From ea02662485f2646c7d390b0cfb1fb5c11a60919c Mon Sep 17 00:00:00 2001 From: Stavros Kois <47820033+stavros-k@users.noreply.github.com> Date: Sun, 13 Feb 2022 14:08:40 +0200 Subject: [PATCH] feat(linkace): Add linkace (#1886) * feat(linkace): Add linkace * use correct secrets * add hardcoded values * whoops * typo * add init container * render secrets earlier? * debug * tryout * whats going on * try moving nginx conf * fastcgi filename changed? * localhost * perms * try with rofs * Create env file on the correct dir * fix paths and update questions * actually use app_key * Add conditional cron * update gui * whoops * update image --- charts/incubator/linkace/Chart.yaml | 35 ++ charts/incubator/linkace/questions.yaml | 535 ++++++++++++++++++ .../incubator/linkace/templates/_cronjob.tpl | 53 ++ .../incubator/linkace/templates/_secrets.tpl | 20 + .../incubator/linkace/templates/common.yaml | 23 + .../linkace/templates/configmap.yaml | 65 +++ charts/incubator/linkace/values.yaml | 127 +++++ docs/_static/img/appicons/linkace-icon.png | Bin 0 -> 8734 bytes docs/apps/app-requests.md | 2 +- docs/manual/default-ports.md | 1 + 10 files changed, 860 insertions(+), 1 deletion(-) create mode 100644 charts/incubator/linkace/Chart.yaml create mode 100644 charts/incubator/linkace/questions.yaml create mode 100644 charts/incubator/linkace/templates/_cronjob.tpl create mode 100644 charts/incubator/linkace/templates/_secrets.tpl create mode 100644 charts/incubator/linkace/templates/common.yaml create mode 100644 charts/incubator/linkace/templates/configmap.yaml create mode 100644 charts/incubator/linkace/values.yaml create mode 100644 docs/_static/img/appicons/linkace-icon.png diff --git a/charts/incubator/linkace/Chart.yaml b/charts/incubator/linkace/Chart.yaml new file mode 100644 index 00000000000..682d099a2a8 --- /dev/null +++ b/charts/incubator/linkace/Chart.yaml @@ -0,0 +1,35 @@ +apiVersion: v2 +appVersion: "v1.9.1" +dependencies: +- name: common + repository: https://truecharts.org + version: 8.15.2 +- condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.68 +- condition: redis.enabled + name: redis + repository: https://truecharts.org + version: 1.0.71 +description: Your self-hosted bookmark archive. Free and open source. +home: https://github.com/truecharts/apps/tree/master/charts/stable/linkace +icon: https://truecharts.org/_static/img/appicons/linkace-icon.png +keywords: +- linkace +kubeVersion: '>=1.16.0-0' +maintainers: +- email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org +name: linkace +sources: +- https://www.linkace.org/docs/ +- https://github.com/linkace/linkace +- https://hub.docker.com/r/linkace/linkace +version: 0.0.1 +annotations: + truecharts.org/catagories: | + - media + truecharts.org/SCALE-support: "true" + truecharts.org/grade: U diff --git a/charts/incubator/linkace/questions.yaml b/charts/incubator/linkace/questions.yaml new file mode 100644 index 00000000000..1dcb3cb55a9 --- /dev/null +++ b/charts/incubator/linkace/questions.yaml @@ -0,0 +1,535 @@ +# Include{groups} +portals: + web_portal: + protocols: + - "$kubernetes-resource_configmap_portal_protocol" + host: + - "$kubernetes-resource_configmap_portal_host" + ports: + - "$kubernetes-resource_configmap_portal_port" +questions: + - variable: portal + group: "Container Image" + label: "Configure Portal Button" + schema: + type: dict + hidden: true + attrs: + - variable: enabled + label: "Enable" + description: "enable the portal button" + schema: + hidden: true + editable: false + type: boolean + default: true +# Include{global} + - variable: controller + group: "Controller" + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: advanced + label: "Show