From 624c157238cf21214a53d36f496d5e89c9e0b032 Mon Sep 17 00:00:00 2001 From: "Andreas M. Antonopoulos" Date: Thu, 20 Aug 2020 09:15:25 -0400 Subject: [PATCH 1/2] node_operations: Spelling and typo fixes throughout --- node_operations.asciidoc | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/node_operations.asciidoc b/node_operations.asciidoc index 488b7f4..a24b4c4 100644 --- a/node_operations.asciidoc +++ b/node_operations.asciidoc @@ -25,7 +25,7 @@ There are many ways you can run a Lightning node, from a small mini-PC hosted in In Bitcoin, unless one is specifically running a mining node, hardware is not particularly important. The Bitcoin Core node software can be run on any machine that meets its minimum requirements and does not need to be online to receive payments; only to send them. -If a Bitcoin node goes down for an extended period of time, the user can simply reboot the node and once it connects to the rest of the network, it will resync the blockchain. +If a Bitcoin node goes down for an extended period of time, the user can simply reboot the node and once it connects to the rest of the network, it will re-sync the blockchain. In Lightning however, the user needs to be online both to send _and_ to receive payments. If the Lightning user is offline it cannot receive any payments from anyone and thus its open invoices cannot be fulfilled. Furthermore, the open channels of an offline node cannot be used to route payments. Your channel partners will notice that you are offline and cannot contact you to route a payment. If you are offline too often, they may consider the Bitcoin locked up in their channels with you to be "wasted" capacity, and may close those channels. We also consider the case of a Protocol Breach i.e. your channel partner tries to cheat you by submitting an earlier commitment transaction. If you are offline and your channels aren't being monitored, then the theft could succeed and you will have no recourse once the timelock expires. @@ -38,7 +38,7 @@ Thus, hardware failure in the Lightning Network can easily result in loss of fun ==== What are the types of hardware Lightning Nodes? -* **General Purpose Computers**: a Lightning Network node can be run on a home computer or laptop running Windows, MacOS, or Linux. Typically this is run alongside a Bitcoin node. +* **General Purpose Computers**: a Lightning Network node can be run on a home computer or laptop running Windows, Mac OS, or Linux. Typically this is run alongside a Bitcoin node. * **Dedicated Hardware**: a Lightning Node can also be run on dedicated hardware like a Raspberry Pi, Rock64, or mini-PC. This setup would usually run a software stack including a Bitcoin node and other applications. This setup is popular as the hardware is dedicated to running and maintaining the Lightning node only and is usually set up with an installation "helper". * **Specialized Hardware**: a Lightning Network node can also be run on purpose-built hardware specifically designed for it. This would include "out-of-the-box" Lightning node solutions that can be purchased as a kit or turn-key system. @@ -66,7 +66,7 @@ At a minimum, the following will be required to run a Lightning Node: * **RAM**: a system running both Bitcoin and Lightning nodes may work on 2GB RAM _barely_, but will perform much better with at least 4GB of RAM. The Initial Block Download will be especially challenging with less than 4GB of RAM. More than 8GB of RAM is unnecessary, because the CPU is the greater bottleneck for these types of services, due to cryptographic operations such as signature validation. -* **Storage Drive**: this can be a Hard Drive or an SSD, although an SSD will be significantly quicker for running a Bitcoin node. Most of the storage is used for the Bitcoin blockchain, which can take up more than 300GB (as of June 2020). +* **Storage Drive**: this can be a Hard Drive or an Solid State Drive (SSD), although an SSD will be significantly quicker for running a Bitcoin node. Most of the storage is used for the Bitcoin blockchain, which can take up more than 300GB (as of June 2020). * **Internet Connection**: a reliable internet connection will be required to download new Bitcoin blocks, as well as to communicate with other Lightning Peers. Estimated data use ranges from 10GB to 100GB per month, depending on configuration. @@ -78,7 +78,7 @@ In addition, the user will also want to consider some kind of data backup soluti When renting a cloud server, it is often cost effective to change the configuration between two phases of operation: A faster CPU and faster storage will be needed during the Initial Block Download (e.g. the first day). After the blockchain has synced, the CPU and storage speed requirements are much less, so the performance can be downgraded to a more cost-effective level. -For example, on Amazon's cloud, we would use a 8-16GB RAM, 8-core CPU (e.g. t3-large or m3.large) and faster 400GB SSD (1000+ provisioned IOPS) for the Initial Block Download (IBD), reducing its time to just 6-8 hours. Once that is complete, we would switch the server instance to a 2GB RAM, 2-core CPU (e.g. t3.small) and storage to a general purpose 1TB HDD. This will cost about the same as if you ran it on the slower sevrer the entire time, but will get you up and running in less than a day instead of having to wait almost a week for the IBD. +For example, on Amazon's cloud, we would use a 8-16GB RAM, 8-core CPU (e.g. t3-large or m3.large) and faster 400GB SSD (1000+ provisioned IOPS) for the Initial Block Download (IBD), reducing its time to just 6-8 hours. Once that is complete, we would switch the server instance to a 2GB RAM, 2-core CPU (e.g. t3.small) and storage to a general purpose 1TB HDD. This will cost about the same as if you ran it on the slower server the entire time, but will get you up and running in less than a day instead of having to wait almost a week for the IBD. ===== Permanent data storage (drive) @@ -96,13 +96,13 @@ Installing a Lightning node (or also a Bitcoin node), may be daunting if you are ==== RaspiBlitz -One of the most popular and complete such "helpers", is _RaspibBlitz_, a project built by Christian Rootzoll, which is intended to be installed on a Raspberry Pi 4. RaspiBlitz comes with a recommended hardware "kit" that you can build in a matter of hours, or at most a weekend. If you attent a Lightning "hackathon" in your city, you are likely to see many people working on their RaspiBlitz set up, swapping tips and helping each other. You can find the RaspiBlitz project here: +One of the most popular and complete such "helpers", is _RaspiBlitz_, a project built by Christian Rootzoll, which is intended to be installed on a Raspberry Pi 4. RaspiBlitz comes with a recommended hardware "kit" that you can build in a matter of hours, or at most a weekend. If you attend a Lightning "hackathon" in your city, you are likely to see many people working on their RaspiBlitz set up, swapping tips and helping each other. You can find the RaspiBlitz project here: https://github.com/rootzoll/raspiblitz image::[images/raspiblitz.jpg] -In addition to a Bitocin and Lightning node, RaspiBlitz can install a number of additional services, such as: +In addition to a Bitcoin and Lightning node, RaspiBlitz can install a number of additional services, such as: * TOR (Run as Hidden Service) * ElectRS (Electrum Server in Rust) @@ -155,13 +155,13 @@ The number of additional services and features is expanding rapidly, so the list ==== Bitcoin node or lightweight Lightning -One critical choice for your node will be the choice of Bitcoin node and its configuration. Bitcon Core, the reference implementation is the most common choice, but not the only choice available. One alternative choice is +btcd+, which is a Go-language implementation of a Bitcoin node. Btcd supports some features that are useful for running an LND Lightning node and are not available in Bitcoin Core. +One critical choice for your node will be the choice of Bitcoin node and its configuration. Bitcoin Core, the reference implementation is the most common choice, but not the only choice available. One alternative choice is +btcd+, which is a Go-language implementation of a Bitcoin node. Btcd supports some features that are useful for running an LND Lightning node and are not available in Bitcoin Core. A second consideration is whether you will run an archival Bitcoin node with a full copy of the