From 2abbf22196d6c28c2cc81a4e5c8154c0a5947799 Mon Sep 17 00:00:00 2001
From: Jack Ivanov <17044561+jackivanov@users.noreply.github.com>
Date: Fri, 31 Jan 2020 11:24:29 +0100
Subject: [PATCH] Alternative Ingress IP (#1605)

* Separate ingress IP draft

* task name fix

* placeholder
---
 .github/workflows/main.yml                    |   1 -
 config.cfg                                    |   7 +
 docs/cloud-alternative-ingress-ip.md          |  22 ++
 docs/images/cloud-alternative-ingress-ip.png  | Bin 0 -> 34294 bytes
 library/digital_ocean_floating_ip.py          | 288 ++++++++++++++++++
 playbooks/cloud-post.yml                      |   1 +
 roles/cloud-digitalocean/tasks/main.yml       |  13 +
 roles/common/defaults/main.yml                |   7 +
 roles/common/handlers/main.yml                |   3 +
 roles/common/tasks/aip/digitalocean.yml       |  13 +
 roles/common/tasks/aip/main.yml               |  10 +
 roles/common/tasks/aip/placeholder.yml        |   0
 roles/common/tasks/ubuntu.yml                 |  14 +
 .../templates/99-algo-ipv6-egress.yaml.j2     |   6 +
 roles/common/templates/rules.v4.j2            |   2 +-
 roles/common/templates/rules.v6.j2            |   2 +-
 server.yml                                    |   1 +
 17 files changed, 387 insertions(+), 3 deletions(-)
 create mode 100644 docs/cloud-alternative-ingress-ip.md
 create mode 100644 docs/images/cloud-alternative-ingress-ip.png
 create mode 100644 library/digital_ocean_floating_ip.py
 create mode 100644 roles/common/tasks/aip/digitalocean.yml
 create mode 100644 roles/common/tasks/aip/main.yml
 create mode 100644 roles/common/tasks/aip/placeholder.yml
 create mode 100644 roles/common/templates/99-algo-ipv6-egress.yaml.j2

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 2e63964..662f7c8 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -93,7 +93,6 @@ jobs:
           set -x
           sudo -E bash -x ./tests/wireguard-client.sh
           sudo env "PATH=$PATH" ./tests/ipsec-client.sh
-          sudo ./tests/ssh-tunnel.sh
 
   local-deploy:
     runs-on: ubuntu-16.04
diff --git a/config.cfg b/config.cfg
index 4a73c03..7d3027e 100644
--- a/config.cfg
+++ b/config.cfg
@@ -26,6 +26,13 @@ ipsec_enabled: true
 wireguard_enabled: true
 wireguard_port: 51820
 
