57_WolveandClaude Opus 5
85d945ccde
Ergo keeps history in RAM by default, so it is lost on every restart -- including the ones this stack's updater performs. HISTORY now selects a backend at first deploy: sqlite (default, a file beside ircd.db, no extra container), postgres (a pinned container via docker-compose.postgres.yml, loopback-only, POSTGRES_PASSWORD_FILE so no secret lands in .env), or off. Both SQL backends need Ergo 2.18.0+, which deploy.sh enforces. HISTORY_EXPIRE (default 30d) sets retention, because upstream's 1w expire-time DELETES from persistent storage -- persistence with the shipped default would buy only a week. Ergo opens the history backend only at startup and, unlike MySQL, has no "after launching the server" guard for sqlite/postgresql: a rehash that enables one reports success and then silently discards every message. So `ergoctl history` restarts, and `ergoctl edit` detects a backend change and refuses to apply it by rehash. The config validator runs with no network by design, so it neutralises postgresql in its copy and reachability is checked separately. Audit fixes (six lenses over first-deploy, runtime, lifecycle, security, docs): - SECURITY (blocker): ircd/ is writable by the container uid while the 15-minute cert sync and every ergoctl config edit run as root. cp/install/> follow a symlink, so code execution in Ergo could redirect a root write onto any host file. All such writes now stage under $STACK_DIR (0700 root) and land via mv (rename(2) replaces a symlink instead of following it); root reads use cp -P or refuse. Regression-tested with real symlinks. - deploy.sh no longer swaps the image when ERGO_TAG changes on a deployed stack (that bypassed pre-flight, snapshot, user warning and rollback); it points at `TARGET_VERSION=... ergoctl update update`. - restore was lossy and could lock you out: it now snapshots the current config as well as the database, restores message history, re-points the postgres password and re-hashes the local admin password into the restored config, and validates before starting. - `install -d -m` re-modes existing directories: `ergoctl backup /var/backups` no longer chmods it 0700 root, and the updater no longer re-modes /var/log (0775 root:syslog on Debian, which rsyslog needs). - The admin oper password is printed only on a first run at a TTY, so it stays out of cloud-init serial-console logs. - A failed update is remembered, so the daily job stops repeating a disruptive warn/stop/swap/roll-back cycle every night; postgres readiness gates an update that would otherwise stop a healthy server it cannot restart. - certsync no longer sends "TLS recovered" for outcomes that synced nothing. - ergoctl history writes .env only after the restart is healthy, and returns 0. - CR/LF is stripped before IRC framing, so a multi-line argument cannot inject a second command; the ntfy token moves out of curl's argv. - ufw/firewalld are additive, so 6667 is now explicitly revoked when PLAINTEXT=0. - build.sh refuses to build a deploy.sh whose archive is missing a file the script reads -- the failure mode that would have shipped a stack aborting on every host. Docs corrected against the code throughout, including retention, the pre-connect account-registration default, encrypted-restore (AGE_IDENTITY), what a re-run really does to .env, and what the update log does and does not contain. Verified locally: all six suites pass (config render for each backend against the real 2.19.1 template, yaml/oper/version/env helpers, the IRC client against a fake server, and the audit fixes including the symlink escalation). Still not exercised on a Docker host: the containers, ACME issuance, cert sync and PostgreSQL itself. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1362 lines
87 KiB
Bash
1362 lines
87 KiB
Bash
#!/usr/bin/env bash
|
|
#
|
|
# deploy.sh -- deploy Ergo (IRC server) behind Caddy (Let's Encrypt) on Alpine,
|
|
# Debian or Alma. Single-node; runs as root.
|
|
#
|
|
# What this does:
|
|
# 1. Installs docker + compose (and openssl/jq/curl) if missing; creates the
|
|
# `ergo` system user the container runs as.
|
|
# 2. Lays down the stack in $STACK_DIR: docker-compose.yml, caddy/etc/Caddyfile,
|
|
# update.sh, ergoctl (+ /usr/local/bin/ergoctl wrapper), ergolib.sh.
|
|
# 3. Seeds .env on first run, pinning ERGO_TAG to the newest release.
|
|
# 4. Generates ircd/ircd.yaml ONCE from the pulled image's own default config
|
|
# (server name, network name, listeners, websocket origin, message-history
|
|
# backend, admin oper with a random password saved to secrets/admin.pass)
|
|
# and validates it with a throwaway `ergo run --smoke` before anything
|
|
# starts. Never rewritten.
|
|
# 5. Opens 80/443/6697 (+6667 with PLAINTEXT=1) on the host firewall. Both
|
|
# containers use host networking, so this firewall really applies.
|
|
# 6. Pulls images, validates the Caddyfile, brings the stack up, waits for
|
|
# health, copies Caddy's Let's Encrypt cert into ircd/ and rehashes Ergo.
|
|
# 7. Schedules update.sh: certsync every 15 min, update check daily.
|
|
#
|
|
# Idempotent: re-run to apply compose/Caddyfile changes or pull images. It never
|
|
# touches ircd/ircd.yaml, secrets/ or caddy/etc/conf.d/; in .env it only refreshes
|
|
# ERGO_UID/GID, re-pins a floating ERGO_TAG, and writes back settings you passed
|
|
# explicitly on this run (everything else is adopted FROM .env, not overwritten).
|
|
#
|
|
# Self-contained: docker-compose.yml, docker-compose.postgres.yml, Caddyfile,
|
|
# conf.d-readme.caddy, ergo.motd, .env.example, ergolib.sh, update.sh and ergoctl
|
|
# are embedded as a base64 tar.gz at the bottom of this file. Rebuild with
|
|
# build.sh after editing them.
|
|
#
|
|
# Usage:
|
|
# bash deploy.sh # interactive prompts
|
|
# ERGO_DOMAIN=irc.example.com ACME_EMAIL=me@x.com NETWORK_NAME=MyNet \
|
|
# SKIP_PROMPTS=1 bash deploy.sh # non-interactive
|
|
# HISTORY=postgres bash deploy.sh # FIRST deploy only: persistent history in
|
|
# # PostgreSQL (default sqlite; off = RAM only)
|
|
# HISTORY_EXPIRE=90d bash deploy.sh # how long messages are kept (default 30d)
|
|
# PLAINTEXT=1 bash deploy.sh # FIRST deploy only: also serve plaintext
|
|
# # :6667 publicly (+STS). Fixed thereafter.
|
|
# ERGO_TAG=v2.19.1 bash deploy.sh # pin a release on the FIRST deploy; after
|
|
# # that use: ergoctl update update
|
|
# UPDATE_POLICY=security bash deploy.sh # also latest | off
|
|
# ERGO_AUTOUPDATE=0 bash deploy.sh # install update.sh but don't schedule the
|
|
# # daily update (certsync is still scheduled)
|
|
# CERT_WAIT=0 bash deploy.sh # don't wait for the first LE cert
|
|
# SKIP_DOCKER_INSTALL=1 bash deploy.sh
|
|
|
|
set -euo pipefail
|
|
|
|
: "${STACK_DIR:=/srv/ergo}"
|
|
: "${SKIP_DOCKER_INSTALL:=0}"
|
|
: "${FORCE:=0}"
|
|
: "${SKIP_PROMPTS:=0}"
|
|
[[ "$SKIP_PROMPTS" == "1" ]] && FORCE=1
|
|
: "${ERGO_DOMAIN:=}"
|
|
: "${ACME_EMAIL:=}"
|
|
: "${NETWORK_NAME:=}"
|
|
: "${ERGO_IMAGE:=ghcr.io/ergochat/ergo}"
|
|
: "${ERGO_TAG:=}" # blank = pin the newest release
|
|
# Remember which settings the caller actually passed, BEFORE the defaults below
|
|
# hide that. On a re-run the rest come from the existing .env instead, so a
|
|
# plain `bash deploy.sh` never silently reverts a deployed stack's settings.
|
|
# (`|| true` on the trailing `&&`s below: a false test makes the whole list
|
|
# return 1, which aborts the script under `set -e` if it ever ends a block.)
|
|
EXPLICIT=""
|
|
for _k in ERGO_TAG PLAINTEXT HISTORY UPDATE_POLICY FORCE_UPDATE UPDATE_GRACE CADDY_AUTOUPDATE CADDY_TAG; do
|
|
[[ -n "${!_k:-}" ]] && EXPLICIT="${EXPLICIT} ${_k}" || true
|
|
done
|
|
: "${PLAINTEXT:=0}"
|
|
: "${HISTORY:=sqlite}" # sqlite | postgres | off (see the README)
|
|
# How long messages are kept. Upstream's 1w applies to PERSISTENT storage too --
|
|
# it deletes, it is not just a query cutoff -- so persistence with the shipped
|
|
# default buys only a week. Retention is a policy (and privacy) decision: raise
|
|
# or lower it here, or later with 'ergoctl edit'.
|
|
: "${HISTORY_EXPIRE:=30d}"
|
|
: "${POSTGRES_TAG:=17-alpine}" # major version is PINNED; update.sh never moves it
|
|
: "${POSTGRES_USER:=ergo}"
|
|
: "${POSTGRES_DB:=ergo_history}"
|
|
: "${POSTGRES_PORT:=5432}"
|
|
: "${UPDATE_POLICY:=latest}"
|
|
: "${FORCE_UPDATE:=0}"
|
|
: "${UPDATE_GRACE:=60}"
|
|
: "${CADDY_AUTOUPDATE:=0}"
|
|
: "${CADDY_TAG:=2-alpine}"
|
|
: "${ERGO_AUTOUPDATE:=1}" # 0 = install update.sh but don't schedule the daily update
|
|
: "${CERT_WAIT:=180}" # seconds to wait for Caddy's first Let's Encrypt cert
|
|
|
|
log() { printf '\033[1;32m[+]\033[0m %s\n' "$*"; }
|
|
warn() { printf '\033[1;33m[!]\033[0m %s\n' "$*" >&2; }
|
|
die() { printf '\033[1;31m[x]\033[0m %s\n' "$*" >&2; exit 1; }
|
|
|
|
[[ $EUID -eq 0 ]] || die "Run as root."
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Extract the embedded archive; ergolib.sh (shared helpers) comes from it.
|
|
# ---------------------------------------------------------------------------
|
|
SCRIPT_DIR=$(mktemp -d -t ergo-deploy.XXXXXX)
|
|
trap 'rm -rf "$SCRIPT_DIR"' EXIT
|
|
|
|
extract_archive() {
|
|
grep -a -A 9999999 '^__ARCHIVE_BELOW__$' "$0" \
|
|
| tail -n +2 \
|
|
| base64 -d \
|
|
| tar -xz -C "$SCRIPT_DIR"
|
|
}
|
|
|
|
if grep -q -a '^__ARCHIVE_BELOW__$' "$0"; then
|
|
log "Extracting embedded deployment files..."
|
|
extract_archive
|
|
else
|
|
die "No embedded archive found. Run build.sh to embed deployment files."
|
|
fi
|
|
|
|
EMBEDDED=(docker-compose.yml docker-compose.postgres.yml Caddyfile conf.d-readme.caddy ergo.motd .env.example ergolib.sh update.sh ergoctl)
|
|
for f in "${EMBEDDED[@]}"; do
|
|
[[ -f "$SCRIPT_DIR/$f" ]] || die "Embedded archive missing $f"
|
|
done
|
|
|
|
# shellcheck source=ergolib.sh
|
|
. "$SCRIPT_DIR/ergolib.sh"
|
|
ergo_set_paths
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Host packages + Docker (deploy-only helpers; ergolib has the rest)
|
|
# ---------------------------------------------------------------------------
|
|
pkg_install() { # best-effort install across the three families
|
|
case "$(osfam)" in
|
|
alpine) apk add -q "$@" || true ;;
|
|
debian) DEBIAN_FRONTEND=noninteractive apt-get install -y -qq "$@" || true ;;
|
|
rhel) dnf install -y -q "$@" || true ;;
|
|
esac
|
|
}
|
|
|
|
install_docker() {
|
|
if command -v docker >/dev/null 2>&1; then
|
|
log "Docker already installed: $(docker --version)"
|
|
else
|
|
log "Installing Docker (OS: $(osfam))..."
|
|
case "$(osfam)" in
|
|
alpine) apk add -q docker docker-cli-compose openrc ;;
|
|
debian|rhel) command -v curl >/dev/null 2>&1 || pkg_install curl
|
|
curl -fsSL https://get.docker.com | sh ;;
|
|
*) die "Unsupported OS for auto Docker install. Set SKIP_DOCKER_INSTALL=1 and install Docker yourself." ;;
|
|
esac
|
|
fi
|
|
if command -v rc-update >/dev/null 2>&1; then
|
|
rc-update add docker default >/dev/null 2>&1 || true
|
|
rc-service docker status >/dev/null 2>&1 || rc-service docker start
|
|
elif command -v systemctl >/dev/null 2>&1; then
|
|
systemctl enable --now docker >/dev/null 2>&1 || systemctl start docker || true
|
|
fi
|
|
# dockerd may return before its socket listens (esp. OpenRC); don't race it.
|
|
local i
|
|
for i in $(seq 1 30); do
|
|
docker info >/dev/null 2>&1 && return
|
|
sleep 1
|
|
done
|
|
warn "Docker daemon not ready after 30s; continuing (compose may fail -- check 'docker info')."
|
|
}
|
|
|
|
# The container runs as this host user (no login, no home). It owns ./ircd so
|
|
# the DB, config and the copied TLS key are never readable by other local users.
|
|
ensure_ergo_user() {
|
|
if ! getent passwd ergo >/dev/null 2>&1; then
|
|
log "Creating system user 'ergo' (owns $IRCD_DIR; the container runs as it)..."
|
|
case "$(osfam)" in
|
|
alpine) getent group ergo >/dev/null 2>&1 || addgroup -S ergo
|
|
adduser -S -D -H -G ergo -s /sbin/nologin -g "Ergo IRC server" ergo ;;
|
|
*) useradd -r -M -s /usr/sbin/nologin -d /nonexistent -c "Ergo IRC server" ergo 2>/dev/null \
|
|
|| useradd -r -M -s /sbin/nologin -c "Ergo IRC server" ergo ;;
|
|
esac
|
|
fi
|
|
ERGO_UID="$(id -u ergo)"; ERGO_GID="$(id -g ergo)"
|
|
}
|
|
|
|
open_ports() {
|
|
# Host networking: these ports are bound on the host itself, so the INPUT
|
|
# firewall genuinely governs them (unlike Docker-published ports).
|
|
local ports=(80/tcp 443/tcp 6697/tcp)
|
|
[[ "$PLAINTEXT" == "1" ]] && ports+=(6667/tcp)
|
|
# ufw and firewalld are additive: unlike the repo's declarative ports.d
|
|
# engine they never drop a port that left the list, so turning PLAINTEXT
|
|
# back off would leave 6667 open. Revoke it explicitly.
|
|
if [[ "$PLAINTEXT" != "1" ]]; then
|
|
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
|
|
ufw status 2>/dev/null | grep -q '^6667/tcp' && { log "Closing 6667/tcp in ufw (PLAINTEXT=0)..."; ufw delete allow 6667/tcp >/dev/null 2>&1 || true; }
|
|
elif command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then
|
|
if firewall-cmd --query-port=6667/tcp --permanent >/dev/null 2>&1; then
|
|
log "Closing 6667/tcp in firewalld (PLAINTEXT=0)..."
|
|
firewall-cmd -q --remove-port=6667/tcp --permanent || true; firewall-cmd -q --reload || true
|
|
fi
|
|
fi
|
|
fi
|
|
if [[ -d /etc/firewall/ports.d && -x /usr/local/sbin/firewall-apply ]]; then
|
|
log "Registering ${ports[*]} with the host firewall..."
|
|
printf '%s\n' "${ports[@]}" > /etc/firewall/ports.d/ergo.rule
|
|
/usr/local/sbin/firewall-apply
|
|
elif command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
|
|
log "ufw active -- allowing ${ports[*]}..."
|
|
local p; for p in "${ports[@]}"; do ufw allow "$p" >/dev/null; done
|
|
elif command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then
|
|
log "firewalld active -- allowing ${ports[*]}..."
|
|
local p; for p in "${ports[@]}"; do firewall-cmd -q --add-port="$p" --permanent; done
|
|
firewall-cmd -q --reload
|
|
else
|
|
warn "No managed host firewall found; make sure ${ports[*]} are reachable (and nothing else is)."
|
|
fi
|
|
}
|
|
|
|
# Anything already listening on our host ports (only checked while our own
|
|
# containers are not running -- on re-runs they hold the ports themselves).
|
|
check_ports_free() {
|
|
local listing p busy=""
|
|
listing="$(netstat -ltn 2>/dev/null || ss -ltn 2>/dev/null || true)"
|
|
[[ -n "$listing" ]] || return 0
|
|
for p in 80 443 6697 8097 6667; do
|
|
if printf '%s\n' "$listing" | grep -qE "[:.]${p}[[:space:]]"; then busy="${busy} ${p}"; fi
|
|
done
|
|
[[ -z "$busy" ]] || die "Ports already in use on this host:${busy}. Both containers use host networking, so this stack needs 80/443 (Caddy), 6697/6667/8097 (Ergo) to itself. Another Caddy stack on this box? Move it or this."
|
|
}
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Prompt for required vars, then normalise + validate them
|
|
# ---------------------------------------------------------------------------
|
|
prompt() { # <VAR> <message> [default]
|
|
local varname="$1" message="$2" def="${3:-}"
|
|
local -n ref="$varname"
|
|
if [[ -z "${ref:-}" ]]; then
|
|
if [[ "$SKIP_PROMPTS" == "1" ]]; then
|
|
[[ -n "$def" ]] && { ref="$def"; return 0; }
|
|
die "$varname required (set it in the environment; running with SKIP_PROMPTS=1)."
|
|
fi
|
|
if [[ -n "$def" ]]; then read -r -p "$message [$def]: " ref; ref="${ref:-$def}"
|
|
else read -r -p "$message: " ref; fi
|
|
[[ -n "$ref" ]] || die "$varname required."
|
|
fi
|
|
}
|
|
|
|
prompt ERGO_DOMAIN "Public hostname of the IRC server (e.g. irc.example.com)"
|
|
ERGO_DOMAIN="$(printf '%s' "$ERGO_DOMAIN" | tr 'A-Z' 'a-z' | sed -E 's#^https?://##; s#[/.]+$##')"
|
|
[[ "$ERGO_DOMAIN" =~ ^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$ ]] \
|
|
|| die "ERGO_DOMAIN '$ERGO_DOMAIN' is not a valid hostname."
|
|
prompt ACME_EMAIL "Let's Encrypt email"
|
|
prompt NETWORK_NAME "IRC network name (no spaces)" "$ERGO_DOMAIN"
|
|
[[ "$NETWORK_NAME" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$ ]] \
|
|
|| die "NETWORK_NAME '$NETWORK_NAME' must be 1-64 chars of letters, digits, . _ - (no spaces: it is sent as an IRC parameter)."
|
|
[[ "$PLAINTEXT" == "0" || "$PLAINTEXT" == "1" ]] || die "PLAINTEXT must be 0 or 1."
|
|
case "$UPDATE_POLICY" in latest|security|off) ;; *) die "UPDATE_POLICY must be latest, security or off." ;; esac
|
|
case "$HISTORY" in sqlite|postgres|off) ;; *) die "HISTORY must be sqlite, postgres or off." ;; esac
|
|
|
|
# Re-run guard: server.name is immutable once Ergo has run with it, and the
|
|
# cert/websocket origin/Caddy site all derive from ERGO_DOMAIN.
|
|
if [[ -f "$IRCD_DIR/ircd.yaml" ]]; then
|
|
existing="$(yaml_server_name "$IRCD_DIR/ircd.yaml" || true)"
|
|
if [[ -n "$existing" && "$existing" != "$ERGO_DOMAIN" ]]; then
|
|
die "This stack is already deployed as '$existing' (ircd/ircd.yaml server.name) but ERGO_DOMAIN=$ERGO_DOMAIN. Ergo cannot rename a running server; re-run with ERGO_DOMAIN=$existing, or stop the stack, move $STACK_DIR away and deploy fresh."
|
|
fi
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Re-run: adopt the deployed settings from .env
|
|
#
|
|
# Everything below (the firewall rule, the scheduled jobs, the summary) must
|
|
# describe the stack as deployed, not this shell's defaults. A setting the
|
|
# caller passed explicitly wins and is written back; PLAINTEXT is the exception,
|
|
# because the listener it selects lives in ircd.yaml, which is never rewritten.
|
|
# ---------------------------------------------------------------------------
|
|
if [[ -f "$ENV_FILE" ]]; then
|
|
for _k in PLAINTEXT HISTORY UPDATE_POLICY FORCE_UPDATE UPDATE_GRACE CADDY_AUTOUPDATE CADDY_TAG POSTGRES_TAG POSTGRES_USER POSTGRES_DB POSTGRES_PORT; do
|
|
_v="$(env_get "$_k")"
|
|
[[ -n "$_v" ]] || continue
|
|
if [[ " $EXPLICIT " == *" $_k "* ]]; then
|
|
[[ "${!_k}" == "$_v" ]] && continue
|
|
if [[ "$_k" == "HISTORY" ]]; then
|
|
die "This stack was deployed with HISTORY=${_v} and you passed HISTORY=${!_k}. The backend is recorded in ircd/ircd.yaml, which deploy.sh never rewrites, so re-running cannot switch it (and switching does not migrate existing messages). To change it: 'ergoctl history ${!_k}'."
