlock/usage/tls.md b/ee/ucp/interlock/usage/tls.md index aedd6ecabf..ed2c3f6b81 100644 --- a/ee/ucp/interlock/usage/tls.md +++ b/ee/ucp/interlock/usage/tls.md @@ -1,14 +1,12 @@ --- -title: Applications with SSL +title: Securing services with TLS description: Learn how to configure your swarm services with TLS using the layer 7 routing solution for UCP. keywords: routing, proxy, tls -redirect_from: - - /ee/ucp/interlock/usage/ssl/ --- -Once the [layer 7 routing solution is enabled](../deploy/index.md), you can -start using it in your swarm services. You have two options for securing your +# Securing services with TLS +After [deploying a layer 7 routing solution](../deploy/index.md), you have two options for securing your services with TLS: * Let the proxy terminate the TLS connection. All traffic between end-users and @@ -17,10 +15,7 @@ service is not secured. * Let your swarm service terminate the TLS connection. The end-to-end traffic is encrypted and the proxy service allows TLS traffic to passthrough unchanged. -In this example we'll deploy a service that can be reached at `app.example.org` -using these two options. - -No matter how you choose to secure your swarm services, there are two steps to +Regardless of the option selected to secure swarm services, there are two steps required to route traffic with TLS: 1. Create [Docker secrets](/engine/swarm/secrets.md) to manage from a central @@ -29,11 +24,10 @@ place the private key and certificate used for TLS. ## Let the proxy handle TLS - -In this example we'll deploy a swarm service and let the proxy service handle +The following example deploys a swarm service and lets the proxy service handle the TLS connection. All traffic between the proxy and the swarm service is -not secured, so you should only use this option if you trust that no one can -monitor traffic inside services running on your datacenter. +not secured, so use this option only if you trust that no one can +monitor traffic inside services running in your datacenter. ![TLS Termination](../../images/interlock-tls-1.png) @@ -86,15 +80,15 @@ secrets: file: ./app.example.org.key ``` -Notice that the demo service has labels describing that the proxy service should -route traffic to `app.example.org` to this service. All traffic between the +Notice that the demo service has labels specifying that the proxy service should +route `app.example.org` traffic to this service. All traffic between the service and proxy takes place using the `demo-network` network. The service also -has labels describing the Docker secrets to use on the proxy service to terminate +has labels specifying the Docker secrets to use on the proxy service for terminating the TLS connection. -Since the private key and certificate are stored as Docker secrets, you can +Because the private key and certificate are stored as Docker secrets, you can easily scale the number of replicas used for running the proxy service. Docker -takes care of distributing the secrets to the replicas. +distributes the secrets to the replicas. Set up your CLI client with a [UCP client bundle](../../user-access/cli.md), and deploy the service: @@ -103,25 +97,24 @@ and deploy the service: docker stack deploy --compose-file docker-compose.yml demo ``` -The service is now running. To test that everything is working correctly you -first need to update your `/etc/hosts` file to map `app.example.org` to the +The service is now running. To test that everything is working correctly, update your `/etc/hosts` file to map `app.example.org` to the IP address of a UCP node. -In a production deployment, you'll have to create a DNS entry so that your +In a production deployment, you must create a DNS entry so that users can access the service using the domain name of your choice. -After doing that, you'll be able to access your service at: +After creating the DNS entry, you can access your service: ```bash https://: ``` -Where: -* `hostname` is the name you used with the `com.docker.lb.hosts` label. -* `https-port` is the port you've configured in the [UCP settings](../deploy/index.md). +FOr this example: +* `hostname` is the name you specified with the `com.docker.lb.hosts` label. +* `https-port` is the port you configured in the [UCP settings](../deploy/index.md). ![Browser screenshot](../../images/interlock-tls-2.png){: .with-border} -Since we're using self-sign certificates in this example, client tools like +Because this example uses self-sign certificates, client tools like browsers display a warning that the connection is insecure. You can also test from the CLI: @@ -132,23 +125,22 @@ curl --insecure \ https://:/ping ``` -If everything is properly configured you should get a JSON payload: +If everything is properly configured, you should get a JSON payload: ```json {"instance":"f537436efb04","version":"0.1","request_id":"5a6a0488b20a73801aa89940b6f8c5d2"} ``` -Since the proxy uses SNI to decide where to route traffic, make sure you're +Because the proxy uses SNI to decide where to route traffic, make sure you are using a version of `curl` that includes the SNI header with insecure requests. -If this doesn't happen, `curl` displays an error saying that the SSL