+# This feature allows you to configure the Algo server to send outbound traffic
+# through a different external IP address than the one you are establishing the VPN connection with.
+# More info https://trailofbits.github.io/algo/cloud-alternative-ingress-ip.html
+# Available for the following cloud providers:
+# - DigitalOcean
+alternative_ingress_ip: false
+
 # Reduce the MTU of the VPN tunnel
 # Some cloud and internet providers use a smaller MTU (Maximum Transmission
 # Unit) than the normal value of 1500 and if you don't reduce the MTU of your
diff --git a/docs/cloud-alternative-ingress-ip.md b/docs/cloud-alternative-ingress-ip.md
new file mode 100644
index 0000000..5c123e9
--- /dev/null
+++ b/docs/cloud-alternative-ingress-ip.md
@@ -0,0 +1,22 @@
+# Alternative Ingress IP
+
+This feature allows you to configure the Algo server to send outbound traffic through a different external IP address than the one you are establishing the VPN connection with.
+
+![cloud-alternative-ingress-ip](/docs/images/cloud-alternative-ingress-ip.png)
+
+Additional info might be found in [this issue](https://github.com/trailofbits/algo/issues/1047)
+
+
+
+
+#### Caveats
+
+##### Extra charges
+
+- DigitalOcean: Floating IPs are free when assigned to a Droplet, but after manually deleting a Droplet you need to also delete the Floating IP or you'll get charged for it.
+
+##### IPv6
+
+Some cloud providers provision a VM with an `/128` address block size. This is the only IPv6 address provided and for outbound and incoming traffic.
+
+If the provided address block size is bigger, e.g., `/64`, Algo takes a separate address than the one is assigned to the server to send outbound IPv6 traffic.
diff --git a/docs/images/cloud-alternative-ingress-ip.png b/docs/images/cloud-alternative-ingress-ip.png
new file mode 100644
index 0000000000000000000000000000000000000000..82de4fbf666d3b7e9825097434ed0a3def9f145a
GIT binary patch
literal 34294
zcmb5Wby$>L7dJW#LpMlBmmm#N(j|yeBHaui-6>rnNF&k>(k<O3AksB-NH<6~-#tF>
z<NKcT{d3NBjRV(Q%)a;DYpvg^-}2KN#g|y<r05_J2<w&Xi?<*U5)ttGJt{Kru5_vu
z5Bxy0m(_9tfharS{}60PTtq=2YS60}5~}a@_tG#@$<^W>eDh85@dNy*nV+JAf3Doq
zgp%ToiBQwl2cQp~LSFdGD}geERduPNUA$RVvc>Zlo6*L(F=$brqB|=EWd0!aVxbP9
z#z8{x7yn#%^N{+AUp@I?yGSRh?BIT3n32kL-*ZUh!n3$I-^b;k0nCR_jqvxi1UcU^
zXr3%dPe(+`!$B4Tzpp|t#o%0@Lla^~Kp3&|n}b~Da5=UZdvLHQq@L0Ljs~IqeO03%
z+yzEPKxF;?ePyEg4?yKyWAvTC%dG^_3E)I&b3A-bO`Mn;O#2|ZgNxV3Ik~7U<AncR
zBw8F3@|3j)6vzJR-(>`Y+Yw$;3fS#eIVo})eMFdPbux`#Od?rELlC8l)YWcuUOU{5
z_!1NIcQ4{@1eq1n3%kQJvHyNHAa0n^73B$yYP#R;S$>K@-uXJw?+4C2lYqtg_isxK
z!q0-~{(BGjM-qOW**LO$l3;rAKd%vQ$oV1FqEXta4?%QJlifK}awQkPQfY?AQc?f#
zjY?>?(bNC@>7OseWzRq){{1rW$udpmTt<c-{{=b8iD-a@2m+#0%gIPTHfvmbnVmOJ
z_`ipRUtZ>GzsF(CME`S-AKP0Iuex+QkU$%Fip;1b1ib=z&fDL@RPe9@|3`fIi45Y<
z7-H~$uk$@Bx${Uczq`kYnH}=LE-HgG1cFnZ=3yP2!pH#o`jq+O-xG?1^%VR%jWjsK
z7?u9r_#3%QJNvDcp6A41Q}*qz;eN*0PYndGbG}G-+y7^K?aA#OU0o@nS4vem4wX3w
zt{*xgqqluI0=S$&X4r-s?S|M8C%?`6#~>xOdy)OCLt_vn@|vCB4L{yh%5HLS#CAh)
zaF!Ma0hSpxu=xa(|J}Talav{PBYD=>C_n#HE-hVGTIy@gZkhjV&qkVhT&$YTBejKm
znXM;LBukR^=<^50-(>B#Fp^vK?^h8qE_L#eX%`6}jF;^xUI3><VPnYudt%&lafSqg
zC+&;BL`J11Aecugy=gVR7Aqx;Ip+$#|B)sxufI1+FmXLQk@!54A1kOrWy1Ky+Myfg
z#!FnYxYI`d1op=*9JFoD<4Azwx^~byh5prpdo&Z2kN4OyrFS|NW=4<~2ln}}{T9cS
z=C&t%3@Eh!(YK6$G|M~chL2=ssl6F1TH}gGL4!XgrMsS=WL4LIlB$7AuY)VO8ZWaV
zv6c`j{PzK+^wcxD_x?oIa+d3<b7t1)Vf$6;;a}kP*Z86R{;sQBb8fX&A$$*qi<#MV
zw!cpZ%f5wfqjxt=YpPt^;asfI#6mzJ1K9XAq}%rIvU=jn6DnzYhg9`coE-ZBGqp>P
zm{@C<lDUlFNU<dj_Qb{+p4~&^ekwjh(o7+4hoV@u_~jnEBM$j;aZU5rPxd74{Fx7+
zAZdNtzl+kpc_I$wT9^U{bvu{i<iM@XADgkF!ne;ha&-fQ34ZSqtW?)`IzR=wN;jTo
zu_HI|QE{u<I+#(>+&ehi-1`d%&A@*1Zajd?I5>kk!yhn`1$h>DCH12F1tK9~8g`m#
zqJ`cnNvh}S`(NKU70u_;fp64qHgZ}1i*)|aQQv5W2U<FdGO^0^eop^KnUnE<tbP25
z^bE2bp&(Qhi2qc=-qyXu9?!uU2LU~7p$eAD^sjb`bAuldrQliaZ$2W@>Cec41C4kB
z?i&fbXeh$@-e;zlLJA$j-(|B@$sb3+xLR^!KtbI+W$4ELN*&)E3s|%C*MXZVdYI3v
zN~%9A`ynBqhZ2pL@---j-zr&nt%d#&8HZW|o0T7Y%ZdAU`|$)71VmG0%iHn2iyskw
zd=ykmxx!BC%(heAll@~I%NgQ)b!+B`7l8wBPKQ}FmAGljPQ-FQ#i(`cO*c^h3t9)O
z8HN9qP9H8RGb^bua>uX8Ku<m56b1qlv+$L6ttRXPQWVW!HxiMZMrN#{W`8h^iDrbq
zehrKBfC>3I>k}FmXA<N~J`<P*WAD(l+)JhEeukIO%6_8M@hAU6YNEgR8z^4AZ|Ti6
zJHL{A35|vjc*g(sg8KRQ1l}NNgT(1if1HM)DHz53vMWXSY$RFf(+@_30h)4pw8S>l
z)bjXHx+O(N)ks1r;NE^$=9>Mz3|Bfs8rIk4?oQjEM{j0riY!9v%FD~An%{30Q#)ps
zzX!Ct^Sk0dM~y%;ag@U*tj|CCx=Cd4B!CL~)2mdN>pF+%W#=y`{LBgxeCol!nkE<m
zNbLo2Y^PCny#NVZLe9MYb?l@beI9fMA3C@!P@sM<5$0*ySCKX8+DXM>AQ?AVVLDDL
zOcNr*T5xJ9-!1XA-R@7{%{=eOhft+fb@oWFZ10tKUuyu3JWl>EcKb5}r~0Ii@ra0^
zd$0qpj+s`#R=ZG82c|%K>CaH>$d;!#H?TwIw?pRzczIoV2MPMsG^=er&oVgO*kRT+
zWo~yc5oDbX!&d)h?DpG7&p^}~pM+eDER3$wV6l17ez?pZdtl4|3+~Z^fC>}n;RDZI
z*)aTLMsbj9<P%0Rz=(7fG3`@8Vn|;nn$DBR${r4aqUb494IX}{G>GiFy7?{W5qpNn
zhm|r5)(ZCjRzy&IN{F$fl#JGk@e+X9=RVa8|B8N#{?B6+{^v1jki0t4rtE-~7`D{Q
z1yHLUrn*4YfYO+D?3F;}Xg7_F{Zl_Z?cM>eY+Z7NAl!LD<bB>}LEY!t95QnM?jDyB
zxG;w??{vHWS(q21-FP;$j1bZ=t1R(5D?v|>nN4p=arx$2ao@$@c1o(d1Ijs0YixJ?
zJEf|>dvrCHDuHemH?zWADuVB?Eu_6_m(<kdP_b*Y*qd*2Wr%)nHo3I4bW%~Zt_H$B
z=EYYEIuH7k_D4u5Xs1}1zU?6bVy}>qHCbp^jRq!nVe)$3<8hn!+<m`SNm-mOKkF?w
z28VV)Uu9(5V3wsnbG%g`pu6bd6}yi32q>8O^D&ISxWb5w%F3E7Cejd8wQEC1w<`#}
zE=`nT;OAk8PA#uw`m4$#rI2rdT~z*DORw$keTfpoemy5nV5hk94p?On{bK4b$Qev3
zZ^mUC`v%m8uMx?i5MJ`yTo~IJ9@rr9B>#=toS*u)cdqaR-yocTsBLN{3)fkm+8b6p
z_FM4km4uG+GrQ8mk=m9ndT?C~#n3|Xq_vyG>9_T&?(OQQm|g->Zo;lTk@o|xEw+c1
zxK7rR;MG-`wadQB7{WqOJ9Rps4zwKT|Jo`7egQs!Tzwo&fKtTL4m$j~#8Oni(XaZQ
zGUA@rAe%aWd+y;5HqP}3Y3;~y^%L6Fq<iD<5H=l1c(Q#wy+v$H6^sZ00v#^SXQcl<
z1}mTr+xpt@H!7Kza4lh@2DW?%s&E>RS~7YuWCEK%VX~r-Npe)vo$yWRX~YhYbT8o~
z-z9OTOa!FR{=@vAP!H};D&a21(}D?j^CqEy3x{5wI<{YorG1Yi_^yR(V=i_zXX%qe
zc%*#`+=H#u_x2(CbM?f29aLLi*`lF9D3xN6fL2NoeIEa7<RN~*V^FDkwgNhh!tJ+{
z;fOaI2E-r_RiN?^rX63>9~!1jm#%e_Z!r6-%EiQ}up@cfKUcJxR<xDrvNnszJUCOp
z*8o*a$Ni15yU+mVZ~;~U-mW<X;TJ6%0<764?T5sLrQ!HOvBAN5EuZV^5WOyGe&hz}
z_^clLJzik>mmZ9KXQY8IN}oH8eiDcL`Wrse%Tm`@Y=P@#AZ-qMRSX@nb3RXBa`p!`
ztNL|;thcQs9}#&&jTqri+A;wr>E5FwEE4vTBOPN2SMM|Bj*Xo;TpsdeBz1I`6FfHv
z?(q3Nut09W9+^%NW#@4w2k4){+r2*$`hz)F5HLpAai)Vq``Y&(<$_d-r`)>s-|<q0
zwc54`LFZ@dfLr5`-+KWUY1(T*2pM$0tt(rIds5$0Qngg8%+y%wdwb`fuRQU+YeWzw
zeTj*@ff(C8im`g6kZ})y-f8cr7Py-Ic{Tcr8$$6eh8@>yO4>|(9Za0Aib2ie2`K1c
zt(=tve;}ULf1rKDg4WS;&58T+;LGwCweC(Tx(kKiVZ1Fea&7ByFT{2tWn(UT>=ah^
zCSl9A)6FO#*6~f94*M$=GE_~}uraGe-A0qsR@-)hGxD43YmdP&w^npol<Q*!=qNFR
zD?AqPSEP&9<Ech1D+%$^@9}CC7QJrxaW@9l1K(g`b8I;bPSH#=8oj{z^!$)Dg6+or
zyU+Fz3ZUzv)Rq4QjRXL~61OA)9eBi#@+Y#YrLQ>rCFR+u;%GAw>_-wfzxE#5%$8N{
zFycum+`Mg?(rAFPRv(h@u**>8x#+$iy(vsyY0zjT2{%`~|20?m$~AzsDbJIK|IygU
z_QhWElYsPmk1|5TL)1XuS(h~avQ*9UIaKd4HF3bN|9S{W97g6zscZrz#DxZ3$ZW^9
zCc{&*R6NiBS}X?K<CXCM4%Wem6aGYVASReUYVZ>fY;0dAUSIjKn{)C~35t4(wbo`0
z$-rD)b*~Mui|<8el-Y?LN=9p>|DzQD!EH`>_L5BugqMHUV*z_NWT{}T$>AaEF%x6l
z$ZSQG(NafK{K&xWK*Os)uD6e5B2GvnE>-fddI8V5`2Ok%kc0tFU~j?XoN~(GGVLYm
zXr%a(;r&g|vY40F$q~`N5zA~^duv0MTSGJpZ7Pa%H!4(SpBYe5ruJak6PEhn=R-cR
zEb$9?NlJp2vcUd&4ajBA$@Rx>0&1*0)4g|sbPpp94u=w#8BXq@-^#t#XLIEe8q>Jw
zh5~>Hzy=jUNQ8v*W1>VOfnmtwo6SbzH}R^5+ey&kFBaDSYHT&Pe+!Pl22zWY=W9^*
z>^FJkN-XveYg_Zj)LnQV1=ZP!h@^p|lj3HMO!y~!TnsTAOgdu^xv@puLtE|!k%RIO
z^ZS`x7!U{_Wgy!Z<LPe54>soUIKTqa1k{E?A+pqJkO1_sb`?(328W}Uy>W%AgHP5w
zNc<7$QY0!MoaM)a?EekoW|PECsULXpQprcjpEAopo}uy2_-ENktkEe)JfWpxj)?GL
zWcEE($pDZHyXo1phAb(hV?xjz;`G<9yxwhRM*lO;_ao1b``|ug;geq#5K72~i`zq$