blockchain (some 350GB in mid-2020), or a _pruned_ blockchain that only keeps the most recent blocks. A pruned blockchain can save you some disk space, but will still need to download the full blockchain at least one (during the Initial Block Download), so it won't save you anything on network utilization. Using a pruned node to run a Lightning node is still an experimental capability and might not support all the functionality, however many people are running a node like that successfully. Finally, you also have the option of not running a Bitcoin node at all, instead operating the LND Lightning node in "lightweight" mode, using the _neutrino_ protocol to retrieve blockchain information from public Bitcoin nodes operated by others. Running like this means that you are taking resources from the Bitcoin network without offering any back, but it is still better than not running your own Lightning node at all. -Keep in mind that operating a Bitcoin node allows you to support other services (other than a Lightning node). These other services may require an arcihval (not pruned) Bitcoin node and often can't run without a Bitcoin node. Consider what other services you may need to run now or in the future, to make an informed decision on the type of Bitcoin node you run. +Keep in mind that operating a Bitcoin node allows you to support other services (other than a Lightning node). These other services may require an archival (not pruned) Bitcoin node and often can't run without a Bitcoin node. Consider what other services you may need to run now or in the future, to make an informed decision on the type of Bitcoin node you run. The bottom line for this decision is: If you can afford a > 500GB disk, run a full archival Bitcoin node. You will be contributing resources to the Bitcoin system and helping others who cannot afford to do so. If you can't afford such a big disk, run a pruned node. If you can't afford the disk or the bandwidth for even a pruned node, run a lightweight LND node over neutrino. @@ -171,7 +171,7 @@ The next decision is on which operating system you build your nodes. The vast ma Ultimately, most of the services can be run on any modern POSIX operating system, which includes Mac OS, Windows and of course Linux. Your choice should be driven more by your familiarity and comfort with an operating system and you learning objectives. If you want to expand your knowledge and learn how to operate a Linux system, this is a great opportunity to do so with a specific project and a clear goal. If you just want to get a node up and running, go with what you know. -Nowadays, many services are also delivered in the form of containers, usually based on the docker system. These containers can be deployed on a variety of operating systems, abstracting the underlying OS. You may need to leanr some Linux CLI commands, however, as most of the containers run some variant of Linux inside. +Nowadays, many services are also delivered in the form of containers, usually based on the docker system. These containers can be deployed on a variety of operating systems, abstracting the underlying OS. You may need to learn some Linux CLI commands, however, as most of the containers run some variant of Linux inside. === Choose your Lightning node implementation @@ -189,7 +189,7 @@ The programming language doesn't just influence the choice of build system but a * File locations (in the filesystem) * Command-line arguments and their syntax * Error message formatting -* Pre-requisite libraries +* Prerequisite libraries * Remote Procedure Call interfaces When you choose your Lightning node, you are also choosing all of the above characteristics, so your familiarity with these tools and design philosophies will make it easier to run a node. Or harder, if you land in an unfamiliar domain. @@ -204,7 +204,7 @@ As a final consideration, you may want to examine the performance and reliabilit === Installing a Bitcoin or Lightning node -You decided not to use an installation "helper" and instead to dive into the command-line of a Linxu operating system? That is a brave decision and we'll try to help you make it work. If you'd rather not try to do this manually, consider using an application that helps you install the node software or a container based solution, as described in <>. +You decided not to use an installation "helper" and instead to dive into the command-line of a Linux operating system? That is a brave decision and we'll try to help you make it work. If you'd rather not try to do this manually, consider using an application that helps you install the node software or a container based solution, as described in <>. [WARNING] ==== @@ -225,17 +225,17 @@ Background services usually run under a specific user account in order to isolat In addition, if you have connected an external drive, you will need to tell the operating system to relocate the user's home directory to that drive. That's because a service like Bitcoin Core will create files under the user's home directory. If you are setting it up to download the full Bitcoin blockchain, these files will take up several hundred GB. Here, we assume you have connected the external drive and it is located on the +/external_drive/+ path of the operating system. -On most Linux systems you can creatre a new user with the +useradd+ command, like this: +On most Linux systems you can create a new user with the +useradd+ command, like this: ---- $ sudo useradd -d /external_drive/bitcoin -s /dev/null bitcoin ---- -The +m+ flag assigns the user's home directory. In this case, we put it on the external drive. The +s+ flag assigns the user's interactive shell. In this case we set it to +/dev/null+ to disable interactive shell use. The last argument is the new user's username +bitcoin+. +The +d+ flag assigns the user's home directory. In this case, we put it on the external drive. The +s+ flag assigns the user's interactive shell. In this case we set it to +/dev/null+ to disable interactive shell use. The last argument is the new user's username +bitcoin+. ==== Node startup -For both Bitcoin and Lightning node services, "installation" also involves creating a so called _startup script_ to make sure that the node starts when the computer boots. Startup and shutdown of background services is handled by an operating system process, which in Linux is called _init_ or _systemd_. You can usually find a system startup script in the +contrib+ subdirectory of each project. For example, if you are on a modern Linux OS that uses +systemd+, you would find a script called +bitcoind.service+, that can start the Bitcoin Core node service. +For both Bitcoin and Lightning node services, "installation" also involves creating a so called _startup script_ to make sure that the node starts when the computer boots. Startup and shutdown of background services is handled by an operating system process, which in Linux is called _init_ or _systemd_. You can usually find a system startup script in the +contrib+ sub-directory of each project. For example, if you are on a modern Linux OS that uses +systemd+, you would find a script called +bitcoind.service+, that can start the Bitcoin Core node service. Here's an example (from the Bitcoin Core code repository) of what a Bitcoin node's startup script looks like: @@ -363,7 +363,7 @@ Securing an operating system is a vast topic that is beyond the scope of this bo To secure your operating system, here are some of the top items to consider: . Provenance - Start by ensuring that you are downloading the correct operating system image and verify any signatures or checksums before installing it. -. Maintainance - Make sure that you keep your operating system up to date. Enable automated daily or weekly installation of security updates. +. Maintenance - Make sure that you keep your operating system up to date. Enable automated daily or weekly installation of security updates. . Least Privilege - Set up users for specific processes and give them the least access needed to run a service. Do not run processes with admin privileges (e.g. root). . Process Isolation - Use the operating system features to isolate processes from each other. . File System Permissions - Configure the file system carefully, on the least-privilege principle. Do not make files readable or writeable by everyone. @@ -395,7 +395,7 @@ Lightning wallets do use a BIP39 mnemonic phrase backup for the on-chain wallet. Do