Advanced Controller Settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: type + description: "Please specify type of workload to deploy" + label: "(Advanced) Controller Type" + schema: + type: string + default: "deployment" + required: true + enum: + - value: "deployment" + description: "Deployment" + - value: "statefulset" + description: "Statefulset" + - value: "daemonset" + description: "Daemonset" + - variable: replicas + description: "Number of desired pod replicas" + label: "Desired Replicas" + schema: + type: int + default: 1 + required: true + - variable: strategy + description: "Please specify type of workload to deploy" + label: "(Advanced) Update Strategy" + schema: + type: string + default: "Recreate" + required: true + enum: + - value: "Recreate" + description: "Recreate: Kill existing pods before creating new ones" + - value: "RollingUpdate" + description: "RollingUpdate: Create new pods and then kill old ones" + - value: "OnDelete" + description: "(Legacy) OnDelete: ignore .spec.template changes" +# Include{controllerExpert} + # Docker specific env + - variable: env + group: "Container Configuration" + label: "Image Environment" + schema: + additional_attrs: true + type: dict + attrs: +# Include{fixedEnv} + - variable: APP_URL + label: "APP_URL" + description: "Application URL eg. https://linkace.mydomain.com" + schema: + type: string + default: "http://localhost" + - variable: APP_DEBUG + label: "APP_DEBUG" + description: "Enables the debug info" + schema: + type: boolean + default: false + - variable: BACKUP_ENABLED + label: "BACKUP_ENABLED" + description: "Enables backups" + schema: + type: boolean + default: false + - variable: BACKUP_DISK + label: "BACKUP_DISK" + description: "Backup destination" + schema: + type: string + default: "local" + enum: + - value: "local" + description: "local" + - value: "s3" + description: "s3" + - variable: BACKUP_MAX_SIZE + label: "BACKUP_MAX_SIZE" + description: "Max size of backup in MB" + schema: + type: int + default: 512 + - variable: secret + group: "Container Configuration" + label: "Secret Image Environment" + schema: + additional_attrs: true + type: dict + attrs: + - variable: CRON_TOKEN + label: "CRON_TOKEN (Generate this inside the app)" + description: "Generate token inside the app and come back later to fill this." + schema: + type: string + default: "" + - variable: AWS_ACCESS_KEY_ID + label: "AWS_ACCESS_KEY_ID" + description: "AWS Access Key ID" + schema: + type: string + default: "" + - variable: AWS_SECRET_ACCESS_KEY + label: "AWS_SECRET_ACCESS_KEY" + description: "AWS Secret Access Key" + schema: + type: string + default: "" + - variable: AWS_DEFAULT_REGION + label: "AWS_DEFAULT_REGION" + description: "AWS Default Region" + schema: + type: string + default: "" + - variable: AWS_BUCKET + label: "AWS_BUCKET" + description: "AWS Bucket" + schema: + type: string + default: "" + - variable: MAIL_FROM_ADDRESS + label: "MAIL_FROM_ADDRESS" + description: "Mail from Address" + schema: + type: string + default: "" + - variable: MAIL_FROM_NAME + label: "MAIL_FROM_NAME" + description: "Mail from Name" + schema: + type: string + default: "" + - variable: MAIL_DRIVER + label: "MAIL_DRIVER" + description: "Mail Driver" + schema: + type: string + default: "smtp" + enum: + - value: "smtp" + description: "smtp" + - value: "mailgun" + description: "mailgun" + - value: "sendmail" + description: "sendmail" + - value: "ses" + description: "ses" + - value: "postmark" + description: "postmark" + - value: "log" + description: "log" + - value: "array" + description: "array" + - variable: MAIL_HOST + label: "MAIL_HOST" + description: "Mail Host" + schema: + type: string + default: "" + - variable: MAIL_PORT + label: "MAIL_PORT" + description: "Mail Port" + schema: + type: int + - variable: MAIL_USERNAME + label: "MAIL_USERNAME" + description: "Mail Username" + schema: + type: string + default: "" + - variable: MAIL_PASSWORD + label: "MAIL_PASSWORD" + description: "Mail Password" + schema: + type: string + default: "" + - variable: MAIL_ENCRYPTION + label: "MAIL_ENCRYPTION" + description: "Mail Encryption" + schema: + type: string + default: "tls" + +# Include{containerConfig} + + - variable: service + group: "Networking and Services" + label: "Configure Service(s)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Service" + description: "The Primary service on which the healthcheck runs, often the webUI" + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: main + label: "Main Service Port Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 10160 + required: true + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: protocol + label: "Port Type" + schema: + type: string + default: "HTTP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 80 + + - variable: serviceexpert + group: "Networking and Services" + label: "Show Expert Config" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hostNetwork + group: "Networking and Services" + label: "Host-Networking (Complicated)" + schema: + type: boolean + default: false + +# Include{serviceExpert} + +# Include{serviceList} + + - variable: persistence + label: "Integrated Persistent Storage" + description: "Integrated Persistent Storage" + group: "Storage and Persistence" + schema: + additional_attrs: true + type: dict + attrs: + - variable: app + label: "App Storage" + description: "Stores the Application." + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: "Type of Storage" + description: "Sets the persistence type, Anything other than PVC could break rollback!" + schema: + type: string + default: "simplePVC" + enum: + - value: "simplePVC" + description: "PVC (simple)" + - value: "simpleHP" + description: "HostPath (simple)" + - value: "emptyDir" + description: "emptyDir" + - value: "pvc" + description: "pvc" + - value: "hostPath" + description: "hostPath" +# Include{persistenceBasic} + - variable: hostPath + label: "hostPath" + description: "Path inside the container the storage is mounted" + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: "EmptyDir Medium" + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: "Default" + - value: "Memory" + description: "Memory" +# Include{persistenceAdvanced} + - variable: logs + label: "App Log Storage" + description: "Stores the Application Logs." + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: "Type of Storage" + description: "Sets the persistence type, Anything other than PVC could break rollback!" + schema: + type: string + default: "simplePVC" + enum: + - value: "simplePVC" + description: "PVC (simple)" + - value: "simpleHP" + description: "HostPath (simple)" + - value: "emptyDir" + description: "emptyDir" + - value: "pvc" + description: "pvc" + - value: "hostPath" + description: "hostPath" +# Include{persistenceBasic} + - variable: hostPath + label: "hostPath" + description: "Path inside the container the storage is mounted" + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: "EmptyDir Medium" + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: "Default" + - value: "Memory" + description: "Memory" +# Include{persistenceAdvanced} + - variable: backups + label: "App Backup Storage" + description: "Stores the Application Backup." + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: "Type of Storage" + description: "Sets the persistence type, Anything other than PVC could break