zrN)WfhSl$%5Lu#NPGA_?uCM2}ZU5K6GZoNI*|Z%q9Tu$U&@-})UQow66a4mPj}o*$
zZ>p@{JEz|qu`yQG+{+{!-uM`a_+s*XnH5SYOa2NCwWE={^;(L_pWLt#4{%Y&7{QTN
z0D7!F`4jR|$Qjn%-_OkbAbJwAN9ggnM;JgKZ)I~a=Mj8xl7E(p^jftnGI4l9FM5Nl
z*XS!f@S{w@way<K#~Fwf)lzv~7SZBTVA|ufv1wW7An(3E;QxOoGPnWarkoG%T$l2w
z#KTGFr}aYf6-HMXIY-h|r8I!z`r-sgWs@wB2v|CLtpz;w8tpv+;D67rn3lVOp6;0%
z_`~iD!fqcE4<mICxfUr^OTD|&IotvH`vD#e84_>rh8~87xM>eJnrKY_z4oJ4TqmhV
zIcW3-%#q<TzrsYd<)~B0T8TNeH`q+LeV-D)bi>;Iuz`j8CdBeYF6Xcyr<TXcR1eJ%
znxYi+D^?sAtQ4|)pp~rYV}?t24iEVK^MFV3Nl%Pn1F2DHM&O^+NEh-9@#-*aSxoYV
z*sD-j{c?E3XN#H;a=t5e{!V3R!aD}Cx;nchv{N8(ki19%t)TOxpy-H1Cc8h}eo!z;
zM}VQOS+tkT*e@5{YrsgBqrmgnT*VpNNuD=K90DhwWLInv86OeN8OE5Ra|u<f8HN;h
z(vqP$6CxmLJ<}q8yj}Fl=^Jq9-vA7eh^=zcz0t&!imLr{4X?pT^Pi=V4&LEG+<Y1|
zp9_M;oMULg7%0bfZV<5$T6&H7yYA;4K`{xE^EL?Xh4%!B38aQP2(_U`si9F#2=lh#
zS`m~bsUAOD&hl7>@60~jtE`508d=77vPWC9`_lN)?Uz_cgKZR+dpTUGgzSxsjEYLl
zI+lSvV@w)Ag+^EoAL;)@E<})T4YyICJv-=i>L;#xo5d1=8@)McEhFgrniLzp1TnmJ
z{#mvI!QYFt(JA2$b}9G`Hfohez1WEaN;tNg(!yJrICjUU8^a}#qaN3E6k|pNIj|d<
z15OIL&OL^lXENN^x5G6@{z6RxNXmD+w&2J|P3=FheDup`;0eND`jj5|X69IKKW(2S
z1{ucwDxiJ?9Kju2zu()%Xdsrd2-e;w6;`?qnOY}S)}P$AiW(1~U=Da8Y}A3P5Y#bD
zYC?4FH+S9^5^{ZYAMm~jK6j>Qc+}2r5gA(<BQ6YiVWo~47e+_$`!Zhx(3vuNcyXX#
z@&B=zJwu--nCEEbwGM8^qCgqsPWLGlkD`eG_Q{j<^fM{c#V^-}fhd<|TqJ=Vnikm=
zg7xlJZ0U@w2hZB<TCMV0(PRy*q>3pPzL0MV{ED2+tqmk6?rrt|<wlmsP4nJe*LZ{j
z?Q4=BDC~82r)ILTi8Y`OHZpL55QhVAQ^BL~ixLL`Zs~Il!o@s@;jHn#9*D%)zTza;
zq4~Go|MCtu=HYhHPx(MDEFbtl_~S|L?--T<vbr84I;cZn!PX+GVL$A{xbs9Wxx;yG
zeZ9Ym0lSzvNP)~P`Li(!{?-d{54k=i)ntj@pF(WNKlwn<dQhj4uE}-++~MLg0&%P_
zQC>*`*ZWz#6WCja)A;X!n|^F`(T{)lzJ(arYJt$OSOdOs4Iz0qwVnpRT?iVM74Lvk
z=L+`8jq4Uy8I1WPBy?jKw?Wdcx1>3k=NV~Ohcc-4sNTc+b?VeYRim?#?1hb8It7U~
zB!<vN3{TMyVh!j=^^=!EfOKTw;qcAu|5RL-W5r!Led#ezso&l(`~#ln*yb~lkn5Wp
zPfFKXU8Lo~eUdimfwpHox|~)+44VeNzuYJ*E20+G1fUN2B1DVzqvvLU7<uHI#up{*
zH7`_4hP;BWymij&4<6%sEgSI2Z<oz!9FPg6eZc{AV;$rB(F!B*i%$=^Kcq1Na30R(
z&;MIXLdbx0rbF1;6>^PebZulZD!=JmqwWbsiwzLo+FjFzanT0eP;dDD>>e%eejXaP
zYXPnNhIDPfSWK#GKgGewt5N|~>98ZJka|1!*=<(DsZ~SQ`MbN`TVtIVh4zq6BXG39
zi$=J`IC|@&X8!Uw;Pv0?5Zv8`)T#OTQDKeL=}$GpmGVAdFH3*~&tpNhC`UpWt#yT$
zBZ9TQC>6XQZ@Kr}ekfkoN3L`9FGLcV$EkOhDLm2JSBbca`yxS$%QK^fpj*mz8xZXB
zv;oEM0Y!XDdaepoZF*b|Drh_90RTcP%p>OOOHD8DcP}G+%I`Tq)r0=q*(cX&6Nl|$
z;OU`>8sc^<P;)JQ!lK=2Q|^UOi`msxS!<?Io6~wzk?3ht(aE^4vX{o0Pa~NhvBvAG
z5~R$gXdlGo3{lNf(8%RImfyFDbNP4af>R!CBBJwr``KPgD2D3m{Od(|M8k(ijX&)|
zug4m-d~1#*2=KR1!QNp+ROY&yvz)Qe(lgFe!LC}4gtlqWOXnWzfB{K{2#2<30-_!Y
zxW&(J6vgNdc*LBLF-5f>Z~bO+a7|=VaoAkoUg8OeQoCMS4LM1#mu}r2kY3%Pq9m)8
z#%Oh!+Uc{zba?i<^iVcPI<R*+ajBzw6+9~DIwMQ{7A&(IVyLoe#E7a-B>vTs93`k*
zcFG*t%!wJtyZl&SIT+-XpI4r)|L`*7e0Dzq<U^U+R=1l4Vo&LC72v!}xlj!hz2+><
z@O_6&CD>a97B%0c5+&9dvM3Kly^sU>OmzrNyapw2Q?1>Xb?#{RZ-1tbm<4g()z-%>
zXBuTwR(zF|Y;mOm>6PoSHN3EsfpU4|DSOBVR}`##Ud(Vs!98tq!S&k-^z$jtDZn_l
z1udl^RH3_ufpix#qtNxP`OoAZ<6i4cPW#$4qzZvZ5IDyXF!Di{8INDQX$juGdm-KD
zp|IId-zU=d%qtbNd>ZO7!mGjElEK_$xu;y(vhQX763q4_dJszw{Nq=x1W8~qV=u;G
zbxppW8Sd8Z@Gw8NEx5wMY~blMYj}r1<oHS4*t7r}2SL4r=DdhX0JV@v1j9^dd2-v4
zvC-Gs$PN*=1<}ICSi?1G8yv#uJx$&X2=p;?cjzC4_R|}{0d8t5tV?J8eP7aaDfT2$
z=Y(jXzb)vV_a`NvMT~vdN}lYJ0axNr7q|HyFnn8oC3BRKzW1bwi-~pC0mC*|iza#U
zKx3qck<~I!Cc1=D2dZ3N%yF5ReUF#jMpHAx#>}jbV`xVuDvGrnCVH*b)J)v|!tZ{u
z?57mfYhP_V?tsR}<)|1w7-ClHqXu5s*(*8d;F^_{dyvoCcy9-&^{~pWc>!o0_4Aip
zIHQJLdru&uR3ly4ZZ9n`gKRH#_~tRbFuxkiZu-Hf-Xi8xm{;EOmGRq9y-J_)i7RO8
zioASwKR3?$w@g6hR9dTFvcXH;iOnychaJ?Y?@Zc>#kd>J%j(X@t)&T_?iQ8eDi?2X
zPB4vb$TkTOnqtH~&{zks+7|ss^>AQ=T+feses|)OQjAm>1Er0tT#)D#7Xi8;UWd2Q
z8cXiVkGjBQnHk@}iu#uuwxDYUJX%eU&7Hn+Qmo@tREr~#UI#@de)3B&p4pO+Mnd{c
z$CA6x29L45<+vf17sdx((F{gYK8oTl!56fw=!*uFEau1xkLGj)!#VQ_=n%I1u{iiR
zgWebeAx;p7UnT$C8*WLTw|%Vzo03R{PvUI!7l&K2ldnet`Z+9c1FuJt1>7JZ%1t}x
zl7x#z`%qA_a(+On==4rkp6R@5N{?#FOhHnp+579QuFU(6Y@G}joile{@NO~U_ZimW
z0>P5wQMONuM5>w-4W3jhfx@UlAohz8D$?L@<MK2MwFOpAt_oh)BVyZEOO{nmr#Y(#
zUl0o3rxXicdQQErldHQ&A`a^IGidtIRHv^wu{S3t0&ZJ6j5k#=hkY~MSJTmSu$U6e
zrBE#K8U_GtMz}`O$R<zMSDO6HhnQDLssE9AZKID}OLoqpj&oB@eDKlu&L_)F#HZl*
zsD3_&yh8JyZP$+~MlCY5!IIoBS~%)XTT3|nor}+PcAMAwRKLBt`~F-d!-E5MTjoA_
z$OYn2X+2N3O^Ks&Rjg+8j|X}J$7Vl1rqQ@6tgReR|A=wzsovoMdr~<LV0dhv&O?&e
z8^&uCUa<QuuZ`u>`S@ngy;CD3${>jILJb?&3Pjf2C;3vOlb!#4X4Lbo6S$N1pwWBG
zuBBWyE4Nz<(z#-g@8R*_JsDb+Q*;<h#1o!_h1%TW`&)hZxkw$j$Bt<J#7r8>RTu}`
z6CniGSo8#iDoW_MkR^qhdLrYl-bUsaC5oD;bI&}eKJN7dCEc5Dov$0SD4zW~5=r0h
z;3%@bDid9{WJniX_NaPW9TjRkS=vH{jJt-FWh;<cxP4gJQ<&s4+2BQ)=%bvUVc}hA
z+UA`cRH%b&SAh9-poVfjO%w{V)zQFvQ}wM`!Hwy5`XsYFJ13MuO}$3)Tl(z994XZz
z$ytuDpK=CQ&s0RGk(YJOQEGEVLFbrH++nkARq5Se@+%W<khp>9*7=eLP6sroo5K_0
zL3n%Wnb!wi%v;G>tSY+TjnL@F+47dGbGACK?a5Mju#2dvr8M4`i=n<~nZ4;VlvX|M
zDabC4S1oA094+nn*_^Db?<qE#K&DO9Ip<7%msT{yZ7$>9Qmk@V<Ke5}FgX_h0D<Id
z>DgH#*ZrJJzEKo3dPQpP_owGZ9yP7j(T#It-P`A<teOogsg|(!D^AOP+jO{nXsg>P
z>dPT7b~C~R8hH42_`Af8NFp$SI+f7y;VySiivwLS@>0`oLhSX+UMGbc1l#e_pU4~O
zP3q+n{0Ry=rJApx4(50-)OnDmG6O>zsBe-JD5{*d-?r%pSO;fQpiR&i(#Q7uDo`_O
zt!7o2N3dsRUD#PKk^jpD$Qn9_%I=zOcNK`<?gZLSaPTzil&Z;&2RC@`4vgPK>yU-<
z7r&sYP`lLD=naN37cY9+SlaM*8R+!)-}o&IsEd^k5=~gA7ya1ky~hPD6+2s3zta_i
z&B`XIUQdQr>vtIEp?H;cYk8ZO*99#qHIJTWRgka^7qmR#V1@OgpAK0v#Js9H=CNv2
zu4>6B5*uVVjhA_&e1L+5e7xAzav`!%s!B*})@WCx<2`!(8+qv>Nqt7B)^vXx<AX<&
zNi$e?zop^&CTq1oe6B#f)KuM4y`gs2^YdWbbb(ip0n|bNNtc0@gL+D<;V7{R6t-x}
zUQOe#iu+^ZV-#X|>spQV#<8QrgpPXq7|x(zgt#lUuYidlG;?mQ3M?S7T{`L?B(0Zg
z;V|mLZ=K*;;ekG6!A)_FKl$^m=6s?F<Z)Pj>$LYC1_1$qMCjGan$*+r^?xE$NB#Gq
z?YDKj=;&dvEimcMoj&)*DRkJhsfeFN1_x(^SXnt^zL596Nax;p?tqbWK$#o4<~)OM
zK{7u{_}WpLo6?2FuBJ9S)G9*pZo<aB@l0bgGv5QbkYWb2r7k|<7&e}G2NP6Xs+q&K
z`R3ZJL&r;?jP%_@vR&R~qdDN0d{RiS+BaEVSM;#KGHjo+8n^#x3V+C%=}_VRB%kbG
ztQ8rdP2$j}Q&%yAL00a!wZB`cGc6x-(rS<TR^zR&P|=fk(?(*RP-R~+o~$enyYx><
z{4#AT201mOvH8X8&rg?02c4(1za-;rPt{!@g@t~*p38D!uL;t+`M~atEd?GW0C4Sr
zg=~rpizft6z{t`1yI>{5h~eJ6I=q)!7m_s89M!lDjf(QT-*)OUjr%5jZE(lWza!Cg
z&E5X3&nT-=j-{k2?_9mpNTr<1C9|TQYr3K{TU_*PnC&QHPDW<u-P-r+P-i(X8S0*Z
zu<$NY)G9rqiq1oy7%h6(y;jh!7U3sn&q`D60_uF7sZ)O?19{<@?=7Y_Tk(W7li_h$
zKjZZW>y@*VkQ!wed2T*6*D@H|*sv{#&hH_Gx{+0jzPCCL*QhV(*=D4i69pm&zPX{6
z$9#?Yf>E<J5rZoy>DtAjr_@M;rbRZ~?>N=E&1*)39S9#;R;^lbmjNXToyR_l=uqXt
zUAL;)Q~m6VZ#x}`!0lJDT=W%{`k?Tr<ZD-PhS#qRex2})M~9xZ<_o&gjShLf^|lcR
zoGl(y*Hnd`(Z$(BUB4|H^~YKamnJ;s=~v>OJJVVx2Wk62<v<?q<#WQ_?0SrFe^<Gd
z)fjE~$31&InIP=*LHf{J73b^dm3K?0WG_b5c{4$@xDNjG=FzJDG<VH?S?CX2?%<|(
z2aOA_H!~i>Be-k?Gyc#O?y(K6AyU3C?FfF@aB2qCSjpwG3|+*l6<O73JfJywdOkFS
z)lX}MS8;z|K*GJ#vuzCI-%xAF(`CJVIbbZ`lwXkuSx@W<k<^^;SvWua^eI<+IVA#u
z|72vzcW19n04G%zDE9901-f@rdB2~G<rC9UF_ZWGaK=-MK`MOY&Mj6}I<avhqrjPb
zmQP!io;WKHDM<^it8W#J-jRCfXHIhUh?cL}h>tAI&(~LeX+0h=JejOF$trSZEM9fN
zQ(QKC$~`DKR@$vh<*~j1F2(6iW+M3@Z4)6ohoW(|N~p%$?_B>mt&m*RM6GOb_H(0%
z?u_c34)fV;(ZhqU8n$skXlimp4hmnvvZhTrLMF~~sm(n4g7*EOjFPBvrT&XWRv9tc
z*r{MQo$`IR>T8h+R#ETDW9PvRwHhwZe&P4rL}#7_9N5*{EmfobTG!2)7Z;XkKTKyL
z2GuLiomw`{Bj$JFp)GX<B#+l9i(O1wvfs6IHQe^B5Bin&e2WcMs^XnmqFUGTv^z0%
z4A$~&J24c)mn8&vBFDiE&-9cgi_ix6Uw4njmWEqQ5CXNF=6jnN^QpIV$Vw9SHC!7z
zT2@o~-gj;sUi8eGC=|bc4Nl3I3bd1WGcjCuzVfB|Y+Lsw3`wM(4R$UJ#cLPwYhZ*a
zm!^faI;4rVXp>p7ek`d(y?PWRy&D$ukp{>~G0`{$oCx=A%P=)WDopZ5Ybcj{T;B7W
zSWd9$8w^L8{;*JJr*4y49H1Z+P+LAmSFc&!3OwtGWBs{fw&>x1-GCnK@k2bvRc@V{
zYyq7@`o#26p%_`rVAKB4M#sER)Q+q9;r5sq<mkmavib{%2B8G+NncZo-b3q%*g+BR
zOi`=a{3LHtsZhQPk(E+%WPp`D)gz)nZn-g_)AeR{@iUU;94mKay6>RiDP_qi0*DwH
z>-+e_dR*yX@?BZ5yLaAk5{ybUMw!a*w9YUuPcnOvpSS4^6^tj(a=g@D`?!;#xX)8F
ziQjmxJW<y(Ix#^_HQN#Ol;?>*3=eP_L*VZ>-}v5e%2Zqc>=Q=+@acwPR1@TQlNY*d