not fund channels until you have created a system to continuously backup your channel state. Your backups should be moved "offsite" to a different system and location from your node, so that they can survive a variety of system failures (power loss, data corruption etc.) or natural disasters (flood, fire etc.) ==== -Static Channel Backups are not a panacea. First, the state of each channel needs to be backed up every time there is a new commitment transaction. Second, restoring from a channel backup is dangerous. If you do not have the _last_ commitment transaction and you accidentally broadcast an old (revoked) commitment, your channel peer will assume you are trying to cheat and take the entire channel balance with a penatly transaction. To make sure you are closing the channel, you need to do a cooperative close. But a malicious peer could mislead your node into broadcasting an old commitment during that cooperative close, thereby cheating you by making your node inadvertently try to "cheat". +Static Channel Backups are not a panacea. First, the state of each channel needs to be backed up every time there is a new commitment transaction. Second, restoring from a channel backup is dangerous. If you do not have the _last_ commitment transaction and you accidentally broadcast an old (revoked) commitment, your channel peer will assume you are trying to cheat and take the entire channel balance with a penalty transaction. To make sure you are closing the channel, you need to do a cooperative close. But a malicious peer could mislead your node into broadcasting an old commitment during that cooperative close, thereby cheating you by making your node inadvertently try to "cheat". Additionally, the backups of your channels need to be encrypted to maintain your privacy and your channel security. Otherwise, anyone who finds the backups can not only see all your channels, they could use the backups to close all your channels in a way that hands over the balance to your channel peers. @@ -427,11 +427,11 @@ If you Lightning wallet balance becomes too large for your risk appetite, you wi Sweeping funds on-chain, is accomplished moving the funds from the Lightning wallet to a Bitcoin wallet (presumably a more secure hardware wallet or cold storage). You do that by closing channels. When you close a channel, all funds from your local balance are "swept" to a Bitcoin address. The Bitcoin address for on-chain funds is usually generated by your Lightning wallet so it is still a hot-wallet. You may need to do an additional transaction to move the funds to a more secure address, such as one generated on your hardware wallet. -Closing channels will incur an on-chain fee and will reduce your Lightning node's capacity and connectivity. However, if you run a popular e-commerce node you will not lack incoming capacity and can strategically close channels with large local balances, essentially "batching" your funds for movement on-chain. You may need to use some channel re-balancing techniques (see <>) before you close channels to maximise the benefit of this strategy. +Closing channels will incur an on-chain fee and will reduce your Lightning node's capacity and connectivity. However, if you run a popular e-commerce node you will not lack incoming capacity and can strategically close channels with large local balances, essentially "batching" your funds for movement on-chain. You may need to use some channel re-balancing techniques (see <>) before you close channels to maximize the benefit of this strategy. ===== Off-chain sweep -Another technique you can use involves running a second Lightning node that is not advertized on the network. You can establish large capacity channels from your public node (e.g. the one running you shop) to your less-public (hidden) node. On a regular basis, "sweep" funds by making a Lightning payment to your hidden node. Once all the capacity of the channel moves to the hidden node side, you close the channel (as in the on-chain sweep above) and open a new channel from the public node. +Another technique you can use involves running a second Lightning node that is not advertised on the network. You can establish large capacity channels from your public node (e.g. the one running you shop) to your less-public (hidden) node. On a regular basis, "sweep" funds by making a Lightning payment to your hidden node. Once all the capacity of the channel moves to the hidden node side, you close the channel (as in the on-chain sweep above) and open a new channel from the public node. ===== Loop-out sweep From 9f162fed2c12d5ca16e6d552fbe90b71bc21dc61 Mon Sep 17 00:00:00 2001 From: "Andreas M. Antonopoulos" Date: Thu, 20 Aug 2020 10:26:40 -0400 Subject: [PATCH 2/2] node_operations: Network configuration --- images/ln_port_check.png | Bin 0 -> 55194 bytes node_operations.asciidoc | 68 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 68 insertions(+) create mode 100644 images/ln_port_check.png diff --git a/images/ln_port_check.png b/images/ln_port_check.png new file mode 100644 index 0000000000000000000000000000000000000000..696646926bd58796e1ee453a9018eb4aed6a6890 GIT binary patch literal 55194 zcmeFZRajPC+ct`dlprV|-Q6IKgmiZ*-O@KD-3ki5OyMV`64$OzhwSF(x*4HZy^Nah_F;SU~AyM(|%s%p$`V zfMb=z>{jC3y6U$5!M5~bp2UG?wl!U_46*aiX9syFjJUWH#*qpI@0Ywz1Kstp(vmY{ zF@0~-`1CHbaR}MY56I{{l5JWfbNWkNWz>d`**i^Q?_L=cQ+q51X)UP55M2c_V47f9 zM8d!zA((;J(vX$mF|@H_)Hkv*FlKbNf`Iphf#DT!hUgnw7&{Of7@L||^N}7lwvrN? z8S#;-v&%BeLWGUKm`S+W87sTWsTjIi7;+nt3h*QGI`e=5tc)G>iJh%1t?hZ7`AGj6 zmk0d!(?2tj6903Fg9RU{hO7dyu#KHDF&iTrBQt}jv)R}8r2I(4ymm$=JW3*B{~iMT zA0O!#2L}ib6O)sZ6QdI=qm7*@6AL#tHxu)FruXj|z!ePkF4hkE&J5P}WKTo%)#_@hKYrdndyJO+`-J` z|KakdGyi@0)6F~zX3oZz8X{&^#@6=W75GS5n7O$B8STGMfBN4}vvG6%bM|Q{9!V>G zQ)6{ABZn{l+kO9iM#9+4^b7cw|JyzCc4o%F3Qyk)ZX#uRvL(~MjS1$4>3>bmlZF1@ zKmPNO|B;RVW3K<0>wjc{|Ix+&@vi@v>wjc{|Ix+&@vi@WnG5N^%R6IhP}4bq;%zau z@BtKlu=YZdDhS|kM=%P8fgy&G6cJQ$p50q;RKc(yffiwGgW_J-YZZm<*Tx~2sAZR`mpIcDU)%3J2ch_bfAGhg!ErWcpEXozb`R^g%b?^*C9d1j3D&yt8sk<(f)n$C<3zY zzXyyG(?j$B_tk9A{fPf-=r{ivIym_M2!j~uzXiUKQ*w3X+|}LPYc(}8A{a+s?5awm zMk#C{ zwcCRtiN5o>eH}0T^uol%L1eS@`jvOt}$*e zi2NfWUMI1eeS5gS>1g@#hB6w7&-Dx&{UOaazD$SiF3H>bBR;n)zIX(oc=*l)v(2E) z^v2)bE^<=RfPlb2Xh(N{hX*_=fiaqhFoSNzPCN_(3@qGB{gd%TE_Xdtbcq+DqN0W) zqsG(KZe?)q~&uoD(fR%=JRm=FrGQJ=WL5g&tUnw|ZzI1K@!b zdLwU<30QCueP_ZS*-VF0#eGP-*B)k_c9IS@(^?@cag4f&l+W^phndgz1rRuG7B)m> zL`0Cd9j+vzZ&4|$(jR1$?7gsYa0J!W+=z8(yMs;qo#D8wC+N`^4gqWW{eK^}`iF~tQ z40vs-wx>#=#xr&c74dB)3VkD^gtgm2$4|j{gq(?OA_CA9VzcEx?H z3|Q>x>hedF$K76rX7>`VZf>Gp?s6(ri8)dxz?m%+z61%T+`5y}{rEhfz8+_`*2+(j zERe;PO~l=uHxQYK#wAkE+&olY7%o$^in6@2GTLpw`4+W&C!HPAdO+fS$g)bgvck=2 zG>{YA>MW7cQ*u z*kt7OT%nm)2No&TZdS5Wl_Ve_czV#jCWro_ujq8SZPh$Wi>K%GFJnA7)V-lD%I86y z`473B)7W%z3}Uf;vHrKZtu8Ns@e&lw{_LN9f?mwm+v|^Z9V0ad`S?6jqt~RLS>3z} zQI`2aO8T~8!;|3IGatJ-(Nn$@KBs3O49c*fbi)L1ghWLA?whb6pDVX6NW`Z$jR9;Oski<1Yn|4ra|39d(K zjgO0aNBIqpY#xh{Fv4PLK5Eio6baJu2L3Q`T&P;|tz^#WkJaVrsko(OvC`5f${6U#D%H{Hsjz|qGlZF~6e!u??- zEF*&$8yC0j_bl#uf2{IVZ(t?3?|2z1d<73nOizz*Vv_qOl@1G^pr4A{E3%T`{Vo`b zNr!}(83qb{!_3L)C(7{(gIX_$G~kt)k*73@;}1hbL`3J4F7$MMFEKsvhGb+>1M~Rc z`>D0^(f0OEOlQwjOk3n7B-;FfB9BJq@SZ(;1`=0bPQXj4IQoc=fKf^tXSdt7(-~IS zD|liaO1LN6^`{dV_x~7F5SHrf?6iI85Ut+_p*UOo(psb56{W@F_M*Q$^D@HB$TP&9Qtrkrqld8OuY>49d2Oo9|;f- zJN}L%fBkx`*pwig6sNxPr?arQl~r?b2-(qGLj(I@!3#k^K)~NWuw#B68QA%0K>@=R z@*|K|(5lo|8Y{8M>xHazD^!ZuLPh?T<_)zKSQF$doi2P}dP?#>K7t5{C;=5wZ;FfQ zqxvV`QAo#m*LBrIqX8$NI4iCJoyrxEM=6y~~s=u0|ZmVZE z`cR(pBlJZ_N5}F09A`p80&#LZ_uhV3hC;hh0sx_c;=m}uAUtJ11>l3^KJfOcvvB4 ziOyz`x4f2#c4qkAqmuSbWO8k}{S={=eQN~B;=QXU>jPnosUNZ|HX~>Xf85{QJv|Gb z*Bv&U-$U+XT8TnB!y;bp%S=|iP_tngpI3wl!(5-$;b;Mw$xsR$jPvOQLmZ=KNLYN? zANC_JYTZ)$KolH*+=(Izw?Pp64KK8?>i6m57{#h`!=JgQryDN>hS#|rwm@i%K%`=` z9*5}+LY6zmfA?g{II9nky(`2f*L$%OuDKL$#nu*dIMl7YVaKR<*9=usLv}KKr<+XW zwx?=Z4R)d@i1;vTy)k$wJKUL%x*ixe1gt{KWX&ghFh3a86|L8OpTFFLJe(CgS~IE@ zfA(9Yl9L+j{_(+y@oaYvFZIJ$2}Q$;t6t^lCgbF_D;IlvR)>S>XMS*J@>Osa<|$n3 zv`wYSoEFc?$b`8-3{bBfYu$4@I(pO8w3v4T$4||L-T3ve8$|Tu?kUb*L+Lo`hkMsA zi^w-OH&W@l6T6(#4Ic1vDZBys`Coch9UL7Mt6bR~4ksy8?bGwgQ1jI9n|IQyH7YFw z<}Y6F&vqCe&{wZ}sQ!YE7Rh0{oLwP;mkzf$;6%g1qN>%Emq$g}`Jg|)rT8cHLwsMK zWdWP@Sc7rsQtj80qz+;bspK&|Biq_OT2B9ZX*#6c28vRONLEfx;SyZ-;aYhn45p3m zg=Y%t*AH7GhQ)Jri0Wn9;tmeKjAqs~TJRg3_I<@rcJsD))ywJ)=OR+0riOqFw{s9)VbQ`) zt&015^{V#y`1oMIcgJYpx%8b&tdiu&@II6m*%;6bo|Qwfy$=lPNM`}{@LbKI$O2q= zh5P!B5uUI>Y2-0FRkmnRO*CdCDX7?=!O*Ff368z9TK>9GYy`6=-dP}i*vf1X5yt!