|
|
fi
|
|
if [[ "$_k" == "PLAINTEXT" ]]; then
|
|
die "This stack was deployed with PLAINTEXT=${_v} and you passed PLAINTEXT=${!_k}. The listener is fixed in ircd/ircd.yaml, which deploy.sh never rewrites, so re-running cannot change it. To switch: edit the plaintext listener with 'ergoctl edit' ($( [[ "$_v" == 1 ]] && echo '":6667": -> "127.0.0.1:6667":' || echo '"127.0.0.1:6667": -> ":6667":' ) and server.sts.enabled), set PLAINTEXT=${!_k} in $ENV_FILE, run 'ergoctl restart', then re-run this script to fix the firewall."
|
|
fi
|
|
log "${_k}: ${_v} -> ${!_k} (updating $ENV_FILE)."
|
|
else
|
|
printf -v "$_k" '%s' "$_v"
|
|
fi
|
|
done
|
|
[[ "$PLAINTEXT" == "0" || "$PLAINTEXT" == "1" ]] || die "PLAINTEXT in $ENV_FILE must be 0 or 1 (found '$PLAINTEXT')."
|
|
case "$UPDATE_POLICY" in latest|security|off) ;; *) die "UPDATE_POLICY in $ENV_FILE must be latest, security or off (found '$UPDATE_POLICY')." ;; esac
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Host prerequisites
|
|
# ---------------------------------------------------------------------------
|
|
[[ "$SKIP_DOCKER_INSTALL" == "1" ]] || install_docker
|
|
for tool in openssl jq curl; do
|
|
command -v "$tool" >/dev/null 2>&1 || { log "Installing $tool..."; pkg_install "$tool"; }
|
|
command -v "$tool" >/dev/null 2>&1 || die "$tool is required (certsync/updater); install it and re-run."
|
|
done
|
|
command -v docker >/dev/null 2>&1 || die "docker not found."
|
|
docker compose version >/dev/null 2>&1 || die "docker compose (v2 plugin) not found."
|
|
ensure_ergo_user
|
|
|
|
# Other host-network containers share Ergo's trust boundary (its loopback).
|
|
docker info >/dev/null 2>&1 || die "The Docker daemon is not running or not reachable (check 'docker info'). Start it and re-run."
|
|
others="$(docker ps -q 2>/dev/null | xargs -r docker inspect -f '{{.Name}} {{.HostConfig.NetworkMode}}' 2>/dev/null \
|
|
| awk '$2=="host" && $1!="/ergo" && $1!="/ergo-caddy" {print $1}' | tr '\n' ' ' || true)"
|
|
[[ -z "$others" ]] || warn "Other containers use host networking: ${others}-- they can reach Ergo's loopback listeners (see README: Security model)."
|
|
|
|
if [[ -z "$(dc ps -q 2>/dev/null || true)" ]]; then check_ports_free; fi
|
|
open_ports
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stack directory + files
|
|
# ---------------------------------------------------------------------------
|
|
log "Setting up $STACK_DIR..."
|
|
install -d -m 0700 "$STACK_DIR" "$SECRETS_DIR" "$BACKUP_DIR" "$TEMPLATES_DIR" "$STATE_DIR"
|
|
install -d -m 0700 "$CADDY_DIR" "$CADDY_DIR/data" "$CADDY_DIR/config"
|
|
install -d -m 0755 "$CADDY_DIR/etc" "$CADDY_DIR/etc/conf.d"
|
|
install -m 0640 "$SCRIPT_DIR/docker-compose.yml" "$STACK_DIR/docker-compose.yml"
|
|
install -m 0640 "$SCRIPT_DIR/docker-compose.postgres.yml" "$STACK_DIR/docker-compose.postgres.yml"
|
|
# Caddy has no admin API here and bind-mounted file contents are not part of the
|
|
# compose config hash, so `up -d` alone would leave a changed Caddyfile unloaded.
|
|
CADDY_CHANGED=0
|
|
cmp -s "$SCRIPT_DIR/Caddyfile" "$CADDY_DIR/etc/Caddyfile" 2>/dev/null || CADDY_CHANGED=1
|
|
install -m 0644 "$SCRIPT_DIR/Caddyfile" "$CADDY_DIR/etc/Caddyfile"
|
|
[[ -e "$CADDY_DIR/etc/conf.d/00-readme.caddy" ]] || install -m 0644 "$SCRIPT_DIR/conf.d-readme.caddy" "$CADDY_DIR/etc/conf.d/00-readme.caddy"
|
|
install -m 0644 "$SCRIPT_DIR/ergolib.sh" "$STACK_DIR/ergolib.sh"
|
|
install -m 0750 "$SCRIPT_DIR/update.sh" "$STACK_DIR/update.sh"
|
|
install -m 0750 "$SCRIPT_DIR/ergoctl" "$STACK_DIR/ergoctl"
|
|
install -d -m 0755 /usr/local/bin
|
|
cat > /usr/local/bin/ergoctl <<EOF
|
|
#!/bin/sh
|
|
# Auto-generated by the Ergo deploy.sh -- runs the stack's admin CLI from anywhere.
|
|
exec bash "$STACK_DIR/ergoctl" "\$@"
|
|
EOF
|
|
chmod 0755 /usr/local/bin/ergoctl
|
|
install -d -m 0700 -o "$ERGO_UID" -g "$ERGO_GID" "$IRCD_DIR"
|
|
|
|
# Pin ERGO_TAG to the newest release so the running version is explicit.
|
|
if [[ -z "$ERGO_TAG" && -f "$ENV_FILE" ]]; then ERGO_TAG="$(env_get ERGO_TAG)"; fi
|
|
if [[ -z "$ERGO_TAG" || "$ERGO_TAG" == "latest" || "$ERGO_TAG" == "stable" ]]; then
|
|
if _t="$(ergo_latest_tag)"; then ERGO_TAG="$_t"; log "Pinned ERGO_TAG=${ERGO_TAG} (newest release)."
|
|
else warn "Could not resolve the newest release from GitHub; using tag 'stable' for now (update.sh will pin it)."; ERGO_TAG="stable"; fi
|
|
fi
|
|
[[ "$ERGO_TAG" == "stable" || "$ERGO_TAG" == v* ]] || ERGO_TAG="v${ERGO_TAG}" # ghcr tags carry the v
|
|
|
|
if [[ ! -f "$ENV_FILE" ]]; then
|
|
log "Seeding $ENV_FILE..."
|
|
install -m 0600 "$SCRIPT_DIR/.env.example" "$ENV_FILE"
|
|
env_set ERGO_DOMAIN "$ERGO_DOMAIN"
|
|
env_set ACME_EMAIL "$ACME_EMAIL"
|
|
env_set NETWORK_NAME "$NETWORK_NAME"
|
|
env_set ERGO_IMAGE "$ERGO_IMAGE"
|
|
env_set ERGO_TAG "$ERGO_TAG"
|
|
env_set PLAINTEXT "$PLAINTEXT"
|
|
env_set HISTORY "$HISTORY"
|
|
env_set UPDATE_POLICY "$UPDATE_POLICY"
|
|
env_set FORCE_UPDATE "$FORCE_UPDATE"
|
|
env_set UPDATE_GRACE "$UPDATE_GRACE"
|
|
env_set CADDY_AUTOUPDATE "$CADDY_AUTOUPDATE"
|
|
env_set CADDY_TAG "$CADDY_TAG"
|
|
else
|
|
log ".env exists; keeping its settings (ERGO_TAG=$(env_get ERGO_TAG))."
|
|
[[ "$(ergo_domain)" == "$ERGO_DOMAIN" ]] || die ".env has ERGO_DOMAIN=$(env_get ERGO_DOMAIN) but you passed $ERGO_DOMAIN -- the domain cannot change after the first deploy."
|
|
# Persist the settings the caller passed explicitly on this re-run.
|
|
for _k in PLAINTEXT UPDATE_POLICY FORCE_UPDATE UPDATE_GRACE CADDY_AUTOUPDATE CADDY_TAG; do
|
|
[[ " $EXPLICIT " == *" $_k "* ]] && env_set "$_k" "${!_k}" || true
|
|
done
|
|
# A floating tag ('stable', from a first deploy that could not reach GitHub)
|
|
# would let any pull change the running version with no pre-flight, snapshot
|
|
# or rollback. Pin it as soon as we can resolve a real release.
|
|
_envtag="$(env_get ERGO_TAG)"
|
|
if [[ "$ERGO_TAG" == v[0-9]* && "$ERGO_TAG" != "$_envtag" ]]; then
|
|
case "$_envtag" in
|
|
# Changing the version of a DEPLOYED stack here would swap the image
|
|
# with none of the updater's rails: no pre-flight against the live
|
|
# config, no database snapshot, no warning to connected users and no
|
|
# rollback if the new build never becomes healthy. Send them there.
|
|
v[0-9]*) die "This stack is pinned to ${_envtag} and you passed ERGO_TAG=${ERGO_TAG}. Re-running deploy.sh would swap the image with no pre-flight, no database snapshot and no rollback. Use: TARGET_VERSION=$(normver "$ERGO_TAG") ergoctl update update" ;;
|
|
*) env_set ERGO_TAG "$ERGO_TAG"; log "Pinned ERGO_TAG=${ERGO_TAG} (was '${_envtag}', which floats)." ;;
|
|
esac
|
|
fi
|
|
fi
|
|
env_set ERGO_UID "$ERGO_UID"
|
|
env_set ERGO_GID "$ERGO_GID"
|
|
ERGO_TAG="$(ergo_tag)"
|
|
IMAGE="$(ergo_image)"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Persistent history backend
|
|
#
|
|
# Ergo's history is ON by default but lives in RAM, so it is lost on every
|
|
# restart -- including the ones this stack's updater performs. sqlite persists
|
|
# it in a file beside ircd.db with no extra moving parts; postgres adds a
|
|
# pinned container for people who want a real database.
|
|
# ---------------------------------------------------------------------------
|
|
if [[ "$HISTORY" != "off" ]]; then
|
|
# Both SQL history backends were added in Ergo 2.18.0.
|
|
_v="$(normver "$ERGO_TAG")"
|
|
if [[ -n "$_v" ]] && ! ver_ge "$_v" 2.18.0; then
|
|
die "HISTORY=$HISTORY needs Ergo 2.18.0 or newer (the SQL history backends were added there), but ERGO_TAG=$ERGO_TAG. Use HISTORY=off or a newer release."
|
|
fi
|
|
fi
|
|
if [[ "$HISTORY" == "postgres" ]]; then
|
|
env_set POSTGRES_TAG "$POSTGRES_TAG"
|
|
env_set POSTGRES_USER "$POSTGRES_USER"
|
|
env_set POSTGRES_DB "$POSTGRES_DB"
|
|
env_set POSTGRES_PORT "$POSTGRES_PORT"
|
|
# docker compose reads COMPOSE_FILE from .env, so every compose command in
|
|
# this stack picks up the overlay without needing extra flags.
|
|
env_set COMPOSE_FILE "docker-compose.yml:docker-compose.postgres.yml"
|
|
if [[ ! -f "$SECRETS_DIR/postgres.pass" ]]; then
|
|
log "Generating the PostgreSQL password (secrets/postgres.pass)..."
|
|
( umask 077; ergo_random_password 32 > "$SECRETS_DIR/postgres.pass" )
|
|
fi
|
|
chmod 0600 "$SECRETS_DIR/postgres.pass"
|
|
PG_PASS="$(cat "$SECRETS_DIR/postgres.pass")"
|
|
else
|
|
env_set COMPOSE_FILE "docker-compose.yml"
|
|
fi
|
|
|
|
missing=()
|
|
for var in ERGO_DOMAIN ACME_EMAIL NETWORK_NAME ERGO_TAG ERGO_UID ERGO_GID; do
|
|
grep -E "^${var}=.+$" "$ENV_FILE" >/dev/null || missing+=("$var")
|
|
done
|
|
(( ${#missing[@]} == 0 )) || die "Missing values in $ENV_FILE: ${missing[*]}"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Pull images, validate the Caddyfile (static config -- no admin API needed)
|
|
# ---------------------------------------------------------------------------
|
|
cd "$STACK_DIR"
|
|
log "Pulling images ($IMAGE, caddy:$(env_get CADDY_TAG))..."
|
|
docker compose pull
|
|
log "Validating the Caddyfile..."
|
|
# A one-off `compose run` container gets a generated name (compose drops the
|
|
# service's container_name for these), so this is safe while ergo-caddy runs.
|
|
docker compose run --rm --no-deps -T caddy \
|
|
caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile >/dev/null \
|
|
|| die "Caddyfile validation failed. Check $CADDY_DIR/etc/Caddyfile and conf.d/*.caddy."
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# First run: generate ircd.yaml from the image's own default config
|
|
# ---------------------------------------------------------------------------
|
|
render_ircd_yaml() { # <template> <dest>
|
|
local plain_listener sts_note netname="" listeners ws
|
|
# Cloaked hostnames end in this fake TLD (default "irc"). Use the network's
|
|
# first label when it is hostname-shaped; changing it later re-cloaks everyone.
|
|
netname="$(printf '%s' "$NETWORK_NAME" | tr 'A-Z' 'a-z' | cut -d. -f1)"
|
|
[[ "$netname" =~ ^[a-z0-9]([a-z0-9-]{0,30}[a-z0-9])?$ ]] || netname=""
|
|
if [[ "$PLAINTEXT" == "1" ]]; then
|
|
plain_listener=' # PLAINTEXT=1: plaintext IRC on ALL interfaces. STS is advertised (server.sts)
|
|
# so capable clients pin TLS after first contact. Anything sent here crosses
|
|
# the internet unencrypted. Loopback probes (ergoctl, healthcheck) use it too.
|
|
":6667":'
|
|
else
|
|
plain_listener=' # Loopback plaintext: the compose healthcheck and `ergoctl` use it (loopback is
|
|
# exempt from ip-limits/bans and treated as secure). To serve plaintext publicly
|
|
# instead (not recommended): change this to ":6667", enable server.sts above, set
|
|
# PLAINTEXT=1 in ../.env, `ergoctl restart`, then re-run deploy.sh for the firewall.
|
|
"127.0.0.1:6667":'
|
|
fi
|
|
listeners=" listeners:
|
|
${plain_listener}
|
|
|
|
# Public TLS port. fullchain.pem/privkey.pem are Caddy's Let's Encrypt cert,
|
|
# kept current by 'update.sh certsync' (self-signed from mkcerts until the
|
|
# first sync). Rehash (SIGHUP) reloads them without dropping anyone.
|
|
\":6697\":
|
|
tls:
|
|
cert: fullchain.pem
|
|
key: privkey.pem
|
|
proxy: false
|
|
min-tls-version: 1.2
|
|
|
|
# IRC over WebSocket for browser clients; TLS is terminated by Caddy on :443
|
|
# (wss://${ERGO_DOMAIN}/webirc), which proxies here over loopback with
|
|
# X-Forwarded-For -- trusted because 127.0.0.1 is in proxy-allowed-from.
|
|
\"127.0.0.1:8097\":
|
|
websocket: true
|
|
|
|
"
|
|
ws=" websockets:
|
|
# Only pages served from these origins may open a websocket (anchored,
|
|
# case-sensitive globs). Add the origin of any web client you host elsewhere.
|
|
# Non-browser clients should use :6697 directly.
|
|
allowed-origins:
|
|
- \"https://${ERGO_DOMAIN}\"
|
|
|
|
"
|
|
MARKER="# Generated by deployments/ergo/deploy.sh on $(date -u +%FT%TZ) from the ${IMAGE} default config.
|
|
# Edit freely; apply with 'ergoctl rehash' (or 'ergoctl edit', which validates first).
|
|
# server.name, datastore.path, casemapping and enforce-utf8 need 'ergoctl restart'.
|
|
# The pristine template is kept in ../templates/ for diffing after upgrades." \
|
|
DOMAIN="$ERGO_DOMAIN" NETWORK_NAME="$NETWORK_NAME" HASH="$ADMIN_HASH" PLAINTEXT="$PLAINTEXT" \
|
|
NETNAME="$netname" LISTENERS_BLOCK="$listeners" WS_BLOCK="$ws" \
|
|
awk '
|
|
BEGIN { print ENVIRON["MARKER"]; top=""; sub4=""; oper=""; skip=0 }
|
|
{
|
|
line=$0
|
|
# while replacing a 4-space block, drop its children (8+ spaces) and blanks
|
|
if (skip) { if (line ~ /^ / || line ~ /^[ \t]*$/) next; skip=0 }
|
|
if (line ~ /^[a-z][a-z-]*:/) { top=line; sub(/:.*/,"",top); sub4=""; oper="" }
|
|
if (top=="server") {
|
|
if (line ~ /^ [a-z"-]/) { sub4=line; sub(/^ /,"",sub4); sub(/:.*/,"",sub4) }
|
|
if (line ~ /^ name:/) { print " name: " ENVIRON["DOMAIN"]; next }
|
|
if (line ~ /^ listeners:/) { printf "%s", ENVIRON["LISTENERS_BLOCK"]; skip=1; next }
|
|
if (line ~ /^ websockets:/) { printf "%s", ENVIRON["WS_BLOCK"]; skip=1; next }
|
|
if (sub4=="sts" && ENVIRON["PLAINTEXT"]=="1" && line ~ /^ enabled: false/) { print " enabled: true"; next }
|
|
if (sub4=="ip-cloaking" && ENVIRON["NETNAME"]!="" && line ~ /^ netname:/) { print " netname: \"" ENVIRON["NETNAME"] "\""; next }
|
|
}
|
|
if (top=="network" && line ~ /^ name:/) { print " name: \"" ENVIRON["NETWORK_NAME"] "\""; next }
|
|
if (top=="opers") {
|
|
if (line ~ /^ [A-Za-z0-9_.-]+:/) { oper=line; sub(/^ /,"",oper); sub(/:.*/,"",oper) }
|
|
if (oper=="admin" && line ~ /^ password:/) { print " password: \"" ENVIRON["HASH"] "\""; next }
|
|
}
|
|
if (top=="languages" && line ~ /^ path: languages/) { print " path: /ircd-bin/languages"; next }
|
|
print line
|
|
}' "$1" > "$2"
|
|
}
|
|
|
|
assert_ircd_yaml() { # hard post-conditions -- a silent sed miss would be a public :6667 or a dead admin oper
|
|
local f="$1" fail=0
|
|
_chk() { if ! grep -qE -- "$1" "$f"; then warn "ircd.yaml check failed: expected $2"; fail=1; fi; }
|
|
_nochk() { if grep -qE -- "$1" "$f"; then warn "ircd.yaml check failed: unexpected $2"; fail=1; fi; }
|
|
_chk '^ name: '"$ERGO_DOMAIN"'$' "server.name = $ERGO_DOMAIN"
|
|
_chk '^ name: "'"$NETWORK_NAME"'"$' "network.name"
|
|
_chk '^ ":6697":' "TLS listener :6697"
|
|
_chk '^ "127.0.0.1:8097":' "websocket listener"
|
|
_chk '^ - "https://'"$ERGO_DOMAIN"'"$' "websocket allowed origin"
|
|
_chk '^ password: "\$2[ab]\$' "admin oper bcrypt hash"
|
|
_nochk '^ password: "\$2a\$04\$0123456789abcdef' "placeholder oper hash still active (the commented examples are fine)"
|
|
_nochk '"\[::1\]:6667"' "[::1] listener (fails on IPv6-less hosts)"
|
|
_chk '^ path: /ircd-bin/languages' "languages path"
|
|
_nochk '^ path: languages$' "unpatched languages path"
|
|
if [[ "$PLAINTEXT" == "1" ]]; then _chk '^ ":6667":' "public plaintext listener"; _nochk '^ "127.0.0.1:6667":' "loopback-only listener with PLAINTEXT=1"
|
|
else _chk '^ "127.0.0.1:6667":' "loopback plaintext listener"; _nochk '^ ":6667":' "PUBLIC plaintext listener with PLAINTEXT=0"; fi
|
|
# The history backend must be exactly the one asked for -- yaml_set_nested
|
|
# targets a specific block, so a wrong result means the template moved.
|
|
local got; got="$(history_backend "$f")"
|
|
if [[ "$got" != "$HISTORY" ]]; then warn "ircd.yaml check failed: history backend is '$got', expected '$HISTORY'"; fail=1; fi
|
|
(( fail == 0 ))
|
|
}
|
|
|
|
CONF="$IRCD_DIR/ircd.yaml"
|
|
FIRST_RUN=0
|
|
if [[ ! -f "$CONF" ]]; then
|
|
FIRST_RUN=1
|
|
log "Generating $CONF from the image's default config..."
|
|
TEMPLATE="$TEMPLATES_DIR/default.yaml.${ERGO_TAG}"
|
|
ergo_extract_template "$IMAGE" "$TEMPLATE" || die "Could not read /ircd-bin/default.yaml from $IMAGE."
|
|
chmod 0600 "$TEMPLATE"
|
|
|
|
# Admin oper: random password (plaintext 0600 on the host, hash in the yaml).
|
|
ADMIN_PW="$(ergo_random_password 24)"
|
|
ADMIN_HASH="$(ergo_genpasswd "$IMAGE" "$ADMIN_PW")" || die "ergo genpasswd did not return a bcrypt hash."