zP7`1IJp3DGQOoqB3XAPXh4_owHpwE3-?al(3Sm&Y5X*!9DC<vDv9=st)-9-GWsOIt
zk#(T-eqtwWP<KH&)3sbAP-|Gz3?}cp;mp+vy5`JR=%y$9tQuWxQ==2pGUrq*s;c{z
zN}I8SPg=~Jt=BSqGW)XT_xsgzpS&}S;>YZhB*l`+QwcpqNy3v28s6{gc7r-f+PWL{
z>KjGgA_)v8qK!4Ll=c+Ya9Sw^W34FNSjK0W=JTy+pXJXH)SS!PjJt35MI{HV5k9rL
zv4~%3o19^$;8`@kR?!UqXsoLb6n1Hf85=#hKTY!ekPA~_p4pmg^s}_nG3p?zbHi{w
z^DSRAt3GNqjpMiSkd-@2*P7En>J{U6db4?w^sV&{J#4YDvL*>&vak^aF{DWW_1}9D
z!&Ayf&1kkyqX<vCxyjH5WT{j7t=ylm0j5}en{v?E04*}Rn=DpOo!UcExBhw)DQJnE
zzMV!y5`i8eQyXbhQDhwR@~1J~wGgpfP6Y`D%p}#3#ravPz-wWknAFq7i(Fo#qg{iY
z9%?wrR(jo4I=44;8m_04Fx=FwA<aSf+h=WNBQKxCH;bYFjTP6<xsF&qY)VL1B8b(y
zKwk|{oOcLEU6HT!<BrJh`o-;x<g5#2kZ%ErHOBI3vb;=6m$GF-q530h=WLgp^$5wt
zk~6)OES~Y)TyU`|iF@7swyQ<y6MmJAf~kB_KP%HHg^$YB2_ir<-d$!tqBEN++e2x>
zrp~T-yCi9L>0%Ys-b$!EmXcO-p*FbHG@c(Nv#^5}w%F>klDch3p7PwP&ND-`VM$~4
zn2xn|$SF~yh1lc~k(B;(9y<f@Oh;A_XLj(~Ol=fk*oRBWwLa!kzaV^q6tl}*s6#;x
za>E0&)wknvLlbHIg_amg{LQ5$E(swa_k+!P^Br+vK^9n?JLg`|(M(qC*UC7Lg2Yy{
zah`eOZ#o<I&~g*y)R%4L@B-Ib`?0CJ;2O8^agcVHTu`k{68&QA2N#ls<nzFv?+;Nj
z=i*#$Qqre&?R2W|DYwt{7VwJ|kbX>E3*$AYYo;=-j;1JNud43qPNIjM)m~UW%mx}I
zr}fNYHVic_3kbO85tNc$6)m7s^64no;T9d~*a*HP1luBI+IhNAsC}IzHJ{AW3U1V&
z+#gx&(y5Np7t+p939Gdl$CMVi?beyl=B7V`%)s~n-qZS$wKIAcH{RGyH7vep@ICCX
z!l(T1%U5&y*NUo&GCtKa_*a*@I5nd;A+YF4DXr6s9FN2DWd8n=i3VF`0aST|9<P!O
zAAFvwWA8Z9X2I5rToqo*!$bL&KxolBsiG%RJXNpdEZ>s_NmCJ{G&wW;)6+G&BjYG*
zlCv;!pH3i6LrbWd4QcPZ|Mg%G!O*2MW?_uC;PcX{h9LDU#f2e>t(SrwR)4Yi+vgT@
za}$l%P=+&*08Pt|_caoBg!5&m)>gFwzclKkmktE1yX_oqw4n}p<6q7sRO@8giaM*)
zD+;pnV0V_z(GoW5q3E6wicB`O&KAX`nmSbSR6}vnEd;+Ut0GUkGfe3wDDSfaDouT0
zrWvr%K8d<^eq*Z(fgoui+gDo3nk6r_+vKjno40~g>6(3%FprPiyn{QiF_fC@uZuWm
zBSbB2C<5|Nwg@Xhez3AqzLW&knk1OV=NiiDv6AgD?8B~nSXNQXgXc}buoTM$PfPja
zVt)~@?V0b?@L6loUNc9GGrxF^k3-evr2tyBh`%*^dGN`0-x1&btYhU7Hks6Hw0INV
z8~;kP(yIczEeUB6hwmKi?{bYKVwq{J9ud(=B{kEbhxKu9hKvF%MG}hsNAAa_#?z=_
z9^e|7a7nB52@9(S_xYoj+)W-1Fv`Vev6|*&W-YnLwghzo7B#gD(<v#b*mHZ1g@kUr
z{jZd)N~bKV_=~N|z{W0{fuZ=x?x*62RLZ?e);@z``9LRGnZ@&sW=U@OJCtf+>9g+}
zJDbe5-hEEVH}b`KOP+V>Q>L8err%)CO5$59wA{U)7TGo(Qy!@fCzwk379aax_!Kxz
z<gKKd3h-G9Murj}7C9f?2(7g|6mN5gFskyWRGD&MtG!U>XiM7p3A>(1;J@w+i+~8m
z!+V?2sLi>A0RwS!nSmolOOezShs#IcDPBgYJULnEMa+T6vE9nv*q^>CYlcINtx^Hr
z6_#5hDV*;&YA>HeY&Xc#hU2`*G*Fy6K@OBn*c`+zOlZ`(H%Wi}Mi0{-ezEEk`!ZUE
z%X;&tKi!#ELB*xYaA5wv6m;Lq>}Rz#5Ah+Q!$_&`nU{yOwl^nif6zDMmtb+-#-h#d
z!S7>FrDx4sf!15jFOmde^f3KzHA#-wN%5>Bd)-Snx&gCn&6auDU*j1rQ<SJ88n<0H
z+f+p-Za$eN4682v)cGuVNRhlyosrKY)x!3p#(1uIxrl8Y&t#S~-!=!fCpB04ZczUt
z(x+hWSJW<$Ya*;eOWhNpx%PUj*?97OL4R>m`%8N+nSQiwXvipEN5W5Iq(cN7*gX@g
zc8*mGO;9(i9D%L^sN;{O>jlIocW2k+Ig^#7-wL(8y{XVgjd&(qEt5l;nLR_|Az6X$
z9)WFANQinTYCRdM;t?I<Ca1R_SkIr6EBMh(s74fIHCQHtGfA2+TD_Zc!O2V1lH@(u
zQ_|b)I_J0#MdV8eO$f{oOz;qYQNyRLCVw7^=yA72gR7lVsh?9}UiEsxS_(SabX}9=
zno%@SnZ{IHe(tkXY6G+tnc_SwO&<-WAe3GZ++ihcKT=$1ylwf}KAC`j^Zr?8O?>fn
zB2(a)jON5rp&hv1^W!Tk5ly?=I9S9a=752Q;*feI^Vc0=tGW4~uI8m0x;7reQv(MH
z2qUv?K05|7l?<m6;9<OJ4*urxFNq5gR_7p-^pK?d2i|sJF4J^8Jg#~TKTkcb3&8--
zO;OQ{4XbjIDlLnkh^H6p$AQT86Zj%^5;_4nTAR4<ceAq+O5CL7K1>`ah8TX{AXr~1
zxW=A*%KEW$O4}F?wZo%baGQ)Ykc1`o9b+glEX&VXx45A23VUCUdwi1E!DC0TSA1vd
z(OJ=&bfVJq#<$=3W<Hpumit}bUE5E-I%Y{iTwg@-Diq%pce3XyJ?qMG`~Evps}rno
z9yqas@qM1{eVXfjkHqo~HSRpB{F?_-B80{_YqY*hh7Wo0Re|O;1)ivj8K??K*ScC=
z%Rf%5aWZ!`luB&4s(ROxEv8tyBMq&5-FkjslD(3E$R2j_!h^TeZCO@4fy|}c+aZ&K
zg57GlqPDtIgZYfo%4!Q%?5pWgm`li$(yT2tHM~9Mvzf28H`y3AY5kM>!ipj|xb8A{
z&?kl<k%%Fj+)%e!+T{9><*qJiUHtmnB@x%gM&a4e84CxMh3bLHthWKXZzRI0op4Hz
z%?RIw`FPAfG)Qi5T+@ktiglx3vz&@dtRJ(cjC9b$*z`fzRG~mf_~!ESvog2nU{hCN
zO#(kk@$9pPA{?hh0^Yhp6K7R!k!qsEdj~BYE4ixKW=3;ZI&KMg!dK&iOlehaFsAVO
zC#fKLLWyDp9M<PK8x;uNTNBTVb<iy9CMggN8+wCnJ5+uR%;_5xB5K_&SqAYBN=~q5
z=OfJHER$hj3y+}Kifp~$W~lK7wFe;(t79Z-aEAq;rzX?nfHTvFig5a-RC{3BrpeMd
zySg@Kkau@C5_O7O$>u818V}O5T3(k09w{c3U%%3_(dn2AcF<O4dB|P`Mas-XApF*J
z&95*=W2dP)z$Y?mJe*8NF3)Z@?NHmr<I~0+G%Z>5ZFwB!@&1!f@L8)t>8I%*!Ly!K
zv}6lP6Z%TN5A~a(ziS0u40%l#Hq=@&%-vczZb5#O%sF%6#TPa$8CxBUIFpe4q_u?i
z2aFy{V>f**aXu-kmWn&`wPn_4*p8hg8q3z|D_MB_b|34O!f!vcYLe#>ps|wc-m3TR
z&kTpS7lS;+-|FtGbJgREyiHzc+900NbB?(<<OXW(o}lJ2Q+t%5Te7hJQ)yl@v}nJ3
zi8L}%aYM!OFD#*<eRdHgV)l-E&6Zc6+kKc=k!9j35#g;h3>o}XK&s0F+9tmi%5<=P
z8H3c-Yjd_Y&8EKR(SG*PxAFK{KuP<?=K83(JHW-N8eJzaF8KA~=C$80A*WRx^Au%S
zcAFUis9F(Pv#rkSU3@|Bw~w$TmFC8h5}74^U0lkCDEr`6)7DIjUDTdu^sZ)-;Kb7E
zLrZ=K6j9lP%+mF<Xt)(d^6%#=BJ$qLcUptV>1c-1($4Q+NrR4H1jU2_YUa<2dxFav
zLJJ$&-cVf@&lFDDs?lUgCwRQm{3ob7{YPf*hrELY?qV15c1NZoNWYbD-kRp!^eKWY
zk%U_e%r~-4Z@0ZQA0BqXm?CmKb{y3}liFe0ot<;1($VqFBjLq6>ZZWK9ADM(Yoyp<
zEfsl}Ruph?8FT$m>uUXk`vV*E5Q9s5O#H#(qutm(C0@g9&<#fB#REg{(3Lb_LY;{6
zePyd&-JHkvSgu5y)vMv8)fn+?2+=vm%%Fqr9UDx0Ym}$sy?aS?m5U5?G+q~d4`?tO
z;*kXK0!|XPr422>F;8~i%%7YSEKZ`m#@#OE;EgT!c<ea%LHaB|iS3$h*NnV$Jr}3E
zMxn0BqUT*zEXLU{T`Sv3BDxC})*Xv}u_8=cmHbLqGRKiF$DK);({Gx(0uw#M$yTth
zls?O)p0KU2voiNQH_Ab8=Yny>9Ikf(XF!#&e)bv&FSd{*MP5sMgPArSZeviE+i$o@
z7hR<EvT!IAF+RPinewT5>^XSAhzJT5MJY&#DHvukK*?;A_R($`xU4wSO{&}q7QU(e
z(B3(Jv`Z1_CZ#IRqaDD&w$Fs>14bNFt+in3?+$1!F$K7K1vC}QA#{8hRX!?gtB<nk
zpJuQ`MR+YD^94zhSu#~-RV026G9*z4qI+$qRc;K?hyh<$VZwDq5l+-Pvc%3|geik1
zOeZJrF;nBagEB#i=Ce}MqPBunOau}O&XDv(59i!6qnzhFPRhQjVq=+sqScnEQLwA|
z6fJHQqO6N(Frk!-T=o(ovGeq7>4Zexq<bABGshv((N1+WWiI+pZV}u9kb4JaC6(q?
zbIhCKsfbpJ$^EHq^G8JEmDmy4vcVNwEmTN@MCU#iMK$JRgRXfui-mv{SdHXeD0!of
z5+f{<7E0W1iHvySCS=@vijNs7akMiv+E1h^X&%v>qfV4ED;O<c@DLj%tv}m&u`Qyq
z%b{MU%5Q8y77%}1KzZ<1$hU2ehg+rpy*Y+p>k`*=c^Imyq7Dpk;?zJXUqLV2E1yR+
zn?rF1U`vn!HRNND5KWVnY`kVG#}fN@Z<c{t1iqZIFM1f0Hs(kCf5^ULMiq3Rh1onD
zi)6h#Mwy2O$B<7MBrdyEraoIz$@j>GIBeIYqLjZ^+s!hFL2sb)N>57pMEbP2G4D*f
zElS1jvedJbxsR%Cvtd`2WnwGb=hZIbHfulMTB%x&^G=k|5?b7mYv<qyX+J2`nJ~%O
zG?u=al5~f`=B)Q`foYm}->T7Z8dkor&l&s-nK~IYj{;zh6N1(rV#*zg{ci`HXPqW<
z;@^%CGXbB(s2-kOzh&6EOS5_bwvhum7`Nw~yHUi(qNqvt*v=;0(NAK#V`Ml&g&c=c
zAE8ad@8CN7joaHGJLKY@t3g2$6v~>IuUVz<07kPp7s+cwfPRfgmxBPXTkrwRVvv~e
z!9))`-!p#&ke|<il2uj|;?O6*->uJWZrmr+{C1mjg)8N8?2G_~HJ7A*>wx#X5Ga=*
zaJ2#n)>6UPR7|JQHS7c46+E&NV>t&n<Fe5JnnIvDn9|TuFsT9{n%OjQfV+gsnGYJ{
z<wfC7YUwte(mOqiP)xMFa51^1$0hc^zrRlpPGj>Wf3=al>|a>3d!glW<=!aOr;$^!
zg`pxSq^v2w*~rQ43vBv&^}9Ym*g*prU5T7WeqF!`QNtGiPStEu`yw#<wB<6u$l~&7
z&Yjuch`-%{F)Szn>6wuk{+1*7=8Wp*8<W}VT{=s>)#$-gJ@!b;J9Psf@8^);-g^P%
zO55!$xCMfyttbLdfCEG?50HX7+Yzx}Lb<3pT^WH(&;ZX!OW6goc<eO7@(#W+#ICQ%
z*7h?DZhsax2Pbvh>U;+X2z(g(16(LyI4JI7sKg!--Mx8jK?P``9?8e`Fn}@q4~dl8
z0?vhJptKf-r<RrcfJ}7oe_*ej;1(1-FJ@!J6*Lzp*CiKVs3sGn_GhOb;ZGEUk)%@i
z0Jz=o+%e?;*UEEv0C@W%7~NOxgQGYN5w8YJ9M&-K8o#pOZ!rTz#@iX%=X`r#k)GG9
zvU;^80lOVU&AoI2Hmy(o5%vWTX<o>*Kfp~TgqIrv8XtiE{<T?mI-EK65-1!sLZZ9o
z*pEUGi42tsHA%vz*%o5NrvN&Fm=E`A$vE4n9U8xduU6P2qAq3ILf)Y6_?6A&e`=V~
z8^9vJ0VXpE&QwA3Tg~uL`a6Iv{54#hkDmuy*7s+prP^~lfX7=`YiS=T2Tl{uv>W}5
z7_qBQ=F0B#jR=U)a_1#Ife7uxaF!ID=SNCI0W9zx7<n)vSIs$j1?3WqKLt3$(WGEt
zY)%H`U5HlD?O)=uP->U1d2b%pwS4rC_TM6b7O8A$2dm(V(#^lM0v7Ea?)abipcNW`
zibPqa?4DaeLip;M2GDmjAZzxe@=K_Bn%YEDuY-BuN;CezZ+O6EwSF)Nvp(LcN)fwp
z)R^D@wX%-8xz0Y&hQUeIZe<*PG3r=Z;SzoiOawH3{KsV^rXUPpb8nmexu_AFO17YG
zA`Vb64xBCc)QbmT#D)M0)Ls8WW;LPHh=+VT2w?BQOU<{jpp7Ra169bE{)pj0h0uD9
zhm}$f&m%zx&kZ4?MN_}Jm(PQB`nx+*Xir~i(2q>Qd70&(me=fY2SObkPD5lwfy^Oi
z?*G$~&AI&d#P9QQzq4mPUPkjDl_D?G+Z7dcJ^B7UxgfvwF#FajA9InZT?ksCB>P~z
zZUj}9rQ!jsrvP_L$a!nsH2(HcyDLqm@ZxUbl&<ggmeiRSP|cR8oy-HMqb*=^F-#yF
zfNqV(1E=Eyti)J~>=TgE#29`h09a`-z)Cg}x|S0Yb1o}MoI0v{bYo3gI)j2ad}8GV
zsPHnOuH*72M2Q?<LUS@cC1EYZifiEgz{E^rpw0i7RE@`)PR^1l2j#--el+`5Q~p;r