_ zbDFyo4HGlGU06KB=Fz9l{xWUNt-GgZb&ZCT&1T_sk6en%jh5+PT9C3IrAD2zS#&r% z%+=lcs~W4N5T0{9{oBC>+?b^wnGtsMAX~)b$_Q7fS=p{lACudpftStZu$l>+J;#Nn zSMMsjr{;1xZrmP~A6`G)1%yG&hha5qtm2WqVV2y;Wm5TH4L09UCO@=Jg*QLqdcVp3 zO?mAiEZkXcvH&-3GmgQe)1-21W50F8Qg5~Nq7tQb=?jMise9`9n7(LzL#kMFplpR@ zccIY>VwfXPF;dDT`BE}`ULDEqK}x3r=}kJW~3vvp1*hxs9F}`}2Z51?F=Wt!PHehOLNiUaXC)_M1t2{0y z5rW5=6JKhjFhtXRsQFhA|J#x4BmYbT2bd2$4r{T6oA3(#u{iJ`fxdY|D!DAt-LKdm z^xt+oTD_tb)?Rl50b48_CvtNC1N1D>KKj{rBIEd;0ZnW+2QD6`U7sP{7Hapj3UlD>Y}b#Un>*46){$ z95uJ?J#Wr%?%`1|UvDd@sHm|0mc9GXDz5EIe<FiFv*{ z#<|VrDXh{_BY)FApT2@ocAvfJtgR^Nwsr5{+$&B%s9qH6(dhK&et)roea6E4?^Q@bt)60KJHO)5+AuVGYdWVQl>^#JH8*xnJAVt?Dcr^#-)cBnAYAo zXOuNX_DsEqpD`I=^JLONrYa?Ong6lPs(gR8GFNMJWznXWLpm?;l#xM;m%G)}uU70^ zTN^oArdg|xejwnSf42Mf?OSI3QH%gwFijA|W-sK{I@(NVK z;3Gez33x>n+NW`Chh~zAndYCVIJHE^_A3N;LYasyMd&K%ht3~MqKuMCd;+FpIGeyVe$UL@UbK@z07(?%uUYMw7shv zOj^Y%FrU}L%9v8z&M`0Sl${9GjPFx%PCcaxD&@3WZP7t@8lPnkdOnhcv6Ygp=8sU7 zK_3GnqhO?n^#CtP6e9+}g09{84i#mT76MV2yudJ>bMG!wP5R z5%^aZ`*>-s&OQJLl5F|9dqE%>;UVDC$IwgV5Bf{cioLa4`{R@UhuXQ>E7I+f$SBxV z$AL97uP6)-W#_)K#HA{i3$j%{UjYVC{4)6S@wrk(MZ$ZlTu6FB0gdaWgV?$hroNR` zxXn@v^c>VTjgK(A){Adjrq&9^Y$55+TkW6@EO*)c3T*+U*YH?99w=`Sm6g%`gT$Ai zo#LP%$~*dfavy}MaX$3<8xA|E@cL7j!C^nl6UUQ_bu5e=q5|<%>V}e9`khLt$}^YK zwE)m&xbu7XfAQ99+BIV{m`q=@p$Un0)VT)+e& z0G|kGu54=dU^Y8pE7nPLD3>N!chl0s4-Cf+Z~JK5*wNRARBbW&F^#wW4Hg!Bx_mlh zf7TIzPQ3)TAdsq+>iCV21-)9bxLmw?*u8Jh@uq7G z;~|M>PsvVpH%@8-v5QzDunLsWy)0j=%|lInb$%Ju8Ih9W zquzd9>1IP6hc#F3_n7Grd1DCxLZKkOayeX4BfX>d{*8i{VcQ7@ft1TnxbUU(cU}-Q z`rjt8nFqVroAf#QJq7$4f=1>kV;?OA5>Uf}Q2F~0RCs;SrZbnJ;}leh-VDi;{p@f1 z;_1TV2xeCgX~xPA+eqrC>eKlBW~y@Y^4sH>Y;@=$iGEMP{Rs3z5LF zNUM+EdV^nJKmatIeOH+mYGZfJz^Wk5{T1|+y$7YB!Tep>{VIw|-n!lcAg0W&^UnG( zCZ+w)xh4w2wdyS=lG1Q!mhiB#^?v{A{W6ioU1@Y(?Q#s#GBW;qEoZ;2>oXjHt>{HD zB$r#J?N)w#FMv$Iiv~*l7`Mu6=&HC(8V}jRrlCaNIUeB==KS(_f$}R*{I*&afkjhX zT)c+64od2eA|n2fx^I7S`qcwA|HcjAi@!dIp(EN4dnX70H)b!WLGfI<>^lHhvOY>fPmf&m@F`4Iv!>u@%J-zP-_$7TmCF8Q=|m<2 ziB$8ZhKAu3uQszm?zg+;cXczo%CG2f@t+?|>84TVWQ*O3Dk(kj08{)=^R<-m?4H@- z=wp3vW~;|7Tzo)SKy&Jp&HOjQ!3F>JI=;8f-*3)#d|Ig@9*vVhznQPm{$_u+MhqnA zfb~fLrQpCylHtG3h65FTTQT=aY2obbY)8oVCjhJQ)Nyb4_36gnw}a8eB_-i$g9|K9 zlgLmD05kbjZ7OlJ>y;$2L+*D(_vUMG#`5mM+h5!o?rlXu5K}?HkR6VxWw{c!wv~AdszrxN5L|LeUXe0^ny5p5nAN@273A zOUvFTBG+0ky;*W#ghaVZWr3I2R;KElot4tyUXT!csa&T(g3tF$9vkL*#2NpC>rcp1 za;;5Fs*3zi)v%4}U!LJwFNm%l#vT9WzscWJQNNn~xiLFkWlAI@Bou(++uT?qeZfzy zS_wN@_K87jaqnovu=nfj;NG=tXhR=ML0-hgg=mGv?K|iI`q4ejz@SyKzMdX&EfWXF zJ3I~>MGIGxpYG}G7Has@jp+Nczuql&@o-JArmK$1!xBmJ(lok@x+|l?7>b3r1?vm@ zYd4;P9=#-aG8<~c$EYG%Smb${9@uerm&|50Dq($FYqJD7`H|eQ+2pZV3UPaEy+P>j zA^IIbh#E!ra7X8PBs?ZY*dJPwW$T|fMpD$}H;b`Ddy z6fQfoRGu33D|Vg3R;Q5??J^QDSfL75Q^vAhZ^dW~m8`_q`@==PRK*PM)cK3Z#YH=9 z-&W6iq)lt>k+J$)CNHn^?byB1&miRIt7Zp6mV!`;Vxv<>Vs+Z){0V^2vRtG**x@@r3@NXukUMeDk&62m^ZSI8 z9SVikId7j3r7ww$D@H8TyUD*Ft{yfnT^pDk5^R1W4FBqKUjRZaiY}k~X_eb=%?;+t zZH23M0>P7dW0~0H+Yps4KQHwg32LP}G`O?fWJ{N|_oi{>L6WXv!QZ-Y+EEfRGf8$P zODWuCUkO6i+;FK|q`rB5^zL#@IXlk)D+BJln-e3QKg>-5PC~|AgFLYw+0JMv;=QpH zojarBn!f7fQX=0Woz#Tm4rs9h(3f|1b_^C%5_=y4JzUQ}Ru`&{HWvp+hQ-sjs<@<+ zvi~w)JJP4tDE}B;#>vLk^*p}5!vi4u9qgC8IJxcu4r}?4V27xV0A{0MZzEj+&pm4B z*O6iIf?oa8&Hm)ICVCi!rGnBU+~C+=G;Hjy`d+-kPpIC=$9O?c# ze)_(~b-rXXIF#DzZNJHsA-O7+z-28{xv*TO=W||0I$HLDa5}ju3JNKQ$%1Kt_qt zrE3Wm>15^=a_0v`;PU1s6LRjo#_W4;hGb3OF#tO=by{~hbx7&#JkQe z6q!Z>2&7b`bUeGKELJ&`%Q^7U1+vQHC!iORNlRmk!dSo+bho!IazAEv_U@Viya4S}K=hDLby!dSs_59H zRLL!+P*0 z3sjY%_NpaHIOi!lefQf`=z?ku#NVl}T66V!`MS$oY}e6p)}k$u(uYKNjYKG8NYsX> zn;8_jr;60oGy8C0q<&B{&OdA&8;1AU?9lgs#Pb-TB)=dEI@;lkmKaESP)~`>ZE`-@ zQZjYap@6H~tMt*QQqQxw0f)yb$JK^Sexu>m!>*U;r&{85s>d5!G}nO!6iGQ}1eo7q zVoz}2eERr{=&ZNT04qhc0x%58wEoc!A!o)BSs$Jgh)H29tMsC}W9p4a)}?}QyOd0l zocR|`B|%Nw?}dq6e@OF_L169y2v=zrdEJRC+SEc!X-< zj}%6VvN^}0(_zz7trajxbFS^~anHtBR*;P!79QShAJQhBBZc{c$8E#{N~6{9l^#xQie(R4z&jXs7S5{V3E^vNs ztX#Vo69=3mbRC1nO4z~SjH&r6n6TE<6QQ5P%W0reC|;_QgkHK_?}S5c52sRUYB)aE zn)`(Na!Zuf>x!Sxo)4D`@{K#$39a{Gj=8UYG(aQotgNUIt7S|bIV|JvknHe8Kz=KZ z6o#SXiE>OD&@KG@`HSc5H?@BNL-qvN10EDQbGpg3?uy$ZpAwD#>b|p>o3VT#QJE`_ zhgxF3gv|>H&#&(vxSv5c;1r9gz@ea4AS6GT6Q)kLm1OUr;9L0-Gm4D-M7$v=B|5~a z0Hp$aN#!8rZD+yr_X;!DdF!_dA=he1@2J0L3e=AK=ZE95%UmGpfMlTXOG3XsN4xdv zW+kvk7MPH|cS`fKhTh6mMFPKl%^G{9!?n~C@CFA52cg$}4d@Y}{m<-}xP4cwc|6r4 zb^0%Q^{ojxZSHH&N@H^V zRn{?4@uTH+XUBRC3LX!3-cTAke_aUhJy5DVo{v`br=!NwsS8!p#wr$>$U;SqK|h%L zv#2Nx@Nk)yiSHl3#uR4{D<=SI26|yh6a2#j{afuzZ|}B`4<8?ISX`C>D{c!E3X@jT z^D$Pw{)%C=W9|V8o%A*Cfq_`_>7vo}q{EyIL>76I6=TQ8cUg!hFx#1oc0KGC zq4Cmd>Z9DwTN0ImXfOaxS%zp~c+$3d*6Qe0UJUW0z<*7+E2Zb&`@C@etB@y1r;BFiec`vwKW`m*v zDW{-R=jPkGw2Vwwf-O40^=%)V&6E;zY+i_r`4aC?_mEO-#IyV{&$#2J=(9isfhqu3MDrmuIvgezUh>-?@IEoZ29_y%6#{BC3A^u!4yG`Z zr$_pC`2d>t4d_$!j@ll!#u`ndn^m5D1Yg%5M=uid8-)e*fdPRr&)dM;*EYi{++eyV3x0;3y{>%%wSGS z^xpDP3hvCT4+Z(Ye1-6cgi$U$h|jGwkt1nda+H9*{sN2TEv8?^^Ke>OwY;ygd$Sd) zcE0(bwn9L%JFckI_|)M3oA35Qnj;VilRlWnOTMk56aHv90$xYJ%h#za?f#O}SuQLI^j8q1L1uzqUm}W`W5+Wcf?rnSc-JAmkkj7H077hh(+^?m@ zfb%_IHh(W?k}*5p(Cf>?0smB;T1xtUsro5TDvn_3{o)IO0%&R|97YZRY{__ewXQC2 z@3h2}uIXQ*uZ#7F(5VO%WxK1JHpMI$34fFmP3m~RdOij|e) zRjLlvI?w5PH&h^eU;$-3a#WD&Coc=BrzLJqTftT^j)v?=t6uX9atm~D0FzB$+1;PN z4g)+-9W&a|-m%Bl{V%B~por_}T<@PKFK5o7VvO%gZbdCo6u)LCP6t}}gfU`Q`K;*WaS2`9 z0E(4ro!XsR$?%SyNarN81u{OM`J%gPd|cKKU918*ykr0P_!!~ZD%DO}`dGOZm54w0 z+Ns%nJ*k|<0=QM~17Fm$?-=FfXiM`gF1HaOF_L{OVU{!g@}I#%2A@vTVGXC-<_%pkO9)KLCTTQ757aIc{AB#m&XGf*~mTEP_WwtJS zETBUzs(hII(NxyQ!=4;aw} zwMx&2m0db+|ACd-v@bijzkksH01~;DuT=k_7$-VL zg^H5WV6f@hQsF&97B@g}Ni1Ojlkn`};h9wPRBGc&bzAJG3x+CYX@lp*Yib^fH8A&! z)VI~kOgdT>j$LEExdjZ2m$LBDRu z6b{9LifFuS(_eOX%HX`uxMLTOG?0TnJkYkCuxvP2oIH_-~ZYtdwkpu$S5g(!NTRMO~;baTPJqHD3DTqZt;0gOr}2S zMBU>`I?=1kInPg697wT!jm-S+fmq+Vq)v2%inb(T;&0uUs0u2DZj^i=xLH}Jqg0@z z>G|0Zp5~x>mjdE3m)k)TB%P-*=VAMrU!74C%KHwW$6Q{=27x!li;MixoG{6p#ogSs zF;b5xL_8XmI%u+On_oBR0gpg&dAT*RY9!#5>HCt!b{_j!w)ev|Rh7l06%m@<~hKu1W#k?HOTZ+*`o3ytQt1yp0gLzH~~HPnW!aH5<=p z>2TTGn>m#_|IS5HA@yVH9#pBCM*VQ`@NUo+5a#o?>svhUY3a%0OEhBd2I^}#fGErF z?z&6b&aK&NNQ}adI4N83-nC;NkJC!E&ilr6p9gyJK1aH9_A~o#uC(m)vs-dmvmCK= z^A+Fw`2Y-6dMXOa999;Nxa5jflYyO%oJT@F&*-(f)^zPA_m{vLc3wb`^-xldDNl}x z_Wf?OCnO}K4&d*sGd8s9rQ|cB?f@pvDV^z&=Vfsp$L{+5yAog7mU~iRC1sOItBWo~ zpWQAzyZJT%UBqM{Ni~x~dMu1`?bckiDEP%I%^I2?@J~gl2U1WZ_3C$#L*x&Qclp{y zxod0NlJ|}~!#WzKp2z3iD3O{SdfgG)Zfg%1`$|j`WGcTZV*n%6VNc`As@d>syq=U* zxbCy`#X5EBr z9`NOix~wcIFMHkxLRwo|_%HSasMW@D)j^HQX)(NdeV#R`+e4NclJ}A z$^w?I?q5|s_vv0`Yc6}WJB*(;hlI4Zgi5Tx;bGx&`>%m~nEI3RIUXA<@Ccea9Z)N* z)QS9Pl-vJoH&;y0Frt8F3-8T+suj(*gc6wy`M|J*GSk%s3&5@`<75@I-K&t84xCG` z8pyHI{9l*_7**Bs>l)xec*nIYXjy{s||)bL`D147Sq5Cz#fdQ)#@+#gJ(!RvW~VT1&Wlat0cJFU@gMW@{Gt7}uq zGCyLx4{LIA@?Y^}P{u`o-HJbHc_w~Vlj9b1zIj)>;cH?=4^^%!|LoDd)K6z=pG0=($R~qjp9LMz zUw>2rW!Yt^HhKI5A-^3m;H;uOB0-JdC7&AM0sk6s;DS$LjCq#NpFdM;e{SJa0%>>c zg{o-3B%UC*B(m>a#gpwT{OY`CTkJU>(s&3I6;ECo2?;&_x;N_w5CbG#O@MA1iKY|& zR0{^W?l+9A$)7>Q8)>#Mwap^#~N)Y5BVQkWFQW!x?y@=H`G~KI=sx^-Z0QJVsYn*RAXhn95+VP776Or6X2> zz#1{GM1!IU(e-AJo5#^nO)_H>uoTgTzmhr3QVK8QT<-yDvR2v;yopr&Vy`3cEa4bE zhTiG9pYJm1@tFpjtzkca0Ggk_Cgk@8x-}{nzw4tBvc1_V`MNUq`br#1)S|+NCs(Kj zt}t2fq>P%VtUqdI)NToV<`+bwfYx+;dfEfXt!SCNv*9uuo8CnYpf=19O}^l=9aYs> z>@|9?)e7}F;Jekk7dtkW0~j{;@F7$0>E*#XJu0mz z=bqdRtsvWdC~ZOPJ@)4AW)R@++Ro2#dWpxtTaFaUy6r7EEw^U;_HGvr=-mHYji&3x zYBCfnGeq>HR>~V%8)LJWEQXZVZid_9F2Ai${8Pu0ZF{}LuK&Xh=v}w~d1pRV?9=o( zc((`0bGoTg$*;F#BO~q60jH`wVa`B_3{YYQ{GoZEAqVB-$Cf4+w70mSDcp8?$3pQc z>GpTiBXy6xUJ*4gEhahSN|&iQ#KEv245K(8eZMPw*jYczoJg_Sp?cnvOv_R zIh~<`*Fatnfa3Ea==EySts|&U@wn}b#6h3>MEmY?@>xuQvU}v0f6SQyX*2?$Mf3~|e1XFDshLc!wI*X^lsjMtwPhe+bfblZH6n66xF>%q z3bUEbBLJoS`o%)C6OrQ%yAa^Np?bO)0QN;dLh49$yNp4Oh`?h-x<1)ZwfJl<)G{?X z+HpqXl?}vZ{wSlEMGx&8408$vN}|9bWI!xtv*ZH3KE?i z4k+oTN+ZGKNrr%>65-pL=~~^EqPx9%M!-!|@zmG^MN@=!0xpD{oN{?p+$N>f88PTJ z5oTOCcxh4aL98-_YO43CPl;*nDKUwMV+Sgi<^?<}0&U##N>2Y1`R8J{DdsN33xX5m z@WIc>ZR{uf69tkafC}6YeetT*Z8HFbhqksh7%;3)bu~MX%%Ht{7dU0JNI63$rKyP* zhV>WywaYb0d6!q@kuIz?c^SNe!iR#E--a-I!3(%h~clWCw)wxJJ^SQUm z?PeLDn&6bW6S2CI10(`#km-U&>Ef@`7&oiI#+YcKR^LnhjH)>2)+FR z80`blB@+`9^+D$kWQGMt)j+4;5vXN{funnuw+ke;K;2BtowyK5#jLa-?{%rZw1|rb zqiD*_VYc`5R%mTcMIWzqn`z5~v?HrGVu9;cie|%3BKc_2mODv&MTpOmuWVEGAtV_Qbs(lIY|?Kkte) z;|J?JJB970w?Qj|nTAdUJY{1bF_EO-37EWCryhTw=WEm+$>sK`DL$8jM&@NzO-;uR zru2GW8U3e95RR}Mc6R8s`0pS5g6hh;%te7(`)Lu`1dkyEbsD{Y(h&g8V2u*0GU;!d zJyK>vRP7G$m@+lm@f`m0K$NByDYj zugYB^VF64L+F}Y*k^qw|<=*~uCP5%F?subE>xDW(pkY#;LYtWU{XCvKy7}XH;y-k5 zZd3ZZe^L~|hhH%%Ho{T78RlU7PESNh@^^-0m%=4!09!mg9Cgzgsnw)=v^&~3A`2jU zhL4M>NbvXLiY;?k3|R_z{M=wAcQ0yxAXm4e`IN<_#-K~fogR@zUuoPqIe-Vm6nJ>+ z$i81nfeNI;>yYsY|2VU-2i&1*e|$azV21(XA`JGY(F&9S4l<5W$D09fDpTaxprBAi z3>nYYQ2aHmmh;Bns26TdHsbfLax{f9fToGD%=rnHM{NJQY@nJ!YOMwOpTO6I!Qkds zmq1H+EF; zTk)qV1F(riquHQf?Wg%p0|z_F((d-Q{{8HP6uYyP{YDp1+bdL=oIBiV!M{ZR@qCHu z1-(|jLQ+b$Vkg}2f3#ex1d54YgXJz7m_T3KcWXBCkF3M`FZDNkewDhF$nomRFAu!Pdyny- z`x-+r@ohK8k5yhm`ePaV?