|
|
( umask 077; printf '%s\n' "$ADMIN_PW" > "$ADMIN_PASS_FILE" )
|
|
|
|
render_ircd_yaml "$TEMPLATE" "$CONF"
|
|
|
|
# Persistent history. Ergo keeps the in-memory limits (channel-length etc.)
|
|
# for the RAM backend; with persistence on, retention is governed by
|
|
# history.restrictions.expire-time (1w by default).
|
|
if [[ "$HISTORY" != "off" && -n "$HISTORY_EXPIRE" ]]; then
|
|
yaml_set_nested "$CONF" history restrictions expire-time "$HISTORY_EXPIRE" \
|
|
|| die "Could not set history.restrictions.expire-time."
|
|
log "Message retention: ${HISTORY_EXPIRE} (history.restrictions.expire-time)."
|
|
fi
|
|
case "$HISTORY" in
|
|
sqlite)
|
|
log "Enabling persistent history (SQLite: ircd/ergo_history.db)..."
|
|
yaml_set_nested "$CONF" datastore sqlite enabled true || die "Could not enable datastore.sqlite in the generated config."
|
|
yaml_set_nested "$CONF" history persistent enabled true || die "Could not enable history.persistent in the generated config." ;;
|
|
postgres)
|
|
log "Enabling persistent history (PostgreSQL on 127.0.0.1:${POSTGRES_PORT})..."
|
|
yaml_set_nested "$CONF" datastore postgresql enabled true || die "Could not enable datastore.postgresql."
|
|
yaml_set_nested "$CONF" datastore postgresql host "\"127.0.0.1\"" || die "Could not set the postgresql host."
|
|
yaml_set_nested "$CONF" datastore postgresql port "$POSTGRES_PORT" || die "Could not set the postgresql port."
|
|
yaml_set_nested "$CONF" datastore postgresql user "\"${POSTGRES_USER}\"" || die "Could not set the postgresql user."
|
|
yaml_set_nested "$CONF" datastore postgresql password "\"${PG_PASS}\"" || die "Could not set the postgresql password."
|
|
yaml_set_nested "$CONF" datastore postgresql history-database "\"${POSTGRES_DB}\"" || die "Could not set the postgresql database."
|
|
yaml_set_nested "$CONF" history persistent enabled true || die "Could not enable history.persistent." ;;
|
|
off)
|
|
log "Persistent history disabled (HISTORY=off): messages stay in RAM and are lost on restart." ;;
|
|
esac
|
|
|
|
assert_ircd_yaml "$CONF" || { rm -f "$CONF"; die "Generated ircd.yaml failed its checks (the upstream template layout changed?). Nothing started. Template kept at $TEMPLATE."; }
|
|
|
|
# MOTD: the bind mount hides the image's ergo.motd, and a missing MOTD is silently
|
|
# ignored (clients get ERR_NOMOTD) -- so always ship one.
|
|
sed -e "s|__NETWORK_NAME__|${NETWORK_NAME}|g" -e "s|__DOMAIN__|${ERGO_DOMAIN}|g" "$SCRIPT_DIR/ergo.motd" > "$IRCD_DIR/ergo.motd"
|
|
|
|
chmod 0600 "$CONF"; chmod 0644 "$IRCD_DIR/ergo.motd"
|
|
chown -R "$ERGO_UID:$ERGO_GID" "$IRCD_DIR"
|
|
|
|
log "Validating the generated config (ergo run --smoke in a throwaway container)..."
|
|
if ! ergo_validate_config "$IMAGE"; then
|
|
tail -n 20 "$VALIDATE_LOG" >&2 || true
|
|
rm -f "$CONF"
|
|
die "ircd.yaml did not load in $IMAGE. Nothing started; fix the cause above and re-run."
|
|
fi
|
|
rm -f "$VALIDATE_LOG"
|
|
else
|
|
log "$CONF exists; leaving it alone."
|
|
chown -R "$ERGO_UID:$ERGO_GID" "$IRCD_DIR"
|
|
fi
|
|
ADMIN_PW="$(head -n1 "$ADMIN_PASS_FILE" 2>/dev/null || echo '<not on file>')"
|
|
# Only put the password on screen for a human at a terminal, and only on the run
|
|
# that created it. Unattended paths (cloud-init) send stdout to the provider's
|
|
# serial console and /var/log/cloud-init-output.log, where a server-admin oper
|
|
# credential would sit indefinitely, readable by anyone with console access.
|
|
if [[ "$FIRST_RUN" == "1" && -t 1 ]]; then
|
|
ADMIN_PW_LINE="/OPER admin ${ADMIN_PW} (also in ${ADMIN_PASS_FILE})"
|
|
else
|
|
ADMIN_PW_LINE="see ${ADMIN_PASS_FILE}, or run: ergoctl passwd show"
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Confirm
|
|
# ---------------------------------------------------------------------------
|
|
if [[ "$FORCE" != "1" ]]; then
|
|
cat <<EOF
|
|
|
|
About to start the Ergo stack from $STACK_DIR (host networking).
|
|
|
|
Caddy will request a Let's Encrypt cert for ${ERGO_DOMAIN}. DNS for that name must
|
|
already point at this host and ports 80/443 must be reachable from the internet.
|
|
IRC clients connect on 6697 (TLS)$( [[ "$PLAINTEXT" == "1" ]] && printf ' and 6667 (PLAINTEXT -- credentials in clear)' ).
|
|
|
|
Continue? [y/N]
|
|
EOF
|
|
read -r ans
|
|
[[ "${ans,,}" == "y" || "${ans,,}" == "yes" ]] || { warn "Aborted."; exit 0; }
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Up + health
|
|
# ---------------------------------------------------------------------------
|
|
log "Starting stack..."
|
|
docker compose up -d --remove-orphans
|
|
if (( CADDY_CHANGED )) && [[ "$(svc_state caddy)" == running* ]]; then
|
|
log "Caddyfile changed; restarting Caddy to load it..."
|
|
docker compose restart caddy >/dev/null 2>&1 || warn "Could not restart Caddy; run 'ergoctl caddy-restart'."
|
|
fi
|
|
|
|
log "Waiting for services to become healthy..."
|
|
if [[ "$HISTORY" == "postgres" ]]; then
|
|
# Ergo refuses to start when its history backend is unreachable, and
|
|
# depends_on holds it back until this passes.
|
|
if wait_healthy postgres 120; then log "PostgreSQL is ready."
|
|
else docker compose logs --tail 20 postgres >&2 || true
|
|
die "PostgreSQL did not become healthy; Ergo cannot start without it. See the log above."; fi
|
|
fi
|
|
wait_healthy caddy 60 || warn "Caddy is not healthy yet (docker compose logs caddy)."
|
|
if ! wait_healthy ergo 120; then
|
|
docker compose logs --tail 30 ergo >&2 || true
|
|
die "Ergo did not become healthy. See the log above."
|
|
fi
|
|
log "Ergo is up ($(ergo_version_running))."
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# TLS: wait for Caddy's cert, copy it into ircd/, rehash
|
|
# ---------------------------------------------------------------------------
|
|
log "Waiting up to ${CERT_WAIT}s for Caddy to obtain the Let's Encrypt certificate..."
|
|
deadline=$(( $(date +%s) + CERT_WAIT ))
|
|
have_cert=0
|
|
while (( $(date +%s) < deadline )); do
|
|
if ergo_cert_source >/dev/null 2>&1; then have_cert=1; break; fi
|
|
sleep 5
|
|
done
|
|
if [[ "$have_cert" == 1 ]]; then
|
|
sleep 2 # let certmagic finish writing the .json sidecar
|
|
bash "$STACK_DIR/update.sh" certsync || warn "Cert sync did not complete; the 15-minute job will retry."
|
|
else
|
|
warn "No certificate from Caddy yet (DNS not pointing here, or 80/443 unreachable?)."
|
|
warn "Ergo is serving a SELF-SIGNED cert on 6697 until certsync succeeds (every 15 min). Check: docker compose logs caddy"
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Schedule certsync (15 min) + the daily update check
|
|
# ---------------------------------------------------------------------------
|
|
log "Installing scheduled jobs (certsync every 15 min; daily update check, policy=${UPDATE_POLICY})..."
|
|
STACK_DIR="$STACK_DIR" UPDATE_POLICY="$UPDATE_POLICY" FORCE_UPDATE="$FORCE_UPDATE" UPDATE_GRACE="$UPDATE_GRACE" \
|
|
CADDY_AUTOUPDATE="$CADDY_AUTOUPDATE" SCHEDULE_UPDATES="$ERGO_AUTOUPDATE" \
|
|
bash "$STACK_DIR/update.sh" install || warn "Scheduling failed (non-fatal): run '$STACK_DIR/update.sh install' by hand."
|
|
|
|
echo
|
|
log "Stack status:"
|
|
docker compose ps
|
|
echo
|
|
cat <<EOF
|
|
================================================================
|
|
DEPLOYED -- Ergo IRC server
|
|
|
|
Network: ${NETWORK_NAME}
|
|
Server: ${ERGO_DOMAIN} port 6697 (TLS)$( [[ "$PLAINTEXT" == "1" ]] && printf ', port 6667 (plaintext)' )
|
|
WebSocket: wss://${ERGO_DOMAIN}/webirc (landing page: https://${ERGO_DOMAIN})
|
|
Stack dir: ${STACK_DIR}
|
|
|
|
Oper login: ${ADMIN_PW_LINE}
|
|
(rotate with: ergoctl passwd rotate)
|
|
|
|
Config: ${IRCD_DIR}/ircd.yaml MOTD: ${IRCD_DIR}/ergo.motd
|
|
ergoctl edit / ergoctl motd (validates, then rehashes)
|
|
|
|
History: $( case "$HISTORY" in
|
|
sqlite) printf 'persistent, SQLite (%s/ergo_history.db)' "$IRCD_DIR" ;;
|
|
postgres) printf 'persistent, PostgreSQL (container ergo-postgres, db %s)' "$POSTGRES_DB" ;;
|
|
off) printf 'in RAM only -- lost on every restart, including updates' ;;
|
|
esac )
|
|
$( [[ "$HISTORY" == "off" ]] || printf 'Messages are kept for %s, then deleted (history.restrictions.expire-time).' "$HISTORY_EXPIRE" )
|
|
Switch backend: ergoctl history sqlite|postgres|off
|
|
|
|
Administer (from anywhere on this host):
|
|
ergoctl status versions, health, cert, user count
|
|
ergoctl users who is on
|
|
ergoctl oper add <name> add an operator (prints a generated password)
|
|
ergoctl announce <text> NOTICE to everyone
|
|
ergoctl kill|ban|defcon ... moderation (see: ergoctl help)
|
|
ergoctl cmd <raw IRC line> anything else, as the admin oper
|
|
ergoctl logs -f server log (health-probe noise filtered)
|
|
ergoctl backup stop-consistent backup of config + database
|
|
|
|
TLS: Caddy holds the Let's Encrypt cert; 'update.sh certsync' copies it to
|
|
Ergo and rehashes (every 15 min, silent when unchanged).
|
|
Check with 'ergoctl cert'. While it says SELF-SIGNED, IRC clients will
|
|
refuse to connect to 6697 with a certificate error -- that is a pending
|
|
issuance, not a broken install. Fix it in this order:
|
|
dig +short ${ERGO_DOMAIN} # must return this host's public IP
|
|
docker compose logs caddy # shows why ACME failed (80/443 blocked?)
|
|
ergoctl cert sync # apply now instead of waiting 15 min
|
|
|
|
Updates: ergoctl update check current vs latest (+ security advisories)
|
|
ergoctl update update update now (health-checked, DB snapshot, rollback)
|
|
$( [[ "$ERGO_AUTOUPDATE" == "1" ]] \
|
|
&& printf "Daily automatic run, policy '%s' (edit it in %s)." "$UPDATE_POLICY" "$ENV_FILE" \
|
|
|| printf "Daily run NOT scheduled (ERGO_AUTOUPDATE=0); enable it with 'ergoctl update install'." )
|
|
Restarting Ergo disconnects every user; the daily run warns them first.
|
|
|
|
Re-running this script is idempotent: it never touches ircd.yaml, secrets/ or
|
|
caddy/etc/conf.d/, and it adopts the settings above from .env rather than
|
|
resetting them to defaults.
|
|