zC;bu}S7f>)0Zn`b41*=o?=J&{Va%a$BH)ukT7ZbB1UZTz3G|SqHee@wITYd$o>x{C
zcy$4K&h;KS$4S1Sey=$Xu>uhYJMF-K3VBsSx5B!xY+Zf!NOB<7;Xgm$l7&`^z&<I%
z0I-bFKt^+B^Jha4j-Lev9p(4O<WT@7(H}-8wLW<J{_cqDA}BCyX@_L9SF~}~1uxZ#
ze6t@;Du-@Tdla|MkMv@u5+GEyP#yL>pXvMkF4pJz8xHVzUof<a2&<yDuGjkvizWV{
z!By2Z=)4WPa2K!x7r9P9Fx=EYL`|Q?&G4oX+OI&0h;LpmOaOtH?JGWXfb#Z-04d%K
z8N0g~H90^bcVBBZgAFz41A`@ojg#$H$0iOl>s*)E`;Kj0#BGj0T|}`0Z{>$Dm(LqT
z%Il#ksW(zMuTg-DBf|@!wHhTk$?E$(dI->!GsD8*qqwHTiU7@#m|ZYm9{fO?*|~zk
z+_^HQiWUw;7T#%qME(r4gk*?&_=+VDv~VPdb%CfNNMpE6x0@3N?#61&(yy#1T64}5
z2H6f!Qk4*=bJFb)PxAX#wiK14<lqy$WT+-6$N5tBlBkqZ@nJ!3aP8u>0kmtpmNuLb
z70@mT^GXghXL5u=!G<|*mO)+l;C7(@wLnbvA8MihCEC}E3*(Os!QQr3Yub>P2|eh{
zwY6&f8z0-y6QjfoQlod}x?}F<ET3V<LuNz7O$}ekd}j+rbyql?HLGj8Zz2|5IqN7L
zp$Vy-<=MmeA}(4J(X_u!Kp;0&>%mUmb_0;i_gZ;3!(U~76zARjej`?=zxnbv{=ZxR
z!>_=cD@NSE;&=ubySf=QJV@%usUsdQ#yJ*}3GMyiv;I4VjP5Kcv+B;VOQ@9Jv;p<o
zBos+gpPA?*K4zd4fWZLpV?RK8_TGs(JO)_Z3{P2S3FPCR1a+&jp#-AAhZDpN_Y}ct
zFEjae=_$Z;!1)a<fQxDo4UdF;rimU}ijwIxvb{_JpH!lb-Y(Q{D8v%vEDk)NE->yE
z9m_Y7x9f6UT3a+9E%nK?kIH5?0WFx5j7NbSb3?NvCuxA}ag+f<Y2q^>z?<mcek6bo
zSBlq9CqV?`#9K;YVd#GZUkbSRKZ2Ky6u<Tn+Zkvn_kB;bniz*?bfw@vweQ+HmTUV#
zROJ_QEZKFQvAvFk*XfEX<U6%&rWC;cCtaMZ-*BVJyC?=gRVb(%7cy@08p@?m+@To&
zAMgA^auX~55<ih?_bcx|hlB^R{~VGox^*c^&}kTZjU#wj1P|I!18{wrXblRTbLM)0
z;no{D=0M{&^dl1R07(bIJ#hca*C}fQ_=r!Dh!yMXXL)~$pzcSkV5tgVK5dkg0_#=g
zI4V!S;4Ae%Qrrd9{vV_I1{piMQRcpoXZQU8ig^cAn}fE^-2PC2QGxI-T1*GhJA2K=
zNtMVNsV@s;NQR;C4C$ZHjR~JfVR_jCKBs00{!MW#39X#85<0ou#wEIHia99$FdEY?
z4_UdnD|pPC(*J<jPL`vI-MidQ){7w)-bw5YAHjhSvphAn*GI)S1MDK|k6p0A?cy7L
zco#rI26B&Tz^N7Bj*RmvA!gzL#XO*Tc^p0q*hRsoF)B1?GXF~-F=2XcM5#mEm}0ts
zrcp$%7oyuAf!H7n7>cB93gl9Op@=_T4vy{a^nXMov`m{_F^v#5-K`=UQ!(9L++G+f
z&Ws9~`APJE2owfYbsu2`0?9<8tqh=WjltrL!1D7|4b7%t3c`-Jx;pGci+KK2jen*Y
zA^=*QJ0VexeyKuJ6Ck9}&TOp4FEao=cP4-{RUANZ<j(FP`jJA&Ezwex!J88NJiv;q
z0B+Jh_wNW9ySPzK@_a(DH3ixT`tFclze^O)Fyzbml`0uNu+V-2JfSNAVdISskCH7-
zl^xk*t^9N0=I(f-|5vVRE(=b3k*QVt$}s?F7@pSy%!1lpL9W;M0B`~N%j`6?@lh1}
zhX$SaQKVy~y$!@?3z+TkgY2M&U6q3_Kd_Nbx#%}J8qL@NOi6tCPk;t}VTE*6&;lBS
zP8K1X8H+mb#pZK!CfsY3u>m9gm5Sk?AuCVd7Wp%kyWy4%%!(S=4q8fQB@!j?L9v04
zFB>udvroTh5LGI2>17sGNU0hEI<wh2zDxtw)hEe`$pU!O(u&a#h~Ovj7VB6TS|~6)
zu{sM#h;sM)(^qiUb9)D>7+yXKpft8c<Mu`r{#BBIl-n=kL)C-x&m&}@4)z7ZBn_j<
zpJSBbdtc^NRW%UKCL8Ty0r`y&7Ky(IfUkdY3JUQ|zPYbw|6EYX-wTR@BRj|h`J*CX
z%($e&(huVPRk{r9^}rqgy6HzgwENukwp#y8YUF?vi~}*tE1;u>D<8-NOwyNtjVplv
zPhb=%I?HC#p{iCXjL|)Pt7#pD0oa&l2|*6M|0OB_+)_c^BXgPS90#ndn(n`UApWNL
zY6hP*n-&N9ndK-W#(k@|fK+&bq~$y;xN<5I<Kqm;`2hWyeUpQQ<_tj?1W032gIiB?
zZDoWB1zqI6DU1J$7k~(MmZD^9CCE~r3Fwa?5>5kRm8Eut&qO*P@YRw1&{boPqy(mD
zBlRtTQ|Fm7k%RyP{$WHT=91tv2}3zhRIV%YBO;Y1o^k(wVJ{>>yvSGV8KPAFryqqh
zxVNUUGsCR)2iali=)VH<;1{!;0_0I`RPC;<Si%%o_Twg%6*z#wdN6$hiUrx-hEM(B
zoPh9fWZ;iq!6ySD?{2t&6IJCr0Svzc@(uB7mu7m{6&H_OgOnxJ*h&fD_#@z>z6P%3
z0inG(a8~X50T?*l1HzTh`q~4)&fh&D35NGCfa<6em>yRM__dM_n->7^H<#wXL^&>w
zf6yV>B23Hd-g0+=MA&BFnnGPM^@3lAs`}47VkR6i9}w4EB=(u_sDL1zBe%l*6$hK?
z{{=ZAX~3$}c)_Iq4RwQouEJABnV!9t{&iq15PE)I{bwk786NP``vrBd<+H&62%P~s
z*xR|?!0d*$`u}O?t)sf$x_41ZLP;g18w4bjPNhXa8l*!)I;B%WX^`%g?gr`Z?(Xic
zv%a|Z`+Ltg<Bt399pj$;mxB%Kv({WQo;lZ?kEi7%IQl<x-Nle>fP489ERc(LFhskK
zASv<&G)MP*E$1IK0^XVV#7Ky2(c=Z8!*@{*TY*rYfNJ2Z+!rt)qtMf&1p|p5=(x4O
zJ5UIMy|Kibih|xfi6A@hcgz5aBHs~`sm`F1KE5wrB~+Y0o*Wt<l50#rX&CE1Tigea
zX|JC8N1hJr0FcK(*Ti80qJLS62tI(bli=0@2rYj@LrV9ey5J|9NJ5`9k1D#3n(<SE
z1Bf2&S|6fa12A>XLE%>p)g0F%PyOvqWpzP^D62%106k<mcM%9WzJx57WEqVCmP-*;
z1wX-s1Y~mzuedyQ{FAHW%gv3vJ)=juh)6h=>RWOclP|hv?!;2q&k$t6rlQF3|F?<>
zWIQ?q4&1!>rwU@P=2Twp&tV|DdY=q{Su+&Q3>QvxJ?MH-HQ6(IobIiFELsZlk+|`B
zT?`hOipBtSm~e>*AlCmKa)3cJuxgh@1)(?aQJm8t;cgWo;pRA1!M$RXxG)BmPZe45
z7NSSc#xPE2jPqYBR(N#wpg2m^=$*ee>mYg>F=Z4*`zUB3S3pcREDelo14RdY20z)$
zK=PV`F$^hnlmUHNvWB)U%b0Kii_$Te8a;B!jKiJd5oiqR2G~}V0dTo`xe0(zeiR9z
z575qH)PQEt0RmoP%fP&@UkuRBXlP#>X>Dc-0Z6D2k_2Y6fS5ecUASnlR@@9jr~2}7
zYzPr@Q;0}1?M;3J%$#f`pclqZSnU7sUhZ%@5MmU?x|9StW#qsRRNzEXL0A8p8@$%F
z-e_arV)wEAlDfy<-|=)(B#6I!5h`ao=f`3GI1;S>w@IjD+@a2{1QzO!eGYUO%Ptc#
z&dvWFV4v#+qBwpENm40+q_fo`H#}28JcO{P40=O^vH+#eUYp$`R?Sh;+8?P1u>>t?
zFl((z-*~!2$F>(U&#8KQ8uljX(~Oa}Sr#u#d%H}oDGfa;gJ-ABcDCe;&a4W{N?sQo
zovqLKPT;W^7sQvA!88USbrZ-v_^>_i0MEotV$@*mAq>!a=!U(B6-o4vt46PEfUFWE
z{s!WMfMa`j;(ldEv)W{3sW+3u0ObBNyGW;9=T)S~J7r*khDbsBV2LA$H8L&~ffM>r
zia7!8_WPG?hhfgONR2-Ji;=|Rl0{^L7yDpnF|PO8H{u9BEn-cFbVOPCEsejItRJ+_
z8`js?B%O)~T98Hx-P*}b4m(JqDcTDS?%}U>M#iH+8i1@Rzz#JbF6SkbwX<!(mYx<E
z01whI)0F_`3;n!^a*&<r){K0;w&EOKnNNitnH3XTxahQhEPO;%BrAW9hu=Du+5WXc
zJfyRzOg$~2gCE?+y-G1Pkdh~m5*6Z%4$VK|fdZWx)Ds$r1cLi;;g8R|mOE|PDj<-I
z1X>j`Cana0VyWr`>uge@e2MKXtm;WyvZA<&$p9~i1SwW&>AeM867vMwN<lLd{0_Xg
z5;6b>qC*<ewMLAiWsSe_&zQWai4kz=0x%Vjlc7MJmzT2_?DBCkAJaYcuYi-&10^qE
z|E5nc5EqJzhXSM$28f!Nk-E>pfI*pos05I`GGxl(2HM16ZMKsd#Bj~>k_-&UEWI-N
zrs~^UvXxkVXnPNDPN<V8D@&U+*jzS(`4XqhQ?<SKO_lqfd9Rpjp_j|2ja=7}ah=Op
zx>vv?O7)jI^2`~4;2~^5alq_^HAulWvmt|m5k1FhpZ*QQH6akKfpu3>mAX3xu{<n;
zq3<yeGl6NwK^<n6my<<bNvtfvfUj7gi-K|;WR!)kYNKF=`db+hg-A=ndFL#OmhToR
za`(48s}jccCE0`6W}WRQKj?k|$UHn6IHEjIxajULAj0l{ftXDn5Z7ZsvqOF?oFH<m
zettB23&`z6xN~w;eQ9gfs^Zb0;n7r%Z#bmE<vh?N?!1yCqn<6TIgLKk!oc4z6Fui?
zBseSNryq$^!8;nouK^GQ(<tZ#WW?X{Q-(D7@*vO*9}(PKSbgBmqWZxldcFX`D;x?N
zz7me4DuqYUJ~x6P@bSnb9^Q8ncGd(J>;SlI&%;h#`7C#;54^xWbDMMs-u((&>bud>
z0ae|MYb_o9u4S65F;e7ke}e^!ox|DrL;MwF67OwAk@YiU;NR%qO;?5i1yUT|m;{nX
zL4w1<CQfRWub9}XCvKmjN1V#eHb`QTI(X&;H7C-s?hEdS|JS51z(DUHzE20*q!iT+
z;C78TtttXAMh+4KJp|wT7b1VqVVW2~IjHdS%~t;4v|Y>s`vR*OQX@7gym-5O@6fk=
z4F^{iuZ(Y);AKu7Ut}EeGPfQu=>^t!0_XY6|Dt==!Rc2&f6LdXjwS>&^Xt~k^=$0k
zGG5>GqRGUa_TS>kUjI5uhOA4&YURo4;Yf(%pg{Kn^+abnt$Fm$&XFkrzBeia4v9=x
z@kPH~zC|xo3I^{aE@f95a%-sB1q=4dK(->R23r=c36OW$=YaA^h$g;x)I@YO<vLBr
zzBq}ffO&&AN#1v&=HyZbUN9VN=jsN6+QmDO@h_-6${?NAqKFp7rt$T0y{<!NIIbHQ
zs!otF7vfF~YOYIYe$k(h9NQ!2sHsI<6}aa?o_*G`wJTgD+SGQtA?1Jm!ie6bH%VKM
zmB6|U)3HEIZmvT)6TcAvVL%1KY6}zu)NF9k!Fmua-QNKY;BTIT^L*04!v0+_bLFIz
z`eW@Ph3MS0BNGxIFCg9a-R^oO1}1-l{&;C29sM+_P^}(-4j&`gMg759K||ayctjNt
zf}{W5cE)m+8Q0!_mn#Wp?(%?8sqwHo?b{R}>~{H|a{LdB$y_kJQcBptwercm2TayF
zy?7Q43l3{T=<%m1<>Dpz3sUO)CSa)8-fbb6Bl=+G*Oac=-V;)e`i^}AFa?DO;9i*3
zJAYGH4RCMXHpTwf0{^#)(v0cjFNI0MnMIqv&u@Ttq4)?w?+&S2VFliJW1h>l(S~=W
zI_q&+Ag?LJ8j|rK6<HK_uh_G=rIW1miQVbnr)Up;DF06d#&=-I&{w<nW_<ZcuGzfl
ziGf$E?ce}W!rAEhfc}$p-*>w;HH_YE1sbkWiEzUok{Q`=ZDFm$Or3RBc{7eM63Mlm
zg+S0C3Q#>?D;+(0OtPj7011`?A!SYB%JTNVWMRJKz=sj=e+K9Q0G;1O9E3hRh*cMO
zp#m!YI=wssc2I|@(fT6}X0-Hn^RZSU6ob%k=Y*XNb6B^HcCSP%`azc~$3Ge*zzb7*
zb}=yDKDA6GkSFb#crStTSiDaHB{mHMkat_i)Ea)k#I7|g=2UoYNDTuT_PHgC`gAjj
zCfA>J9*QTwK_YNIJj|3f`AP(L2-AZ%FE?*nn^0tvZEPg{7((rdJa!ic-I_abno~k^
zyW2tq^^cnZ+AO}SewEZN&bZ{X7XvX<5GI`yD9S(Wov#W(3lf<)KM)57a92Kzu)Qf2
zW`X|SB&9G5z>MM}sg6CMxDtGz3W<ZNV?vJ6pZd8S*Q|rv%uoULw)|xAFa^Nbe*n8B
zq=f}%%J3FE4ET`OgWDI90=Msm+xRfah241urt0qhh1`sgdxv(v@J$=$Q3Wqk9L)@s
znMISwlv+@vkQJeWGr_iwAS)8j(C~mZT2C@aRisq_LMWKVk(wnqP-4p%;+)OF^7WtW
z=o7@PTe@@7(WCHBfn>Qw)~pz`i~he?<*^||XKUzn9rM*!XH=z0E+@7)>X@5MOgBf5
zuWd$f*y}!;2aUHJyV!<}niT*Wur+vs9Qg{y&fyZ=+bzuEsW?eK#K>*Gu(blD|5zPP
z?g3hM+~KF?K!dEqr%r@_rvs+r!OOtrXYj=oV^S+EL#QCmWaq8T;M+^>K;W8Xr+u4s
zKH&IhUqOlse+g*BVu6jP|3JVGZq{Ma*p&nrpT?uIZetQ>AeQwE0kNWtXmU|ow>J*>
zrh|&}cY+`y6;OoW;c`g|NulsNSld-|IM!)GUbn(NX!C=NK@HPqH4Zq*h2N8*AQXth
zG<mmC2QD@ca$E>_j*YR%$;rV?bs_R4tzynN0u~d~dS~QBI6%w;-12L!Ak;TX(0>$O
zVe?`CEoIdB3oHoSE0c3@pXNP5`<SoZFaTlP4A<2B`^kpE=G4VsyT%na)594ObC^=W