handshake -was aborterd. +Otherwise, `curl` displays an error saying that the SSL handshake +was aborted. > **Note**: Currently there is no way to update expired certificates using this method. > The proper way is to create a new secret then update the corresponding service. ## Let your service handle TLS - -You can also encrypt the traffic from end-users to your swarm service. +The second option for securing with TLS involves encrypting traffic from end users to your swarm service. ![End-to-end encryption](../../images/interlock-tls-3.png) @@ -189,11 +181,12 @@ secrets: file: ./app.example.org.key ``` -Notice that we've update the service to start using the secrets with the +The service is updated to start using the secrets with the private key and certificate. The service is also labeled with `com.docker.lb.ssl_passthrough: true`, signaling UCP to configure the proxy service such that TLS traffic for `app.example.org` is passed to the service. -Since the connection is fully encrypt from end-to-end, the proxy service -won't be able to add metadata such as version info or request ID to the +Since the connection is fully encrypted from end-to-end, the proxy service +cannot add metadata such as version information or request ID to the response headers. + diff --git a/ee/ucp/interlock/usage/websockets.md b/ee/ucp/interlock/usage/websockets.md index 5aa8a8c18a..7bc839654c 100644 --- a/ee/ucp/interlock/usage/websockets.md +++ b/ee/ucp/interlock/usage/websockets.md @@ -1,20 +1,20 @@ --- title: Websockets -description: Learn how to use websocket in your swarm services when using the +description: Learn how to use websockets in your swarm services when using the layer 7 routing solution for UCP. keywords: routing, proxy --- -In this example we will publish a service and configure support for websockets. +# Using websockets -First we will create an overlay network so that service traffic is isolated and secure: +First, create an overlay network to isolate and secure service traffic: ```bash $> docker network create -d overlay demo 1se1glh749q1i4pw0kf26mfx5 ``` -Next we will create the service with websocket endpoints: +Next, create the service with websocket endpoints: ```bash $> docker service create \ @@ -27,10 +27,10 @@ $> docker service create \ ehazlett/websocket-chat ``` -> **Note**: for this to work you must have an entry for `demo.local` in your local hosts (i.e. `/etc/hosts`) file. -> This uses the browser for websocket communication so you will need to have an entry or use a routable domain. +> **Note**: for this to work, you must have an entry for `demo.local` in your local hosts (i.e. `/etc/hosts`) file. +> This uses the browser for websocket communication, so you must have an entry or use a routable domain. -Interlock will detect once the service is available and publish it. Once the tasks are running -and the proxy service has been updated the application should be available via `http://demo.local`. Open -two instances of your browser and you should see text on both instances as you type. +Interlock detects when the service is available and publishes it. Once tasks are running +and the proxy service is updated, the application should be available via `http://demo.local`. Open +two instances of your browser and text should be displayed on both instances as you type. From 1566c5488dff4a23cd9b9bf18fbea5da76c3dad1 Mon Sep 17 00:00:00 2001 From: paigehargrave Date: Mon, 11 Mar 2019 16:50:51 -0400 Subject: [PATCH 2/4] Merge default-backend info here --- ee/ucp/interlock/usage/interlock-vip-mode.md | 40 ++++++++++++++++++-- 1 file changed, 36 insertions(+), 4 deletions(-) diff --git a/ee/ucp/interlock/usage/interlock-vip-mode.md b/ee/ucp/interlock/usage/interlock-vip-mode.md index 699b0ffa1d..6349a67512 100644 --- a/ee/ucp/interlock/usage/interlock-vip-mode.md +++ b/ee/ucp/interlock/usage/interlock-vip-mode.md @@ -7,7 +7,7 @@ keywords: routing, proxy ## Specifying a routing mode You can publish services using "vip" and "task" backend routing modes. -#### Task Routing Mode +### Task Routing Mode Task routing is the default Interlock behavior and the default backend mode if one is not specified. In task routing mode, Interlock uses backend task IPs to route traffic from the proxy to each container. @@ -17,7 +17,7 @@ Task routing mode applies L7 routing and then sends packets directly to a contai ![task mode](../../images/interlock-task-mode.png) -#### VIP Routing Mode +### VIP Routing Mode VIP mode is an alternative mode of routing in which Interlock uses the Swarm service VIP as the backend IP instead of container IPs. Traffic to the frontend route is L7 load balanced to the Swarm service VIP, which L4 load balances to backend tasks. @@ -40,7 +40,7 @@ Because VIP mode routes by service IP rather than by task IP it also affects the In task mode a canary service with one task next to an existing service with four tasks represents one out of five total tasks, so the canary will receive 20% of incoming requests. By contrast the same canary service in VIP mode will receive 50% of incoming requests, because it represents one out of two total services. -#### Usage +### Usage You can set the backend mode on a