%kX+J?1#1n&p7k^}l24njRt3|B`=K9tISG29If}fOHfO zWLgTtvTuv>yH&!Mu^cI;i6B@+ZM?gV<}H=mPvUCwlCSKMEcl%B{x#8j*h)A4w6hVK zzvr3ImFc?Oc(EeiOh`>AH<#Xgf?}QXAc`z5r_$|a`pG3Mz0Owjnv$&ZG55)XgtV%khy&=zBQ$I!s0;ajV{r88rY{F zKZV~#2AUBL`VX*<0|5O-&YeOn9Y+r-RL0ATAZiD?qbR<{@HK9&g+b=d`yw#kb#}+} zplJ*TNsDR@p%&oj+2XHza!yT`0lAOP{Nl&cqSDxUkJS^2FH-bwAVzzE0>lYdE~n0J zduwcdhjOV+1*IRkYi^*mDE?f5QKZfoqm>GKwRmdtv9$%DO3%B)xPQ*c+<<*BarmB5 zYRw-#-O~YCfOtv3?W)B^s0+4vtp5Ji5l~gSHJMW-B#(N!)*B8LhF|UY#L4A!Sa`JA z541l|op)O5oWf8+Da5XODHdQn_ND`E+sZu()l%!o=|QTBUZ!9%s{OMVK~(4(5ni%! zcBGiK0a}7Di^Yh8^{FBtYfm&F1;xfIe zKXeN(R##WElt1d$IUKOvTpT1?%2NYzAe+T3b`a`bdnLsyWwt$OAh8DMY`NzEE%*~_ zAc;e+hIeFaOc<;!u5u@=IEGIMKyncIi0shb{A=eEHeP4fIP6nZ z0lcZhxLb(~h+|NR_yW_@1$=$|fIJ@sys1%bg;+iKnW8g?H7C&X*128s-`(Az5x#lG z%E}6MkotsT(*1O$e(sT8@&I5-P?L#4Aj}5F@3HZ4o&=E)2z8$n9r_PLfb}`AY$Fn- z4}oihfQB0Ex6(7y4*@DgrG;}H0yc^zw|{MI0^JW3V9kIV5_xdHRw%W^iJc%w>}_9s!NFd#6ap6{p3jz0wOh%@Minwp#6VBq_L=WXrM|C)FIFD<}!`}kkv0Hk-`ejX!i z^PhV#C*M?LJWlTbG{>sh4~U^vrC3kXX?TH4>8VDwdS#!1fdtR*&VnE9a(* z6G0&%Qkick-&J+f)r$hJ*6_T6l983?>K3K86=bLjf%dgNV1A}zuS7PhayzlcUc;?d53 zy%M~Ol@-`C6ghnKN8q5*xR6)^BEbdT!CCa}zh*3l3{Tn~HYo7Xc8N~;rC`hN-*yPd z|2n0}1Hd*BK)?tbxY>qi{p%x1Zvw32=)ZS&gB!yBzx~q<{`4}wL}>=A!?BRaXD44% z{1VR@9$V>-o}0*WdDli4e1Tyt;w@)_2J?g$wJpl1XR`JYT6P^xIQhJPQT{~&2b&c4 z;FY-ks`SU&4j9WVUCI#k){YuQX$TGepBWRL4ffvSr8KH!af9PJm4QM^gyj zUMStA?yB||Y@=aO4tq@uYDG-hSvIlQc~`U33LWdt?}*k%&%T#HRrYWdWKK>~1olGh zA3X?#jjAd{M=H-pGG!U2O{IH#1=?4;Z0i~XI>Y3j1xIgp{F%pnDaDl~nH-mIY)XDE zbhY5rS=z}78QNtP$}%2iuNC!q8}VhLg1|h7$I1YDdBRwl!X0^9cA`ICNLVf(e|T(h zqr+|gQk_qCHB}x)$f#zk-iV)P%|ue_=_fh5i2tNBGQ#P%ltKD0F|D;*ym{`$GsQnu z8R=kz-^LS>;^yY-G;$%Uo+%pJLJ`h9;hYXlA+7FkD1qOE;Z4RaM zTx$+3qu+ZJS)c#Z#dNnop`>qlPBatA&@dc;O!ABfaySY<-{?RXD=ynTjyqX!=Ui4{ zynYEI5uLvIASMIhew^D35&M(JS$DmSVy)vKdK;oVQsf`CvU$<^EWXzQ!v68%@p3$t zg!YUzt&XS%{gMu{&-bP(X|tz{B%GRekp*4(wU_ta<}ULYt4;$^&z+{zv2%wCGJ|QU zyWN#QXDsXHvg% z2&-i(TiIF+bAEH+S5?G8dbp>bZ=E~SYPlz^F7v4gUf#2jJFYkS)$2Ng$<}AzEsZ}I zN*uc8N8h?ZNJckFv^dM!C*hyf)!U&A#wLW`%qZO<9)DfJt@D)HD9`_(QGMkGBf_c9 zfQ&PXQyrQlj9PJY${XoOSF>u;29K}NM6f=EB0>|uqYvBW*xl;$qEqM#cLr0#lk!i+~%MwE{V1O40a7+RxsP?lnjwnD zF^~F-Y21_|AD1%*7DzkkMRO$0$(}Axz>oWa=e46>? zErFB)U)iz_8_b$;S-}g%*8J;M&P~@pI$4O6->kpQ!=T-uZR*lEpL`FhJ5hoAh_!zE zP4Lm{1^iO0;mflmE;ROmXUnX-^GlC!9sV!o-ZCn#;Mo_2KyaS~cPF?z1PGE~2?Pl4 z?(P!Y-8BgWful9js=~~&?M&so}QLKcqHQZ!e)zPVSAAsgil)M8iX!IBU4vCO)>&Uw@ zkS+^Z$3R@|3SwFh1!WM?yQ|y~*P8opYTu0pd*J>i+XM?*pT9Zwi^OPnk=;&EA zqjZmoj6N=DF`63x_!U#`2=>~aE9btuw8Ze9M31&f7(jx9#Soz?ZWMXP4Cr%TRH!h3htt}=MV_oY90U8c^x z;ozRFH*cXq;OBWrW0}UF6tDkg972-dNmYyWXZV;RO{4G%|8y3i!3Tcj8Se+CqGqvT zsnHG*5Se1|MU}C~$WT;+Y_T7M&=b4fCu1C<`=c4R0}nxw3~qV zIgbsfD9-y%HdE(74+^ayU6AQ7)>Wc>V!8)%Smcl)0^HZU({X)=&Z0T!_)8af$%9Eh!Pb~I;UfJ*W{K6>C#VfGTt*v~I_&iEo;$G{y2Nfm0AA6<2(CD!THA3{T zo5Y+G6CuyWRwUiM*y}=Vls2Sk*(($Ou+)96S)5K1n~Vlrjn;3E_aa^Fm7S*G4(5@M zplJHY3X^Xd@W)Fp0@+L&8{Ek2m+yiHDL{u%3|WH8uG{yo`87mc%1gHqixx(~zHlE1 zTc^AWCqMec8BEA}Aj3(Qd@-3Ov(XeGdhl|U9huGf^>dCfTHgo5{lVCC0q``-O&zic zc@?+NlpU|GuFcn)pGQ(w_Hw3?2O}VT|4>wRXGW9aD-r~)cHaYkNWFf9>eF&3i6#xT zCxy@wqTt{opi#dl+kDpdO?}Bq`^c&NaKdOJA=kdH==Zs*QrxWS16fI3h3j{=FVA1T zz`>!G|0Jm}C`oxQrfHTqs?ZIJLzI)8CqO;-6C=NnV7Oj(UYm0@UpyLf^{tq=ZibU1 zPxHEJnIhaucLYhAH9AB2%lE30^^6(-4np3k-wAsL8#iP{PLr6G$PGyI1LJbNvz`?t z)aI>Cw5p=9cBi-PJKl__=;^eC(xJ~)_0HF5D=Kfi=eFcu9{Z-RAXL79F~koIr7Qd{ za@o(9Dtd`B!f}O9b6i}Fo9hWcr)X{S|2lJO!Sb5*`!>j(V}MHzWm|xhR6yx#)xm;r z{yp5gtCTB|-C151J&!LFY>&5( zVKz2!C{)(ty%Odc^UfVcvcl<=jgiqH19L5NXWqUh{VHG%rYNtxWMTD}hS-Q~R%EP} znl<$*0o(a9bsHstl{!9N3TTYRl^`cQBs_$_Kf7NzCSAd|kV^1gCuuUcV`wmAdXtwp zCO!I>^Up`&z4T~_bfnchx*R6d_wTLD&yll=iNt+hs%E+Ai%ZYScwJR&K9{qX=a+LlE28IfM-lC_d)0N+^H(93jQ{#Q2WSqW zxep#dOmsZ*T^8K0Zx}PFTnkIW=~q_XX^p!bP6Z#eq>=e^5DF%=P_&06v>z@wcXMUY zQHkXjp3|OuDcs^g^Zy(R!QBP$NjOlVbw#xN{1?M{oxQn`w73qmJ#Lg&-_UAbP z347?BCVa&=OC~uHjlT9@oj#O43X3cqCObX$%Hzje(@(o59&c+yPUM;iPcUkwW4Zo?)~4AXe|T+w7BQJ?!^P<=qO^{45Ija&C92cz8* zS#tA@Q5R~6g25RLwXF~~+sVS=tY&rO-r7OOjP2>@y`}&SF^$sj9GmGzo4Dy}dB^$y zdY+kPY!D~ELQzqm0uHXkUX$whrWjUK&TWqvyjJ zO(CyPyW^wFK!fN6$87Yn!i*t}N&3oHb1wuwS23rj?eGu2ood?Y$1U?}3O@r@4nd{S zXyPCo;Y`@9yBVYYr@IU-jEoJN9JjbxLJ5Km5Ag@}4Yvyn0rrH|spm^C&D|*&08%R7 z*pnA6OUrvC&@$2goW#E2^v0xAU1bq-6mV^w4JKX7+1o~JO-wl$fyzxC4xI&kh8k~? zO}1P6b3?~k>+ZZoI2lxQo%>0rU%dEWh5((%jmDs`nYZpXLVb4VpjBSm6_NHup#E%l z&CL+u$EUt-Z4I*PUxgF72IJ;%G>v;9;vDSD?^IPMqzqB9g~utEAoK#q-nm(34r1qyv1gxxKO|P??NaiQuU_hj3Y*9ZsTw>yRXP?W*-0trKs%kQ7 z!U3Ou{hDI5vC8c}p6fH}?dy7JUtO)~>%0rJ@!vuv*M}g+wW+$aehi}5R+d1`&s!TZ zM;161P-wroC5KKVaMn-GpKHYzU$++0NQ>Im?*eqiUCg#19XJU^925J{F zz1@2_H{DBADQ$!`A5H1jM}morm8}~xxgB?}HwFejOp2zp+7t8zwb#U+Mdof64`9O* zh&>Ticos(Lb=lHeZZQ)b(NutKbXN94i>_^tnb_jALw0`VLiOfIZhUY2@J;R1ebL^J zg$52@M2BPJ1!3>%(xCD8IBz2iMT54oXKYApOl+6>4#`AWNz*c%&OW!Vxsdzsn5MRQ zwu(`cjP8b3EOa~v@kQ5~F}_!)YnA@#3&B-X2ai_2~(qyy2D46BiS0(VIG1-Ed=Ku=Rt<+hp>h?h4A zzsT({s^M&64;uAdTN@4m%>NL;a&D;?$C={EAJ<1$hqlr zUz%sCyE?nQa36mHBZ@rjWhc0Z;bc{*nDhJ+39f|Txm9=d9U(isSR^q!AvTW}yyV^n zxD$IkL5_&-qGvtE?qimVL(IyMRDDq}{!-?+;!^gEZ?Do`E+`D%tsc6=nR{0oFC(km zGP7M_0tPTMB1acHH<{M%e*Uvt!Q%B{0eC+q78KgiCAo_(G18S86N#XEen9A&JPWf0 zmH*h9ht-(Dz;iCA#}yGChLh-bIO*(A`14udPI)5nZ2SGoImrEWEK{OZ$8JZX^;pC> zUN>*Yt+Jgm5}Mdne))ZMOp!iy~6y1@j4eT``z;HqtGn1mi&GwS%7@AA9D$;?#^9Q8_o3OH;yepMuh;uVLv>LnDo_vn=^gbXRlv>S+}(?FP`*uSZET3G)boh0)Z4e6>j?{1G~A$Z4*#W*`-h#9IM-^5S9iVw5tP<< zOsResiaU4y56b;}etmmK^$GeaioWu~N%dgInfL4@2)}P4+&hEJb7Lvv8uC zm?)ZeK@Mmsk}%WdV5{~#*-}-XlKH!vrq-kg%GsGwGMm;~TBrM2-fl1!H**4+={`x8v7CPLw3uL9G=d!V=JMF^09RuWjc*!5f z;P1}*!E1N?le8;YM!w4Qzm%*578riTFPMnRNGRwV`RqT&UQm2$Pqv0k zqW@W5>m8u(U&7WwcSY{M$_LCq#L9^Hq}xAH!xx-CD+ugoIZ*Q7H*g)%(f-E@-#NOv z8lGOXZl74og;1{21ITi6yq>@}Pc)uC%O~6}wwku=i&>0AJC7$0VVl4vA2J)@|b zpAxGSmaFuaCkZvvs~cY`y58A!`C;Vd()P;eC0+~umDFa)+%&(Tt!3Y81@V9K>6-T} zjReOv5PZewe)JPd1Nst&Zc6(%`2q5LtI4gMYjUUM6(l7Ci49TSDU*Da5l|jxE`<+| ziT!A-gV?H|7pgwcp;RjR3+${)!%&$HO|EZT#>J_4;on2Q?k5n5hdFfh{QkWa#)A5hUDpc>= z7dlw7yg%fG#8dvC6v6*LjTR*L)`RFJimhBnw))l!TKf~>0fxAa1gMVzo|v${`G&SM z9AfkXZj@cbcSumjPnVX85bIjhKH)ehL`leyd z+0l27>?oz570Q*gZS1%Ht!MU~;;mo3-KvbC>fCKd>bCXmTo#_?(jB=xKi_`VF71Tv zX37+yG5M*J20^S6iK6Sy3w-ro>+j`rM6rD&jpgK{>8F8Vd8njh$2|PAA5=a`)|G23 z{xSHc@dRbAL%8oewu~?O2L>D@){g3RE`cMZUyo1yuP=JV1u_e2!5GR)CIgY!H^2ay zX#xs{n3NeFVeGg$%p0UoJWi3E@E>w+=6h8gYC#v==F~nP>C>>Wd#4PGDylOVl{oIQ zP~((nnW>{U%e9AWTj3lFyCfxjP>{6gqqLn#jgG)Av26q}wOb##jHGlEdhK!d7g;~lzo zK~?Y_acjZU6cqaij}lN?9lm^~bc$vECiv|!ED0nvbs7sM6BfxOO>WaU*RV$GAaaF* zU8YbXqC8wa_;2;9I``)bk>x-Ce;XLR_=1eXDOiATxEK=+$&rlK&8BZ=f0) zWbR=Wm2z4N+N&1)`l9`w;jy)?99pdk``bRU;50}ayvJ%g(0YvmlKWZF61$LZ9B~?& z+N@Gvx$=68Gmm@(B7Mz4V}Q;6xMm7GxX<63xj0o`KNRFn&%}T05P)6F|3NQ%?B5Q@oVf|LJ7GAgQ96^s2`9Y5!VfmIe^!fUcEn-;CZa*;^I?{A~ zIN=B;pxbhMgua0}a|Evk^$HxwCLF^{x9z7bJrXdm*ux%paY1Vo=zH2PU0Ro#2ziH* zUqfgr(y4KDH938qff7r_DwxYygDo>*C!}@A#LDvRNBh?1;Ojt|@Uzg0=Ah&{Y;rzc zHMJ>X{7}wc*sn-mQ|4EWQ!kW80weZN{69u>3R}3<+V>$2AsXaymqnZr#E(Q0f+;Rn!}UM3uSdLc0l>H znj1f#hP5OPmD`oF$DrES6{hu&9WM^I9U3?N_#Tx#fxn07^=VZ`KsCC@cI*g>Oa0Fd z%CJZ*1l+gWH)+*K(E;a(c^_Js!_EYqMTqex?=TIO!OOqx_9wwR3Ds$}z=udnH8{A--qCB~a*a zp~0Si&5igJU7pexqHq#@xl`xv^g}ee_tWpD%lZS1Yd1sIrHPY5HjGpOGgiV$ZUNHM zjopi*+k@*ZaKlV|13NZJ7>G46{N>0eJrP8!e2*K0EBIy|7jmp%pKs|RraZX)O2pQ$ znCw9PQv(VnZ>Tl9%-n1jl@0>B+C6(cDu8z1TWiyQDq)XKf@ue0cHbHE>!1ACkel5m z=-FmE2+nA(;+=N-Qcj`_#gS2t1)}yM1*?d0X6W$py#Qe`@2Ks#Y)Z+!d6Cb?Z@ij2 zc9jY8t2*AH2tcjkt0iv;aCF}iYu9ndPx*%3kX4k^ocXRqxQm%F`^QFp)2qQa#jGfc z!?GfSH~=io$L~ZbuwALa^`jY99X|!C3S_gNipB@yEb-Ix^gjsFS_1qrG^Ok>+0_c7u>_@dzvbg9R93b~i+crsWh1 ztxob?FE!4CZO>F}dIDdB3rOduFkBCcUGo9gvmCWD zzm3W=fqfx7qv(!@G>A<$xR>I0vhvku!R72^iDszMPi+5GC`vyzvbh9Si*o#DMCJB` z()^g(?e>AG%02RohYf&u);%akW>a(7zk8dhS7jiz;c+<2JMNMB>JU|YqoJXY!`q4_ zON@=;TN}xn-wx;oMTHgS7h6Qap`)E_R&GAS)^kDXKd|WCmWybv zGm=xYdGBvyfaKgk5a++8x9YRUj73f^Xs5W9Dr}Z0=8LBt6<40)RP8IRsiG2bi6pDL zlc4o7^~Phg*3n>3-R%mM2+f!)Ly#{S7xi7V1OXBI7d+hxy3;$hhVlm+UN6aS`eJrUqJP1o%8>$O!!}pc`}-@;FB8<*b z@*~<D!Ky|C#!{g)U1cRUO5>dGYi-#75Q%ia_v``ba=#yTODQmr9(k@y2 z!DfvhPLY@>#aYkm@CCT9fCt$m%p;F%Xe)t5I(&H7T`)pK;!Bj_s%TTZPqA8u4>FLF zkOz5|FqR(eXE+*x^Xd1F^5;}PNV_i4Rt%w-c_g#L!m@{7!8X=SyN>{qfY3IQSR_ig zkE)*z5c9=xQ&$Z&Rp^bMb+)^+mSSI#ef+dg&6$^){NcGOZVcNPYjyFovt!uR6nOOIgUiMDwL zI9OQa6rjwtJb+-gbCnoV4{Xv){G}8dPpC1^J@8xfwGH z%gqEtaDN6@BYL}iQ2R99F)rhcNynSBP9mew*>_6faKkpPkE)U{s~jcVa_<)!bl93> zV!tM3I5H%@gh!!VWlrE4a({QN){ygiS*46HB0P?eW2-!=zd7~M-OReM7y+jL)E4>| z)iu=qhQC3&qkK}MPGq?ykeo2j0!xdEG1>qkf%#J4=V<7|6COp8v&*FK>=kHDm*srw zK?P*~{n0Uf^Lo9hfq-dTj$k|zq}o)~kM6nTkyQz!8KN;@%Y@*Yi@cdlQna{ePYm}* ztI;pwhd&m_&R%-o%_)J=sEp5OxsviDIK44FdM2Nh>{h*Rb^M^C?yQi5Q&Qvkumdz+ z;&S6^Fza7e7PZ#!