zq_!L$a?-qGv=2*##O&~z6^S{_zEK^bjO7(sq!3gx`W*2!{XAo>S*4)S*6<k{)6L(Z
z^|F$3yuv*IYb)-aTY&<^7F>zH&pf<R!82az6#`izO*;iZ_yJ<b;1TE$@>wu#b!Jcf
zktqKfTMBI%)E&@2)9&DZR{rjsBTrC_V=LS4wNysz@n`ms7Jgk~JXB7(OhgnSKX`~Q
z)#%uDxXVaGn_`-K9Qr7Aog+tITF`Tal2twx{NVyT*k_1;1E~e09xhsS$hSQDpj%Bb
ze#isLrWTBgm!M0#-@J7*yO+Y+QFC*0(50x!Cmq^tV$jN)__GNXod@|)R%~e4?j4Ot
zVLgsuk?HR)*?-N+_P_Xv`0x{--2~5z#Lpu<u`t=K?e}TcnPA|g{s^-tMiP#%LB_Np
zgnq*aGA1I7%amu}0H_pT>i7aypC>09uc?-*<Eaw-nJ6nQO)=)#0P-q=(5H_wV#wZb
z&#6dYLB1~3>}ACP{z?i$+BKI8UR?emoXA9?=UDdZV+Tx6g>d%5aAE~?IM2+38`0Fk
zCE1`u9+zworTk1jkU@GPl*jHei*To2Q5?{4NAo|2$D!h95vB03L1%*Z2ZPTWndC1;
z09VT(#v?!|u$`Nj<0-zCiMt}USPeZ%ROj9h$Db)EO9A9rJ^kY00^HAmTY9X_{k+Qq
ziFuQs^AHMfU~w-td)7ozia1J)5Zilnz2ozNR#&WkHkp|C_LWiNxUmhs-SJ43=LxDb
z3<i3Lru5mVo?<@74KW5s8W0Zjb11--Ll*pzb7#KHXyDp6(b;Ogjs(%*f=jw^$3g!@
zW5n7Gy|!RqLc2IODk+@W!wzt(p+rD;31L+F;n4>MT2+3=WZLqAoBq|Pii1+G*KPX;
zs~GiEm3#*+o`Cy+u|gS=;~E#M>uYUNU|c<QPsH|ZUJ_5v02HRC2KzO^QT_Z6F_G}i
zO#mx$c>(4{%N3PcXwsqrP~rzZ4^je$LMns6W`4v*RvB+CWUKHM@6PRPVJw_Gh#v&0
zAEaaI54_fepQw{)wQ?0(fHdSKuDr9t+@cFVfSDaOvr?GULixEEz6TnpAeRnfW3GVg
z1eAxCzPGW(Tf}*P)GqGB4p;*593%$^P#k<L&)c1A0KZjR=j{;44g|JAnRs2A4gS?D
zk=b5qz|1fR`msdn=q+nis|*dlbzmukSNc2AUsHRqksZ>s*46T`)szJ4=>G=J+X#{d
z1m+$WMgzC_m!l1oY<K7QZ+~iZ{DRuW#UpB}UYjt90<Q({-mH;7^9TY4wM<<!uq4`$
zV~}(47D`lvFLqG^gl9LACGd!fiTUEVc+n5doX_Cy4L?GW#Ct(2Tu8jUsM^0~&yVLg
zFyF&`s|y%z#P9$(r&SG!wfN7s1=JxvR~TIdgMsMHRt;}QK7<d;@a_>hy+j02u0?0H
z6upjT+y1dVc&JnA7f|N2r){g|h4(Mk`>hghL!q2H-onj=2_T>|@oP4;&mBCH$sm06
zkpoI)2q_%qC-1v`{7=f5gLt}jY=FC%hJj$);BnQdXL)+;cQ*{dcK(QZ*S-%)9Qy{)
zTfyXT(68yRo*e`ZvwOGE7`1QG0sA3@52fv9_W3YDF(?Z|w(e<~Nu<fc%*;GCEWp75
zR&aVmlC~fn`G;f`1&QF%j#Rie9HFsW-M7drEgd1GEAR_8plc)q>ahZ-I9?+mv`P-8
zfjbh?0Ia!Icn^g1Q6b&Ks6G@zgw7ZqXfF6Fo2eggYUG#80LPRjaB%hm@=p?dNZJig
zFbslf2$Yc&Fys$_f(NHzjJZEp_vaE|8kn<nl-4X?-gRqz3qJ?cO6X%FInDYCp9GlP
zX-$Q0Uw*68ufAutaG%1PB~*aX<X`&|4saPaA>PWhc15*EVtK_pc2`V5I!5*Z5#3*q
z42ATTaxe=2KEz`vJ+x~2K-<F6q3)BPG1N7<YeeZ}^TTNNs)7?Kj34TszIT$Z6^G(@
z2iN=ojB%EsfsN*wZib?kpWyXw5NC&;AlcwSUrC@99iX&@*4CIT$G--m#DzpaS`TOV
z<#{6#>lWlW(+ZuUes2}JkW#3+)(OxJ^bbGj7S$s+*^m0(F<Tuy@149_ZP2LLkRFGa
zM((js64Hfo7YB9FddlBL@pgy1yRA8Qg#d(|cpJgX`IE&Z$&EhN6|&1<bTh*bFmsXu
zMISQt3FTuscDnZAn;=x!msF69#Q+qPZ*KqyIsJ9OJZVV|fX(0+cY^I_&;HYqat8-9
zchfA{;r&kB9Y4#lH-Zkduzcb824VF){Fe#q*#-QpOF-v5Ox;|esnDGnEzUD1;nmy}
zP&KrCQE{5ox7Gl?C?sJW3$VXDB5o6BcvKJp8ipVZFkgznUx3i-$aRa={IxoZqo&-#
z?jaA1i;GMBdK<UqlTcWfr4-Qc^MV`vZ5e{cuGYOH?rxMtncLeCV*<+tYPo$_YyAPI
z#c7FtXR;++4g&Cm>rsD=V?H)AQtGeU+s~wr<5!BNh5eMNRye#K3_ntY{T9(K7N+AF
zDFOs_(gL%Lu+3-UOV>>4=j2)>nu+v5&N+8v2CZOoKOp)+WAz_iQCbk~)&^iL<mm+8
zz)SltLT~cppl!PaG6z?%Pz6Z>Uqlkr>(iv~ZUSF50$R8gq3l9Y9wdby$7Gi#(>+rx
zA~21TR)81qeY(n$G&coE(i^FvVL9zeI7)gAzS)7&=B6Uh{}<{G|MOMKe?XR`kv%dX
z7EE?Q<e>`*2XD>h)OdgmmBNS}kM2#hn?J7FeyzL1PaOjqiV!;(czeutmx0yG<F2xf
z?n?-W5QDIp?(kLg^u2gt{2A9)6)oW}k(jfjr)tVyDo2lVaskWYyYT>waDiAvL<{`Z
zc(s@K43va`nj!rMJFfZT3;)*-uRk8@CI9NJ`=Wg-B6L5&s*JF5PKDtO8^hwM68nll
zfd9!V#czJ|fTUA_`GN3M)#gO6FaalY0JrX88!-k>`CLY>9ZqOo!z-^%Jw#8;tngIV
z!{(uDNo#_)$A7m10T(U=A%ztNrvZQ`Em;9hXcY!g>a{x8@r7cmfOav~=uSY)Up6XQ
zq^$6kXqI+$9?n0vo{Cad5BEz9<6N1Oo^mOlIrnS=Ob_Rd?VA?1(zg7fWk77B5C`m*
zzlY{v7vDAJNwSRE5%&l<!c7u17C`A=#e#Q~zfD=mE|93@1-1Du@nQT=sn#mc3qTnN
z+lU9+!SlYi=W-)M3L}L9>YUKma8PQ&RTF}rLO6H$WVs%04VH;=Vjf&@)--o&F1-(Y
zv-MH09MEC1qWrzXJ#mW|flr7+2OM*?a8ge*K{v(||3-93bfPNy_Han&*yarDdC|^`
zeFursl=n{?`Ty+&@W{G%b25N2?NW$XYM9@VqV^$$YvIZ9ONRe~{w~}MQSN(kGVgb0
z(m9mp<cNqr1p`t&{oI+6=R!%KYq|5?MJSL-=SaH)gx<0Yym}*!D4rGmXYIPQUwcnM
zaZdH1-pPE-<$~Mz3#G%sDCdoHmPW#K?fIwQ&TY#zwu}vzC>zeXJ6Kws+x7@VB}Oyk
z2;TESGM2CKEsJQd530>CjCWOreHHT->h^5al{|J}{ZRF2aDFbQOV}OQt0Gvxp@btD
zG=RayzNzDW?$hRafHwRN3PzVQ<oNX;f#D@x!ssRvC=WcUPl-yX*cz@|^Mu3)J!DMu
zc2zI%rRMKX){>pG(#g3nb<Hvp?Yhp`w8AHr*TS%8PO}Cs5q}N8WB5g_QL{695nwJa
z;t2((p9lp$Vov%$U!pG3?itzFM8(#0zgV6eVj+Rk4-l|idasgb-SvcfVTiqnncl99
zyu+OHtY5hL@?Cb7x+q!iOxeUQujM9}lI;x?<p!gjt5-j%`(}Jj_3Ab0{PBq`w)Ri{
z%)W3yhlN4kj0K-8_@;Gv3l3S&FNOe(_%WdID6WFPoaTcQW0;er&M!P%7#E69YRbQ7
zi_Hi6-L}(gB9U5j5V%hosS_>zTg-V555o4Rn@+8{z8nqTIoa_v1pD)wot)pi{(Y+C
zOT3%rY)vwPgO<m6JBe1ewVS)4l~0cWgN`c<)v`?Ue(s*AMW^yMh7fG#S0hp|_uV*q
zLG69aD}Oo4xq3P6XaX4YXeN()e9Sjc$o?<>VCA%!&sJF;;kV^$s9>*c$t5}_X5APv
zE8lFoIBA}Z{duq4;IJc=Jvps(rC6&btP*ei@hZV!Z?5)Y@T(@>ju#Z12zq1D<bf(&
zi%!D@!WOu}Z1hQsZd%cZiF}t>iieXGxtL$#;KxSjRe$8K#-CuB@0R-NV8Qvc8O^@b
z4nm2m<jwr`I{vuqgl}$3JxY_f92(8#*615=nVmMjMqZkj<o<=X%`iQ09kr-uC@Iqg
zoSO2E8|9qczW6BykT>7{Qx>2{gcwx|=X=J%bswbZ<jq3MQplO3v0>1aX+314vIkXB
z=PXuK8J$iXl2o@WM*a}BEdTmpK3TH&t7OzcF44{`i!P&S+WQz4=YZ?N*u}>poO)*&
zh$Pa!#I9UgI7RMaZ~p4KVBJ6iQ6QNgZrptOS`w=*|ArhR%sC0lN7xJ=5zxey!?Br6
z)uhn-2Zr4aFlzxNbd+9vDvpEotWEWNZ`xAjAcK&M#HWq+U>+!i>8q!EF~?=rymQH;
zg|h{9$IbOl7eu?XemZxN`TT_?9HPV0=ko0ejEX8>Pcm?J>$Juge?55*1w)Pmu`w(0
zj-XvJ-|QDO8EEv#<9sFy^GfP(&bngIVbI+hk<mHKR<b+j>GP&&BJkz0(PUG&``jn}
z5Ir17EEH0fQ)RvGyq?_kIDJdlslm@p)mDx_W;2^SKD~)rTT~AViaj0$_u+>1YC%nm
zSho0ZOwiZHbVA@~Ta(OMa#hEB8J<-6>K{5E681YIgo_UkU1~LNmZUPYtblxQfPCgF
zB*I#{4SC5w<=D4nIBDDvWYaiNy<7%TLf@qHSdp4{+|^OxsiHsA62HjGv0<!4N>QZt
z7?7x`qwnd#d8%G!K2Uw2nb4E|>U8wtOdG#);n+ubPf>;M>vs5?6r?JS4rp;gCq`_4
z*=ng_ZCp$z3tj9sVPiC-p4yB3svLx25*Xlam_5!^D|l5h`XvW8gEF+Q1(M}e;)@<U
z38Ms_05L(qMT#!Y<Fgal#kHjc6K)Q={PYM?keL*G5X<H$k#{Ifr4N>uA)wtlT<dF8
zKvy1vGo#7ad5SghVa+y-F!J_bxkmO{o>aXc^>)&ujr{dPV_g3qM}=@i{}$b1uLP;5
zJ@{PFv9zR69$YZqi6w3q{U;u<(1-$!a8f)+0k#wK%Z&&~zWZ}`hkfSA1$8S}cao;V
z+**im;CFza!2YNtfnBE~O$4|BZ`ZuIB5S#UnrZL>QGnz*%~?eGm!lW<bXKb1mqQzU
z!Yld934U=?=6io+L`426Yp`Fdwc+nbit_%S#Ymu_5od*<T69F&n|&lzljO0z=>}ih
zQNWA<tr`~aPAqo2kithZgnamq^dg3|>wM@0aou*puq0=;A>j)ei9NT@`u)Sf(ta-E
z!D5<^X#d$K2|A*d^6sG>higwo6m~}9L<-_Z6pt&aPupuZjFVUKS3Zr~Knzqc9S_H}
z7c}Dpb}91nFFqtZw|_`!W0kJkHP^hW{;NNK4-P!WgDBXlFMHb$gZSe8=|atiuh~51
zg3Qq`VXVcIX?`|vE=Su+yWLC~X!1uvDZd5R{j>2%+WwmNE$*&-_R3SElrdqOm&6{a
zRfZP7?f0E7{+$0jLg^NR91kK2Ae9v|cWp~G3MHog>%JKcvaKsRTu%wG&kPI>w}-?8
zX_aZpQy(a}^@v7t_C&i=k5mqI?}|`j2d;1LXw}ul8dT{qYk_4S^=<Wb)Bo4H5|m)w
z>{hB#x4U&y>c|W!#-|A+TZc%JEk)?j1~3Q|>WY|a#us~h7YFNjaK^rmidYq1NmR?E
zZ13~dK0tmpsQGoz%A~zQHon5<&a0mnhRG9q4O$(Px``f3|Lh*}!S;_pL83hh^s2(8
zrte`Fcy9-fyu91ayt{8c)JVvFM(q-&0v9Tv3WKU-qn(aV;gT(XH00fsa%Wt2$(O@l
zDJ;ehZ1zW^7aKU>bX%J!)+_ekqjQvZCbWc#Vtj>0dq|hOHj=b1=^=ayk!@|y)?ynL
zDlZf!%7{G^|Le%=&p{lZypyp`a#(Nvk#u$5_eXVJY;98}?~)hp6`Ywy9_Q&fG3WJ5
znRmaOK(LIa_gHqFsVuC%YVz`*a63?}Q)2jWreqUgv-#6$;YK8JOaeyK;9ol+8N`RF
zgSybCLx+2`i~o|qKmRNh1cKPz#R>zu{9oJp&p(sd;h5;p|L+3-R|fyT(Sxxv%KFlD
zU-4@sam@&u=yYN62dXU=@dYFF&Gj%>0a@Cuos<FQFl-9K5Sy_woHuP(W{gG&={poI
zraw>Gv)8?CMeSn%h>9kMsRS%UQMbI}69LLMrW99m-5c=(wXb6bjC=O%ywc4pG0A#}
z1`asJi?q#to#y+XS_W*_z8i^-*JWT2G<&o`CT5s%qx_kgtAG;~QGgr2f`GAF@%#B<
z%ZYH9s|#GLfdp69I<!+k`be0}QAZf`v4!{p?UpY^z0xqexR=6D*Wh$XqXe{28^i9M
zc<OOEksccWbmB3pywjy6N}BpiE7Pgd(F|;9_DQ$ows0CE`#WEU+<B%~X8ho%?lLGw
z322#?mbf<DUJUlUy5&<DUZ_y}Ug%bk?h<i7#w_*AW+;T2v*R;N7XD*&`1q^w1!X;R
z-{G4uzPCeDxCAh7Ag&hKd>&4yp*H;+HLO<L(n3<*%e}VH8O;w|X*$Y0vcm|JbE?DM
zVMG%iO$-GaZDATAzl4Z!SKeB!pJ|eGb&qm%n3Yny=+24gUqgcOCONdzUIQJXzSoRP
z7>-*)oeMMlwCd4|CX#Epu-C-Umz5NEM%yP7VHK3H+l6A&wXJ<uu;OmG$VFq!f5^5v
zDAnhf3Q+usLu~TW3;KsCU&rh}3cKhjQtQbMbQm9x59_?-@Wu#-Y5xZE$EhiFz5&Jv
zJv&v(t2@t%4@g?dY8m*o0bk~1!Zgoyxq0hH-Q<R2)6;n<X^8i4l)7q%mL$z=eT04C
z8-#~V!<UAie%x<BmQiy4!OM^o6A<6<R)0lPqXFgj3Q=ue^G$nAVDG61h^~X|Fs}TL
z3F&gLJg>Y$d2x0=Ya;s}(Vx3LR8Y8mGX6RgvcX3!<|w^Q5Rp?UaeZ>i7t-;WZmXb6