================================================================
|
|
EOF
|
|
|
|
# IMPORTANT: do not put any code below this exit. Everything after the
|
|
# __ARCHIVE_BELOW__ marker is the embedded tar.gz payload (base64), appended by
|
|
# build.sh.
|
|
exit 0
|
|
__ARCHIVE_BELOW__
|
|
H4sIAAAAAAAAA+xb+3PbRpL2z/wr+ihXiUwIkNQzoSPXKhJtsU6WFJE+J5fsUSAxJBGBAIyHZK7P
|
|
//t93TN4UA87mzjZvSrDVTIJDhozPd1fP8cNp9cqtqbhMgoTZa+W/pPPfnVw7e3sPOnsdbr7u135
|
|
v9Ppyn1c+9s7nSfd3a2dvc7W7v7u/pNOdxsPPKHO55/K/StLUicmerK7P34T+jfqr3jnv9G1Qf14
|
|
HhKYML0my6Ijx3VX1DhV6WZC/WAar6KUvqY3ajJkSUlpFodB2sQteW5weUSJim9UbNc2ahs0CqPQ
|
|
D+crJvX9+ehEfvSmKqE4C8gLKF0oOjkfjihQ6W0YX1PgLFUSOVNFjSCkYxFHOjscNXtCkOQVU99T
|
|
QZrgm2U9p97e3rf7NDod4ttD13NSPDeiRqLwZn5lrByfBhc3O2382WsK4Vs1uUt4Z2ebpsIBy2rj
|
|
dy+e8v3u1r7dwb9u75sO3izU8WuiOdL40XoRxrdO7CqXP2nq6xwU6t902pU3NA6PXvWbz2R6XpJk
|
|
yqWpilN8pmkYefjqBWlIdhuTcGkWxkL2/sX7gDdppvhekqoAHJys6CqLXCdVdrIQwskqmF5R42sa
|
|
Dl6evL4ASxZOstCT9cMwmrAEyLW+5L29vX2KfAezUe/SHhmooAVYmi6mC4XHvqYrZso09a/o/Oz0
|
|
p0em2ijeg0Wqd2oZiTwtyYss31t6adKeOEFCTgBehBlvjJNAhKZZrJoiDm8WK1qESZqLjxfMeyIh
|
|
/FwLvIzDNPVxV2gMLrDBocOj6FqtKNTypzd9MwE97ESsEjzJw7XwgZcZpNbnO1EcvlvRbZj5Li08
|
|
V5GCpK9YkPYMFZqohYeRoAtyk9hz54rmYPuts7LphKe6DPGg4ychLRWvjqfAa8CLXBWsrMnKctXM
|
|
yfyUBmcXr0c082I87vsgyHLrr2ge4r36UXA+CrGb1HBV5Icr3t5YzXnf44QgYpCwNstC06ajMEjU
|
|
20wFUECoE0HBruTh3lX7ynAQn7GVMdTvyGxsrH5V01RetmSVXeSLaLYMPGBW2Hfmn4AAT64UGM3L
|
|
yiKrm26ENY0BuzTBFrtOLGABTTU8vOwfHr/qU6M+5H330pW826837VqNwaIn+ler5cjSqxFtPIIE
|
|
v+sSekcGBSicpBD9pB1DrW715q2rNusWJE/FSy/Avid0MhpdDFlhZUFMDAJqMZOsEkYjJ10IowQ9
|
|
IefE2kUsdSytkTNXNg1TJ/WmUIVg5s31Op0ogjzI7GaeD4F0oTV064HalavBc1rsI5u2VMMNNN9x
|
|
MUM6vBjwRoSzGRj6+TknL+OpEnlLLKJn7jx9f3R4fPzTeHT4smdtWY4feYH6IOOwPGaxisfl9lry
|
|
lPxsltGjLPChqlaShlGkXPnNyPCYJaQn8qYpOtHYjcOoRz8fnp7+vbgHmrh11h+Nvx+cHY+H/cv/
|
|
Ghz1/14C1EYJ0o04DAHGgVVMD29TLjgXYAPShZc0hW5ipHQcRpjjz0FoQU6sKPZusD1ziCdkXekp
|
|
3IR+ttQCKzALbJdltlU67fEf/ZWq8yl3+muRA9ttQ/MBENM0jFk1gJItKHYKCeJhzXvEYQOcnvy9
|
|
g8YbxBaInKlALdNnK/FM2GhBxV1ngteyHOfm4x5tI5nmf/lZBTceXIQlsDFfaP/y5fn4+PzV4eCs
|
|
R/Wn7yvfP9TNGJ7KuI9bpzKk/FqMwLa9Ob/8z/HZ4au+jKneMKMqNil/+QadGvyxZOf0EEq8VAF+
|
|
Z9hYN/dLSl43+OuD+sIXlJy3un706tganvRPT+stqt/OodXW23OLFmka9drtAhDb9L80j1WEX2nz
|
|
f8LrzfrfDSE2qfGN4/dou5PkxL2lCjPQ383vxCqNPYgNbZsbog/jSMVeCHnu4tE/BQIF24GAzIuK
|
|
n0eXWSB2uQLxYv2vKFnBCi3FfFbMkxCbQqAYHL1UW/dFeAsq2rmBXWFx0/vDajdLWKRZZZ2J53sp
|
|
Vm9Tn02v0JIt8lKjj77H+Imd0sR6xH/tlbP0W/qjO2kJptjLMHVbNMt8f7qARtuRWraEIGsr/AO+
|
|
YdOVF3hgP6vtFUUZG0LcISeli8ExdQl2/C7SXnu+TxaQ//XFlRBsaOeqh3XB/3ATA+EtenU+OhYG
|
|
sPcqatXMranwU1xLeB2wa8mfAc9Mfw2djTYOXh2+7Pes+WIa217YFmdu4aTy4UPPDBLshvABFh5H
|
|
7t+L2SXX5SvLUAkWrwfHPQsxY6eYy8viTv1RyP8noJnlb8zyV5lCuoxm0Lqf2/jwKICLyMnfxwGI
|
|
zb8Pz9HnnZ1g0aJZcAVv2WVzcFdZ2oWLYe/hpP7wejDSNr3ev7w8v6TeD5mX1guCokE+JA9qcQjX
|
|
F97b6OiCtyOAXTD+auQkCfurgabkIGKBb+oW4VpObJIlq0n4joIpXHJ2JjrkzIBL7JJoLGphWXAh
|
|
RUAZyD6Kg2BvkM5ok9fwS/xLsAn0A2nrlrZLH5EkqKjCoqzzIWTcu4+Me78RGbfw6L86vv53v9z1
|
|
/A/+pNiU5LMmgj6R/9nd3tky+Z+9/X0e193Z2939kv/5K64NutBbPvzhVAI535GwB/jrSihPt1B+
|
|
OhkMR+eXPx0U8iHReBmBOtPUu8kN/AQhM3AXcYzkAY7OX12cD/vjF4PT/oF7L9/Y+4gI4nmdBIFX
|
|
2cJMvOmC7kU5bF/xSkCX8mcImkITpd+x0lcgho9LBk9x+ODV6bRXI4taFMHnYDPVQrw6x2f1Tk2b
|
|
VCSQEhg4fEvhCBY5LRAUaIWrgtgthgPuO/NEuBf43rUq5gjYZ58l4SVwqO3kJGC2ApqAMH4NUn/F
|
|
GYlJwmkFSYuEgSqmrNMRSn7E9B24/Is863ZWSYYobVtck2W6l3bL020tdmRwe8Vz4PgBO645xFPe
|
|
TIopHp8N7aqQ8GsVogLF3FtxPIT1BGG8dPw8/2FMfE1bqiib+F7CHo4OncKHkgPPtFHMfSF2E9NK
|
|
Emp3Z3sL5BocxmCX4lJM3vq2JCiwyMLxa9p0BvZwIC2JJl6Ryy68BUNnEpWYwtL5FcENZCVho4uR
|
|
F4Ozs/7x2mpv2bVj9uhYWhYrsVQRg7EUQNpTaAmkkH+YzcAhbNMafeF3mZK7ApM4bZKGmXH+8H7x
|
|
yTA/eh3NY0cSAZ4kBEFV+d5EwT9A1JItIwuMtdjL4n0o0ydl8qRcgiROqsmSnHNrfmBx8+l7KOvo
|
|
5WV/qP297v6ng/X84U/6fmUwJrLA3otOulm5kLiS3QIn2X1RZZBxJzXWMuS0DNOEU3Aml8f8KlK+
|
|
PJnYm4pXxXKrXRedAyu8uHopZ5XVX5xfjnoWC94HEb/6Y+Ft8cTrYf9SfNb1O5Y40fW7o4+/Xx+L
|
|
7zJyDElgufpQ+nssrMwPKJXLy2PM0wihg35mg8RDLFELDs1CCYskKsKMC0KNHJHEv4pCXyBbo6uA
|
|
DG0+3RR4Kd+nvckJ3nmNlxRBcMmnw+EQcfix4HuP2kCcNjxv+GZJOxcMK6dWzKS7Ly+cID66pWsF
|
|
N1BnZjHOmxKMEDy9ZwK4WBg02PemHgCSV4o1Z2kWq4KWiDDlOVQDZ0sYM6G5rq2QShdMypJiHS+P
|
|
D0eHmPeNE7ehY+0SWCRp0o7m/N/D/n+xPp1keYREJVy4yxibGdP7OM96cfjJrFbxiqOT8zdntHZt
|
|
SGzlTtqQ2XgVhR6bF+8dIQIHNC28iG2aZkNB5vjwaMxYMh72Dy+PTor7L0C9f1l8HfZHCMTuvE3i
|
|
2PJVPOVES6uk1Az+58uUSK9KELHePxu9PRB1PRybzMdewsoDF+c1/fKIpv5SJ8td//WebvKYtw9E
|
|
K93d35DH2X0wWtnO8zhiCJecIGc5hsYqyiJoitjcXKInDmtxwtk7FbGrlUd/QDq8gv0Sndpg68M1
|
|
oZTM3LE3HMG7rFgzx/MFLbR182YaTYHPKhCkyQKxyPyATkfA5cNPyVgbzDBm45WHrQzpLYNFUlrA
|
|
7OIwKUG8bfyDBOqc2mvpiJJuvoPrZkqEPQxcj9/Uy52Tsd75Va1WUc11pfwSAX70KnKef+I7PhX/
|
|
dTs7d+r/3e7uzpf476+4qhUGU7KqdATYecGPU74frd5rr/oy9HWlkahr07mUzsTOS/XskeKZN/Om
|
|
7Nfy698/rRYHbFMvzMvJd2rcscq0i+hoQuwIP1j0lnq6BBUcTebUTGVdT4/TtUrXJ6khy9VBZHeX
|
|
ll6QpRy86ShNB8RZAFQM5spt2kJvy6ZRXgKsVADvV/6AzWzx2+srNc0GZD3PZ2cqpUXhvdJwUDAA
|
|
mLvempDvF/4UTLvTnUDttTsXcZjqeFGWLoVZU/oVk53HZzm1hpTEERLAb8PjPKaHQVPHZ4BvCvxz
|
|
YwVb9aRw7Lw478DQbmascnpLJ76WpCTX+Knx9X8bfm5zbCCLt+4VRnXUXdo7GI9UDBnkoK0F8dB1
|
|
CS5kzE6OrvXoDDw1lD234UK+dJa/OpUWkJaEUDp8apKTSCgs5bav7LwjpJLv8ALoh++buE20Z5Kl
|
|
d2I6Q4AXdChlWy0yulzbo/uZjEq9tlZ7r+ONJVYGtagUxGom9jlZ74PI076Yxnr1Kiz1FgJVCsxW
|
|
p/ttHkcVVp5jWC35sql5LcK0ZJjYz5aIxHBUp1FSb8p7b8jBPQ9Y3RByPytWzWlqLl9za8tklS+X
|
|
Z55qaoa40NDTx/P5as9CUav2dk+7FxKUcNiXuRH3POTLlGCxEUjtVm7kISMrE+I+Q451qKlDkDi8
|
|
FWF1Q3G4OGNSaGuimxsW2xi64pYO45pyCj2h94VrErEaTUMIxKJLiy25/6GGrXqk/AhfxzjiBnMf
|
|
6qrhhqhyG1lNk2uox936opkG+BnBQaJ6eF2nrU6H374OMmagCqbckfKPJHVp/g8vyjnMNT5ZbbF6
|
|
jb/kzYMwLhqp3mbYOOlfeGbQhiHB078bUjp/AW81dgKYh1iSW7rdIRMJSO7CUtsgkcniabceD/hq
|
|
LK0SBiC/qvA8ZjlN8Ls06awDodkAM53ziDMn4DSmKw5kQo2q6sdKx4fAeNu2mzYNlcq1t9ORWvhS
|
|
aRiwTdJEshTrCFGrTLoyTewoR5xHkG+8zBqtIkV1xrS2wJvoB5aRHmTpzPqmXlme3s/vvhv9OCru
|
|
8vX+6Vrpm5GprM/W1oYe5SUhKQEFq0o3XW9tYC7UPaFflZo7w3jhPfkkxrgxOh027wwBa3vm00dM
|
|
HTUeaIvJ9aK5voxL0+DEmUZveq1TT+1lMqczfB1i5oDul4PhqH9J3+Vx8/M1EhewV7FGHm3kWY14
|
|
dlIa5mJnkdrQF7gualSRJLOV5d4OJblkjUTMwRir6FmqL513FmzVwXZ3d3sPXu4z4NHUz1w1zCbH
|
|
4ZJ7isq9/tGqiod1HmkhxVUPwiTwZrNy7KWaqTgG1y5C35tWu0XqOtdlhbE3h91kP8WSAMzcKWlY
|
|
Qy0rlbX54byyMESubEgAEfhU3J1xllfEPoGjV4Dcv9qH/XL9/ktD2BrEffZ3fCL+Q+jXvRP/be1/
|
|
if/+mqtiHDlRZwGWHogD4TtpUy+u9ASu4bX2s6Up566nrPtzEmMlgbmDs+HguC8073gkJb2W7jqo
|
|
6fxhbiTKoCcGECmTMy4yYQ/0TN730YWkyZovFfzEqabzoLNOzpxbg4zDLo666UP/mLeu4bERxrog
|
|
Mk19fd8yo3Tzcv+ds4x8U6+JTXr6biBSGib20iYgZ4fxvK2WuozUnvP4pgRnIJk34t3e3upfqJEF
|
|
EddXHO49UpwlxAQm4IMu3MnKuV7FVUjtwdu/JqFuEgHB93XtB9R7+JjFPv6vm83gDKqTpeGvMNB8
|
|
e8MPJ5NV/cOHolW/8H3y9m9J+H5F5fSKX1hGxsZj2RA7wiTgfTm6kkNXVnVxPfkTh1d5+lizPa9R
|
|
muwftpyr0vdKzLbmMqT4XAxhyeN1cURA4Ov0MMyc6XA27TKFICZ2Hvtqo5qsVR7t/2/GsGiM+xPf
|
|
8Qn87+ztb+f4v7fV2db5v/0v+P9XXE8n43E1mhiPn8Z8AoRobLRiPK7V3iif6xD/gbgfQJon/yRN
|
|
9rgzXav47ZKLYdddAoPf4rmfwh/lDECQJ3p0SDE8HJ7SxSnm1SJOZq1RgpE5Gw1e/LROqRI8cCoi
|
|
UH45iSPcWJ/EhhmDB0+UH/Xo3rX+zpP+6QUJqt6hyD/Uat9zdyifhwiJUyykuzYKo6uzIpLQk66U
|
|
9uHxq8GZXWv0EahWkks6Y5TbFtbX5udBGq792kobps9C8IHr4/rf7XZ2cv3f7+7tSP5/d+/L+b+/
|
|
5NqgozCSphyWBJHjGbe8sA90x+OJIPK6WYDrkewJLDntxweU7LVmsET6skvhhQ7PvDjRqbXS84qV
|
|
+CG62Yd9P84Gmc6ys/NRv0c3jp+ZxCFu0NssZDVhCpXyaKCLDJit72MnE28eFGeZdP/YeqeDpHek
|
|
1G7mIZ0S7Bv1KonTEAq61nMhrkVeo5cxUrunBqS5ozOJkuDjDtqJLm5wTUE/Kg5Cu+Il1KSxmwYu
|
|
PD5OF/zx3u4NuuAWmqkkQDlBwqftbtkPgg+INX+vGMGLE1jGreGBrft1Gc5+c0ElySZ8FqxVHo/Q
|
|
Hnt+wsu4QhU3XTtFNg2Wy0w6xdfcei0GWlKoYTq+ZrqKE5oqjIHpslVZikywJxVP7QCszFHLxrqY
|
|
n33JlHPssl5iWuusbnMviYeQBbLD/VB2rUysH8iu/u0OWU6YVatd1BgMX19wc1B+IuWghfWLfYQo
|
|
BcxrTIBP47XIBTMkq0hj4i0SCcG+B4iruGqWVOMV08Ai+gBuVJZr16om+qHFizBJG8wfliQtTOYk
|
|
AIKHOWIjJ45XsoGIKCTW2rzZpMbNlt391u42q4uIPHPCMVC3iH3kCKMOQwoU0IOfUVmpm2TLyACG
|
|
FNfAAP0j+HMmOhqJ+m3qwweb7U1R53RTn1yUMyqMUAwUiYocaZObZJ7v6sIFOKscDiF9nzPxRpTk
|
|
zMPBg0ceavl5hwOzRuZx5rm9uWcKZbE5BIPl8rnQtQoGHXz8bAw3MurzMJKOLJj3jKqHYmx6ASDW
|
|
bkF1lJn968HxQS0/CnGQy8CpKQ0mf1gOQLDDh3hEJpu9SiFSeverpUct1o31A8HGV5FyXrdHh6fD
|
|
cxP1lpSk4hCQOWIs8MUdJJKsHo6GgOIbrg9z82ZijgP5pnKYH9yGYPBZGpuOYiVg6vgMboijpZQh
|
|
lMsmFDEGgZLa0BRiyf2z8NggOwEXD3nIi8HlcGS4LaWmBPLLx2Gdsu56D9BNb/KaFVw3cjaNQoNr
|
|
TJTlN27J6U1dvy5omzh8M/f1eMhmSzrheHpiEkXsW+UYk2XYFJwOiI+TZEE5lVrRJynFsbwglge5
|
|
dk386VH/x9FBJxekVypJGE7ypqE/JEiiMVwLTgp6YOHl4Sst2CJieeOQxz3BiXTa6jpknmgRSjqH
|
|
ntcMw8BUpTRaxNztxDlqcPtC9z1JrVAncSA0yVufrReVcp03UE6UqLE5L/asbOkulFoIFE1rDgse
|
|
Hx2stAqX+t/4SEu7PnAfzmYmmw8m6L6pLIKVUs6ST5Q7Nx4CJunsZldK+Pf8gIBF30Dh6CS8BZPA
|
|
hKXeJe0iXatI2KcPiwu2gIJhuF3phE1sMYLK4h61tfQFNbqwZeq6si/Nlvheunn2rrKsA3oCTiPE
|
|
EdnWSlxIaL7t35nesuebDIJ5Qz8WIC2b3lyQW73DaK+yPIBIfgBBbyFL6VCla7jI8vNw4/8jbf//
|
|
196797V1JenC/TefYlmWW5KNJAS205Es0gQTmxMHfACnO4MJFkiAxkiitSUTGpjP/tZTVeu295bA
|
|
jjNz5vdG3THSvqz7qlXXpyLfftX0ME9gNicGWsDElOYFJ5RmhUbcEfBgt1iwdMpMQXOLq9xj66k/
|
|
+09r/2d7J/Rn1zVKPy6mY1TfDCsNOK+UczvomHOYnefczpvWn+PzXNohF59+sUc70ajAK73tnNIX
|
|
IgfONp/dgddmO3TatCwye5lnzq9a7GXtokpzPXaxeJnvX7RO18qHzPSvVvfqUEiJHauDHoK5bHPE
|
|
g66Ud8IMIVBFh/o+q2LmSrFymbBbqkpPaM66U/Ab/zk6UhdzgZs4ge7m4xBXoXVu2VOrBwU00wVT
|
|
Xhs6J+3QRZ6Oq3EfhzYrazp6eumyZJaOw945iED7Bp30Ih/eY6LIaGGHFwwOQG6sWCc6LE3WFL6E
|
|
uUHYNXUxWi2xMKGOBcUG4+lCYA1TmcQfBXJCWPutK8nHQHWMD1J41Z+8nh75x4lT6ScjNoWwZ4hA
|
|
WUQfau4Q69/Fg/CI2KbRShszcwD3/Y4pPHwICielF9JFJer3BNI9YdrZS+JjparrUjkO9tyI6ycW
|
|
FJxaHYLQyRVvgcrCu7cv1/Y2aAG+2Vz/pS3DCrc+aSQmA4ub6zNws5/CllKAsE3iFYdqX8mCTgp8
|
|
JJ31zhm6Br4a/d4lNoGVgrjefq+7qHEi5oftnfWNQ2lBu1FbiH4vMcGHAzBC8c1lZ8x9KdPRtLm+
|
|
wb4xxNCw01nFGog6QzuHykLIQVqzvXy1s7a+0X6OohvKsndJhJSYKcZruZjCxavDy2is8q8EG4jT
|
|
YBDUXhY3dz6AEBHUO6qqPcfLxh3l9QYj7A1i8JeoWilVxR3zqd9xUDq29YLfQccKA2isvdvbdoMS
|
|
SX4TCT77XZ8Fh9LRtiAd/9ssGn9+PueDtUbnMB0pf1wdDPL27NkM/e83z1eePrf635XnK0vQ/wIS
|
|
7k/973/D5+GD+jQZ14/6wzq4lKMOxEUiK35dMDN21oHvFJFzxJPkOorvEpdwnFJomDL7EMthyPLU
|
|
MStwx8dnxF5VFgPWEQTV0j15q7i7t7b+4+HLzR0J52SyLGwpK5yt94HEeTJh9ZynP+6E1xd2jvkH
|
|
FYUnZ+MeuJ5x/2LCEsGVuPxqtExTubbjY4YHC100L8ediwtI7+rL+YT1GAztoO6i0mGHe2Vl+0Vb
|
|
8eiyc9m5CpCF1JWW2KN+F2YhBdqqrvIIQxUL+eRqeLwoimlBfQolN4nfG05O7Ml63BFRjwdqfTT8
|
|
BOUIxwad0Kkt/mXE2MJRdzgaVv/dG4/YYwJ8H52wgILgExb6ffaO7R33AQGmQb09P/R9caxlZS8d
|
|