per-service basis, which means that some applications can be deployed in task mode, while others are deployed in VIP mode. The default backend mode is `task`. If a label is set to `task` or a label does not exist, then Interlock uses the `task` routing mode. @@ -65,7 +65,39 @@ The following two updates still require a proxy reconfiguration (because these a - Add/Remove a network on a service - Deployment/Deletion of a service -The following example publishes a service using "vip" backend mode. +#### Publishing a default host service + +The following example publishes a service to be a default host. The service responds +whenever there is a request to a host that is not configured. + +First, create an overlay network so that service traffic is isolated and secure: + +```bash +$> docker network create -d overlay demo +1se1glh749q1i4pw0kf26mfx5 +``` + +Next, create the initial service: + +```bash +$> docker service create \ + --name demo-default \ + --network demo \ + --detach=false \ + --replicas=1 \ + --label com.docker.lb.default_backend=true \ + --label com.docker.lb.port=8080 \ + ehazlett/interlock-default-app +``` + +Interlock detects when the service is available and publishes it. After tasks are running +and the proxy service is updated, the application is available via any url that is not +configured: + + +![Default Backend](../../images/interlock_default_backend.png) + +#### Publish a service using "vip" backend mode. 1. Create an overlay network so that service traffic is isolated and secure: From 03621d8f891af181f0463be94732b2bfece6a879 Mon Sep 17 00:00:00 2001 From: paigehargrave Date: Mon, 11 Mar 2019 16:51:50 -0400 Subject: [PATCH 3/4] Moved to interlock-vip info --- ee/ucp/interlock/usage/default-backend.md | 37 ----------------------- 1 file changed, 37 deletions(-) delete mode 100644 ee/ucp/interlock/usage/default-backend.md diff --git a/ee/ucp/interlock/usage/default-backend.md b/ee/ucp/interlock/usage/default-backend.md deleted file mode 100644 index dfe5129d1b..0000000000 --- a/ee/ucp/interlock/usage/default-backend.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Default host -description: Learn how to publish a service to be a default host. -keywords: routing, proxy ---- - -# Publishing a default host service - -The following example publishes a service to be a default host. The service responds -whenever there is a request to a host that is not configured. - -First, create an overlay network so that service traffic is isolated and secure: - -```bash -$> docker network create -d overlay demo -1se1glh749q1i4pw0kf26mfx5 -``` - -Next, create the initial service: - -```bash -$> docker service create \ - --name demo-default \ - --network demo \ - --detach=false \ - --replicas=1 \ - --label com.docker.lb.default_backend=true \ - --label com.docker.lb.port=8080 \ - ehazlett/interlock-default-app -``` - -Interlock detects when the service is available and publishes it. After tasks are running -and the proxy service is updated, the application is available via any url that is not -configured: - - -![Default Backend](../../images/interlock_default_backend.png) From d18703bf7c4d04ebcafacb8d7a4651ff4c31d601 Mon Sep 17 00:00:00 2001 From: Maria Bermudez Date: Mon, 18 Mar 2019 09:18:07 -0700 Subject: [PATCH 4/4] Incorporate Euan's changes Add examples for sticky_session_cookie and redirects --- ee/ucp/interlock/usage/labels-reference.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/ee/ucp/interlock/usage/labels-reference.md b/ee/ucp/interlock/usage/labels-reference.md index 2efdbe130e..b6e2a2bf7a 100644 --- a/ee/ucp/interlock/usage/labels-reference.md +++ b/ee/ucp/interlock/usage/labels-reference.md @@ -5,8 +5,10 @@ description: Learn about the labels you can use in your swarm services to route keywords: routing, proxy --- -# Using routing labels -The following labels are available for you to use in swarm services: +## Using routing labels + +Once the layer 7 routing solution is enabled, you can +[start using it in your swarm services](index.md). | Label | Description | Example | @@ -20,7 +22,7 @@ The following labels are available for you to use in swarm services: | `com.docker.lb.ssl_key` | Docker secret to use for the SSL key. | `example.com.key` | | `com.docker.lb.websocket_endpoints` | Comma separated list of endpoints to configure to be upgraded for websockets. | `/ws,/foo` | | `com.docker.lb.service_cluster` | Name of the service cluster to use for the application. | `us-east` | -| `com.docker.lb.sticky_session_cookie` | Cookie to use for sticky sessions. | `none` | -| `com.docker.lb.redirects` | Semi-colon separated list of redirects to add in the format of `,`. Example: `http://old.example.com,http://new.example.com;` | `none` | +| `com.docker.lb.sticky_session_cookie` | Cookie to use for sticky sessions. | `app_session` | +| `com.docker.lb.redirects` | Semi-colon separated list of redirects to add in the format of `,`. | `http://old.example.com,http://new.example.com;` | | `com.docker.lb.ssl_passthrough` | Enable SSL passthrough. | `false` | | `com.docker.lb.backend_mode` | Select the backend mode that the proxy should use to access the upstreams. Defaults to `task`. | `vip` |