zZb$~HnpZ50pRZ;NkJ{9pr}SMijkJ=1(ZasyDr99SkF6Kc-?f?l&;|4;bGoqX>7P2>
zhpwuPexVTMHrgsD0|}<mck?l|-5V`~r`qSKyAj2F4m_g_#~$yr4-XD--v8c4_IH70
z6)$WCl5^1w<bg;`KeRD{!bN2mYs;IXu*s*OgMC$HJ6!vyDeRsSY0tuNL&9!<p$5Ap
z`Oaf#=*fa4VVdk0Mv*M;Y~%aO%beA%&4tP%N0Z~x#v%@XH|9=cfG)JoFu+ESL}g>K
zMq&|Kbb<tM&ryr7_v1O$FnroLXHR1(I}qaC_RuNm<XS$XQrjhMh&eiJ&*~|cQ72#p
z@Ay*uv2DWLu(h(9C8uyHZue*DS=Fmi<U`HWyM9f-VmnJ}Tg8GWl18=$cT99)A}%e(
z`Fq!6i^orbfks#5;Q9M%zVKfaY(8ylJEx9jG2>QyA!JbN+lL11z7d?+7Wm_+8?^@8
z2QJ08#Q00~TZde}nGR^`ejE5(HQMu8^VD>~=Zbv;_yfAaQSjh6$%Syc+4dUG_eXzm
zPgFzCxxS@&B6H8?BfP<UzjVrTT6*#<%vq!QN@X{Rb#1-8i4h<1&gAZ373q@!Q-BdO
z&v}tWE-t+K8AZT{F&cBP%hwnqiEq8-W)8RFd&cxGLB@Qo<e>(+i*^4-rk2z*vK_Y9
zhTEkx4{n9&zE=<YaeSXdbok=jWQT8t(TF4NXRb}uo7j_X?gxz$dK~l4$}`^^sU+s1
zaka$^e0gXHbW*7da4hVwBQ9*YUN1U2;hNs|a+R*O?XKPR^TDAaoLvcc^_^Yw+te!+
z2A?*Cl2AG|pA*ux5DH&5Zqeo6`fKYeUA0G8q&zkKMYwaxgzpvmj5iTRCA>QH;%^9P
zTf5sdb$Wz#;@!GL`WuWpQLa9TN2Nb2H5n^!6FN&9-}6mB`80-A>5xY;u+hwByQC_i
zvcdSl(fE1$kCUWPbUrhcJj|M@p3!Rh(jEswV`37iZF5*{Lf`OV+@o)bc1akhUYFdZ
zPM>Ko(cKJI_V8c2U-OmDGV^cHoZk`wh|~BMk)v)xgwg5wC7yv-N}xaA&TK5QNgA@h
z<bcoy;c=;jQp=R(%_?*>N?fQ1?=!;01po5Z1z|63ISw0EWG)dB`@9TX?9!;LLVp7-
zqLvcixkZ2E-|&{N#{)GEtc~Y<gjQOZ9#kzlJO}x1S1wK2?{oSba|Sr^QF4QLip|gJ
zo8dp~RIt%2#u4h})w*%troPnJd;do2Zf(6e`!&t>ON9QI-A*_hhtd>tiM~ra+~XUm
zF-tw#Ypv0{T)DjS_XTPD*$OvK$o{!@#;T0H7w&;P{hXV2&W=#!M9IU&T}9Dz$+>N+
zd47}Vk-27UefTG=)zaaiMUM4Ycurbe=?wVfxh~T$u}$ScbtuUgI_s;l+BR2k=qd3J
ziE!s3@;2Y^f!^n8MmnbEgAZRxYkBdkzsNc9-`A&$23MImJ<S@JORbb1$xxhi84S!(
zoPMuY198l__|Q%lcd9QL+)R3iM{afbiSHi943xsPhc<Rq!dwfzzmMrqwqS;Gs3j~h
z@twpqr|9C^%+*BdD3{^1H&Ca<@?iJ%ja59bp7|TtXrTGDVY5F~|0~XAxM^H$QKV3E
z=w<HrXR#aNjw;tFyjP`iA4ev~Z=79gQ9WmhigSJ1WR9;d?n4}8Hml@a1~;k_JazWh
zc+?`ZXt~k?olmz&p^^Q0XMfT9V>Zx~u@<4cC=S$S#$i2*3U+Dww9$Ha9%+MER)2HP
zv1;7y^QJbgRsqHT&pErCUp{d`!D>uk#Q9qX7g>E10_Q*qC%EaNa@xQPeuk<CS6S4#
zvF?zD<I5#``Qu9-h5!r{{~nbr!Ijje%4_!vd1hZlzOq=%l1+~l<Gz-itA*AsUzPi>
zYtC`f(waHTu`X_x#uL624m{T70o7}tY7GxhS?x}~U6wXDbABJ3;Nej}?FpNo_2hjN
z$VY#H)8zr;nVf;a90Sd>Ha<sU`CN$^>mkNnR0*qoQm4Z;w%y&LERT*e>#+fqq-VuC
z)~rf$XS><qoQ|yH4muTm#hY(#B*m!;DShN8X!Wc8VsC21f;f?%!y)^R)QrR+Jmv#F
z7|K7jhlXGeq@;+>uTMBPv8{2qS$`2~yq0RPE{jX+BPd@y)Doo;N*E=kbkUf0H)Iq^
zx|;H57RemL!&c`QyG~rdQ~Q`78`;WVNn}FUcYtZv*cFOFbc57nY{_|@oS;YWbkFZ8
zK5jks&f-1I3}%1d97hWPoBfCDf#Ro^F#M)1I`S2}8B6F}(Z*dDS>a9G$P;~cCte&c
zv3CjrMJhA9#}o!aw8h+*TpWsvhvRq4H+e9tRTOI*Z%8ctyO*pcj3ylMHRe)_83*uA
z)b!Id!rx<e<eYr?F)>xzw!+zw#>;z>V!!Zfh1|*tw=Dd$cFZNz|BC&@mRaq!YYP4d
zLmv~w!A43p&fA<To=RAZ^&F^>64VsrSSEC&o(x^jmLPbls>=&F2ep@yC+bQP&7(4$
ztE^)`%hZD!a=QISaVJh9hvH?o-|_W+=C|Kv+HjIW&ifhrt&`<ytYynQt~PqdwVUC~
zBjlFl5_8Sh-yb73^K(OE<vfvb6~;2{fgpN2kt5%FY3gbniubG!mbXPJ7sUg_N3Wj=
zj}v^+rw+~0J~~Yo6veb;V6(f{T~!kF{k_wEk@UOrs;1&P**9o|vrV<#UiaLR2E_5%
zh^_9?3~gp7`cd!qU!HyoKfOBT?{B%hJzW?o!WH~>VmoA9@X~cIv+;v1&aLnk@i5v>
zz?XXkIoIs9g3|4)jiQR(V!Q}V{HJ$kJt9+7-t>;X@@NfpiW`B>Uu5ZB26<WRTSgr|
zUUSj)DK-=OB%qO6cczT8HD6B$E4qI+x+vFtHYS?owDAUl8a*DQ8wYaTr1%Sba5``<
zzMko6${HvK@aMX&c9&K<n6YQj;@SFiSZ9Bw3Dh1Ovu5cTm$&~iS+9F=!J8r&uA``6
zWySgx+5h&-V-hPsj9A7@&o)L~)RDw{HK!x=j+J=XS1t)x*bq%H>Be>|HB~B>ykR-|
z9Nor7tDNbxn#5Ur1tK%=XB)Pk6AZ${HjV}MiNUX+CVcNie6T>FwhG2RcXe3iLzisS
z6dUF=sTL>apN*oM%P3jOe4Z@g%zMXWMm{r{qplO>>Qb3LtU?|9%xL<KB3#}NIZOHu
z8ou3})IRlir4wBrCh%HDr9w^<->RGn1ZcX)juT$A)mcdeY2V;C#MX-q^NU;2IGD_n
zZ)o)<#<RJ$^8{BHqWHUoAM?Ai$iGwHz7uwXB=_NDi{Hq6@vemD`V!&Kkq=AfvI&C3
zNF_M?M4YK=-4Xz+J{7W4b^&+PcK=9CIoghrx*Si#@|8|o)4=gpRbbM)1l#fq731mA
z!ojEmarFXsGJTx5cTG73=+o)vNtUF4D?OnC_$@l&)EaTdD=`H8aMN4uPgq@~M4STY
z*i{jn#h<e@D79V$vmMLxQl7-_%u`3^qD|w$w=5If@q*fDTA!KnwiWQ7--x2Egr<IP
zJRLGKMe$d8mz!%hRz_#*)0TO-XZaGlUeT9~+c$NiR=UlWr(0D4RjH<5nTf=)cGV$g
zKGAlkLUvazq`KMY)S2KM2fdzP<~F0X-cS5?r=T2W`=>6ahg;my7NkO`1tz>CT;d#Z
zQaZrmml%f1Qd76fi6}<C;x%u1E92^rd}(21T$S8<71DN&kFKZoO4spO{eymn@^a+&
zDpyPrpzf^`$k^tKS6eN7wS1XW_?l%sUfPu(6lvC_($W5=IGzIdD_SF>Eo>8P4lEVw
z5(%Jab=+FLeR>(O>4l3uv%mUk(^uOP%Vha!)TjKXbF0g02~<8bnxQ<;)aJ7DwTFI+
z7ijDjtBaRxm#8O<V8v)g^N5N#SOts}8FC&A+D5~yyDGFS16>I}FgW<=^v;#c0ja&U
zKC!`UZm5d$!+lLl8-FSEn+<rQnl;o9j)up|HpBxvbvpOU=ea02Q*vX*$)L6m9##ZS
zKbn(EoH=|pP`2TaJ+Co8M*q#ty=?6y&$lSEkz&oV_NHZNPzuUCO})TbJ*tJh(2Z6h
zB`zA}4gK}YB((ml-SuFtVDX1`-QqrVG2+LvQZ%LqTYFQ+%j4MhDY*{MbB)q-j88j0
z;mkN23$_ZCKm0D`_~S2R5E|`jl6?)z_TqCfyaYHcI%w<}u%SArelkx#Vlz^G4;J5@
zd5N7iEZ=uC3g1K{{B_nx82_z$#&kX{rsFRebIzSp=g{&K@@eI2{w`ToxQVVsbUvlI
zQ;xCi>Cm%1SymQbcJ5yciWvnxx>Nc|R!O#D`>~T(u9iW<>>D~|C3}ZPFCo6A0I@Y^
zz}50xH29(5JBbRL8`O!z;;oPwv-HsKPn%g{Tn*YDS1StVgZ=}1+6KPXV}CfkP0{EY
z*Hh^lV%F`<gq>ukjc5BFOb<G1*ic$h2l96ljPTSD*JZ+pf;x1R+)#U;Jr+eHK6FdY
zdxta8k7McLSCHBs5RcvWu+obJw`FVtt=QNcKm>MSdLELY*wUa@)-vxQ+2??^XBr(S
z$UGpg3W8iL&p<Gnee2ZZ7ioB>{V9(1LKd?XCi)82RL4JT-4VH3>mP<}K|CAZGG4x~
zat{o&d0i%}#FN~W>}d9M?cAO}?woPoytm~`#<Yk4K7;k}Qs%9y;#ZeN0*0={T(*~=
z#cj(C=oZ=ZHB_oYBk^4aH0dA`62~x<>!cVUd{)=Wv{r-Tl$B^<Sg0DFx@f(Byy{IP
z=(b{A+ck3(v_*e-DH)M=SF5Z&U5&|`bpkzOxK(^NTWD<B|3}7YSR|(FmZ76>#GUQe
zwR($2l9x>Qq0`?=WMeea$7$W6vD8un9r|g`U9Z#uvn(pho4|B_>0!Wo7!sL^_IV=f
z)oHYOCm))xcJV;%8}%t29mRp&PwDaDv>&XT#BnkP4IXB-B~ab^w0nUUQGBj*DJNI{
z5kJS35ec1GA4uvmlJ)QX-{>aN#MXqLr;grfwP={#tCm2Y;%y<waH@52@y2)9Exn*q
zQdv44NXs&eOzSGbwKh?y=ujFbj9AE{SzyO{bvVhl7=N=J+ikkF3_msLWXEFP4*R?R
zMf;8=#>-OTb?rBE4N&@^6tf=F=ucUnyq=e>`&`if&dE*w_)W=v+dX#JeAN5kxyoy8
zgUP94nJ|9$>Z=9mJkG*Yb{Dy3J56G&$g0d5Yl?f<&pyHfDlTY81D(Yj18xy{;Qi5E
zpc0PCR5_rZb4<q=geo;5Yt5ffZ}2u~?{~iortD>3HI<=A3?aCPk4lKvo7>cm^#0L-
zB<}$hW5`;<U2FTLIH@@2j^f-DE}U3K#n3|<Ud7eTMZ9BH!0R7HZqZ35j<gH&+o%a|
zS7g_uKg+CAAl9Q}rWc7a!=F^MZ%6y$regH<UbSnfbzj#jTCm(Xe~R<t^aph_8NAP3
zTqpKJf>aN^K71RQ0r^0BZu|GI6OT>Al`_b9YQri6+@esb#$fmFx?qR$^3wTK!UBI(
zuQ`#vq}_8_J~9z2gPzFCBiPu<;Ux1lfo=eAeI!g6Fh_WERA{EG>_@*>x0n;WaTX1-
zu)Jz1bYlfwclv{Jm<I>;48*S^)8oXCMdNSjP024#<c=aXu{h`tbotPD3TKLP##`7j
z13OX+D>23$h*z8tecFD^9wR?}v`k|;^C>8(C-&k(@8lT}KQ@C7GK!=^#t$_WXA8Kz
z+D8>1rpdS5DRxxM5&L<EXbr-M{Cma_7~GtLiv|1j#Wiy{Hp(X9YkFZo>QGuFF%o{%
z--TZ+nW0a|tmu>Dldrr=p+sCEvqPTJys|=3J?I}dSIuZ#+<KG6Y&B8iu*`JyPBH&?
zOhoQ%L;gg(V8`wnZbTy2kf~w$ktxAW?}`#igXDZ<i*j(z=x%k+e8Bmqv-^P0rC0_|
z3hUS>4#NGF*-*J}f-0&AH(?+_&IFE#4nQ(P)03CHABSs)Svi&RMieg_=29{Gvw2LQ
zdWrTVJvU0peeOl1J+z;l`!-03p#SI&sQs+yw8C9zCKs34k^03??IZ?sV7S<n3l<VA
z0KgSNhg4poSCgM-**(pU${^->lM(ZhDwfbJ4}S)Ci|sXl0<QIHE`zkCucc(ZI`9VB
zIg1rNv3ODN9HN0;B0-jTitdRNTXm$miIiK66zb|D)V{Af>Li(&Ya=T5BAmtTR_ywz
zmE7|xzEPkBN-MgCwv5NBmH74<tqrW`!+uq5Nfowm75C-g7GkK_jWM7c)J$wI@8{@<
z>8fqxH_plA`B^?;Hqf(48ot57>+oAqu!YcdkCn4fw>&1{ASzF5W8sGHnnB!c)PmTB
zW)6WEf2F?X(<68nB*~oh(-v=O|4Hn0dt2$z&p4PQjl;|8fZfVWlyD5&fyU~JoftYC
zd}}7Sc~JCbm<Z}T@mo{AOyBWc8b!~NzBFQzLd)lmY1+~~>_M^V>lc;*GDKkt=7Tk*
zHh5$fNRQY+K&uPxHsyd}E63h-jv@X+l1qi><~9g@z$mGK+w1L^AJmQ!pLs4S-k(<D
zR|!<TG6vPc4%_qmvy5&+XWafHC9QrfJW`{DxmQt9X=skKIWI6m5hebh7_7hm-7A(>
z7u)J?xxZdw#AGAle0N((In}7d(9Zn&O0BW&#NJscFfl#%G?l`);mUmRI(F70ZCp>~
zuIQqit(B9rVQzG$%&4GLJh4`S>($*bR!qa-d)I|$1@P-PjlTW|&v0__u-}`BDE?Hp
zSf94xzaqMB_1l@Yc!WJ3Din($nn}Fpv)|^YarNcTih_4eI+)xDtWNOmK!v=i)CSue
zS`WPXfr!FMt)<@0`GSyD%OD{~*LUE`DPxoxVT9Xjz$Hs?tAs(6xQxiKe#W?rZ&J}<
z-zuTEUI-{q6k@>NGAsmoCR0K?nKw|a$(<q);GA@43ml^tmz0i(t&*`YWF`NtHA5;6
zKy7Qt-L;Fk&wC-&L&#4Wx2YB{=zV4GbUtT3^I0o;_0UN=w&8oYT9GoD8}~97xbA-*
zztE%cz;_MwbI~y$R{~qdqd>QQtKz(oZhLH%g>O0EJe$*2s&A3)_wVWuk7W)?PiKNk
zL0iM$Eo4eIwiVxh?Mye9@Ghc?XtAH(`NH?_|AYvH6g+H7vBmyPP{0y{v>v(?rl9^z
zfrD<nlq)UasQD^jJlo<U>OY5gl;avC_aOMH27$JJKlJa$!Lc9Z43_OThl>2K7v;aW
j9U>R-3;$nO;F3Q)E~OEp5sDrP{3k9fB~<WU%kzH$TT!lZ