xBZPorzGxwc4VQQLbv7TdC4/Mq7Lq613hk+2andRUMkSeFNWf+a7ggnx1urIv9aHPXFPWQIpc+CA
|
|
uhGgd6UEoU+KBlT5yvVSyQ8weudgiKon7Gi3Wu/2PtWHxF6Y5dW/NhgEcGjd8MoVY66NxdF4v7Sy
|
|
st9orSwP9p8c8I+lgXmUAFijUHxcaBlx0ARHRC9m31sZ7D/Iec+s/nXZvtvt9/LrbAz2f5v5LlaI
|
|
aaCMk/7Xn6t12RGCxpQrJFSa5seNX9o/r715t+F155Y0OXGGyoJAUzMbgVhyCeHeblWuZNF9k+vQ
|
|
Hk/gDVX7yl0LQG2EDV3f3vqh2c7t4m1hAfBBh/iOyeXZ2t831TEVki6jYA4OzM2N3dRLupzgxH8I
|
|
u4Q5/GgOJRT48gz93Pxhty1yHpUnj9DrKH5IxfMFlNkiodV5gNJdd6v9X+bX/f0mGzKaBwePH+L1
|
|
6r/RP36iXg/u1m+5fX/9K6vJ+sNpz5V5+LFtX3n0qP34ltb04Sd36eHjNl+Rhz6mC0217KM2a636
|
|
H53qvw8P9MtS9dvDg8dFHaFMC2yfrx8cfmxW57RUmvXp0ftC0MpPD/EzCAXgTVT9pO0pPUqwbQ4/
|
|
ySNdyJ4v8uZPvfh19jh24GVvTAdXl73tEwT3EMEQcB53OBqW5oed89oCKztITmaP+cQtGF5x7nla
|
|
asn4Uz2ISd/Y+llUVQV/5NZx+sltOtxe4lJ0G+eO3BaBIX2fZRZ5YHdjfWdjbzfziCpW5KHv6eq7
|
|
t5lncHxOL/SZvY2f3r6h0coWNekNLlhY1Rr3MKbph2qIUunJE+xlwZHrrue+lYF1t+AH8NXrw52N
|
|
t9vNdoyNFTwBWfSHX5rtRnhxd/f1odwIN3qSnFVF8Lb73L3wcueXw513W802kK1oEYySk87AzaXs
|
|
5363XSgYQIzQXwlIOFG6wMWPkqrVK2D/usOFn6R3i+Va5sHl4Eyitd87PhuhOYDZui1U/PKWWj+r
|
|
hMM3mz9uBMXQeYE/MEybgin2u6bIcCkFqIRsPXTMiPxpCo8rUpj+brXCh7q9oz5J+oXHN/RjejQd
|
|
Tqb+Db0ZvzEmNlafP+l1R+OO/jimk2GU+Jf5ufDViutTv9usTocfh6PLIVELfaaXdI5l2570oAfv
|
|
mHc7b0S7Ci96YqWm43NofQAVWGmZ8bFpsFW00z+fQrvOr7mppim1emuiJfxuLtsgt6onye4bUx2Y
|
|
5SVqYKMQzoa07jwukPEK8wv0UIbVvTnlsRMsU6uGndbbr88I/EOQhAQHiK1uJumc9ICVA3sQX0Ak
|
|
+qVYPMQcNHQwAUHUGgy4ixyml4B77cAjlkqWAFJFcemplyyrgBKzs729J2CQjWdViQNVxwjmxcXc
|
|
4Dx+hWUBb85WT41fNB+OLz4sAlaQ3ZE/YAV8WP1AnAqcJ6BeSq4GdNJ9tEaVbg/WD2bfWb8OP2CW
|
|
n3rHU1X7sbFKZAMJ+uNYMpwsoxO1hatvTWfCYT9wxK3KGIHHUSb+su9j5mqI0e0MeuXlikVQ4fLY
|
|
Ua3PwXVUFpHAN2vrG7u+1WyUc2KDdErU/IveIsN+wDK+wTyejoCGIEo0BsAdXMDMzgAdnnALEqs2
|
|
fumbpaVFAWNiRCU2qpOIscr6YUAK1hnWAlcGn74274Y5RSuFT+QBgZIxXG20xiwCyVgc/saM7wes
|
|
69oCrYDT3uFkcMGs+uAjF5Y+pE57tX/yh5l7CH603g9JKjoHSvoLwBJSZav0rTOmnbpq9tHvA7NP
|
|
ddO/p/TvQvhK6vCg99u8o+V1+r5c4JEDM7PSrMKuQURtygfF9VPmh07lxzP8ENp9Rm9Qy/Fegf5S
|
|
oRGJAJvlgBQte0VFOtYK+J+gpHQNmI6noKh44DavNC5l8AnSk96kP9z6gpCcHTZliQ9Rp8voNSSY
|
|
y0qStSb6gchLA1PFYDnT8dCirXdYzpbtWO7Iuh1L1JeYa9h/87KfoKCLK8RJsYWCle0kD/FGxK4j
|
|
CiD2tUMtjmfcPIRr6uSM5gxvHbjheSNENoeDh2CHgVqm8WnciulMi2yJCY/VHyNRfrAvXSLtLvuI
|
|
5qaJwbQrtYjbbPwRhDvQn3zlsqngQ5p7HlEMHlaFZWLtAhMtwoYp/FpstAvRAzccx0dLskFfiaSa
|
|
ardNhSxX7aLFtkMdidaBWSNRk3Yc269Wm1YzTxctxJKYcy4uGDflRFHcgl33sXclu46KkC3XS46V
|
|
bThuF6/pcr3+/j39//3725ZepH/r9Ru6dhNf+itd+uut5RIURJP7ek313Kb6G2ykFC8Ix5pq31SJ
|
|
x0pu7Mu1xzf6jWu7vYlKc2d/Wt4hMadtVQT0Nl6iPhXM6mrmdWEUWFrpciQkj7LOauj3ZjAfpkQy
|
|
XMmUSIwrhTOkRm9vcf00Ep2XOIdqtGWMNWQBDp0h0PolwJ2LLVOBgTx0a9PTNLTs34VMyK5vETah
|
|
gilzlLcoUjtqz+SAbCZRgmlMBYO5rC1cnB4qXE+02v2BMcc/Id4KAFmNHBNqj+3DpdnLhYd5Mwnd
|
|
BuD7C1u2Ax6CefjYe199B8Z2yYw+LhJ7S+dgbeHtq8P11xvU4J92X0FgoU6x7dEdTOkHdGE/ML77
|
|
yprGT7p51XB/IreFliOfLStoiHBEMkvy6fiQpUC3IioF86BtdcWPnbSUqidaQ/4A6ScWMABv+5ob
|
|
rmbZ+90jD3LVPYLwZNd64KpQoffxVO5tODdU3Lh0j5kZBHfuWhVDW+FgBYCyQs8Bz4oudY/SCHNz
|
|
FJHZeXF1STXlnAIrwfCHot6MgvqJU9MzegZQ7PPwrMxVb5J3YMFBUuz8xBB2nbOBoo3xAcSWe4a5
|
|
xF7jGjTEK+lZiAgw1145WDPvEhElnHWibll8tR2IMwSXT/tvOmBPRE3VIdgmkXdayrVidEStKYde
|
|
Eqv5bhB0XRzW+TSyKk57JIXXzIuf13ZWa7VaeOIYUfaBvnxETwvFvxfSyjxVe83Ven0KlyQR91Ab
|
|
YIv4ZN8OtV9e+RXovtJaLl4/xIpBAw0dtDT+Uyuu1rq8YoH5AwdFX3+yOOB8bKO003uV9uqepRFD
|
|
fo/S9tZe5ZemeOm+PHYgEH27anNapp8pj52T4xKbWmh/Fk47ztyybXPFSg/xqUTCEzGuva71kBHz
|
|
WLc/JnbRJhtatJGXcJyATZQJPgNJPmQGdDoZVaGYZvSj7jGvyLI57oYnUwGrIRVBghVoKtqur8kR
|
|
PjQ/q1eLPVnLF8ATgjmz5SxSbGUCxz8cmerPX9vOI0ErYuIbd/qchOiD8iuaYsf5IIoWoS5nkW0y
|
|
Y2E2lUMQMgI0zFPNUPEBBKvam47MRf+iB6XRB2u+9LjCw1GVvXrl0BeRpXOEfgudE3tXKLFf9Xvn
|
|
7FBbKIiCmd2X4DUFwkHiLSRXXglEaGoLAPolxikyNcm6bBQcoPtow5T2l6rfHjx5X5O/Zful8l0p
|
|
YsA9P0elHh6rZAyOu0P89tEqBHmuJzHVhqkTY1FXdZNsno45Mn3zm5FcMTBp1JxNo9qh2y9eQNle
|
|
1nZzO5V+ZR4+yj687HSWNBh9TMMScTXLERn9DaJxZ7/YPyDhGRsdnP71kbvgVa8nplymtq6aK1Op
|
|
KKfBKsWGPTYd5xA+/yLzfDX7gqOt/AAoKwb01ElJ1C0dYZkr6Ztpt02hIWYefaN3xxvELxWq0Svn
|
|
93nFvQFxPeWKBom1p1gBqsI76g+RGarMHsRVjcIoQciSK3Jhv4qIoYNSpQWtKwNyscXdYoyKoyFR
|
|
Q8cHxOxbd3Q5VLuJtuVQGZKU0uRTwJby4/pYimHicyFgzxiMm2lqlT0sJKOK7XakL5m5dezfvH0T
|
|
K9Tjw5ge4eb4xRycDfpivIM/qTZlS7wm4RZwMe55GIFT4avU91GQ1HwMEKuzaXgiyFCuUfwI9SCN
|
|
VFH8HSqosqjMCzaOuHPRr532J2fTI0Q41bE6krozwtzWtVFJXcoumPduDsKRLFCdDFRdCA2VzfBH
|
|
Yf/XwsGTQjS6YWEsI1NRSb32+D7Flbm8SqH2uP6+US/pQNupmaR0PI2cabBKra97OK27dc+nzlcv
|
|
v/CCyyWiLW4xqwWmmQphz8e/OtgvGl45Bcv6K4Yr4CXgU0DjXahxPB/OnZx96+IF2IPXqMFfWY1u
|
|
pzcQ5/doHTrJz61A2qUXCah+taqwRqXr69quNPH21uAHXpCvr7mNt7el1KbtXH4Er5uIbqdUbLTb
|
|
ibnm+TRQ8hSKK+Ipcet0F5bnDQhNRjzFA0KcI9GUl8U/On09mx38BbxuetkB9SYmBSOumQ0e4LrH
|
|
3hOnJxlZGxAr+cDK6fDfhFMgKjgkwjug/Kx2iAW8pCZZKF53fmvjVs2+1l5NxIH3IKAA1GUZui7t
|
|
PXZB0HRA9ne7SEdgsczqtiePEiQeZV1oY3nplg7FwJ0h9dwLXyTOzuC8Tpjg+MEuFOl7SqihaxM5
|
|
HNODqnJOJOVyqefAulzJlXP+EP3qXuecYR/hfKbnXcbjzJTjPJ4VCcsBW2x4GU+OL2oK3kKn1OG4
|
|
c2n2q1UYfQ7w5V/TPjGduxvruwdQXr3AcLKYyWCvLutkxzu1McgDvNQguLNAPGLmFlqjxJTYtF4i
|
|
7tzGWSiOTTFlkceuFg+J7bcbO3wd2KKAiBYcBbRk0XKGLMhwrDBjxcLuAYjBMlb2eHTOCHtwPRzD
|
|
0Y84ZpJ/KkQfJv3z4FWWDI56RG6k15Jx1Y6Brl2NsENyI8QJ7awfvlnb3TNno/Ouuh3SCDLqIXPm
|
|
Ym50wT1isORRRpbXDod3WpdGDLBa9oplwBBy8CGn2FCZIZkeJSQsnLNh7QKggapp4GFAUIugtil3
|
|
L7M0Pm6yNo6I1YrBYGrcT5cuPHUpoyBO8KVncby0XF8I8jbMzdwq/T3pfOydE7fQUahHGWmsg14X
|
|
gXhbm+s/PoFK6wm3h0pcEbtlzzyr8o49mo4TsR8ygiwMaBqQfyX51JIz4ha/tnnPTid4vYeM7Xdh
|
|
1nfqb36ob717Y6MKTsadASdaIdGoMz5l5Y8loZx3FtEC3AlmkKgg58/vIyaK5ePORPI1Fj5UMqYl
|
|
l0xUYqi4NEY9oIHVKQcF5xMAy9La9RfVSIyIfOzzGM6glHDuO+Mh9GsLh1iP2FYpzgw2iutGvV4s
|
|
vR+X6hBq+Mo5XxmW6iZ1aalkfbE8LyPZvwpFGAH+uhLZ826l4uNBVxQhUGdBbFE3W/SFHhz0xv1j
|
|
om0fe0CC1fOOARuUvPq2NkI3GK6SaHczUOhKWx8+5oYrv5xS1pw/emQes9ONbtLUmGAM20tCHdrL
|
|
MivUA6Z4hqH96S4IG5xzbEreXpcuytLHl+nEChJyaFFri7SITye0R1OuduIeg7Mx8IrBR+gzjRs3
|
|
iCTB5Kx/Mgk9VeQpbmhF2wtJzD65nH22oocY7rc0Ji310GN9JnuXHV+icy/cSeG8oMU8NY2sY5KM
|
|
nPpGOqrvLM4hF82uWcpI62tlx7wX0mdJrmE6R4cZlnqtdtetUS4eSLn320WPfdnTlVVqXgW+Yh1s
|
|
vR3iAQxdEA5XXqzaAzjIFIozml6aY7LTop+G5WIBtgtKZYo7a1svt3+S7rntTT0homuKeDRzC6TY
|
|
ebEsmcemqT/ClRp5i1YnAEavTolwYxtE65a5Nmwn+HMy/Qhm0C6MJ/QEe5EyOfFrfsDeaZY4GH0o
|
|
mCzdFXQzsy/ebm69kjUa9O3t9tYrI415iAeM99eyn5Vvnt88XV6umHDTNmbsgqcrK7oPHsrGF7MT
|
|
Dm/g49i8XAjVBFe2wqx3kkbItR+hGsTi8hfibRvgVYmTld+r9H6lAnaT2zKjkNzpb82Y+2x/lm+e
|
|
Pn9K/z274RyMNz+sbb6p3GeT203tR401PTlbW1b86l+r8cLWtfwstUfupBRBz5iBkB1a9A6b+Hzm
|
|
qsVn7srF547Vi8/dK5ifmr2K8dGV/HnLGJ+VvzWwOvW8mbWGed6/bfC885znTHc05dG0p2dp9rSn
|
|
5oqzmjrS0rpjVay4YnRl2D8jYQBCi1ZYi4x3y7c3fyEUinwuFv4fJWLzp77ljHTpKdPpJD4jblzO
|
|
SohmN/NCvNVnzqJonPMmku88VPie8x7nFxxXVSKDrMFyK1BguvBxVzhX5nvPm4xFa0LxLdHyyswR
|
|
c3Qui3IJlyMaHDYbH13BUWPpt6XlOv2zQv80ulX6x6bvtqc99Thls1Q+kG+w40m1i1CYpaXq+6XG
|
|
Ev23Qv89pf+e04WVb943vvmmlLZmOrFY5CfB/OfQMEbzZ8atiQuf1DasTqNiTXO4Wg4YFcoXGjxG
|
|
HAG6anJGIgDrWpfqjRozqlw6a12sbGll1gZOpYyFXxq58Xpt97XN4u1ZHE65luhtWOulLtM2hR1B
|
|
57ItKixq3LQy5VaqLCtoByO8uGJIeF+mZ8VbVXHbIHjWUWltwT8IjpH7wbWlOXASLseyaOM3dAlj
|
|
2/lBYJbNjsUKxkJeYieF43bxO3vg0HlLnSQatuTMLG5jhPX41otrp6RxToQ3LKPI8XHgAbEckq2H
|
|
BgtLFQUW2AYQwxLOIUgXPCeXHQUwYr/jIg2BlfsFQkeLc7oHFsOniVcKRCoBr4vQ9U/9zV3v6iXU
|
|
N6XURJdaFlUo5VYTDk2xHMh9w6BYKEhLxeV2u/B0aalgrqkv5fqv+7+agyeGrhj5pl1vfldfLBQq
|
|
avS2itOUCt1Xa5n1sCFIG48tBXrACgwNQHXpDcKWhtsd4HFU/or6nKET9L/KH+8n+ZrNv4EWtmks
|
|
SAUrExh6zuKMeE/jReujPrFp46f97tfWiIhzDzfQuZ34S2Zfvc+oJbTbJkmtVhM9Ifs4rJoXnfEp
|
|
Lq5GUvQkaZdDxW0oAxM1ZpGXjYxVG37GLz1pl9l427JSqjudmBW5brAPS9u9iLL4ST3KWJmNMatW
|
|
xwP6x4H6wURRrR53Lqp86qy9eUM/LbIH+mUyuQcDC1G1ioPNWddoEipN/X5K32ECuEbz9/9+wA4a
|
|
f1frDnwXeZhKHLzg01dqniLrpnTBIF0ubwU9LRlToTxqKmgazC+s3y1wBO1+s9k4qNQ4dELwfV4g
|
|
pmC15Wx0Q82OewxHehgGZKY1RPvQxlM5Xb6dTy4mmEy+bhX4iWgZhCUIVkm1GmSDhN6LVkihyK8W
|
|
AuOoDoDgUMFptMuGvVlO5SxMe9dG3d6lvPfS0sistmUMtb6Z2jidnLtbpyTyfu2TBRGChop5x6sb
|
|
kkmXjlNEOXAo0SKb1RRs0s5pf8KWsWFpIrHnHzlUCw4SvmCd59PekMvuZiY4zp0ik3zG38/yiPwy
|
|
SGc0nv27h5QWi2tAypxmmS5oDj3ZLxTPeGO/Ly533hcfY6CDS0e4dKdR9cxGChATRSdCZH8wQZRo
|
|
9cCSX+EubRo2ev7ibAy+nV1XEx3JMRd3aIvj8RRN1LFZfvZcjCxTecr279iUDl2FVW94PlYqtvz0
|
|
tvCH+EitRygDnEeTddNKFZPB6GPvg2T/9fYcb3flzAisdV7ffvsLvKVP1GEMiGlCxTJ5Ac2g11FE
|
|
0Mv+efe4w9haFqSSE3gh6n5R1dqcqa9rcfjqSAzBjpvdfnIxSgRJSpC04GnP+A40H4OOmWrGqT4M
|
|
QN3xFSMgjqzp+OLK8bGOvkJtjgyBFWa+W954Yoo/r73Z5LjcN9uvaha/UB3HRicnovmVcng1YHAQ
|
|
VSdDaKtlXGF41ol6n54+m1jtvQWnEN7ZBq2fSH9VCOAs1V/7RA+7Bs5ZfF9kRfQOpVOWKuwzVTjI
|
|
ofdYpnrI8aUKHW2TwYVlziXEqKzxTdXIL7Bes7XZKCc6I9N7N26lLcl7QD8wxxew3ReKNjq5UK9p
|
|
bFCdaMpqIZrDgmVh6dwf2xiiHHdt3Nfbsq4xHwVluPcEfVMAOuxqsOu9LOCVGvnFU+3XQDDLPKcV
|
|
m3VPwgZkh/i3RbjohD73NkzBZubt9QVGfqs3pROb9pNNvMYxBDgcSIzTsEluB3asC8eTs58DOIkg
|
|
u90o2CL056ftvZe2ibxFdM8Nr9yue/l9euPBegnzKlyy1RXaTnS3poVF4IPsmyGQYTCG8j7qOvhe
|
|
AMoifsnGCrCe1aHfOVFGHCfAMsB19nDYYyD9YAZxq8CghoIs6FNz2zzI6gSHo7uQ1WFx0ckXFg2X
|
|
tKQXMQb3KtNOd5C8eXaJNpqaI+qqO3M5Uaz7LH/2Se40JarfVC/l2E6d5DjEBQ3IcUUBF0yHWuqs
|
|
H3zktZNVQLC6KPVwcAKVTGb78ouyQ53cHu3lUEgjIfyPENM8RiqL+5yzSHF4yg7epiIokuLyII/0
|
|
FZkPl5oOyO8FDshV/5tn8By54A27VwSXXRp4U6BbsExvgD7o5HkQ/aGRAFFAyHWCMFVsXdr1ANuz
|
|
KRzFlffrjpAualA6dpFzqhvWAJDIT/zOQd1cT0YXbQQy4m9bkw012Vm8/ise59x+dasocFf2zfvJ
|
|
wWNVD5zyzf3C+6Wn3xzkqQyYy8Qq4FZh7A9B5hy7KwG0xE8XGNKdR76A7cbz5Jvt1rdvv5EOGJ8X
|
|
UXoiExx0JGAqa9WDJ+gTK5tQ4wM6eivSZCMQ/MfnSYu/Utktw/1rFtG1RUa/b+GBduG7wrx6bcm+
|
|
DX5ZoXYUUVy2w1fg0ulaJShzY+vlXc00ucNL5yGPbjzg1i1c3eSGEvnIbnJDc33SpnXANTKW0IOT
|
|
2xLzvb4MATMJeGs/ebKDzAuINaG0QuSgFTMgyjYwdD7XD20RfVsp3DXJLWArYEC/aLLxbnoy6Vpl
|
|
Xml4p72x9fPmzvbWfgFNLhzE0+nIQd164JtCllS8p0a7YtBfKqZAF0VrAsvQEKp33xJbVnop8Mww
|
|
Zs13xD43SdTU6WchmGOx2VwesE4RZyXlRRHsLoSbCkGweXRi+RgWPrPiRdbpzloFvMjtakBw9aif
|
|
sCvRwX2Whtxmes2/+Vubh7W47POkKoF+T0vnvTfmnPW73R6JUtER7xvQNBw330+8Mk9BFUZjP9jh
|
|
zBWfUukKi/Nme/1Hai43aM5yxYbtD+XYodXyABMWRGgUIK8XFv2K4HILB3Y1mFujb7fL2Jt2RVbu
|
|
sUDyq/YV51T737yE8HZEqHxsQry8xoPc1fV5xOVOkpJ87F+0l76MpAyzp0NFSywPM4SDbmF2cLuS
|
|
3u+ZSvEU/pY9qaljXqgHfPQW6xibe5Vyne2jWz3/7TP/YN7cC4p8B9H5RplxeuQFdWu1WX/xtCoq
|
|
DBpv/Pyb/qSHV2tmG5Y9DgbtXanfJrS6r9f2HOOnzBnA05E83goKpcQMrkhKqHuBoa6ZCaimKr8N
|
|
E+c54LU7HH1nPij//wHVsamno+gysLmJguFMULnN5RipAWgb1swat24iENoMtTiBMyWbl0CRhiQI
|
|
jEdsvDINB2beMQkt/yHrvUcXtYWUvJLeJBgt8wKDZF5gbCxMwn32zd72W9k2u+++lyMZmH5EAgvQ
|
|