>05`M0wX*ho+39sKY)*|akkw>yAm1Y75K00XSsXf7Zk~B;fI#qT;Mw*t z@A)l}-PKFvk!l$RJYhEU%3M7jvE}7&lrC%af~KxK?r_ zl;NOS4fh49w~J0%Vut4WKeq*~`zUPl^-k<2co*R=edzC>p-9rO{=V}36FqoKn;V4` zjcmKbTwf2S2d?c~Qo*0yBHitG@|~FL$Jr=@hxnD~ znkK%k`iUYOkB_TjV?y$cPLU~-N8dVb`{?mi6(DvI%{lLt5&mE`IVaHmVe7d5to3)r zc9`)UO9w~#DUy&7SvCZ%_4ND@RVXx$c;a+ROo_hHf-lF`5OfF3*WM;)`*yJ9svvM+ zNZwUD6oDvM4rISeU988-UI|df$S}@76`PVj1(qLdx#VMM_bseW1;|vMyR)v0N!!fNE2yZ5pyEbE$H*gQ&l8t04YGd&7KF%Q5@Nuy2_dtV zY=7%Py&>lC3b>ki`LsWVP!d?Zo?L|gbPDE!GjHy153+A~X{byhp`OVf5{iKrU2e0c z?zPF?tRpI=PGRq(%!(@zV|`}U4IJtvKKk?k(bxPivnOlFgptwq!Y0M$adX;AH+_nM zTZ|B^OtZ_|`wo=qq)8w~y z6WL1V<3+O9wqJ=AE4r+~2$$Ev5`yz*2QYL5vgzo;@%r2~U=Lan1$J1}JGHY$nZMH! zIp9RTpZ?5&lSHf>Z%%UGzB=6C+cL(!4eamNWy=m|nCu)HSXgm!MfkK(=XNBmYf@8F z{u22!VlbisV>R|&3lKMZxOS52eNEcsb5`?YE|;Z4#zj@xNpftTXDpw(zsbFgG=`X< zKWhKHy$YVP)@i$p#PlFSzCYwzw*?;4JpZ#oIEC_1++gsi&l)2e{Wh9-C2h5q)zfe+ zqe35R+}(&6U4CnlmQ8Erpr)#YjM&RX4V;(gc60)C27n6)NZu)=<7Qt1DH^By2OQqg zn^Ap$4+sh^gkS3O@-o`*=nmX%_7dX2!6R@2Mmz(gi#)ue#|G)cb!Rq2u+F5EX*We6 zkhK^1+4E)i7ERqe$KAx_nVsUGoZ%ous`XIC#AM@m(~sl$TiE)0{Ww-|Jf84JYl_An ztgi~IN0P#mX(eNQv~P{B&V$*66%iUXIkR^Hv9-Bvb=QepYVk+GuCN69sE9a3HqAe@ zf3{SImSCM?#G0NCbRozq&`Lat2`t4bNgttlihuIlfHL{T0h;$;VGeWH~tYb-!SWwG6nb9-72xro*4vE@hW@!=yvz z4+QThDsl94(HDcL;r+P^W5_wu?eeQ%!XAB9?ow|BG#>Oj2E!4um$%zkS0l7zC}V-R z4|>81N-JsG8c?yW9W*@2J;!j8g)$W6*J^I!d2ZjCMJv;Ea~NFpZy4k=#qH<=i^haQ zHTli({BC-LmMop&4I^kTJsn!Rxo#c{!XF8KdB%%=&oNNiI*k4zHh1*aL598!e{KE z_6sLSX!2z)o=DCM>4?veXLC5?3|wjnTt2G06vSH~j~&ByR{B?sAQFW)^lxxDINn4k z8h-S8^KX0*r3tD-IbZ*>#CKB@?RazK?>@8J^8+>hTZIAaGfYSYTtc$p|ru<1> z*-Wfqg883Sn3%=prS5WwM*Y?$WL_kzOd3*BThgM6iB26TgWtTc8!9r@q5sTN?R{Tt zE4tLUW2_$gK<6yG)@|>fGt|(hp50Ylzz|~OfQj)+=*CTojny(kq48WI5IxeX(iM>j zJ`{e=iq3n5+-xnQD|m^5_FF-+OknuiNSfZ6SOACDJpknaJqpXPuEm*gJpJw2P17el9chtFN>eF-z{x+!J%)OiKBG)-6aOL9zX`PEZz93-iSy7X#a!Y(TS zgO6C}uY8BZ0r(C_KZZuLw0hQNHGa=D<*~M8$&ph`V7f2&o9O{8} zpGxS0HXJp?6A9;R)ZjZPFZyBexo(i*E2_*>M&%#YgC|1?PtsGnTZJWu7@ukcbW{nb zY(0Y=4oRPhPAjS!qVj&ok04BtG`VFf(Irbx`IsO?6*=#yvA#AhCoG1DguF4g10>QR zQSfl2pHb5J=%+2G>mX!El$1fFEAOk#U-%k*HEKPY#pLl9cot#ckSELi}X^cYM}QCUz06_66#E! zR2I^(gwCUCtZQp1*GwTmOKAddDxm+w| z$-^<;+IH=pO1Y!{bE{Ce+{pS*4|`(w^7RArH8Wkumpc^!#*Z&O<*b?3AN+lWVt=c* z_Tar$M(KO6(a8W}*-C09wjvemOO5LXL)feuSoe0Y>o3HLjMI6x-uiuH7-38m$^2xcI*YMGYHOaXd`-PP_GXPo66#WF)$-4Q2gbXTHZu|Ho|mm zkRVs+4GMREs?*PgRMPXZmc#Q~D^>D)5@9e}EWMzk09b;&RvrJR=M>xU9lgp5rcaAA zEFzs8@r?`~u89Db=YV=@PqY1*;IG5abY22O;EnW_%!LkyEKFhRSXkcJCoSAbD3nad zW&hXvrg?8@o-C)QXYm}{huCo?SeWKCj(In8%n~SL=(ITo0uuIC!t2lWKCq-=d*I`H zXLWq|?k>{lRj7s$3=JMW+$KY)Q!#qHXB^oYfVFF_J^MhF=-rt&MXg_g?35KJqJgkl~t6D@(G0_;7 zH=o-g&#NsL!Z`8NkZ&&n!!fAFydQ@~6b}@JNZ-D55-MK(HEHwRWPqN}hUuI7bHKQk zw(&X@^rhqV+D7R!S5A600wkj!7YQ9&I1;GNmPq^hl9AiQ&0!Whf9soepRis~* z-_#^6%1BL35FHoCpY}bLl8ydd%##a>3lUS;#lk|V=tr^rx5-6G*&?YnSh**1!dH+% zfVs=k5g@2oXpJTy=fM!liV8Ng>$IsA-*7m87>4a*`iW%mj|v*+kCDWGojcoj)6>iE zOl=X6l$B*L;<~1$wh~(gsN7{k?nj7rHzYpE#s8PL(Ye-qX$UZ*|HfDZPnt62Gyc9H42zs0G4r%f7k9vn7rpUD63i1B|*=Ko(5 z#;^+1yVS4pnBcSwJVfgOewz*_UUsMry@wjGE9PLd-BO6N z{jq7$vSL-%?NaRLoNrgOH-VFR;ccLv6- zJ=eb7&rzPAeBZN3kV|v1=09=?wyJjiW-01_=d293ndSw9VP=mce-bBE3@P(BW}2uh zFIW$P?%qzDe@b@su#&;4q458_z#!~?>qPExYWptQI766wcW@+zB=ri3vb|u%fggJ` zPwr_hH8%tr7ck=+J+;h) z*`(A|HC(da*zTF}#PY{UK;X?lVLT~`)bbbq?z=Iar*##kY=C0T0<+o9X)8L;Xxz#y zJN2rff})L0*7Af&=4(y>Vo)!NKDDuV&Z}v>q3rIQy`idR zDtImt0fXz_+b-iBxufm5#zVnqR{~w2v!>Alf^0<2-9^D@!LF92tDO&62GM4toL{3- z3JY_s>w~l6eDty~ArA_7bblq&gu;XAAL=GfduOa1tY+V#aJgt|`JB z44`A5?v=AeTcUdaKRZ64=ikL{-evV0tsT(bHb+P?!U?LGQ3t}6CKYNiJD^d8+me8M zHIaiIXCM(p?JRwUFnFxs1k{w9FS=mmj;4^}+;MFB6MXdiPyM}W{&q9>5Hf~fBU0T^?MYjW}x>iB#Rg>`fV|3Mbsi>j7#j5^Jl8mBZ~ICqqxy44kM-9 z?iFm3D(Is<&|;xqo7pT8oK#@!?hbytcjE6KUTmIhaKq&^{vg6<&d3KtGHkpKNlILP zH~3D#QO3|c_qXPVnC>{fFrjMYR%$IE3^x`C-H0t}*nrC(&pjszlHoWaaCe>83 z=v{cKj330Z13>#EcZig}=?v8d>JyofclLbo;)4RK{O60@7_UQ{5$U5(EQc0jMixW{ z+iQ49R?R#uC)O0(i>d^xY#HqRoZwDPham@VvM(@|NR{>y;1D|xs-|X5`Z)J*yYRN< zm2DIBPe;-Hjd#L8r;{Vf=e-jQcy@?D>DIf8rETGhBUs)M7&&qNQiwOMO?m+On&h3P zzvi-QixZymLf#tZI>Wx=F?TY1)jr^AcEZ1I~e? zz?lbVi#nTdC|$e=dLqhT+AS{fnTa2oSvwEi=qln zF2~u_XBLJgMBy}<4xjG*d0HR6EGp><2gAz3puG?IGk64Ay`%c)I-@XvxjW|4^_-zI zVKr?b_f9{BldKt?@`J}q9GT^}kuiLBI^&r_lor(JW}!LYOGNWAGpAo>>YCV9o?$7T zbGhT{jXgvFYZEnHWhxEiFHQeu${K43ur1bb%ZfsBIEqm*tNJd) zqOsks0dtD;W*YbB&y_m)L!#3GIbV}^D1hClz2n&XFX!mfdgO7zsHBDeVii z(qQt;Xny`O)k2hi_gAmlHu~26V=s_1cH0AvpifZrxeBssN=qdJBKWOQL27q467!Mx z{5ycbQ090#K%v-TL~nc;ty3WNIX^8a^tCLNy%_jKocI-OB~Uoswc7=}dQlw2s3wF;@j7_Z8OnD`uM@g|>dtPNqxcfV9R~Y&}56IxuoV@#E*M&ix zP#6&fWk=K4*E0nW8n0@A3*UY8emT&VR8cGsTl@RO0P!guSQ^%ny=0i_e8xndOXSck z4OaZza#^gV7?J{RSLzIJLa!%UQYA*u& z2S);X!%ho_4VO#ut)yYtU-TnBW)!&MmMmYb+Y8!F3D`yJ79^bRo`t zY>~R}Ta8HOq94h>N>ve&i2DXobi~g=rPnq_n?Y3M>2BYQDAi{>YI5m2*`3*(jg%iX zA2qMf=i~Csz-#A>`Yp*J)@epO#9ap>cm}t0Is^G}qx44WS*%mHGc?~t9xqCOdC9#=p^TGyy~{%vuaB}l*R#`5*9-dO8rf$HK;L=D*Kxq-AAYBPO(rzo3aN4OAKcS~{jwDczN6 zUaf)2r=D1S_bbx2&cjSn1HKX@x?vrXrj*MkK!eONH+c_{heLH$0fLb zCkeF^Uu&DfjfXd`73UUc&v|HdFCOzh$kaDVVfBOmR)ha1I99^Y!w~41KX#Q*X-YGG zn%95&%_6NGJxXN1TM6ZYB(@DuH3%zwaAg4aJ+QL65pZCH9!UJFM9@0S>#+xDZLs98 z-ybelDSv_=rh|e9nabg*b7g}31J4RlV14deOX{B+&~<9yE3gWLjOdS8SUEGn{pA3z zpnj-?YF3p0t@Q$(yEP1Y>1i&7@D6r$(H|ObFl>doZqd1GJb^NQS`tP76~Le;KZX^1 zSBzY(bj9B%;TR=7j{Awt6#r$s;9|6&`d&vW^?%-pI4Bd=zuqyTwwp&@++}{=fFVwL z>Iad|je^?l@n%I#k$X)*3($%l#v-D-zlN~*runRf(g7G##;GcU--~(i#9H?#a|qTJ zr-Y@wI1>*En>K)r61&}B_W-uy`$)_J&GUlyVxDd|=-wVDXnG49v*Kb9gptD9&GyBatw;V3_i!OGdX4+h8I zraZ%yN`rv*RySRscOFHkr`+e$aSvdXKQH3Ith-MQureuepU{6reEVZlKwh_OOr)+p zXld6QAjp>PSevkNy(a@$>!42zGe_hS?2n>U<)76OK5DmIFUCF^B6ryxn#wkk9v_GY?LN!sXp1aHVcJpbOVrYJaJtDx6Z`HJ8i$qbV^vRQQX{}7cr=K z2!Ky}f7=O>k|T!PbAyolcXf$Id;A%<{omaqvC!{|#diyHw}MZ6<7RfdmnNbdGxS8V zh(>kuUN~Jc+wx#Lu}YvC`rNo6o_F83?(g+&7gzfT4d*TS>5jH&{d`hp2fpq+VTSFj zM(CMm;5MjQz2Y)9`n%$e%B;6m6ct-rhGfPPG(H!yW zsQwFUn5i%^@x&hZj%T^~8o^Hb`|C4%XDH2r$Ro<`8_rAQyS_$62-y8A@tyt!7=Em% zsx*zMX85c_G-vh47%jF0NqN?^Yw(`}Jr423UCUq-hBWODx}ATfsUdL5D<~`hmM!P; zH;>-!=a2)=Tn2wW`R=d)u%gSwTr?8liG5?Xr-!XoSgWO)c-fUm;mc)Fcorr35Epq$cP)A1bJ!m~!#6X|Yfesz=n3kcbX;cE8k6HT2=#} zO8I!k&AnSA;=FiC^XPwdBFc6sGzq=2c6T+CH+ORltIJdHb}GZS0Qe-oHh<3lTtiwz zdgRx~ve@SDDZ3Ae?%cd%qv~U5Epn?ks#Py*^E&MUZUI1+DqDl1=M;02yRkz_H;|yFupZ4;b4zOHS^jIaby>N;KV(K%ii|i{mlzo z8WXIQ{x+?|>C}+!H8T<>)@GWYunXb-`B4-g0D`TrGbj})E+j?tx`;BjZ9q2scQflm zY*P%;gTGQ;ZX? zhi+#YZbo;NOJ^f_dMG@whWfXZlCh6AWnFgMQJr>dgX&Zrz&rZcMt)s_or5;mp(Uc{VK`*-q;<+2P^eZ42pN%r#9~su|tm?#Q5oH#!0diQ6di3h!~{qDAHjp& zOA&TcspdstV4IbO+g%oD!=bw0)Ik{JW>3Zr;ZZ*AEv(MW_@}X-0OwZnBNEx)ey^be zYct`*%+ERO^U`A7=0F8V;C2T3{vr)ZZ|cvh-Eot49n~Q^Qjp=l(X$E-GpFFeC4*fm z8w%a&=(tP8K5sW#sNjC#fAomAN1zYR+RGNX-?yb*b7rPGUhkNIVBdzgrP`Jj0#Ec$ zAJ?_lvu2kki67;Y3Sm-_1Kf4pp6^Yp@dyiVhgYP-Z~VKb|pC5 z3F&!V*dOu#MG9rkU>gi}G}wEFxjsT}vr6pyCX%A6<{p(|NGSciQN1@M5zB4&Coh{5$@rfy!UhO!Q~47 zg{s~M#k!G@E(7X8{O;3`tXtpU@r1u4dQ65YoTtp?r6U6WhYx#HQp@im^^d};`^d_2 zq~z((E_RKlJs^EMC0|R*(p6d_|Axa2j_uQ9N?>uEXaI(sc+U=y0I8Jd>e?uV2`dqC zN78ZQX1c!M_4QvDwEaM#4-?MOgfZ}LTG?)~yFlZ;d+i0)#TZQgT;+?I?3FW}E8wE6 zx&-IWOSO4xokk7=jtpz@EZmg{<$ZZj_?IJs3c)B%9*&5HSIZQ!=_%4$P7cQWlBN>$ z-dtGmsvl)M)p%!kE6~@Zx?Hf1C2e%Xk!ar-*2_KcPqVlzT&Lm)6)c*Z@A;~elBr1=0q{pV|H%_nKAjK}Lf#Q`T@p%Go2)5Bl zH__Zi%|U^QDP9E0Nb6NiHC1?x3xRVXyRo^ZA`KQ#FjY-jl>le0revVm3V}D<2*cR! zSoa}PMKQemHluo3u0q@wYgeLU(lI4-b1flnr#St?Nz-s`dGO0HN;fRq^s($Z&ops_ zOHylxQB@YbD+&$IGPg5TjT#?Ydg+<=H5ND5_CG310*L8#SWn{*w&niXu(Lr=NA5~m z#8O%wB4k-u>GrAo`ZP^_tcPZ%DgkaT|2-$H7w$-Tvi1u40{S&DylCa9lXGAN$E%5sbQWQ zz-#_1|Jn+p)rnDY4qE_UjuzFIa18fMarU}4B(5ihy5TN){Ah`d~B_D_JRZ~BKl==)Xm>3Q=UkyZwx<(+`qYxe$saQ(5`UV z#en=TR<4MJ=Jj2S$2ztIT_}BL5o!PoxyPSjO|y66Yb_Bj zcmg%=l&YL?AJex#r910q5Pxg#vhKh^&DnRD!aQbVhpRzBME)aASeep!)qJ2BKRgO9iSAgBS z_Sv|%NiPU~hQD^#AP;*l{^1mRUPw<%YHJCQNMT+5Saz|9s7DpU@v)M4p<4N85 zWs!&qiM#0?lOz$ZER{Cjq9X$EKdK68&2_6zvm1N=r7Em(^9o0feA&6Ke(qr`x|N9-<^KX(2i{*U=!Tv<@_ z+$dv=Fn8c^}P^Kd=c&Nwi^O;lDDJ>r`zF@A={8q@_GQ#5Oi0c57l1m*^E07lC{{Q$O4_d+G&!q-XrN ziO4Dh^KO@_tx1cYGnodrn;y;@RU)P&_9p@(lM#zE{HTuB3|>%Mmx-tC7M^r9$*sgX{Ae3bN=tT!R;2bDEJWX(}qb}mXUw&Cz2 zxWa%6y^=yOH3rx#qlCa0&(7gdE|bw4)rmMM)ZlDQ8+D8hortqx`= z6;M#N6FAaz&3jEqWKuvb?2AEmORCwrUtn5P-!--fh)g@gPSD8CsXHeZ)c-2=o9ar7 zy_GD}K1eFCHb7X`ta|_17?3ny-g@@vZfz=U6u(z(G=y7$xaqRaB+@lqlx1AB_bXXb z(5_D)YFY%;Ge5n@=7P_tN9u~ZH+ePN+VdJywy*2 z#rZ{Pxh}DK`QHETGi&jH?x)TCn@aR`CZF`}@7O-?$UCNq&ClAXv9iYtB`Zv~=*{lM zW#q01{O^P)aN0$Je@p9kzQivIAZx!^V2$6Qe)7hR#oo3dmhQ>7*I%$AsNhI?ME=xa z9yspa%hmQ}@Zw1bzXg+Mk@#$f+HdEL>+CngKAxz)!CcMNVsv!65oa7lM+%yowt}{a zTFv0^RbdKiuT^Qb`owCFDQ#2B29(y_gvZt5Ghhb$2-a#dosvPhJ*Dw(E?gX(x!S21 zj>epKFxFw&X+@<4oSYXoVAM^(M`127pyt|D>lE2*?xw)AIDSAgFDeSd{O z)DAw zq&C1Z6%ql1fZZ_RAn=Z$OIcp#fPLA%qovs04_Q(An1+UZKZHM9%9>S5$f((YZd%gA zRREsUji2h_rfr&>Esd($lMDG)L?rgcR8RJ+0TL43h*i)2uiTotd28ITw9T2QbW*X~ zVRp@B@qV99kn{d?Zxb`R6*2`NcX;Q>oD2Jid-4;!J%B&<#bAar$IZP8U)+rBV}Rlfr94UoMV zlioelhI{_Rfy&Jig-9rDBD(A-s?;&I))DvK@hY6hD?2pbdM}&vWCV`3(QOmGMSQ>ZGmJ#cP~>Cp69LJ{^zIP&<=t_pd~3@QG3cWk!H2Ul_A7u zT(4`o&Q6omia>5&OuQ;By1v)s7q5B#z(JL&wr9$7`dl^bW0O}3zED`7DrNeMU1x0q z_qcuGsq_SgJLyzj#ck%ubrwhX{PF^jR;!