literal 0
HcmV?d00001

diff --git a/library/digital_ocean_floating_ip.py b/library/digital_ocean_floating_ip.py
new file mode 100644
index 0000000..963403c
--- /dev/null
+++ b/library/digital_ocean_floating_ip.py
@@ -0,0 +1,288 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# (c) 2015, Patrick F. Marques <patrickfmarques@gmail.com>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+ANSIBLE_METADATA = {'metadata_version': '1.1',
+                    'status': ['preview'],
+                    'supported_by': 'community'}
+
+DOCUMENTATION = '''
+---
+module: digital_ocean_floating_ip
+short_description: Manage DigitalOcean Floating IPs
+description:
+     - Create/delete/assign a floating IP.
+version_added: "2.4"
+author: "Patrick Marques (@pmarques)"
+options:
+  state:
+    description:
+     - Indicate desired state of the target.
+    default: present
+    choices: ['present', 'absent']
+  ip:
+    description:
+     - Public IP address of the Floating IP. Used to remove an IP
+  region:
+    description:
+     - The region that the Floating IP is reserved to.
+  droplet_id:
+    description:
+     - The Droplet that the Floating IP has been assigned to.
+  oauth_token:
+    description:
+     - DigitalOcean OAuth token.
+    required: true
+notes:
+  - Version 2 of DigitalOcean API is used.
+requirements:
+  - "python >= 2.6"
+'''
+
+
+EXAMPLES = '''
+- name: "Create a Floating IP in region lon1"
+  digital_ocean_floating_ip:
+    state: present
+    region: lon1
+
+- name: "Create a Floating IP assigned to Droplet ID 123456"
+  digital_ocean_floating_ip:
+    state: present
+    droplet_id: 123456
+
+- name: "Delete a Floating IP with ip 1.2.3.4"
+  digital_ocean_floating_ip:
+    state: absent
+    ip: "1.2.3.4"
+
+'''
+
+
+RETURN = '''
+# Digital Ocean API info https://developers.digitalocean.com/documentation/v2/#floating-ips
+data:
+    description: a DigitalOcean Floating IP resource
+    returned: success and no resource constraint
+    type: dict
+    sample: {
+      "action": {
+        "id": 68212728,
+        "status": "in-progress",
+        "type": "assign_ip",
+        "started_at": "2015-10-15T17:45:44Z",
+        "completed_at": null,
+        "resource_id": 758603823,
+        "resource_type": "floating_ip",
+        "region": {
+          "name": "New York 3",
+          "slug": "nyc3",
+          "sizes": [
+            "512mb",
+            "1gb",
+            "2gb",
+            "4gb",
+            "8gb",
+            "16gb",
+            "32gb",
+            "48gb",
+            "64gb"
+          ],
+          "features": [
+            "private_networking",
+            "backups",
+            "ipv6",
+            "metadata"
+          ],
+          "available": true
+        },
+        "region_slug": "nyc3"
+      }
+    }
+'''
+
+import json
+import time
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.basic import env_fallback
+from ansible.module_utils.urls import fetch_url
+from ansible.module_utils.digital_ocean import DigitalOceanHelper
+
+class Response(object):
+
+    def __init__(self, resp, info):
+        self.body = None
+        if resp:
+            self.body = resp.read()
+        self.info = info
+
+    @property
+    def json(self):
+        if not self.body:
+            if "body" in self.info:
+                return json.loads(self.info["body"])
+            return None
+        try:
+            return json.loads(self.body)
+        except ValueError:
+            return None
+
+    @property
+    def status_code(self):
+        return self.info["status"]
+
+def wait_action(module, rest, ip, action_id, timeout=10):
+    end_time = time.time() + 10
+    while time.time() < end_time:
+        response = rest.get('floating_ips/{0}/actions/{1}'.format(ip, action_id))
+        status_code = response.status_code
+        status = response.json['action']['status']
+        # TODO: check status_code == 200?
+        if status == 'completed':
+            return True
+        elif status == 'errored':
+            module.fail_json(msg='Floating ip action error [ip: {0}: action: {1}]'.format(
+                ip, action_id), data=json)
+
+    module.fail_json(msg='Floating ip action timeout [ip: {0}: action: {1}]'.format(
+        ip, action_id), data=json)
+
+
+def core(module):
+    api_token = module.params['oauth_token']
+    state = module.params['state']
+    ip = module.params['ip']
+    droplet_id = module.params['droplet_id']
+
+    rest = DigitalOceanHelper(module)
+
+    if state in ('present'):
+        if droplet_id is not None and module.params['ip'] is not None:
+            # Lets try to associate the ip to the specified droplet
+            associate_floating_ips(module, rest)
+        else:
+            create_floating_ips(module, rest)
+
+    elif state in ('absent'):
+        response = rest.delete("floating_ips/{0}".format(ip))
+        status_code = response.status_code
+        json_data = response.json
+        if status_code == 204:
+            module.exit_json(changed=True)
+        elif status_code == 404:
+            module.exit_json(changed=False)
+        else:
+            module.exit_json(changed=False, data=json_data)
+
+
+def get_floating_ip_details(module, rest):
+    ip = module.params['ip']
+
+    response = rest.get("floating_ips/{0}".format(ip))
+    status_code = response.status_code
+    json_data = response.json
+    if status_code == 200:
+        return json_data['floating_ip']
+    else:
+        module.fail_json(msg="Error assigning floating ip [{0}: {1}]".format(
+            status_code, json_data["message"]), region=module.params['region'])
+
+
+def assign_floating_id_to_droplet(module, rest):
+    ip = module.params['ip']
+
+    payload = {
+        "type": "assign",
+        "droplet_id": module.params['droplet_id'],
+    }
+
+    response = rest.post("floating_ips/{0}/actions".format(ip), data=payload)
+    status_code = response.status_code
+    json_data = response.json
+    if status_code == 201:
+        wait_action(module, rest, ip, json_data['action']['id'])
+
+        module.exit_json(changed=True, data=json_data)
+    else:
+        module.fail_json(msg="Error creating floating ip [{0}: {1}]".format(
+            status_code, json_data["message"]), region=module.params['region'])
+
+
+def associate_floating_ips(module, rest):
+    floating_ip = get_floating_ip_details(module, rest)
+    droplet = floating_ip['droplet']
+
+    # TODO: If already assigned to a droplet verify if is one of the specified as valid
+    if droplet is not None and str(droplet['id']) in [module.params['droplet_id']]:
+        module.exit_json(changed=False)
+    else:
+        assign_floating_id_to_droplet(module, rest)
+
+
+def create_floating_ips(module, rest):
+    payload = {
+    }
+    floating_ip_data = None
+
+    if module.params['region'] is not None:
+        payload["region"] = module.params['region']
+
+    if module.params['droplet_id'] is not None:
+        payload["droplet_id"] = module.params['droplet_id']
+
+    floating_ips = rest.get_paginated_data(base_url='floating_ips?', data_key_name='floating_ips')
+
+    for floating_ip in floating_ips:
+        if floating_ip['droplet'] and floating_ip['droplet']['id'] == module.params['droplet_id']:
+            floating_ip_data = {'floating_ip': floating_ip}
+
+    if floating_ip_data:
+        module.exit_json(changed=False, data=floating_ip_data)
+    else:
+        response = rest.post("floating_ips", data=payload)
+        status_code = response.status_code
+        json_data = response.json
+
+        if status_code == 202:
+            module.exit_json(changed=True, data=json_data)
+        else:
+            module.fail_json(msg="Error creating floating ip [{0}: {1}]".format(
+                status_code, json_data["message"]), region=module.params['region'])
+
+
+def main():
+    module = AnsibleModule(
+        argument_spec=dict(
+            state=dict(choices=['present', 'absent'], default='present'),
+            ip=dict(aliases=['id'], required=False),
+            region=dict(required=False),
+            droplet_id=dict(required=False, type='int'),
+            oauth_token=dict(
+                no_log=True,
+                # Support environment variable for DigitalOcean OAuth Token
+                fallback=(env_fallback, ['DO_API_TOKEN', 'DO_API_KEY', 'DO_OAUTH_TOKEN']),
+                required=True,
+            ),
+            validate_certs=dict(type='bool', default=True),
+            timeout=dict(type='int', default=30),
+        ),
+        required_if=[
+            ('state', 'delete', ['ip'])
+        ],
+        mutually_exclusive=[
+            ['region', 'droplet_id']
+        ],
+    )
+
+    core(module)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/playbooks/cloud-post.yml b/playbooks/cloud-post.yml
index 1495473..3ae2387 100644
--- a/playbooks/cloud-post.yml
+++ b/playbooks/cloud-post.yml
@@ -20,6 +20,7 @@
     algo_ssh_tunneling: "{{ algo_ssh_tunneling }}"
     algo_store_pki: "{{ algo_store_pki }}"
     IP_subject_alt_name: "{{ IP_subject_alt_name }}"
+    alternative_ingress_ip: "{{ alternative_ingress_ip | default(omit) }}"
     cloudinit: "{{ cloudinit|default(false) }}"
 
 - name: Additional variables for the server
diff --git a/roles/cloud-digitalocean/tasks/main.yml b/roles/cloud-digitalocean/tasks/main.yml
index b41becd..2013a22 100644
--- a/roles/cloud-digitalocean/tasks/main.yml
+++ b/roles/cloud-digitalocean/tasks/main.yml
@@ -26,6 +26,19 @@
       - Environment:Algo
   register: digital_ocean_droplet
 
+- block:
+  - name: "Create a Floating IP"
+    digital_ocean_floating_ip:
+      state: present
+      oauth_token: "{{ algo_do_token }}"
+      droplet_id: "{{ digital_ocean_droplet.data.droplet.id }}"
+    register: digital_ocean_floating_ip
+
+  - name: Set the static ip as a fact
+    set_fact:
+      cloud_alternative_ingress_ip: "{{ digital_ocean_floating_ip.data.floating_ip.ip }}"
+  when: alternative_ingress_ip
+
 - set_fact:
     cloud_instance_ip: "{{ digital_ocean_droplet.data.ip_address }}"
     ansible_ssh_user: algo
diff --git a/roles/common/defaults/main.yml b/roles/common/defaults/main.yml
index f358d3e..4a2c6de 100644
--- a/roles/common/defaults/main.yml
+++ b/roles/common/defaults/main.yml
@@ -1,2 +1,9 @@
 ---
 install_headers: true
+aip_supported_providers:
+  - digitalocean
+snat_aipv4: false
+ipv6_default: "{{ ansible_default_ipv6.address + '/' + ansible_default_ipv6.prefix }}"
+ipv6_subnet_size: "{{ ipv6_default | ipaddr('size') }}"
+ipv6_egress_ip: >-
+  {{ (ipv6_default | next_nth_usable(15 | random(seed=algo_server_name + ansible_fqdn))) + '/124' if ipv6_subnet_size|int > 1 else ipv6_default }}
diff --git a/roles/common/handlers/main.yml b/roles/common/handlers/main.yml
index ebbe91a..6bcae5c 100644
--- a/roles/common/handlers/main.yml
+++ b/roles/common/handlers/main.yml
@@ -22,3 +22,6 @@
 
 - name: restart iptables
   service: name=netfilter-persistent state=restarted
+
+- name: netplan apply
+  command: netplan apply
diff --git a/roles/common/tasks/aip/digitalocean.yml b/roles/common/tasks/aip/digitalocean.yml
new file mode 100644
index 0000000..cd5032f
--- /dev/null
+++ b/roles/common/tasks/aip/digitalocean.yml
@@ -0,0 +1,13 @@
+---
+- name: Get the anchor IP
+  uri:
+    url: http://169.254.169.254/metadata/v1/interfaces/public/0/anchor_ipv4/address
+    return_content: true
+  register: anchor_ipv4
+  until: anchor_ipv4 is succeeded
+  retries: 30
+  delay: 10
+
+- name: Set SNAT IP as a fact
+  set_fact:
+    snat_aipv4: "{{ anchor_ipv4.content }}"
diff --git a/roles/common/tasks/aip/main.yml b/roles/common/tasks/aip/main.yml
new file mode 100644
index 0000000..6055fd3
--- /dev/null
+++ b/roles/common/tasks/aip/main.yml
@@ -0,0 +1,10 @@
+---
+- name: Include alternative ingress ip configuration
+  include_tasks:
+    file: "{{ algo_provider if algo_provider in aip_supported_providers else 'placeholder' }}.yml"
+  when: algo_provider in aip_supported_providers
+
+- name: Verify SNAT IPv4 found
+  assert:
+    that: snat_aipv4 | ipv4
+    msg: The SNAT IPv4 address not found. Cannot proceed with the alternative ingress ip.
diff --git a/roles/common/tasks/aip/placeholder.yml b/roles/common/tasks/aip/placeholder.yml
new file mode 100644
index 0000000..e69de29
diff --git a/roles/common/tasks/ubuntu.yml b/roles/common/tasks/ubuntu.yml
index 97c8616..6355bbf 100644
--- a/roles/common/tasks/ubuntu.yml
+++ b/roles/common/tasks/ubuntu.yml
@@ -78,6 +78,16 @@
 - name: Gather additional facts
   import_tasks: facts.yml
 
+- name: IPv6 egress alias configured
+  template:
+    src: 99-algo-ipv6-egress.yaml.j2
+    dest: /etc/netplan/99-algo-ipv6-egress.yaml
+  when:
+    - ipv6_support
+    - ipv6_subnet_size|int > 1
+  notify:
+    - netplan apply
+
 - name: Set OS specific facts
   set_fact:
     tools:
@@ -112,5 +122,9 @@
     state: present
   when: install_headers
 
+- name: Configure the alternative ingress ip
+  include_tasks: aip/main.yml
+  when: alternative_ingress_ip
+
 - include_tasks: iptables.yml
   tags: iptables
diff --git a/roles/common/templates/99-algo-ipv6-egress.yaml.j2 b/roles/common/templates/99-algo-ipv6-egress.yaml.j2
new file mode 100644
index 0000000..c0aa9a2
--- /dev/null
+++ b/roles/common/templates/99-algo-ipv6-egress.yaml.j2
@@ -0,0 +1,6 @@
+network:
+    version: 2
+    ethernets:
+        {{ ansible_default_ipv6.interface }}:
+            addresses:
+              - {{ ipv6_egress_ip }}
diff --git a/roles/common/templates/rules.v4.j2 b/roles/common/templates/rules.v4.j2
index 0f5bfba..764008a 100644
--- a/roles/common/templates/rules.v4.j2
+++ b/roles/common/templates/rules.v4.j2
@@ -35,7 +35,7 @@ COMMIT
 -A PREROUTING --in-interface {{ ansible_default_ipv4['interface'] }} -p udp --dport {{ wireguard_port_avoid }} -j REDIRECT --to-port {{ wireguard_port_actual }}
 {% endif %}
 # Allow traffic from the VPN network to the outside world, and replies
--A POSTROUTING -s {{ subnets|join(',') }} -m policy --pol none --dir out -j MASQUERADE
+-A POSTROUTING -s {{ subnets|join(',') }} -m policy --pol none --dir out {{ '-j SNAT --to ' + snat_aipv4 if snat_aipv4 else '-j MASQUERADE' }}
 
 
 COMMIT
diff --git a/roles/common/templates/rules.v6.j2 b/roles/common/templates/rules.v6.j2
index 47226b7..96642a7 100644
--- a/roles/common/templates/rules.v6.j2
+++ b/roles/common/templates/rules.v6.j2
@@ -34,7 +34,7 @@ COMMIT
 -A PREROUTING --in-interface {{ ansible_default_ipv6['interface'] }} -p udp --dport {{ wireguard_port_avoid }} -j REDIRECT --to-port {{ wireguard_port_actual }}
 {% endif %}
 # Allow traffic from the VPN network to the outside world, and replies
--A POSTROUTING -s {{ subnets|join(',') }} -m policy --pol none --dir out -j MASQUERADE
+-A POSTROUTING -s {{ subnets|join(',') }} -m policy --pol none --dir out -j SNAT --to {{ ipv6_egress_ip | ipaddr('address') }}
 
 COMMIT
 
diff --git a/server.yml b/server.yml
index 782d713..fb472f0 100644
--- a/server.yml
+++ b/server.yml
@@ -35,6 +35,7 @@
                 IdentityFile {{ SSH_keys.private }}
                 KeepAlive yes
                 ServerAliveInterval 30
+        when: inventory_hostname != 'localhost'
         become: false
         delegate_to: localhost