AdCXZzN2FP6pHjymXWH8Gpu0i0t2e9SYWVwE0BIdqodYqRP5SvfjM133my0WWjktmVayL5Kf4kKT
|
|
SqqWpOKLToKSbc1+Z1KH5US3j/tbNARyq7hk/ssU3DYMTnIaHBzktNd8qmY+PmI+IOeN8BqNrKf9
|
|
wgm40v5XcAQwsjPMi+5ZLHJ2Ti5DxwKv/mlSpxOV1XstjWAUDHfG5dAlfXrvJX3XWv1zid65RH37
|
|
bE+4E0/yJLtCVqbzC9RLHw/NP1iB5tUk1bSiTPC0gOJhtcoswneOJ1NWUSEBBqRwDSRQMnzjcRVu
|
|
oPCt8XoLHTYWmZQK+Ieo/iSAUfIVWJVx36ECdEfsG34iaSjPGEG3i6QP2uBDbbBXvdq2hgzsiVW9
|
|
Wq2nVxrdeiM5Nt2Jd2S1dhDqRykEx3D4MbN0aCfzFFEa1RlrzWbWlQbiyK3ss5V0rjoHZPI76tSp
|
|
v1d98mxebeEAeDuvpMk5V/hhPuCJCTinw/YczPPJyLyorgKscHpKhzBomIsZ4It0mN9QiR+Co5gK
|
|
O+QC0qSLL97r7H2z8fPGm3sxrRmOT7siPB+z/LGQyo3Ik1DlRkgvuBXp4+h/yzH0NRVoD5HHrCnA
|
|
37Q6GGaQVoVY2OrXCN04PiOObxFuCMBnql30Bnhid/PV63dvgWoN6fcPgDWQcOAXgtW0WjseA6aF
|
|
c6r1k2SKoMs+EBeitIuL5j9649Hu7hsOywZ1W4RmE6nCuWuDzmn/2MIq1Zip5S2G0u1Xzkt+wZHa
|
|
ybQz5MhRNo1MRgObd5RnBAUeJgxAn/IYQ7Z4+CUUzIm4gbTtLEpvguj+E/EoXbd4toU6iIOmIEcN
|
|
AqreS+qP64Vit8D/oLkZTJWIAGfgVBSqFTjJR+wJwOZser6KjaLXHMmR5tPtbKC/dYiyb9xhAefH
|
|
sGx5tE5o+/bG/ARTEJKPhklybn57tvStqfJINNCkEQd5Bk+banLWgWk7ttwHOGohqAPXRedaV7xJ
|
|
ZEPPr0uf/ozyNUvp4fFQoonml69Pp8oPw7zXt8x3bfNdef/Xxff1gycVDeXO9ouzqCWHiLVSELMH
|
|
d1QuZi72U17OQV+6DSm5hhyuSmX95BAYYoIHEoKB04KeX6du0pnjWdXD7q5y8gcuVdDBAS0x1up3
|
|
M2uMLZ4kijafP//2G3CXSCTG/rEskRIJoX3al0BA5+zKIYgaQKF7ujVrG2ugsWksuWlIDjUNT9WG
|
|
OoYRsdSMqpgg2A6AHW1ehJPiv4eYAPE4/Z49okqIq+FxTPgFW07McOLbozlxa+Ztpy9Rgk+UEDbN
|
|
0WhyJnioihuj9h5G+RE8mPLF9IiorCQqZpDRrvVTSKGp2kDHySW9+6mUwDWDWFxBm+0MVUcA2ywY
|
|
2fOTKs1i75JByoEiJDZtgJIT9Ty3mLZ8qHPMOUPjSlAqQHTRjLHzR6Pmdkc0UsuwrfNAsH+O5Ei6
|
|
6k3oVsPGqmpmCptIipbI+sbO3u4vW+vWK9idDagodTAkcM4HkC/9hfiIv3zedJMJ38BfVp4MLo7x
|
|
z0dz2aGZPQXSHEOHEhvA5aVrZaHK4yzbtZLa68KcxO/aRwe0YxlYz6Pz5rEu0gO3E4JDsFLIK16H
|
|
VI+x1MgGbsthBQJbea11PcJxd4vTGrGEOmLZ+7gaiyNalBdK4pbxCoJ7CVjsETh5ogUYfB2JEFbO
|
|
tu6h8gdIYqdKtnNi5Zu6XQAJfd5lz+qOcBV1tJszrmllCRXfrZ6cw1kjdChwLeZ+qCepYjRoR+1h
|
|
HT0lyROCzmafocan/AvuHAju+fgK64ETa85A2NNl2/YeMXXHMYJRhOVHVnT4iLKS/EB6BLREZvHd
|
|
BTuJ0A7AtScJxyR+J7qviKC2iLmDIJFz4AFm9FWTk2OD8SIB3CfAs5iAkIR3piZcbNh2/rEWzKNQ
|
|
byGPaaaAqXgyHTjiDafw6klDzxsiBmH5FyjBly9rgApGBZ9XcMAjohPKI8pXiN1FqjnHWSUeR4YY
|
|
010khwA1TZO4k8iLGI1yzoL7rnLPJScI0YGE1FKc6LQKHrH0Nmkex/OzF4Im4xaXv8Rsv9vb3Xy5
|
|
IXDNTdFZ+ySkfRv2gL3OmYYUJyqF7o4qHNJ6Hcjr1vuOgckD2HIpjgQ/CZNw+GyCUm4xlBlXLcJ2
|
|
Vs3/h8GnDzx8Apkee3SpQBliu487HBbK1CgESa+4pFXc8RDAkdiiTzQCcRILe5zpOpGewsWuOmBw
|
|
dFob+l7uGRAE4Ajsuns6e8Dg5Gu74mJyUqNlU2C1wsfgkYCc8APeXc81dCCSdRVpFBgPvHqK5Yxv
|
|
ESVB5dyDz3lXqQxalSYxgRrgOHhm1ugwh6Scy6VwNhximhmsmC7J8SsUCcWw+WYwQgoXASOfyqED
|
|
j9TAlzGHkgb9zyOkX9xFbaFyk6Y7HQvW6sXVPXf9Q7NDy7cabN1FCccjKudyaNdFY+pdIHkEORjO
|
|
Hc8dLQ4aUvFUqlaDDSM7sp+kdrm2cIL83PQS4ux6tYWw+/nrFVcLJn+p8j0/HTFue3iqFbhv8bkq
|
|
c5T7jswVvxMetF8ybQJiv/dmV5DtZ6PAM23IX56Zg13PcVpdF1Ev5w1hpqSQIwhK0nU6f7gDSP/j
|
|
kH1ohXc+hoyDnaU5GHzdY/MRTqi0ZaAWY/fCHOY7dtdQTiGtGgnaxMfbyMF38LhaTMgGCSwr5ql5
|
|
Zp6bb8zfzLckgWaiy5VZyMrGqdhwq9bhI57jofgbS+jCAchoZyEBBIKq4UciL2SbC3sQFpYTta32
|
|
C84oL9GEPWSkp814nngPeiuJieLRnPc6Nqp1BDiboHIps3M8QdpHEmGnE/cYUwamJskoJSpagG2W
|
|
JGtRYQGfOm+/W9Z15jLM7364NueTk+yKnV1VahWHny9Zs7wC+9HPmGbwFHb73cjqb4804aAllZjq
|
|
j0mkb6YRe89Hp4mg0bX8IuAp01Tt3bgzEd0JWphysP89NDpFGIU56HVVXQDcsHJKKxjuYoZugdbO
|
|
PmbVjcEzFZGNnVj78F5a4du8BG5fVxO/OwAfFBjjBMAOne72qt0pErB32O0/ygFqypL7rM627K9t
|
|
IOCiXT4OxPcxwyoZ2Oqp1FGhDlVetEk2cllZV04qni8nDm01Xa2vgv26AlNQ5rGvbzKRpOpBolHa
|
|
SP1hVXVVgOLiVK3WmMyRegrmXGd4bR/r8LWnixb8Idpx7MM7J/0Ja5xpWEcIegXy8qirbg8SXavJ
|
|
7aqN2wAzOJOsxuamTGW9y32WuGUEtUt0R7fPwV3t3fXG0rdyv5ZTTmT3uN7ao+vvdt5Y8Pp0DXek
|
|
T5uRLJMHQ2JaMR5iIMVwiM8HtHH8NL4w8BT9Ze0xra3USne3UtcZ60zzx+npz+DeVU7jhvX/zFRf
|
|
m8I/q3toDFxIuVXI5MCX3+pE4Q4aeZs3Mhs/rW2+CYD9tQoGYZdiNgZ0gKMM//xt6BE7EVgh2iNx
|
|
yTsbrza3t4KiMRDXk9vF6P5t1LOg2r3OacJ9uo3RwVzuQ6Bmh8jUcfgu5+CjR5syq7yRykUMQ4VK
|
|
xUzZLDXKJfiG723/uGHbnSpWLPUCNofEZODrRkPDkbfWMa7PkH+fmoaOptFx/cVFv7taPx4Iyqiq
|
|
KKSsy9H4vFtFBLePWRTUByvbj5AYCRyOYj4yrgmj8RNxIBKZTILijkYkPgIP20aFz83t5F60ZPJM
|
|
MljRgK5NJ2e0cv6t4Z/f9zpjuvEoKQgd9YMUBvfgcyODLbNYVRawqolFMOa3Zr94jQV/e1CwJdHe
|
|
zBi5Ij4mSiQUVPD7SrXMhj+J/6ezrP+/+3HnzB9YxxJ9vnn27C9Lz5ca3zxr8N+lpQZfpzsrjedP
|
|
/9J4tvz0OX3/ZnnlL0uNBj33F7P0B7bJfaYQNYz5y7NvDv+BXBf/HXX+P/R5+KA+TcYc3Id0NkAG
|
|
ZthYty5Au53SlkUKSRmi5ttmqIHldxLBHu1wjOiwc5GcjSaab1IwlKs21tOqgBfNxflUBEdRT1dX
|
|
pSboO0KTFZQbNQ5kH1x0hpyUcuSTdLWMFwagrPMZJFmkhMqICj3vH9UAhIBO7k6PlEfQ0DxhRuRT
|
|
VsyHiu2q+ZQYgZsnet791E9GY9Z+SUJQcJot1asl1qDJhSK20X4ubRrCLp28Vy4zEOcfazJg7pXR
|
|
nNBvt99srv+yGOUbhehyJa3kojUPHX/0O/EUpkx9tS0l2WBvbefVxt7hzxs7u3Qst3+rXdX+TfLc
|
|
2Wg4mo4T88P2zvqGZqKWUVAds/BQF1c5pmnRR2FOVfiPjNSmLOlSXf8qUi5Prh5NoNyMlUsLR2ad
|
|
g0q1TNVOU5HleNFISVZY4CFlhX1+AqUnfoQx6Ei/JOM29CWMe1DQRomaeHG8paVyTCdtNB0VWScy
|
|
uNG4T6z2gp2lbNIEl2gOjmqMV5/4hcVFWaCZoKjtrTe/qLuyALwkAIDRtAvueV2CECI+cc4WTvAS
|
|
f8Zxog1JUugad9SbXPYkgTCvbwy99gyREp1McYWHDx86bqOApmg+WiS4w5rvabDryYl7RyHleWFE
|
|
2Ac2C0aZZ7Yu6bBZR1yRzdk56SHxDNw/AIdDTBNmBJZ+mYTHtiNwuoWyghsQoCwzmZj0Ncic9WVJ
|
|
geEkXm+8eQlANlSpveSKaWGcgy0Lt0SbYdSg++hdyhSjGvVR+6BTJn8+aLuskkVWNFsDgDEhqmwd
|
|
bNlB5XT0s6A+YdctasPEpMQqdsW1SDgUPxOCX3GeGyngASjR2cjU1fYBsSgxpxz6AvFqfYPnXlf6
|
|
q501uqDeR2GZmjVAC1GMDo76VzLvgKf1nBgBad2UkZRbHpQEmYyK16K60UjtJdMZuJfA5C896CQW
|
|
dh1II+IqWNHKhSgwnIcoquSC0O/y5s56lT1NkS6gEyOaO8eiFg21Vq4ZuFOqzs6pOHCLnsswvrZ6
|
|
J2Fy7fo9mg4uxIKopbmJWRSiooODwgAwghOPF/gGnMfZ8No7RvZEWrKjcRcYZffLDefSdzHoPWej
|
|
k4tH0/75BHZoC6nEDXPHYbuejD9J2H181rQtWYuW/5KJFkb7+RIXJxqxtXd72/45I7I67RiTktxz
|
|
097TUInA15YiU+eU0A9N+dKOUp0ZA2CQ+qfOuH4+Oo0Gh35Ld9dfb7x898Z2YxeNgrM1k332PlJi
|
|
n/jzDuuSEbTkdJYSZclRo77f3t1oR/SwbN9syv6kuk0h8mUqwCxGaxQrdyGTwGthYXfjzQ9seIDE
|
|
U+72rR/a9fdAtNvdfkcTsb90cAuQFCBVXnYr9WKZuLTe7Ae5UJ7oqEhcxd0FaqXow6x4+H5pZWW/
|
|
0VpZHuw/OeAfSwNjVWuPWUMGNOwo55d9Z2Ww/yDnHbP6V/Yj6vZ7+XU1Bvu/zXyPfbstVGWgJRLj
|
|
ZduzcQs17Rhr8/z1wgLoLcPZLDQxSm7xN9vu+Vv1EJMg88mZ20VqdLTCOHA1FE4l8ZAKPvGjJGzj
|
|
nJAcDCJ8FR2JyEnFOdQUcYWR+oKtjWLyN7fV2ge5KuMkkPHGjTZsTMbT21SGI3q7qfuexoNvhoU1
|
|
20v2clhsk6iAvZ6uIXgl3tDNtr2e3pvNdsPeon3dnLmx6aGvrqrdUWZo0Jt0oNo3ZWG0KjXzbtiZ
|
|
4pSfsPTRbZrnS3Qc/GtKY5XUzzDHbLHG6Y04IrNcXfnaqBo7G2821nY3dg//zy5RRM5L8QNnypLz
|
|
WJrOSAvbWzTbDFIvqiUgkcDFTZyjbLIRsHUSOIqdBZkFK9Hrt1gV1WECxUotNqdUmoISy8kIeeWK
|
|
T8255jPkpOkWo9RruqD6lgfHvSoyrTkeiBvMCFxH0NDg0vMlHlEWFEfDqwFO4LW3m/RAl/iUSk02
|
|
tGX4Qv9nBQUNxik3R09qJL8449h3CCS+AAzWs6VCKptA7HCfatON+c9/IdV2aXJ10Wu3C53xuHNV
|
|
KOVpslJt3T/IMy19P+rCb4pYI0kxGnDDYMGIzzQvHJPyok2n2WS0aOUTjkgCG11ot9vmBfE6qwWj
|
|
akJMfKJOSkFCvlH3CjntuY5D5oEPVYBwdgSqc9W8QEVhABJjaECdjhuiTgdv9UkfCaZ1QfndNF43
|
|
PZ6buJauzwyzSOW+w6OVQJH9afaLnDZRHikUqfGFmY+d9+xj6Fr+c3ZNYJztOYfGZB6Ys2hAaDpj
|
|
OkBsn0u1/QMOWjgnEaxcs2np2u3ipELXa5gsU6+bQqGUqScE96YV8qJ8rwakavR5AdttgaTiFLHd
|
|
cedkole4IbZlUd60iizgt3eJtn3Otg1fdjo8eXHVzFsJ1Cy8er27Vq3VaoCsZIDUVdBGXro1gDxC
|
|
CeNBMAu0/iVTIe1ZommFVfn9rLa0iF0iSQwLtYXTs6RzaOuM1nXeghYHZKJv1D6L03oBx4XRhWGh
|
|
X/wz1Ev6cymOg6D1wzGf4IiX8WfQmYhA+n1XLL2flNzmi/uXuw/p/sztNPrY9t4AKL206Muudni8
|
|
Ek28inIi7xoeTHaovebnGEQ341mDWzE6KUYDVwMgd4fl7Bp2Mfsdn0Hy1/KL9s1q+6bdvnlxs3rT
|
|
rpScAa/UThf5SdK3e6rD5UVkB1ktrBM8Dc2SAvO3gvhGfDRDwOgiNz9E6UWpEhIqFOpJFYrNS/lQ
|
|
ekENlrd6n/HWalQXP64vz30rquueb0mKoXQe2aChGqm0ZMcwr6AorwE+5TLSn1UqeCF2moocpNxj
|
|
UUYAR7PFyzSaW94QNq/DDHIa7skMFWUGjLaoU/IVmGgyEeozs0bV0pVy7dP0fNgbC14iyCLR9v2D
|
|
Che2X4Tjs3/kvOdz2bLSjc+BCj1CZFvabB9I9B52yQjpFIanFRT590nyKY9if03O9qF52TsGtykq
|
|
cQjLNaCxJOb0fHTUgc4PEhDQ7AT0WJht4OEr9zkS14qBqgNF2DBlVm8zkUend+gw295aNK+3ofFr
|
|
qMaIauSVsGhCtaNo3JDFe9eUaTolF10yHQxgerUgraFrDVXw8vv112tbrzZMeane+NrOGtKnNnC7
|
|
pCP8FX0B5eCW8hXbiPbSgqZsP5wQw9CbhEcYqx15dHIPM1X+iBIVS5Aov3BkX9AKLp8LzEtB7BMC
|
|
+/MsjnwArYylxxyTvW1XWEHqpUrQZhkRg8N9zFkWVT69te4CoS1a6G8kJ2dI8ejkREJabQ2soL5q
|
|
Q/2NbB9qDAqjl9LEyp7x2QRRmAF0LeJIHBnMPB6MG96Y49jIT3eTPDhveVOTNtgstg2krgVA2aRn
|
|
qgmRmmpODrXw89Bs/bDaXpYMidZIwTLJcOTYJCuYcPr5RFzDO2Cmarll+qme22au2Off5ZZrZod0
|
|
zuz0J1519oBx9Wqe6dxX7fTPNM0Ur+nGLVxeaOBvs4VEnio2o7XIsO7gtZf1MH2f2xK8YRN5gHl5
|
|
+MQ8tq26cc0LD5OSzXmfK9n5o1urr6S913MnSR/2W8/bnJI+9NwyILTLxszkd7wLi9qU8sYo6c0d
|
|
fVpc2QkAHJC9aJsQTUo6yiH8nPTT21U6dvM4u11zZo95PNu6MHcME2i1cUwCa2FOlOP9hlfpjq07
|
|
L8lTKkV8vMqjEeAF0L57RWgRLsbrhx5ta1587D3bMQjgqApXIXA5oldqmg+6h13SmQ+weon5UMo6
|
|
B6nWaCk2ytB75mh6ckIXkQQ1sRxat9+DBmR389Xbzbcb4mfltOtSliavEXQerBKOhZPs5Mx7IOFO
|
|
H6luj9FEvuvCQYPNdJy1Jt6gV7DnXHbG3WS/ag7sQ+e9m+g6rXp3x2457nB6P/GpGoVtxK2AivJI
|
|
0hDgcLlxv1kxrZnM9eC5ETNUXJ+nHIBuCYv2J5Y1ZqubV1g0XI1zqpzbJ8cXRP1SvoFOOG6CDHG6
|
|
Pt+/Ml+tfJe+ruOQMzuz+u0SLki2HyA/lBLAHD6uHjyu10txBiAboXncqK4sLaUOkT/S2XuNnUE6
|
|
Fva8yVmQJVo5MBJLnlI26C6yxXXRGRwX6c1FgQK4aiHofkSiv8CkgfN6EjroiLvBkLYwUmNr4ufp
|
|
uPe19dnCbh9ye737ce+3ySoy6TDaiemd0BxzjhNNm+3AtJBEHCGaPbYUO6jmMBgoQ85m5ANjo35B
|
|
jd/vi8gh0mTwoBl+hTTB7J1zKLPhUZdA64SpBmyc+0oLkCS/kNHGk8JpWy2oPCNuxewqcMgreti7
|
|
lKwKPDtmgkzh0KXDMg2eWbrlnueA2+EneOAbzp27+dPaqw0c1NEz1/5Xs3p6djyu9Uf1yKiqjImr
|
|
Pn7ptvmpeD2xD0kUoKwmJRZYU4o06fHVLvrDITy9eNUOR5eIC6RdTqfC9BgGNS2sQGVjfG4LKtxp
|
|
FC5VMCY+/FNB1kGe+wiWhXhSa1mcdlsMeZKNwCdnL4mmvOQwiVyuDe/ERuXBVqFetHbMXVQzfXeg
|
|
wcSOv8NqQHN4iUonmtXvbuHCxsNlysVrmefbCsO3K0lnJYeav+/l68wOU8VrNzu3LZdfwZODlnXn
|
|
4A3WYoLQCjwQxGWjJetkb+1VW+a0hZ2FwIvqcFTt9i4k5MfzYHlxoDYBx8bWz5plGbmb9cdt7ajz
|
|
sVYsc+uqU/Pk0S+PBo+6j14/+unRbiU/bZIf1Ld0GWMa9jYcuwc2SonHpPov0Hj7YA6oTjSiQfiD
|
|
kQgp9eBB2tuNl9SLM1qr9IfLJtYibIQGvGFcO1eK0GEXbnqw3FkX9MsR8CbbPaxNOHYJYkkpqrWc
|
|
k42nEg9IXhqXaFhSw8AUBYva5r17ZrI5F1KZmfJPxECckpTZvpc6XCT3cHWFuycBfll+CmQDaVaU
|
|
jAOVdLL+8nvIVVzBbQ1AA6mJabF9tmTx9LQi9ico1WbPGl/TeKFoXBbsoJfLsaV9ldNHgquaE5zK
|
|
6+AfNE4Sdc2IRAgOZ4escmxkv02IO+sc9/xUM3kOTlBT2LXJN9kzC4WKx4FLyzIZWdKEsYRbbFyH
|
|
8/Oi4/BqNEWSpnPYi7v9xDfviKS0k/OroBUSauoUJFxWIbvid+EC5sgjQw9ZVzGGPxB65PrXPWaK
|
|
pYma74yCnLCYMoPGyDTlBZV9v7b+47u3HFXGD6FJ7fBy3bbL0nM9YG7pwiRxJ2D1rU0VlgaXsFl3
|
|
pv1uld5T6NG6RG2ol0pJHCYrGeSZGNuze+St2akQ8+yDEiZuf6a3PI3r24v894oYA0FtORuMuhb9
|
|
kK9mlWMyYIVwq0j0jE39amFDJUxdM/ow6EgvPI2g9h0JlrVDA3FAH4zCwDDU5wiaSZIrGSnVzJVT
|
|
wKmVSDsnAJ1QzmVGVTLfyMvB6GZHJ/NgtERSd2ctlbyTLpTPLXJpBWs/fQg7ENr7hALLB9ldNWPS
|
|
HEUN7zROw1Pd87XQi90psCbemYClfLu9u/dqZ2P38N3uxk5FY3Oyd19+X5mplOLPajx+duhopu41
|
|
dvOKjnA+P6+Olh5atu/2gI8Qai5D3Q2DxaYWeq2Qp68JFUish5FvNHKJZdWJBWPe1/HVOavgTjJI
|
|