%CTn|eImotT@MbJ=#ldqJ1aAoL{CSB-_ z5_WYh9k25Il5z!#V z9GmSdHfk6$&A|R|J-vaK=rZlPVd2jl^HMc@3%h%C`&Dz>^)bf_)avTI^HUS*z#n}W z(S6N6oShgm^928K9nhS9ygo_HCU|K4X=M`{dt|XRJw$2K+#%2q5*@l7JcSKn5335g zFG$g)7K+s?;_XIqwGry7D{hI05#UezcC5T`^4plz6OJ54is-GLo{Z%J=IoqpwfatV z; z4o``lbLclF`W+!JdoYO#*2>zf{uo-w8fgyp?uyH|7mcA6Jlex z?isT(z!)yC<(h7)KN1v-Aa1wP|AKT|gv-fH*_M@48sJn}fd<$eZ`!~=5b&b1KF;@` zy>bFkX!ZdxbYhA+r4(9v4j39 ztYwL>(;4Inq1Z)JSJ`i+P2uke>^X08Ur_yCo90${bpFVNc;2Ycn?mijcMxv;vxd-U zwW0^}#lgqVdp~;HVb`s9VAI!ll<1$y4iqFlBj)102EQ}55rujwl@f+Mgf`Um{f}oehVp4(&W$W*YA)XerKSDog0T+%w?F!; zF&~!^YTQ^&{pE0%v zosVU;bloaV&CCAit&ckS#fAjt%l>o^9pjqQC6#ARfn_bKb{5sQi6*o)>zcJEEos#+ zZ9HCNe1_arNdQLjZ~>VhH^uLc*|lS&*(+6AZ7Y)qA{60QERv1sPP-@x&YEN6X7 z^$M=!kQ_7a#UXR!7{21$=6@9%U<(PI)weu-kM|}Rm^9~t8?TD|HjjlDCV+|7A^oNH z2XjdwD*m3AN`KXMbOBA{vKT&&Nw*Jk2qC)dSOJGC8(;}bIbLQ38ls)mXFj2l$%e$7 z&U8JI@`TVz*DTxe8{^$;hdR<;Tje<7_xzCVv0UKwD;r#Bi{UoooQmtQTuikuoo6>D zk*sLRejQ{|uqbtNRMAe6^_8SLJJckj6KPGMQ0^YB>QUxAmiu`j9lxSjjlQfk6HlsoU}*qbjr(I%B@|+{KJg&MNpT;c@2o# zg6eof?tfhi4xy`_5;#f#^K;XuG<2%K-&zTW7?17H{40=F*ge#;BK5vdo=$2%QRM${ zYURwS2;%?A`c0TnlDoM!{D?D&pWz+fS6?buFNXXs>zWk1Ymh|~w{^_%5%>6KdB3Mm3mLM?s^rNa^KN-5UR4s!)6r3z5WRcc46SelGtxlcH`~(Yc7*7N;G1vf_mqh!hW^2CF;% zz@-ZPk@5A=Z2;7J@QkNABBZkX2D8x~)pH~Zj5)3#tp09ZyY$Q7fN~%ad0@s6wV^{! zhb{HJa<}hU>EmIIZoLO$!>HzqZ@t?K%NhX}SkcUJ*)VIc!WBiV6nRQpIb{sF3x`;2 z?%eKoKP1mhj(Rq!4gb@G!3RYdI>!UU#uxUA2%!e1QDYPXHXtPvWyXG!-fyr=QQ3_E zw93Wmqp22N^^u)9oyWvU&hK?)gQ)mlS&a|7u(-Hi0}SbZr3Kk_A1$4JWF&S=jRre%0+rC2Q-aP$7K zr}YHc83fZiqxND8)Hpk@tdi65eN}_c?fxsApSR#m6fyC-CFZdGVfaeZDIVQqtm!%_LymW=_GbL&)#lD^X=$yyG;(!b=!7!jl)j8{goCR82b9 z`Oy~lOx<^l*TKPJ@J-DjkA-c%R_w9_CyJ(>>DX70QrDm4nd^7feMlb+#yI}D*_>EwQj3cp!=M2FNNsn{Y~5t*fD!^#-=5^@PF+v z(mG}V(Xa?Z?j|S5FZ&nGYVEF8b>fcY?NMuMzk%oYs@!Qe8k1*%Adjl>I8a?Rp*iis z=P|yC8qX_|DMCtsj)i6`zx|h=9j0>kjXa^!lC{|dHqvk57XfLK2l7V5+3pb%qD{vV zP&Mb{Blk5i{BX)v1DrE-l#hGqpyx`0jqj3e)_XQgK~seGXIdjs)D+=xtw66-mc_Qj zeBQo}lmh`fs^)j9T3jux$`mB*1gQS7frV7Lv4QxVOo_`F`bNd&X_O$LJ}g3oJ)&k} z0rYc?5HMffy5WdC`VCPA5mlCvqlz@--LstgG2^*~+>0eD@-4DgnTx(hZxa6e6j~Oy$aZTEJR(wM8=X{`$uvAD#7~!oMvzyFbu^pVM)XIE*TNSFg z)A>xIn>o9+S-}=*eulyDK!r_nz$gxLG`Qh<^A%_~)(!C(K~|FVokRkehhmdWeagew)N!5buv+whyy4cZtWwt0RA$l~c^y;w4*uRCrJvR|1JU0QBQN<5FQ3rQ zX1bi}>YatPdF=DY)+u8?;D{SVJs$9+`?pX;z76d~LQ8ZA>>&H=bmIhYH5evxrRJu` zFQ_!qs3neFPAeDCEO|Gg1hluB;ZudMyM3|XJSj{aQ-0njo&kYjGF-nn-CoT0%O5kj zb~0+mwnRXr^lgIb)uaN%jPVHxdnZg_pdtU; z^=FXxf6hvsAKj8li_EJ(nm;qAmsGL{n@fR2WVA{BTAx%xTT(DJO)$B)YFuz< zkx>VQDUH+EqQ|RGpX>2CVYs7lvjs`5&WpoUD80nJNZdrx-EMa3L(CNvj2ACf(S)Ny z%Fb@K%fJfpmyTYm>e2b#6kpMgxhp=jv92?H1*h3S__}cf!&Z48pl+oGN}1j7s(3;& z)46xf?!1-bo|2-ZX!1U)dTJr&{WJV^`Bv=zfmfb_2$4A5N3NuFMgd8cH?;|d7ObA` zKgmtcssKgoGrDxp@nitT-?vc=$wVQ-Tj3|EUDL-8gk#;PBqt>6^TPcBMA2rIEv@aP zEvwL`qvDO0@jmV5aO%dZ_lnDLJ)S!BhT*+!$tmR}9sOV|2@v17-Sf=xf_KjM5G7ne zl}jOwSvJhfiE>Fa`K@&OLV|W$0k)cCCMnEt@H$mm73*ga7(Z)buq?LKxgTehv9gk3FNfNcGW>1)XYW-ntf`y{%mCpx(NA?F zo^*osnjWlk);wOzH)yBZGtMjORf)ncJT~K|V}E?Op6fiN$f7;SR<2pO5nJBxIx1T^ zO&#g0=e7(Tc@xO(T9Z<0VM}?Go2kUNNAPRERGOI{zL~}GQsA2au{$zbqiv79|JFtn zSHfELvo32~VTa{|?X}H*s&|k)a53ao<+2vNsxxOAVm`18f)Z;h-R<7 z?X4kTPo$cie2{YX?09>B5x#Bj;x^=56m|a}{7w&dF;4u7GalqMZTBry zyOw8ekL0idn{H~YmPRuZyc`xMvQM|f8X6bp2Y)xVs^$LHb&!h^!ZMn|^XT*+Qm?`uHQ}8Mf zCl(Ta$yD6zay+0E0Luz2z))}`#7MO4t<1$ZFlbeckHyYkily6QOeV9 z3RFKUO6VLuil5`&BGCi8xVHmrltM(KxJ#c&`M!&oBs$$IW%3OOi_zHC_(igG4T*n_`CQU)$5!8Z$dp#J8mgD%6$yf*q|;gYhH2MglZw|G^J zJyiQBzA3mUMEmfYOgp2}Tj4(L#9P^f;2&Al)P)IpkE>R@dZ>z3?!hwfS8<=ceev!S zp)3g>PvGN7ZCQtlB4pP4V|q2=6enuRJ!MK!TpqAJT}eWtkXy;@ zKl52uht3nD+X%P4%hZ`P=#fBs37Jl(H2-niPcJZM3FeQ~Bj1>GD?ay(4qyMF;L`Aw zO(n3sE{gJuM!D)*NA`Aj6)hqz5$Sr({mCm+Tf7r3q5Zfc4Ysf>jHqc4%6$5}yx^|h z7XW2BIJ7X@CFy@+{#)v7|lG!;78mP-&y2 zUiT2h>H6DZ`8Ex}f0%^q_p(~`3|B~iaYiv1xlf-&x zGsC$7-6nA6Xe@rAR$c+qEAc+RK5cGKTx<0oU*3@-W{Zy9Dg%b(olhfM#i#PyAj8S) zS^qMpTuOE%P#7d*gI#T8B9q&1b-{M~tm0VfyXKXh<)uQ+$ycv3L8lU%vTP#CPvN2(=%|X|{IsEZF`N8a*23kW{fB zGGv8c9HXi9KO}o&$gqRQ=zu`|fM;gKeQ5Gii;^z(GR+I-jX_k3%uuB8g`LWblDcbD z#&MvDDcLQ7KfajMWkj}MsiE;6`?4$i5q+B6Xw9LK(lVQ8O2s<-F8+s3oyyYh|cRy8jV2kr0mBKPS#j88puu{E9!k?rZ$F=;YG zEuwdfaV(nh?XUwsW*B_mV0LLouYlh*)YLq9;=JkkX=Bh!Md1rjWYOim2}TceH;wO{ z=>EO}hWJ-f7>;(bYL4N&z}eec^TEJYEwzU}Z0HV+U!;3a>r-zQsgQ zu2pfT$$bgy!DmlRn0Wz^y}ZR#-9}Z>Q-k@tRq`+kF6wnc6bORnh)WjAw9d?p1gv{x zO>Fdge*BPXIELn9eOQ8{++G7Kd`}I&V(ZbIWXk+T;N=Nndw(&2#nCWMy}0&G*_k?W zO?x=yJOna@bIE4Cnknj1TR{G-)%IXmK@DOLiJ>%weC?OuaUGO?n=}ynYpp#NELM4? zh2>1`+*nk-8_U8~5u_DH*xs;uIjN!r4J9u&5cYtD~qB@&^YOY z+U?QAldGoQ4jRaipuTgXdJrfK>Yp$y@NSBi3>3Gp`DtBqV>;Q;UO*elQwo+*dQ$n* zFrMF8&VFVi(#9Ua_OCh2De)`(wsI(-yUtgKAX^)PeuT8DlRB2-7JA>tX^&1a z5`pn>A=eH2H>LL9ni3W^e700(E!z#3=%c>#Am1SFyiGEk8?pj#uCTaYKF1>iTNc^` zJBc%Ro=Ny@+Duxu6fV&R(yu{!5;{c6S7;H2r?*TY=7m?Y6>^u6F{;|%0#V-nTsP)7ba$I_~~CI`bV zgX)RfX0p;zcK#UD7}PK96V61wAo(1; zUraHf4|`vxpJ((3<(OXJ`_z2+egVO+&uv){aI}^&UHs)FcEaAVvAGnBw5;`TRenD_ z0`@LB%It(gp78?*HATo+G~e{tptZItd*luQxVT5m;uxFB&cZj^Y!NT}d+1=$0&&#L zYHWp2Hd;!()AjG@%MoPVMSe2dwCFKt_7M+-;Z5NS6s9~Aq?+t} zP*w3HZp{xNOokFWNAdFoRlHvbQ#_VF3tMLd*g5aB>D^bcj++$L(rm%p_nG2#u(EpZ zEr>ziESUmyZM|&&FV!`DM4O5I*OCAG+a7vSD*A8Zz?<*?s#yL-$%y|$-%U;aKV09j z{{M&T`_2F1`bPTy>f*YVgIm5m{+{f4>FB*JgttjKm@WNiTdCoJNSsHT(0V;MmUlFk zM_Tb|;K@H9OTQT)H%xLnVH(q-=ZDS|t3nB#vHX1sz$lmN5ZweJI94q`)7Y)ZyEsk13q_ zc$4x@go$!Ik^x06{@Jd&C$}z-QihH~#uJkA~b= z$?H(g11lTo9Fdv#P|2}#VYX4g%)2}V-xemm0ixS zb+7H>WGGq3=tSwgEkkNcz7p8-#giRaF{CbBTzIvCYiMod04%{1n?HB4*|>qLi$B9d zYiGBmwj2a}gsgsoeM z@}M49Hzwz{L)2ioc2?9SpV|SprF#`uCIVS8;j_QA5}Fn2!-55bR!2foENf5IwR;QH zS%X5~2WK-^Wir_WW1Q&)GyABn2DE>OeTf_O;j9Q8@u9?!b$9c`Xuve<|<=M@u1 zs3cd{j)+a~7wy|~zW?wm;NL>B{o&3P{0TMMqv<{AqO$HxJwDKx%5`|+;?}RN93|h^ zZil{6iwLC?hX#i=i3*uNVLfDzM? z%x4U5b-l-J(+MWEHNQgFi30JHDXEt%tSaJrJSQ}-MVnodtS+3|peSAh)0efgd>A2-QN(PRtg3 zQGr8w-$pzx;gNL>WQip)s6OF(sazFP1YOiZk-z%-0^gC$d9=VIeEW9&!w!CNYU4OD z_3ppYe*iaWY)IIAHe&2v0582D+Q5|A^CL_7w~#RS*9cB#jsmS%(1}^P zu%Z^s<$EPCl@1-&Vd~N{q2Tba5h`+#n+jihJgsW#&6_P+TPpLxH?F^@$M%%TpxJLM zvK5JvW|UsKF{;@QQ45G_wx)+sK3v0MF1z>|$Ez~O{lK=wq_K!)TbLA^6#@ZAgek1) zzvg7yYNd`MjKYLE60e^tZ`Zir2Bx&^V&Q&9Syksdd%903ROl(4t{f6-=(h0DWqCvT zy+YuneqC^;raS!DXpI>B=*rgfb*-{9P}q9y=k!eYg?-z2U5m4K!XCFhrXjj%SAr%1 z8$5AhA2G8~S5mb7)og)8%;MB%*@lC!(CnXXFj>PL6;}u*F0$HAtp35Xxz`5l(D(HT z%$qlVWodzbc%H)^);YODKKv{KR;m^j+9S)um9WECh|9v}(!#ayK*K%8NQh|6MF>lW z)0jK7C%;cAKs`h%)5M*?#25iA$ zirKg;z3n{t5Wwtzgzx2icufbysqvN(Q1|!3+U$%ms0YGX@uhv!-J?&jp89;|2i66fp$0(a}8Nxu3 z$YTe~8-70^oOKVI(Htq2`IW`y7q9oWoSXDeY}m0L{6Z9-#SwV7%wRGqOHP}QCoIN{ zPXgvo$draBA>gR4^sIzhQQbnaQD`XqB3}=FtiRdt!9c4c`^) z(@X06%I*QE?rv;9%KhD%aK>!Hq@)ry4vZb;fNpci;HUf7#EZU0kvwM!{j9H-9I^LcNS-p;z&LI65p%DFilPUlhv_4iRm| z4hWXsOZVyD)j|Jdp*mk6Wonhl8@H!DKtu{lQCM zoF!wRe_R*VhqPnFCrg=;N9nG72wGaN+pNL6qnG_C_-<;=NcN)0+v9Ed4Zb;|Ig>(S3&v7ZX6XSkkaK1!PsQXQaR+$ULzD`Uxf|a z!?+-$WAkk6gft}|FzOeKmw&W?uKK00cV=G(km&x8KsW&ezwPDtp(QG?`M~>pkoU>% zkn-WFpd&hSXSma(b}L`*i-4TLl=!#h7f;|#k@X%PyYYdu35&BH&-vms`|`rqKIjZB z!n0iz(Xqr@(;HO1*B;4MLDC#WccL-U@xA=E85|$w!C_S}rt1c{%C^Xt`UbFLF3!@y zG`6i+wCGrLvx#xX0PqHKuqI{X%7;Gg6BrksG^^r}3~$_^Nz==H?HguqY_;9Fo-_C7 zS@zXLZ1i|RgpwzTKu4`mI!P*AbT1L{FMo`|Ba7T?kOk&VCE%D}iQ3V=d%eZ2r;<1= z1Z9_J2;U>UbLPBXA9z1RQa^6DN7dVO`7p)pYK=!L#1jx#$iO7$=P!>DY@kE|6)dTi z1F;|R_my#%eY`IF9Z~YVtrH*o-(P!paZFuJX#?3}&ubiT%TxTBjVu? zaH|jTOHy{JIVBr|J~O(VrL-6P-v*sO+b?7996+A(plw94b~Rb# zetTD{UE^X+Q_jDR${|>m!6MJ)QRA=QA!{oM)mtFH9o@$cRJ2awLWvkp&~yIbYd5fx zEn}nLEn8!L`w)~Qb^vXgi>CQ3HZEOpaFDaf0&JUky5)v6h}zzITItG9geOORqpSZR zx+SwMN)8#M=@i1_QU&Om5Dh#FYl4A6)svABRm&RhthyQJkXgu9SiMlq5H`8?hm& zU(3l0JF5NhfyGL2E~&GhF8|sMU5CQnU^CIZkj9})brQ6~8!#A1dX6vPoffx@!$T@0Hdw-$VGT62;~95GanQkdSdQ&! zQREmT@)QvUibH3Yf7L^LQ{mjjukYdKwV1B+*8J`d>@;>j2J>ovXi@G}m#74n(HQ#N zpq%T|39*a2f0mtUK*mnp+p3;H#XtOa+VFIp)}ywwj|T+LpL%hLp!(1<31)kpC|=uT zn{m;l33SS?vG`IO*RyFe+wL9IQ((#jN!f~=dQ5pd97h73N;|m->L!vwHy_WD9`n|A zkY=g_WM_$-P9$qM{)~7d>ONV>U0-C;+3=+bXzC3(RnMv9lW9`D z9ZbkrNnaVsQeMZB%e~m18jUT-2_gWiqhumqf7k9MUEH3t;Ms9x7CH=@{M_@AOh=!* z_O9v;K1%96Isz1KSJyMS9-&Qr4{I$y?VJyKClC@_?%M9hk~{>JShj^;o8qQAqD57_8sQ_Xva!?#p&sBp$tXq-v@?oqBN$ znOcL@w=q9W2fkK;rlY((4i_X*+rNnnKyN?C_2%B4yDY|AGQCR1CQZqla?+33Xaj}y za`IOFxXGGZe5K#{DPt|hE0F-Ai^{fnfZY&5H)~q!EKMtJj#j!dHg~`zC)|^Y?xQUX zqfGRM&dz zc_24s3fi}>-h@j{XWNCF^-u2|cpUH$tGeB!LyrRfes)1E7? zFI1K$k?81v*j{JOw zT6ov;wlk1Zp(>%?<`>zBa1ZZ1K7ec0XEh@G+CZ$Qz3%0-@_2yR%}={*DZFi|{hjoZ zmlWGHvKlGn+0h~xFg{vv-8%auU^ub^1GjE23^ky>Yc&>`3xw~Y-!E4F3j-I9=29DkUJMJb7Q>#akJ zxqUEe%?