c37Z6U8OxQX2Sl5oLHMyVZcgOu8cCg+GRD1oIyKv0bM6KsFZeTwad12W0Jj9KhQx0AxkEXCQF3Qc
|
|
Eu3SrZ8E7eDMGwB94kxhd7HQvkSryWI1gsNEgMxyRHzAFmR+jmzE7dvsa3sbP719g6MLD2ReL15H
|
|
92/vZl1gHVTnPPT9aDbzrFRM+S+acI6xr1aZE3u+JNMXM1+iIdkwpfVAQWJ9BMEY3by06hD4p3F4
|
|
uzTrZt2tXWagxCP8RoEbJqMbxla4QTTNcaAsN8sBk7cMtUfMAEZKENlBwWKyLTvqwfPVLixMI3e7
|
|
WYWHbb9zOiTK0z+2hyX8+wA9NRLm34qWCHAVGew2h0tYunt7ZDdc0Zb4u/bcg5xd9+1SblQpcC6O
|
|
+sMOJ/0+YV9BG/qiLvzlwqwZLFSoXUF5I807MeRsr7GHObVA9DsjoOcwSKQL3eKAAKLS3r4S2Bzk
|
|
+I+Q7qzSjoXThiqKU6v16ZzV+i9TmtWlUhYGz6+j7XNvHBr3gOAgnVSGtuvUjy2lxlaKcqNQvMbX
|
|
24CQfcGqcYOUBz4VokIzBlWcZU9GM4fRSjfos5edH6rsyss8GENv5FFgeL8OeoMjTUCvBlJW4iiF
|
|
UEwW8YeHIMWLTo7Cix7HsnlotrMRk6VkPL0A0Is5vjqmC+UcDeVlh/51+siKOowOPRLjQ7NmBp3h
|
|
lA6HDynRTUNtVLlD4o4ArTF4lbzsgCVsL/xZ5NDgk0/Hh4KewegmooKxuiUd2RyFzL3VB0IJp8Ms
|
|
8YMMMAtlxRJAyFw59M/s6vQ1dZGDlA4h9/4DYyHTMkGY+HQyGnQmApKdLwHrVlQMmP7wE22m/ikr
|
|
s2p5PH+m4y+3/7Glb+swK8EyhSmto+HEjYIFbHVD8N2t4NAGfXOHBh8Z3HnLkMzu9U7YL0n7UTJ1
|
|
U5o1vFbgjwPEG6K9/9FSSpuVPUpIDt2xJUvs/t8/4YhHmxQ5Ch2CWxGD5joWqTvun0xMGXFDowsG
|
|
ZVk0Ah7IGJbE/xMH9qmfwD5k00Q4Ib62EHEjEL1SLFgmjzeYKFZIz8jWrsroZVVGrxQ4pAnnFHes
|
|
0+0yrhND13EJmRZExDEUr+2Tu17CprLbqRtRuvdayALnZqI3LucoM5sZucrz/wJMmLajRmKtgyak
|
|
/t7ZrkC7Z2VJei3Xcoqhy5ZHF6u2nKp0tDb5beLoEQ94dWrL1f5xinm6k5PI3nWV7+ckoYg6mykk
|
|
Oid4or0R7hhOA++f7P/65KDk3nXcXsuuiNQL1f1fq3nP5y0cHV6fPlsChqcXyYR4/IEpPylec6Nu
|
|
61Ww/VzfrTj2Vpo2DLN4japu3e7zeg9OoOsVUCk+Hzs9dRDareMZJcQdPoPql5MNOLbiY3+oAKPP
|
|
xLoAIkXtDk08ZthegouLUBl2YGX/1ZLVKD0uCcEKVQe4Foqqj0uRh+uw7T0TXJ6CYvmcuLDGJFZn
|
|
1eGUGPntZXxlh+1iuTw0T0yjQjfLZTOkpfZMFZd2YZ14TsW5SLovtj15bXFhVoU6hoitAI9nN+hz
|
|
GuPqj22ue+wdwEYmGKBsuAtciQaDqQRGfPpn7ZfafzQ9UgDbfxJ3xFqz0MJDMTOpOzpbljRPtc87
|
|
f0JyFCsvUZ1TUDnDubdQCQw7Hxh8ZlyxuWLRe0I5Pbk32cK8btUONfOWA6uphQsCnN/TYF7LpnQS
|
|
OmNQdmJNooLK7iKrqRbVDFvTbm2BBuvQ9gEn72d4CFrbY749zMoS7B6Sh8YkijuOX6COfdpfqn57
|
|
8LgSusZ5d5VcLQn76wTmFJn20JbFXkVlOHSUiNASW1Fa1Php7nJSqf0hiVvWLUQDLWXFaLiEG8lX
|
|
rqg7E81+fAy6Q8TRn6AuqBXz4LJm4xlGobSgbS74VWdRZ2l8HOlTlyrqlh2C7wnPHKB166zz5PjI
|
|
2PidiBghEQBNPMfOehQDkweDvphGp+WWJoup8mSyNbGAjcStVg0JIh2WFDtGw7ltzDeD7I9sqFqq
|
|
OHC92PMS4XJ+XuVyNFRCQvAEzIkIxMAC8yW5UJVD1Tuwlr1851Ay4HfmEQdw8p7n7bGpzPbzdNo7
|
|
OxWtHCYeCCvgJWnsUyosBztiRh/BeIdtSbkwxn5yy5UAiEzDpgOosPuvjjyfWUQIiJ7gXkVYcU8G
|
|
nlFP4zF1eXa8zOg2TurZWcPHz2bEv9SrKaBOK3lE6uGwzy5Pj5AT0ehbUs3SeFPGYQR3Sggn3c6V
|
|
RScQiFlFa0kQbXBSlbwxOF+4ROt64fPKzUgbQCsSJQ+SU8v0ZzIcRVSeH4/Ncj941+5sJhsjuY2i
|
|
FcyVWZ8fdEY2LuK2q7ubr7Y2XkaoQLSDOZNLWWBkAF0yZLiFZMpJTnrIb9FUbJ+XW7sKEhqmjxG/
|
|
QfYQ/NtS/enTlYqTgW2r42Q/0n/iXhpPzWPzt+dPl5bAwuR3g2RJi2RkLPooH9zlDAbpCdBH0Ri3
|
|
Cm13FFO+C46ACJrGqAvOznTC2DaWMfiOCsZgpWl7ygeU2uf9VCNqIYsuK0XJzuMXbUmZs0TetSmF
|
|
eDnkxuPGG05PTfuCPJG73TpI9cEuwn6zcYP+iHMdC0pdb554VCLni6T4LozvXu6ORxdgxI6qmnGI
|
|
viZQREySrx0WAkYATXNcANE3YSWDTQ3+VMFbWKEQsW5qvlvn2H1intivm++BbWpWl6udc+IUe0rp
|
|
pRze1qJaoYPoAsmUqlX1Cy1dX9c22V3ltsQMSFXQnmLVsPpdpn3xI68ffq8p7Jv3DEg5/IQP5Trt
|
|
XVvDHi6KAionxQEPTNgtntD8znXRs1TF9+pdwADIOCqst/3BG4VbEpxHPCSKi5U4n5eyVFyp5Yn9
|
|
M1zKRKcfeJKltGNpJTT3MEeFwi3akT2AeZLGlXMXvLiRgLFgF5JK6OGRW99nGTjljedpW0tEL6R1
|
|
3jZHVLIQz57bz7R3Zd7T0aA6J9YS9rdq49tKYIHM84qb2YYMhxA1RYHObQdFAWjb19KjK0+rKZOV
|
|
o838muQmAsr7ymU7yhVCOhQ33m2+NNXev4j5U8NTn8YT6l5NzFKLeRGfIEUGqaqDVLsanBfCIrYs
|
|
fCHt6gAgsIxzyP20h3+AH6xjn7NKuVi9zWD1gGrNFvCf/5r5Mt1inCm2kXWNjbtwiCQVB2xIZ78V
|
|
YP8BLcLrzd297Z1f2taFY1H8rC6tMUBR9E8Yni2dGlkdXQ1PMJxwrKe5T1/CBrOOW5YKJzal4/dc
|
|
zUJq4OtrVoDxgHV5NVXMqJJP/RKJ61JfPlnPMB01OXUyIM2sWmTYm1yOxh/B1V1MxzyJCxenh6eh
|
|
llvCNnoM5dbh9EocPypKC3pYk/hmmFPrGpNhRtRzUYZx9/++sRtSwXaLb18drr/eoNVB3DwSa3/s
|
|
i1tbkd3IZdAjJxEa99osLkZHmQth2qQUIag+rPs6rBwGouJ145aDVjimZgIVORGxWpYKgE2wcsNM
|
|
NgE4IRqGxEGfZz0oxS32NZNN+KnJemZNkHDOLsZYeE4LSJDSLqk+SOr7knhQOXWkjqbEbHknHlNW
|
|
1V+gjEIwcxxWhdfkSvDmjaAJMoJ2FOWpHM+88MvZ5/uM0EsMYLvw87s3Wxs7a9+/2WiaL469rGTC
|
|
12SieA1ZbyYOeckx4kk7oHt00Bv5oYpUkqjPfUFROm2v6EOGjXtHLaYz30ShyuFScTO/pm4SlibC
|
|
o/ATcXPY300bRsiOQg7Dyr6vgn9/JLwQr2RpnYyYVXWkRqd4jb+3rVTFrgJfv3/TqhkQvOX8JZSR
|
|
k/0EMgHn5qYrMAVWmRO/lOAogLlDsSZToJRETmfYdCt+IVyjepzY5jbWQuS6TymLFzSQxliemGMI
|
|
ZhpTcINtR1Dqvo1Wz53qhnCNOSVDatncpUfQvnM27dnaA9aORymr8xKOVgIvEmwlGSIuOi/NyAkg
|
|
B2YmGDlB+hFRzuB1Kz7nJATSfLw56YhOChU7W8zSc7giVWZBSV5u/vDDxs6uQJYyMq9o/k2l4hcA
|
|
/ZHjgYj3jMMhE6LyYEaICknJIhWrD1eQtM8HcEnGL83mWXMZ+sRw/IEVwEGB414VSPbYHWbjn8Tj
|
|
bG698sUuatCOYHOCgHC8osWMswr/UdjEl72jfmdYfwck0qlJzvokdyx9880z5iWbyVWChhMPNNav
|
|
5cDE8kGufagE5cHWosoASbsr2cp40NF2ye2HZgH43JuJdF9TcacYiGg3phAgEWtQsbxr2tD+7Fnu
|
|
w7OsvLx6WQAEClUAqmciPd3eo73/qNDSI3K1uqqlBp3eVcDMrjBsnNuODlPuOTKP9TizMEN1lI+m
|
|
ydXR6DcaJMC3Cm8Ex5RJOM/IPsE+FBKElUiqW1ey+WlvrcKIis42Ky5GcGfxToPxKE6crxr7N6+u
|
|
SjeY4w4pUTe2kLihyihdo7uOZfoK7NDs009U5CLyt5Xl+Q4sS/FaIr5vM4yHjee2x7E1woVnsX0m
|
|
9yz2jlFOmydaE0uMghoKxfAomk0aXF92Hb9sITeY77foluof5FNwspDnvKBqZtN5J/X0LJzn0VTm
|
|
oP9J6ryMKTn7b6pYYQriX2hhvD0uSE5/mkgaaj3mVYRquZJsj3ACCWSwTU/djStPswufOapywglD
|
|
4ZrrmIkkl5tA6KXDsI64EB3TeeM5eyxnLB6c/RU1uXiwgbmmqkRf829kH7wjcCzwwA5Yw/uNT0vk
|
|
qYuLcyROjzzo0v7k4sSnbgI6lLc1jdhmQXbGWKbGLeDHMvAWTiGPIYnuhHHIJg3HYIDgtybQffn+
|
|
oFFNvD23RsHq59JrOTy/TYLmkV4zcavGKqZ9mi/Havi46Xmi6D3pao6vAatS1kW/MAEQqbABQZiw
|
|
PdPLPtiXFSDYpc6JoBSIkiWrBnAuFRWOMCQuEWuP0fSJrAUeCOxowj4xNhJWkDZrdx8HQcrnNPAR
|
|
E4cUFBFGfnQSsMe5UN4t7+o467DJRwSR0XQqjW5v0hsPgIbVsV7CzsnEHUqVWuZYCo6hB7MOItyc
|
|
1fMMxRChUKksB3mKy4dK/G6vV1rO+i/QYvPVtr+PIgs1juQml1tBGyjermlClEuH8qJWbGTt6JiY
|
|
eY6O6AkmAEI2OwmSqRDPguwI4DLLzBzT/0spuZAB1tJyJPY8HDA47ZxkIEmmnMRaQFljWnDnmelW
|
|
j2yUQKnFO8GUc80PLg7Onu/szS0130Xv7PozZfEYr6iKdFvED024kjjuFZZSCEUsNvywufXSo31z
|
|
lETCnEiNNZhSKxXG8N6pZCCL0VAuRuHAixnk7QqrK7FygQsOKTMEGRe8gpEKEhI4SRNN3C6bfTl7
|
|
TbfPXRm0LBy5OhrzKzillSkOMMYr6iZvQc+0IsGy67DqtbbAYAscNO7IM9I4QgRg0qb9kkx+L17g
|
|
LzTQwvhHQ8tHMrKs0GQrsoKMa1l87xgwnWMn6z7BodUW6wzLSHO4CvXnfYDdfstOhZCy3FDIeNHR
|
|
azHWaWTsiMR9ZkGCU9QK6wm/AM32gU006HU4mxDoeQca62mvtuBTJoQQ8rQvNc+By4tIl3hUeOjY
|
|
+/b506d5w+f5+3+MR5C/0k+YcjQM7A2v2UhT4yDLnE5WFQ6/yIDip16nXYJrR8lJZxCH1Io9OAa+
|
|
yhFLGc/+ojfukxB8XG88Qxag+Bp7r0TFWFXowwechyo5ez9k4Q3JqEzhUVJwjgyiKuVMBjYxRlyX
|
|
IMbbx6NaZF6e/PaZr9mjIY1ZPxu04/7dot03r0c8UiEGfqaKGX2a/2Iukpp4235OMSmXJmjlvLlr
|
|
fGw1DPPhOFz17nliH1VrYF3F7xv9TGWwug/nKhcgESG5wMc5j47vV1Oq2yLfWgLYvHtxWb3fnPUU
|
|
ItAu3jUnpqzob4+SSinLJxJTFvvPxXui4xLMJFfJpDfo6t+4zTU7WC9ebGz/sLD/btifHCy87EnG
|
|
WuIC2yD8TXGFs8nCnMsTJwzDUbC5s642xIU1drwQVsCWvrCwvyvfDhb2gF1NJJqTx23QrmFuop3J
|
|
VWdiR6cFNO9LOjjpD4gnmds9n4hNw9Uaz4z4XiXU8j0UcLCwPVzvnPeQq7P9uLlE87/w1mVrbgvM
|
|
zf6mUM2DhX90hpNe9/urNtee1ISz/tw+2IP0PlOUSdb31WeCSNoXduCOKXjJIYihzC9p8PKGXo6Y
|
|
9MjvEG0aDfr/7nVf9s47V7u943bj7AvmQ9oO4b7b6Q1GwypxyqNOd8YzYotmf5dLk7fo7hWFet9D
|
|
aG7F0UDfp1q2eATdlSTNn1tkxvs1TTPzRqUsu6vy2eQy26wyL4dFc186yc64qrQY/h7mKu9MzTkR
|
|
7nXqxsern5M70K7mzV1qxD9/iQT9m0tcr7m4RSUut3dSgtTzeb0JN959cgGrZVNcNWfJLGX1V/nY
|
|
u5iwg1CaOdfwEeWSrxtNyUp56xhl/imY0Nb5wq4qIowV7YcY3uwNzTKmN5S26T3nwBsozFqR7cI+
|
|
iEPXV8w6OL2lK7gityzLbisfutvhcre3H1dkbb8D2kkzSAq7z327oW7cKNCEbdENV36jBd24Ig94
|
|
f/He+p/Oefvnx39UT/2H1jE3/3MD176x+Z+fPvvm+V/o2jfPlv7M//zf8ZmV/9naL5B0oUtHFhgp
|
|
QYlgesmsPGt2nCYLtltJq7zp0jAfXQVBl0hn4R01bQWaLPpyjNygYyK7VAA3iW0C0jB5tGb2Oucf
|
|
EwdpB/2OGoFHFxzLyYnNgCbLGcZ6xOZSYeXG8je1Jfpfo/n8+fNvKmgHg4Fyv0oMI7toponFEbno
|
|
JMnlaMyZzRK44E6SOj9awx1JPx3ELies1rPQi5IPzeQANs5I9UrFAbhTgj6s8YnHZGfj9dru61YA
|
|
xhuDDDAIUJCgVMYeXIhDzDjrnV98cIkrLP+AsanNzEZpE0d+RkbKP3NKzskpydlP01gwEqX+0/be
|
|
y3YKca42GE26NKBTnLiROlYko/vsS3HTLfP+bAZ7rkIzLCoRdvVC5LqqSPI+buUmi9bYQ9+sVL/I
|
|
iC700BTpA13ibKNQlrmfN4CQ27UJVRaMuLDvV08OzP7WQfwsbxZ2xdH834xiZoajvgCPTxCw2HI6
|
|
Ig7ap0MF6g1rmcr5OLceholn11GXGjt2Gl0Q5svsk9x7eQPGJmwg36IqiKv+iLTwGnFHV5oIRWuZ
|
|
Et4ocbxK4jQixHkvLAjxmGo24rIjHGr4sLt+DB3DRMrU7Y++seI7//O+uPFyc297JwWGQC9hSd3r
|
|
JbcAF4z1HssdRWG7hVteNFjGPKJ2bXDqngBBNKlweaJjuxGv8htVueHDNotYO1G2j0tUlUsoOUZR
|
|
zGFW7RPRR+xXPOBMH+vcylrXEmt6u9s7msJychNmKZdPQoRXc2ti6XEKaeQMPhmZF9VVeRMNsK70
|
|
+4IzeWOtVyjyIKOXjKug5cSGY6lLUkRfOE1FNeWln58NxX12uRCsaMZl2treI6H5lNE2Odk87ihW
|
|
IbzpuvNLE6NYx01VmUnKSf83BTawkQMdjSyYXlToHNmm1sO5H2PLEOs4X+x3aHNf4ARZJZGBNmnC
|
|
u4i/ISKzM2FPP34fNiLezBUG5QcNqzKJawmhT+LTGYGvtha+6Cry3bk0Y9b5+LcUHVeh4/llkmLl
|
|
xQVjC5JNPx7BBcNu+zTL4MssZ7kEorQ/Sb94kyvHwff5ZSwiZwS2+Pf+oyDebJk9F4pKL3yEIe/F
|
|
sH/8kQZTABGx2I44zQ71vn9xc9zvjm/wxAO89HewZDedYybS9E5Xqc6Be53qYrR0W8by0goYpcZK
|
|
7VvT6JrkojOYv2TKCtHOTAJiUjWiqsPOm2vr69vvtvbYO3CaIPW7JgKZX2gAjIy+4KyDrbuEVspm
|
|
5EEooVwBLOv1x2bzrViYKzomXdq7L0SFt0orCpc476x8lXL0NlOFE6rV7Deqz1InEW9Zoz5lmMaX
|
|
Gz/QoS7UAdRoQGOPDAM4e4FT46fSZX6GIm1Rhpqf39o1u2s7G682d/c2dmiSobg9o0nqjZfvGG+E
|
|
AfeV6eRtgVMQdHM8OseGAmoSDmDkXUF4Ca1EwPDxmACuho7bKmyrtAaIt9Ou0jDUTv8NyBt3bCxa
|
|
cGbRqPGp4NDylaTMb6qlZOXd//umr46yTPk6FmmWvWlA3pnOKMj0/EJ5/6K/Si8V9V76hORuYzq0
|
|
qv7+HfRTPb8ty40gQPZXDuQUukZHzXH/AiGOCZCbhLQyyoPFg32BzkVb2N3q6MA3+dxL1HMIHq1J
|
|
Dpz53UTaxVx1EotAVH+MfKxVrbH2YpKsLkrw5bE6J/eTO+aKCAUxKETGugiu7pyD51POJHEuGUz0
|
|
k3sPqe332quNw82XG1t7m3u/tOvgiuuTEca19rF35QTNeChrWF4LnF2BOlD2zgILVmFmVVCqfoIm
|
|
6k4VFLBXJUt17ofYHc2AneVI2ApAsoOG6R1CzcvCyz0VwhA87LvMmNuX7xG/CKdePCUOGHE0o4jX
|
|
ve79whpV/PnZJo4IF2CNeUbZCGGiDY6NjcRQiUVw7tcu7cBofIhHojC9Vau9zstQkMIzi3D2cwKc
|
|
NaalEUHfCgIVl84trTRF+W6RbBvZzAYkD0Y64nycf9nEYUytZuSJscuabqPkcvA8TFjS5SSdV6eI
|
|
bJRdb+JqmeJyrUbXbEgBBzmOew4krcyAZGecw70Giad6Ohp1RX9Q0/Q08mwKHggTwRBOLcQ+nIQ+
|
|
lyeMHWQn6YFJTyYNC95Ou0I78K9C8e+ckNdH7PiWOWz1ziR9Y1XjdaIMrLymuTpFfsXZ5vQdHhRW
|
|
9R1pH9UHdyZekLKTDuM1WIARjrW075B0xdGzvLJGQ+FzQ3fnbMcdTlnQv1TH8lwOH6oSi7giOQjS
|
|
8bnbW29+CVjtmnk35FzWP13RgbqoEPfuvPBe6f86dwEUBQkkP+8Qn3nmcHKZtS6Y02ln3F1U+H0R
|
|
9rDktDQ0mIEszchnT0umx8dwmFI+YOgDWyDsIdeZSmrKIFgs1/WOiFWdiXhmERt6ZtO7nasrG5o2
|
|
UlHCHPWIyRFPLQQD91QOygy+G2G2EZ5oqMI1CCVDDlnKmV6UeYmqnRN7KrOADbpiV/a8m0HZlbn+
|
|
+ntwy5QNquKfClY6XGnhz4YyyUKBNyO8B5NwURRyqlmz0ylhNzJ50dz5aRtZN1m3EDRm3Aekz/D1
|
|
v4ZxbH3vzeHa7u67nzYOf4Fb/NItj1NjtlOUy/x9AXtc4pypoRwhCdDrDEKZ/zuzf1XfOjAFan2W
|
|
k5Hm0J3FxVteAVePHazNPNLDZ7SqWby7sBJb2m4QOZwmVWfmhU6NCB+qL6BVejHG2j3PyQSQdZO6
|
|
i8je2ejPIJEZ2/u8dGgllTuLSIaWzSwzsfkBM+sV/2K75yaZz3gVfAbwNT1qV+T9Ebu/IB2CW525
|
|
tDw4O6yGXk4PbRtwFWflEU0NfwpAfcUikac4EvuZuRLiQvs2GiYXR0TifbilLcu7WPViCkNZHwvj
|
|
VFy8nJ5nD81e52PPuvZCeewsQMcCUYGg3Kb5UPzug0cy/tA/+YDoPU6/Ouz2we9ocRr9JWcKTghG
|
|
NhDfk6NxZ4gNlpglSwyFqA1sG3Y3X71+99YVpRk76PwgchKgd2qWHSx+oY0RKqJkcxofg3ggidNs
|
|
3sHNvxYDPp1OsN4fySLYlAGTkSXs6v6tPCJUAVDSdSNuYZOI0tm4k8gRM9ACMUM0voUaMZpzmAM+
|
|
DQbu1BatDZiBT51xv2PFansUCMfrQAofz2M7HguyYeYVRQY58txuqpDC49mBFzwoMkyIrA4KTz26
|
|
p8w4o22DCMtxCIawpbpj5gAnZ01jUpuCCsmeTzQmlT9g5sMFuZxdkNIZH54jHRaDKLRQ5WAIKoJb
|
|
iGmQvcIOIXQKByuWqBIrF6uJwQP3IrWSAcyrq4Bk7YibZHluPEvm5IdAwldZz7XHZbuPbpRNqZRm
|
|
xZLm78NP/Y52j0nx50xEDuGOMyd8dVlHOQ9uuEuRd+2n7LZm3s460vXkYRclK6GPJOwD6O1C3tVP
|
|
yaIKH7L8CakcWa6Q5KqBuJlGNBT0PIxL/lnObspqrUCQ9wAOjYIVKwEiP7hQedlrR1om0neIUD5A
|
|
prXy4CNAawBIoMMlg0R3ZU2Cu2SzVLP6qX9bCG/BDw45qhJ5Te6k9AhyyYY2quUnFzItGiF/sEqr
|
|
UIybvLBsfiYUty3/JiXQSIK3OoRO/HDkFD08ZO3/Mr/ud6r/PsA/S9VvD6sH143FlcZtkakbnMsG
|
|
3UM5WJ0Qnx1HCebfFQMvfQKdDwKsgGmZQrhcdMBKHv1va2PvH9s7Px5urf20YYHNaA8TPzYLSAD1
|
|
BusgmQTwQTKgjO8TJ9cIAeTnhHamMQG/BC3IegSIOzo+jxKiOLYG/qF2X/6uNl/rK3ANiCAGqBIz
|
|
xq0NJEb8fcFEmNe4Y1GFvosC8sP0aG/WNrf2Nv65V8l66soceur29t33bzbX/SvmDawDWxs7alZ+
|
|
/o0pu5vtRgDnIZNxdtSi/9p5qfF0UbPX4tlRFNbjE9A5cCzntmtH87WURwPqDZWLYWQfyQ52CEOw
|
|
qijywKfkm1+sWgvKj5KKlOjcI4plGCYwrodDGnbGfBGVKHTioj1WrYhVklehba4U0gjC2vVMO3bW
|
|
fhI5mzp0Tt3DyIsYqjwAWpSG7MWGldCAs9FlpO3M10Rh3lv8lrhK5Hirum1mm/hWsap0PVt3i6bh
|
|
VRu5MjerfvlFNyoxasQ94qDQtHs5+Iq7sFvZttWuHC6bTnTm6TN3f9rc3d3celVqxdG4mRZmQ1/u
|
|
aF/kzJxp3aI1JHC57zPtc/dhVXfuwvxctO+QZnkWpHrLRTYnVu8k296jV79Z291jcMh3O8AFS8TD
|
|
2K6OlCJ3NBUyS39RpRfmAylevGwqPhDX84mTzvlH7z43NLFnnCkjatixFd9ZmeahKTTVp2j5WUNM
|
|
ss09Qeug/7bEQA2IT8AtFHLvRKvZ0grqhUM8Ky632wUqvnBzo1+X/den7uvzZ/7r84KODZOX6VG5
|
|
/mtz/1dz8MRwagH6wz/qi6ZQABcsT0Q/Df80+K0AS54eF0xxydyW7HSAs51zIitjxIlgAZ83bDeW
|
|
FFuQweJhJnpoqqcTthFFukslzA1Oi1A9uQHsLIqpuOKqJyBh5rFNmTAU/ksTJoRK/UBM32BjAWsC
|
|
hK6LBxVz6B1TWhfMVhVnGF2Pwew33/plUWJ7Nh0rYhNjLEZlEkItRqE4pMHSJLjK8ENiUE7/EzP6
|
|
ruj3tSX+f2MRLfoNXDzdeDHsn6/eENvr/FasN5FLN2hnAhfvnok5kObirRUeinDlB/m+jbPIsud9
|
|
zNNK8GZgsHOmSR+lOifgTkjbgwy4mZIFBhbjz3Bkg+c0d/BVb5LHwQYF3w9cPTyGwgpDfLR8JPWO
|
|
tOiqxwDkL7d264KV/h2dqPMwz2JlVW70aboxM7DV5tdDrK8Hb0vVmh2tOSe0m39eJ+1cjLYUt5qd
|
|
Y6H6/N4cpo/dBcPcZywF01Bj9Z8Bb/es87GXrcODCNkq7kKMm9sALkQcBXiS8yqkjTL35Y5iz21s
|
|
7clCARradNgM9CiQeLMq6VSWXN3lEKEyu3yWXKkn8ZQTuNJehqMP7WVIYLiyzMYg9jrDzxXE7YSu
|
|
Z3Tz4hLL/SwkClRcRA5QaMUwD8ryHXsTWRY0Au48wSA9qi4vJcwXFxZNkahdcfm2FJIGWqYxcbCo
|
|
KWh2ZOfX8Bs7kFnPuqg3N6Hz3EE8laFg6mqy1cCTj8csadKIXvbGPBAw0LETcLd/2p/Q30NTNeXl
|
|
6soy+xslaTAoP0CgH3Z8bF1//WtQV4kvlhxsljrWxOWpumjDFH7Fz/eF70gkw1Te0tdmwc/AjdWL
|
|
4SaVzQ85DJ9uj7YF0ImHNEw8DlV+ADBeQ+/3hFUrCnMxofUVPj7EisDQ9yepZl5cOsFWnA4PnYPg
|
|
8tMUlUDR7unT3lDdDguRHwMjal4WAkbOPylao1QL0soMDziRnRp0IT01BRkxfOGNGlrQ8GRap8Vv
|
|
t9I8Zn+YWLcHXqdHtDc/Zs1isfpkFKyGQm7TnUgUXsA2ixZSWbpQkbx2NfNmdIrZVYWuqW+/JXGa
|
|
nzUY29wCy2AEJLEKknGyGkMKiPafzgQXFkuYcud3bO3InfVzNlfgFxSOaLTA/1cvWwmr0PZl1+9n
|
|
L9to8ajhyZUP3leMLgzB8zlr2BWSv5jt2S3txsnNtDo4pstmOugkHwFS2srITReaH3Lt5U+bW4dv
|
|
13Z3GWqsYCqZs3XmttnqXcZe0dryvG0SLu7x4EaSMt50e+e/Y407r+tCugxbwINwWLxTHaw8ao2W
|
|
hjiv7LLD3GOiPqnUzI5sX8DfB2FdafPHH7KxPmdZ02Dk1Pj5tFcH5PNoL78E3cKJySXDKeXZzBkF
|
|
O3RDdPdGNvvNeJCJqAdfJ3fvzdnNF9DOICX7NBCZDRH7SqbvZzhUJVNC9HN4YN47sjvEl79Ydjlf
|
|
srXHp4IUWjGWt7WVcUF5MsQ8T43cqH+xePzcGzPeaJOXAWIgpKlu/cMIwNYQZunTpkQA3Z9cuXd9
|
|
uIWzLfbVXztQE7VSKeBmLJO86IrcNUL/WRMURoAJMe1Kjdq4e9HEypZZdCjruG/huVTV5l0jM/q2
|
|
aEqWMSWINJRDz/sVzEymGIzVio4VryqbKftyPEKUWjRx33F2z2ysSSswr4taptuDWiZRVndydUE0
|
|
Eg1OSik0oKeVCDZTdUEgrSnNoCQci6Y9ly7s9E6JCmjYi/Mk1rbZzmF8xsdpwA18eWhejkeC9Dym
|
|
Ice0j8MSj6ZAEGSTPcdkRAB/Nrz1YjzqTo+ty6BAy/20/XJDowYZW29IOxnGVOrpaErSwOUwCNll
|
|
BSdD8VHJ/KYGXWiBjLzIsc1hteL3QocQgjx21/i9h6Cx5snAovDxQV6bpwv1GjOryywvLXFQys3y
|
|
M1b/3Sw/33/2/OBm5Zv9Zfx9urx8s/K3RsXc2De4al3kqgnN6NDEN/8z5WvEWLSX4LKM3RDkHTbw
|
|
DZ0gegK75rKTWMUKPc0qYJs7cJYuNKUD5WiOitTXYM1nxdaaUXu2Qp1nHrD8nXDyiTpXitGvSpPJ
|
|
z2uRdn1ocBryQmAx6+nJ3pv0ME7PTgB9H3mzcpp3La7sgrM1Hodx6zWQ44NPvcMOTv2JJFXHtFRi
|
|
n5sup9VgpU84EY6BzE3Nzi/JlgPtt6jzXZu5Iwdp3r/X8m5J8DC1ETHiTwP4RGKbeppJgdHcC4KH
|
|
D6+cyOPXep9qYYAg5JhciVNjKaPnfIyFt2BZHGtLES45DWs4IKkoimzQjoehDWB0sGLnA+iIv+U9
|
|
ooGINk2IEz3tOYWDy9W6qLiedsbFg+2oZ95tbWyt7/zydm/jZc2CJmDOy52Lj6xkQPvqxK65wvRK
|
|
d3gSXqkgqspxfumpAU2LfeUnSZyg85dHg0fd6qPXj356tKsiH+9m76pBy8Enu5mjOQ23fsNdtWsW
|
|
+7kgPna5/sFKKubatVK+RLHtyIj6jZPmgESXknrtcWCqqtdLM/S2Akk1GQlMvcS9pkPNXJLucvGa
|
|
m9qsigXXJhXyae5cz+/rbfs9gt+cp5lUrcuFHmWfRgaWOCGeLEFkVze5v7ctB1wjM8Kz+7l2ZVT0
|
|
wiS+QYidDerS6EDJ/HXBoBVM2yUXFlBF2WERqzkdk9ci4nbFyUAkhgih+9KnStbv1NGc6lsxxXO+
|
|
iaYaRah21MXIVu48dgh3fRvekFwNiL/7KGCxWp7NFK+t56AaPLSoBF7MWfac70scF5gLuKfV9NQE
|
|
bTu0pTsRLg7AL+TKrjylSPhMbMf09Mw30qaOoxl7exGIhbwjQ/QIPGUpX4wu0T1y3mi2lOwDUYl0
|
|
ISoPIf2ZMuSifS8Aq5AB/Umcwq2rvPrr8ljaYImz0XkXknktYCrcPUGg1Z93urHoxVgcFBeTWGcV
|
|
GQK/3IUkKvSh9VLRhV697JzXST4d0Nl2hCSmxJQz98u7AdvvQmDHriRlnai7U0WykfZixCG9kuMG
|
|
+DA2tNWeHUTj1fV5wCDGQfoT3i7eV/GM3ePOTtA4/UYtjMNm7CfO6RxO+omf8WIZ46FwMBm7Hriw
|
|
SAtqHYvSmi/rZzTD6MaU+OV0cGEdhwM/IxtvYOcmQ29lJNfk4ENcnPBlPIJvX71c21sLIP3Z/1fG
|
|
tWVDkul2Nr6VSCgD91b3fOoP+3z1XeTvtb2792pnY/cQZxVJg5LUJ3P35fd0732mHnxW3XBrZ2u0
|
|
HjOZfa6dP2L2WZv7y7ZQxK5WxIFAGIFbixJLG9BhBzirMsq12s7Jmihe99nMiZ/ViHlWQnyxIOUy
|
|
BkiXWVCUHJeRIfDYk4svt39a29xqx86RCzaRpiUrC4yNn02OtPCappCuI16aNwLNQWpq7K0KkH92
|
|
2YUPb5RlEWqAgcMUtaxRwDiF+QdyOCY50O+KiHHMumguwMCLT5QMfrV4PUluaxL3L+McaZwBiVY9
|
|
/veJFUyr63aYC6ZmZEtjBY7dEsxkbruLGU9tf0x8defO96ojaVKNm2LF5nBD2JuqHEW5KpX0NfzW
|
|
bgaPFobuItU8C+kIoUYh0R4ISqfrMqi2ppBPEUDupecsNuHhBUfTvtdlT0cGcUFNrgQZ4C+JsByb
|
|
F/p8hfgNOlIqNbMO8kX8E2BqmAFhgLUg8Tr3HcETaIWKb7Il3w17NgqfEy3JuXuXgFUzb6fQrvBc
|
|
cIbIY4MI/f5deAhl1n+oPMIyUIXzFagweDKdIGpcZdyac3BTl/bPVEKAtKuV/7agWgf6J2Jf8Mw8
|
|
C4TDGpA26T7YxzgerN4tAEmwKdcRDH9qQc8XM13LON94kP0X2Up6Mm5cRUAFeYtQgX3ow0NQheZ3
|
|
iPOfCbNQp0lk72Vp8o3s7t9od1fDje30Aq5C95x9Nf20TzwenEUB42vDb2NO0wVnpiiI7ljdJ+f0
|
|
J/HWFfu235aayp41ZqVffQKf1IEQy4ucybvbpmYtpyTBIGsNvZ1JnhZ4oeM2mzkznunsGF5Je1zJ
|
|
nrTbH1hAxMENAwYRJbL+ICgGi0I91QH1NkR0B9UkIN6iruVQ2o7mKXWwIPBUHXRqRrAzbNKV3HRU
|
|
lUwCI7QkSpXjg3XXNV4aoDaXnasoJLc1NwY3f5rXjkYcgOjmM0TqjSVxbCPZsrgk2TB4bwRZ5T9H
|
|
xs3VcQVaNBVofrRZB9ff7YhXk4NoccMtkXH/CVlyEiTEbmI52bjLkZM5Nahe8lUfcf6RUafLnJLk
|
|
fYHtUW51DFTRnP4uIH6TBFKtOe13ZytyrB6nhUeduZ6+49JpcOm0363EYp8DGAklACuA+gHyWzzC
|
|
nSlOkq8glaaroS2fW0nSOaGjQkzzebTHNtx/9FSmkcBd6v1dBaFBJreZM4qKCaGXkLXfuTUFT1kR
|
|
e0mSx4SlB7YMZZ+PO+NxX/EDtnc2X21urb3JwfFB1j8FAhKhEWTHLkfLVZQSBmYKFmzXGm36SRhG
|
|
y2t/OrTIk+MgtHYGeoIGvli5yZ8JuxvrOxt7uzyu9i7bs2Zl/dohURzSMaPdWWm9FqBesB3I9chT
|
|
RGtAi6RF1gMk8/QAQcne5eQ9fCzZKj+7/ZX3hbR0533TnKHV5s46y62pJZQPijL2PmNvhw5jDSRZ
|
|
MTgvQ/cMe3hmZDl0KFTV3s/FZ77hO3MGuiGf7cYj1s5C8SxPNPbJqavMvnajqU5ZuF3CEbeYlXK7
|
|
Y1Dgt2AJR07BWl6N86fMQ/kx69zyIfSRD0FJHQj7v8UOgzM0rL4qhWPp6QTFHWzlds5DigmFcOMi
|
|
vP3miXEmZtruUQLVuM1zlLApHV/IlsuDXv0khz2Tt0Mr0XePHqdRWwK1Uy4oiz2qB0JzWf4LTjRT
|
|
PTXReWZVVoHKL09r5WyGwW7JUbvkU6Jdi4gRqD5iHiXE84ESJiI9OfgXTq10l2o+DW7hXmwsL+Vs
|
|
uVzNFejMl6utXuSPVLrhczbUzsxhcuK5WBGwdUTVIeh8Q0OS2OQqR0E0Yz8F82Nd7I96nFJNx6+V
|
|
Vjoxfw6lVAplKrsZ8tQfAbLaUe+Elcm6VNQQcdSxGkcBbBWvC/ZpAFvoIJNmoMTkbPs0obWL+V7c
|
|
WsCPXdz7nbQr26wacxi3O+rLeyOH+5q3ke5l32L5Yy8klEpC3ZyALW+FOahxALOnCdYHs+o6wWW2
|
|
HyWaMyQxYacep7tTiU/qL2n/l6Db6Mkp60Y3Fw5PKSJY4fyggx6QCG6XDCXo2LWHCdVJuc1n0qN9
|
|
mYoaW56DfXNPRBvUZXZolmSOxEubVte9VrLhdazr8R5r0WRWIt61RyhvdDe7quFSonJnsNplZzjx
|
|
Oi2E1F9IJLGGy+dbwoI4IxSQc1qJw+LrGFWsaXzyX65DDGqcVjXliehjtnOC6r6SLc1/MkaodLhR
|
|
8STWl544bWnBR9b6x8tOAghC+hG+Fjtm4pMTBZ9XfxzcnlPl7PB3fEYnJ5VwYvwdj9E91h1HPJSL
|
|
RuekDXnh6FENziySV8G4B8t7fzRsutMTZYz7x7iY1CSuropQadM2s6fWHpPhyyZ4uRIqj7K4NqGK
|
|
N7TmyvpFwo0soHrFOoDlKHLnArE7TzGvMpd6GMkvSB1+LYTP7hM4CGpAkpjrS3i4FAOI3OqBzxlp
|
|
Wf/tIojEh4sN38i6Re2hFvs0KBEwLwnkrM9CMVoikpUTtRnCMEFcunIOZ53zk6pFvVHcOXEkOicW
|
|
Ddlwex3NZw7qyA6kXswfnkIPMOgNjmCNHzEz1TUXU02iy9TTLS4H80qbNVQ+AWaOSZp8U4hafsDd
|
|
agd8oxrVIAuGL4SPrG//RNzlBouNunS4mEPBJ3OEMyQPaXf4EHdnpqt8VArEE9diR2yoSYlvdfRI
|
|
/tvan3QBYZ/Sj+ZvjtuUKXA4SStNMpT9TuBgp5JgBOHAFDLnOax8uOWwXxcOv+kwWLfw5nE+agHT
|
|
EIU0f45WR1YWbbxXyNTTmeQY/HNVN/hE1src6KWVZZ79OQ3ynglB0ExkwJv9cksDp+7UBWXXTlau
|
|
2lt7RUeSxYfQZRTeNY1vqpJ/+R6lqQw3ozTc5QG7R0ks781s18vvTSjc36O8t9s7e7Nbhrvm2dMV
|
|
DymWv6OyCNnNeWs/PH5EKvRJM/Jgd+9OpNFyaFvC5NCuOe+d8JGtgWKiV54ZAPTQ7GHzC7W19cLM
|
|
y8YahZHW9J3C6v5rKsfwaKgC4t3qS2W9ZBxRFMLv4PUb8tqfpQWdXUzqFHcT6PnHe7fXVoKyvywI
|
|
SgfOq4il5KxPi3xmtcyuC49NlGkb/81zefqycf2KXfalf263c1sINSt03y4qBBruWWm4P1e3DnDi
|
|
OdTiK1XD2apYfZ9PML9mj0JrwfXF5e1XLFtXZdWJNvldIsr9ZZXec9XnlDhLM5rro/f7lKD+M1MX
|
|
Kvso5CV109xDJZiGyMUOCre5F+O+YBQj4pnxaJuh90ufUUJp1R8sp5PrtgcWITrsS5wR16E7s7al
|
|
nHci9pMMvGwrQOfGfY+LCixkO+P/g1jTfxDG9Jdo3x6abQjxwDfvi31GxTdgIvnoI9xn3oMlSul8
|
|
LcMKeemEl0DIdM2SHEJm6y5OKhBQBrnSVqwqfJ1dKehGiVtSysgIYQtpE83Fyt+wXJfdQ91YSSK+
|
|
epqCrxVEPg8A0THmWDz2wehM7LCz9Tirz5+no5yHzx3uu6+jkp6v8JRV0wq9UHipeCjvdVZcOase
|
|
OlKKNc5W7ORlKSoKqA861BjqLnvXMH1iVEyliwIKJN5spUTyaApAqVVzcl68z40l1OxZUYQ3R3fT
|
|
pFbkdltS9bVaQnLlGifumq0RCrP7xQqg2fy4I+M0YoeS9M+7vfDvz4rH3xqZEr/VFPw0czKasoOk
|
|
GnRPTzHQqdj8OCbfZx+09dv2xunHkeDVh8Tj10317KbK1yuGc4jaM0amDAeXR5h1WcARxlQJJ4+n
|
|
K0Sp1CexpuTw0+BLC41nAI5sn1Jk10qmPBv1el9A1lyg2EoWiTUPGJZVoKXvSl7bC1SqTOMZqips
|
|
PFCQ5SmHh+yXQ+BgpI/DdSf7uMbKyB+bAZ4hhSr32CL+Y3EAeuJl4MP8d2L8eRvPn8MjzURpPw5w
|
|
IzrHZwHAus205F/BkR3DiKPGHNxwhRXIhbgOWpABKgkd/PU4rswdqNbvYS/olLpn+JwJ+QPvX9ia
|
|
zQfw9GRsbE7/xnfyWU/vn8LbzAfIw7lR1tjcAclxg/SbX5f+3QVYRui/t4tRTtc06OK8HYLp4Zza
|
|
4FjcoVvdkxL1X8tS0xN6fDJoLN+s+2yx1Wqn27nAgXvsrsXRHQqXYG/2hxJFVAY0g5SGct0Di5p+
|
|
tp4GSYuWFb+YGm5p93M/3ALJmDvecit/wP0IS/baFPWT4zIkf8pnV6LHLPMdPsh5TNPUlHdi+JSC
|
|
YcVPOa8y/xxdVqEqpM2D+CGbMrViH7of0Ecq02ohKFzJxPviexAKJAvXqkDXot7Zqnqc3WhWVXk5
|
|
Wqm+YZh9Laj+x803b0xxSDVfP25Wf+yLv8GVTVGr2ITapKPOMB6iNN6hlj+Djs1ANfQf4BGae/bz
|
|
85POSvbTRjdIPgvH9iB9rGAI+LSxrRlZX11gtuaIRa3EmG6+nWVYNmYSj3+3XaAfLpOVcJ4Mzc9w
|
|
GftXg8vuWXJQvNELg1ExiL9qF16+21nb29zeMmGhmQMtGHo73+++X9syay9fmuLEFEmOp1l/Qqvu
|
|
NmMqVhrRO/+sGQlT3oarnKt9ufHGCHxGHpNAA1z5jJqi9LmZqja3ftieXRcDRT2upN4B2n3OC2Df
|
|
PQVDjt4ULeESNCWvnUq3YeDek3pe3a9CsqJOHjHJszFC4YM2bMI9OPc0Zc+7eXjBsvTY3cA3mvOT
|
|
3uuo5vL5WKYq9G2Pbs/Mf0vENWCoLLAg9Jc/P39+/vz8+fnz8+fnz8+fnz8/f37+/Pz5+fPz5+fP
|
|
z5+fPz////r8fxIvxe4A4AEA
|