>{A>g+;u$DGj`AzSy3&e~jDvt@Hp-OJx^y9QN@)UG8Z3Y6_yHrU*5Nr(Lv zv&8e^Xp64%~v~aCZreO{O^rjbO zg$-#U?Rr0M#jK|g`6+~pNZG`aM*_hO-~JZ$DzSY|tM}%LF{Uec{N4`U#D;EVIZ$ju z7klp`eJR}Hnrs0mRd6X(xQq2J;c}?cDQygG+T!MX2CPb;~10_h|)YZDI@?5MUT zAeml8fhnH}N>qK2;X~|+&AqIM85iGf-P@J3#_H3^&RN&-w${KeX;4YwMiL!!x)tnN z{@wr}8nv~+NO-+sGSBS}A6;5qMBp1p zeLA~B!OJs7f7q7H-h5b^-@A$`JM)uuZS*MyEoZ~tGiiKrOC~VU2f70i{(FJFO#g~F|Y17`WOgEj4 zfg*3;L)7IdhvLcG552(=KYSDZ20p2?ww6oC4jCn!HVrX;zP*&9!arw|FjDrh8EvR~59}MQG*HhR+1Lc)=VD*FqR;vmxJ3 zMo-jk|L&@#jQkfSAT-kZ*69c@&gR5RcmB#tT%vA^T)XetFS!kj3*1Ip~18?gRBx-?P{u zlOf0rHsd`f9sMGJ-IyS za*FJ5Ni)A&6bYGn7xN@)^z9nw79KnHX914P>8Cvcbpm-vtAGKYTST1keS*N^`Rh_^ z=fux3wwNuELgslmY3F!dYU2aKl#rM2uBO3C>@KeKTDj_|g*3sbxI%%-m;}E9;6mD! z-YuyU)RDJD9`}gI6@31^`zerTqM#1Xy1Z(a5|>bvDcDSjm2zx|NALr51au}jU`0T>v1TAlRV+->b( z)#RILh>Y}#!^ot>{<^-Ne=KT*TN zbfI5=&fn{tWi1;e?7&azthw&k*u43nApiNhy)^FTYocb2YOjEYsZ7U|vB2KW9Xrgi zi(YyWJ!C=PZcSQ|49xVA`DDdOjYj4astQLTdRkhsQfA+8r7T2))d6IFlX^bH*mR# zZ=kn=fmvlB%>U034yGjLzf(#dke!GT{vGB_S7XEdJ4%3$Apg%PrZyN)+{|h%se-n@ OCuAfQBr3!V0{$1(pRn!# literal 0 HcmV?d00001 diff --git a/node_operations.asciidoc b/node_operations.asciidoc index a24b4c4..8c05303 100644 --- a/node_operations.asciidoc +++ b/node_operations.asciidoc @@ -347,6 +347,74 @@ bitcoin-rpcpassword=PASSWORD In general, it is a good idea to minimize the amount of customization of these systems. The default configuration is carefully designed to support the most common deployments. If you modify a default value, it may cause problems later on, or reduce the performance of your node. So, modify only when necessary! +==== Network configuration + +Network configuration is normally not an issue when configuring a new application. However, peer-to-peer networks like Bitcoin and the Lightning network present some unique challenges for network configuration. + +In a centralized service, your computer connects to the "big servers" of some corporation, and not vice-versa. Your home Internet connection is actually configured on the assumption that you are simply a consumer of services provided by others. But in a peer-to-peer system, every peer both consumes from and provides services to other nodes. If you're running a Bitcoin or Lightning node at your home, you are providing a service to other computers on the internet. Your internet service is not configured to allow you to run servers and may need some additional configuration to work. + +If you want to run a Bitcoin or Lightning node, you need to make it possible for other nodes on the internet to connect to you. That means enabling incoming TCP connections to the Bitcoin port (port 8333 by default), or Lightning port (port 9735 by default). While you can run a Bitcoin node without incoming connectivity, you can't do that with a Lightning node - it needs to be accessible from outside your network. + +By default, your home internet router does not expect incoming connections from the outside, and in fact incoming connections are blocked. Your internet router IP address is the only externally accessible IP address, and all the computers you run inside your home network use that single IP address. This is achieved by a mechanism called _Network Address Translation (NAT)_ which allows your internet router to act as an intermediary for all outbound connections. If you want to allow an inbound connection you have to set up _Port Forwarding_, which tells your internet router that incoming connections on specific ports should be forwarded to specific computers inside the network. You can do this manually by changing your internet router configuration, or through an automatic port forwarding mechanism called called Universal Plug and Play (UPNP) if your router supports it. + +An alternative mechanism to port forwarding s is to enable The Onion Router (TOR), which provides a kind of virtual private network overlay that allows incoming connections to an _onion address_. If you run TOR, you don't need to do port forwarding. + +Let's look at different ways you can make it possible for others to connect to your node. We'll look at these mechanisms in order from easiest to most difficult. + +===== It just works! + +There's a possibility that your internet service provider is configured to support UPNP by default and everything just works automatically. Let's try this approach first, just in case we are lucky. + +Assuming you already have a Bitcoin or Lightning node running, we will try and see if they are accessible from the outside. + +[NOTE] +==== +For this test to work, you have to have either a Bitcoin or Lightning node (or both) up and running on your home network. If your router supports UPNP, the node services will automatically use it to forward incoming connections to the corresponding ports on the computer running the node. +==== + +You can use some very popular and useful websites to find out what is your external IP address and whether it allows and forwards incoming connections to a known port. Here are two that are reliable: + +https://canyouseeme.org/ + +https://www.whatismyip.com/port-scanner/ + +By default, these services only allow you to check incoming connections to the IP address from which you are connecting - this prevents you from using the service to scan other people's networks and computers. You will see your router's external IP address and a field for entering a port number. If you haven't changed the default ports on your node configuration, try port 8333 (Bitcoin) and/or 9735 (Lightning). + +[[ln_port_check]] +. Checking for incoming port 9735 +image::images/ln_port_check.png[] + +In <> you can see the result of checking port 9735 on a server running Lightning, using the +whatismyip.org+ port scanner tool. It shows that the server is accepting incoming connections to the Lightning port. If you see a result like this, you are all set! + +===== Automatic port forwarding using UPNP + +Sometimes, even if your internet router supports UPNP, it may be turned off by default. In that case you need to change your internet router configuration from its web administration interface: + +. Connect to your internet router's configuration website. Usually this can be done by connecting to the _gateway address_ of your home network using a web browser. You can find the gateway address by looking at the IP configuration of any computer on your home network. It is often the first address in one of the non-routable networks, like 192.168.0.1, or 10.0.0.1. + +. Find the administrator username and password for the web configuration panel of the router. This is often written on a sticker on the router itself and may be as simple as "admin" and "password". A quick web search for your ISP and router model can also help you find this information + +. Find a setting for UPNP and turn it on. + +Restart your Bitcoin and/or Lighting node and repeat the open port test with one of the websites we used in the previous section. + +===== Using TOR for incoming connections + +===== Manual port forwarding + +This is the most complex process and requires quite a bit of technical skill. The details depend on the type of internet router you have, your service provider settings and policies and a lot of other context. Try UPNP or TOR first, before you try this much more difficult mechanism. + +But the basic steps are as follows: + +. Find the IP address of the computer your node is on. This is usually dynamically allocated by the Dynamic Host Configuration Protocol (DHCP) and is often somewhere in the 192.168.0.X or 10.0.0.X range. + +. Find the Media Access Control (MAC) address of your node's network interface. This can be found in the internet settings of that computer. + +. Assign a static IP address for your node so that it is always the same one. You can use the IP address it currently has. On your internet router, look for "Static Leases" under the DHCP configuraiton. Map the MAC address to the specific IP address you want. Now your node will always have that IP address allocated to it. + +. Finally, set up "Port Forwarding" on your internet router. + + === Security of your node A Lightning node is, by definition, a hot-wallet. That means that the funds (both on-chain and off-chain) controlled by a Lightning node are directly controlled by keys that are loaded in the node's memory. If a Lightning node is compromised, it is trivial to create on-chain or off-chain transactions to drain its funds. It is therefore critically important that you protect it from unauthorized access.