rollback!" + schema: + type: string + default: "simplePVC" + enum: + - value: "simplePVC" + description: "PVC (simple)" + - value: "simpleHP" + description: "HostPath (simple)" + - value: "emptyDir" + description: "emptyDir" + - value: "pvc" + description: "pvc" + - value: "hostPath" + description: "hostPath" +# Include{persistenceBasic} + - variable: hostPath + label: "hostPath" + description: "Path inside the container the storage is mounted" + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: "EmptyDir Medium" + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: "Default" + - value: "Memory" + description: "Memory" +# Include{persistenceAdvanced} + +# Include{persistenceList} + + - variable: ingress + label: "" + group: "Ingress" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Ingress" + schema: + additional_attrs: true + type: dict + attrs: +# Include{ingressDefault} + +# Include{ingressTLS} + +# Include{ingressTraefik} + +# Include{ingressExpert} + +# Include{ingressList} + + - variable: advancedSecurity + label: "Show Advanced Security Settings" + group: "Security and Permissions" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: securityContext + label: "Security Context" + schema: + additional_attrs: true + type: dict + attrs: + - variable: privileged + label: "Privileged mode" + schema: + type: boolean + default: false + - variable: readOnlyRootFilesystem + label: "ReadOnly Root Filesystem" + schema: + type: boolean + default: true + - variable: allowPrivilegeEscalation + label: "Allow Privilege Escalation" + schema: + type: boolean + default: false + - variable: runAsNonRoot + label: "runAsNonRoot" + schema: + type: boolean + default: false +# Include{securityContextAdvanced} + + - variable: podSecurityContext + group: "Security and Permissions" + label: "Pod Security Context" + schema: + additional_attrs: true + type: dict + attrs: + - variable: runAsUser + label: "runAsUser" + description: "The UserID of the user running the application" + schema: + type: int + default: 0 + - variable: runAsGroup + label: "runAsGroup" + description: The groupID this App of the user running the application" + schema: + type: int + default: 0 + - variable: fsGroup + label: "fsGroup" + description: "The group that should own ALL storage." + schema: + type: int + default: 568 +# Include{podSecurityContextAdvanced} + +# Include{resources} + +# Include{advanced} + +# Include{addons} diff --git a/charts/incubator/linkace/templates/_cronjob.tpl b/charts/incubator/linkace/templates/_cronjob.tpl new file mode 100644 index 00000000000..0baac48a52a --- /dev/null +++ b/charts/incubator/linkace/templates/_cronjob.tpl @@ -0,0 +1,53 @@ +{{/* Define the cronjob */}} +{{- define "linkace.cronjob" -}} +{{- if .Values.secret.CRON_TOKEN }} +{{- $jobName := include "common.names.fullname" . }} + +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: {{ printf "%s-cronjob" $jobName }} + labels: + {{- include "common.labels" . | nindent 4 }} +spec: + schedule: "{{ .Values.cronjob.schedule }}" + concurrencyPolicy: Forbid + {{- with .Values.cronjob.failedJobsHistoryLimit }} + failedJobsHistoryLimit: {{ . }} + {{- end }} + {{- with .Values.cronjob.successfulJobsHistoryLimit }} + successfulJobsHistoryLimit: {{ . }} + {{- end }} + jobTemplate: + metadata: + spec: + template: + metadata: + spec: + securityContext: + runAsUser: 568 + runAsGroup: 568 + restartPolicy: Never + containers: + - name: {{ .Chart.Name }} + securityContext: + privileged: false + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + runAsNonRoot: true + capabilities: + drop: + - ALL + env: + - name: CRON_TOKEN + value: {{ .Values.secret.CRON_TOKEN }} + image: "{{ .Values.alpineImage.repository }}:{{ .Values.alpineImage.tag }}" + args: + - curl + - "http://{{ $jobName }}.ix-{{ .Release.Name }}.svc.cluster.local:{{ .Values.service.main.ports.main.port }}/cron/$(CRON_TOKEN)" + resources: +{{ toYaml .Values.resources | indent 16 }} + +{{- end -}} +{{- end }} diff --git a/charts/incubator/linkace/templates/_secrets.tpl b/charts/incubator/linkace/templates/_secrets.tpl new file mode 100644 index 00000000000..af4b65b924b --- /dev/null +++ b/charts/incubator/linkace/templates/_secrets.tpl @@ -0,0 +1,20 @@ +{{/* Define the secrets */}} +{{- define "linkace.secrets" -}} +--- + +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: linkace-secrets +{{- $linkaceprevious := lookup "v1" "Secret" .Release.Namespace "linkace-secrets" }} +{{- $app_key := "" }} +data: + {{- if $linkaceprevious}} + APP_KEY: {{ index $linkaceprevious.data "APP_KEY" }} + {{- else }} + {{- $app_key := randAlphaNum 32 }} + APP_KEY: {{ $app_key | b64enc | quote }} + {{- end }} + +{{- end -}} diff --git a/charts/incubator/linkace/templates/common.yaml b/charts/incubator/linkace/templates/common.yaml new file mode 100644 index 00000000000..bc265dfb097 --- /dev/null +++ b/charts/incubator/linkace/templates/common.yaml @@ -0,0 +1,23 @@ +{{/* Make sure all variables are set properly */}} +{{ include "common.setup" . }} + +{{/* Append the general configMap volume to the volumes */}} +{{- define "linkace.harcodedValues" -}} +persistence: + linkace-config: + enabled: "true" + mountPath: "/etc/nginx/conf.d/linkace.conf" + subPath: "nginx-config" + type: "custom" + volumeSpec: + configMap: + name: {{ printf "%v-config" (include "common.names.fullname" .) }} +{{- end -}} +{{- $_ := mergeOverwrite .Values (include "linkace.harcodedValues" . | fromYaml) -}} + +{{- include "linkace.cronjob" . }} + +{{- include "linkace.secrets" . }} + +{{/* Render the templates */}} +{{ include "common.postSetup" . }} diff --git a/charts/incubator/linkace/templates/configmap.yaml b/charts/incubator/linkace/templates/configmap.yaml new file mode 100644 index 00000000000..7a84cf9ab31 --- /dev/null +++ b/charts/incubator/linkace/templates/configmap.yaml @@ -0,0 +1,65 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.names.fullname" . }}-config + labels: + {{- include "common.labels" . | nindent 4 }} +data: + nginx-config: |- + server { + root /app/public; + server_name _; + index index.php; + charset utf-8; + client_max_body_size 20M; + port_in_redirect off; + + # Choose the connection method + listen 0.0.0.0:8080; + + # Content security headers for Laravel + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Content-Type-Options "nosniff"; + + # Gzip + gzip on; + gzip_vary on; + gzip_comp_level 8; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private auth; + gzip_types application/javascript application/x-javascript application/xhtml+xml font/woff font/woff2 image/svg+xml image/x-icon text/css text/javascript text/plain text/xml; + + # Location configs + location / { + try_files $uri $uri/ /index.php?$query_string; + } + + # Assets and media files + location ~* \.(?:css|js|map|scss|jpg|jpeg|png|gif|mp4|woff|woff2|ico|svg|webmanifest)$ { + expires max; + access_log off; + add_header Cache-Control "public"; + try_files $uri =404; + } + + location = /favicon.ico { access_log off; log_not_found off; } + location = /robots.txt { access_log off; log_not_found off; } + + # Error pages + error_page 404 /index.php; + error_page 403 /index.php; + + # PHP handling + location ~ \.php$ { + fastcgi_pass localhost:9000; + + try_files $uri /index.php; + include fastcgi_params; + fastcgi_keep_conn on; + fastcgi_intercept_errors on; + fastcgi_index index.php; + fastcgi_read_timeout 300; + } + } diff --git a/charts/incubator/linkace/values.yaml b/charts/incubator/linkace/values.yaml new file mode 100644 index 00000000000..ffe6c9420a2 --- /dev/null +++ b/charts/incubator/linkace/values.yaml @@ -0,0 +1,127 @@ +image: + repository: tccr.io/truecharts/linkace + tag: v1.9.1@sha256:d56fa76113e3e5ab0889a13bdfb463d12b71b3e2ec839a8ff6fa99ec036be862 + pullPolicy: IfNotPresent + +nginxImage: + repository: tccr.io/truecharts/nginx + tag: v1.21.6@sha256:80d87a1d4d67749d2caaa64ee061a66a946b81942ac56f4780e36f8356cee371 + +securityContext: + runAsNonRoot: false + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + +env: + # Internal Envs + DB_CONNECTION: "mysql" + DB_PORT: "3306" + DB_DATABASE: "{{ .Values.mariadb.mariadbDatabase }}" + DB_USERNAME: "{{ .Values.mariadb.mariadbUsername }}" + REDIS_PORT: "6379" + CACHE_DRIVER: "redis" + SESSION_DRIVER: "redis" + APP_NAME: "LinkAce" + APP_ENV: "production" + APP_TIMEZONE: "{{ .Values.env.TZ }}" + # User Envs + TZ: UTC + APP_URL: "http://localhost" + APP_DEBUG: false + BACKUP_ENABLED: false + BACKUP_DISK: s3 + BACKUP_NOTIFICATION_EMAIL: your@email.com + BACKUP_MAX_SIZE: 512 + +envValueFrom: + DB_HOST: + secretKeyRef: + name: mariadbcreds + key: plainhost + DB_PASSWORD: + secretKeyRef: + name: mariadbcreds + key: mariadb-password + REDIS_HOST: + secretKeyRef: + name: rediscreds + key: plainhost + REDIS_PASSWORD: + secretKeyRef: + name: rediscreds + key: redis-password + APP_KEY: + secretKeyRef: + name: linkace-secrets + key: APP_KEY + +additionalContainers: + nginx: + name: nginx + image: "{{ .Values.nginxImage.repository }}:{{ .Values.nginxImage.tag }}" + ports: + - containerPort: 80 + name: main + volumeMounts: + - name: linkace-config + mountPath: "/etc/nginx/conf.d/linkace.conf" + subPath: nginx-config + readOnly: true + - name: app + mountPath: "/app" + +initContainers: +# App checks ".env" for "SETUP_COMPELTED" status, to determine if it needs to run initial setup or not. +# We create this file and set it to false if it doesn't exists. +# If it exists, we let the app decide it's value (true|false) and how to proceed. + 1-create-env-file: + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + volumeMounts: + - name: app + mountPath: "/app" + command: ["/bin/sh", "-c"] + args: + - > + if [ ! -f "/app/.env" ]; + then + echo "Preparing for initial installation"; + echo "SETUP_COMPLETED=false" > /app/.env; + else + echo "Initial installation has already completed."; + fi; + +cronjob: + schedule: "* * * * *" + annotations: {} + failedJobsHistoryLimit: 5 + successfulJobsHistoryLimit: 2 + +service: + main: + ports: + main: + port: 10160 + targetPort: 80 + +persistence: + app: + enabled: true + mountPath: "/app" + logs: + enabled: true + mountPath: "/app/storage/logs" + backups: + enabled: true + mountPath: "/app/storage/app/backups" + +mariadb: + enabled: true + mariadbUsername: linkace + mariadbDatabase: linkace + existingSecret: "mariadbcreds" + +redis: + enabled: true + existingSecret: "rediscreds" diff --git a/docs/_static/img/appicons/linkace-icon.png b/docs/_static/img/appicons/linkace-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..a6647a66a36e11fc4eab78dd4ed8e203e2429eea GIT binary patch literal 8734 zcmds7S5#A7w>_bRl2D@bP7pzQuOb~(L}{T(2kE^NK!ON{E~0>dNa%##q&GiG=uxC7 zMLxPzL3+LMzfbq!KHo9!$;dd#KG}P%%(d3ubI)^P^&V?eQL<1106_KNzJ>t+fT;hz z$-#t{;F{Ay!imI5RaX@NYLX!rwxopbT=w@3bO8W)8vsx*0pN_#gjxrH05JgAumJ#t z3;09qyNKu=s%}%jUc;7dAB>VEIg?en0#ckn zmu{BftG$PUML*1Uuf6*ga-aK!UEQwJY&`}Y{G)f8p+-aO&4u~^k^*pCXHK;wxvX7f zKn@*_hxUT0E17~OR4 zD(?mMMYpQr@BkU7zFQTUcW|`rQ{cjggk7L^9*0wAoVnLI=O$k3SzQ**!4r2onj?PD ziTg=B&P=R{$9?FX>tzTPDU|vLchV+j1(p=ptrFX!K$lCscp4u)`)A_fD$%pw6cU<^ z9R+#c8gx_5yUPccR2K~jtx&GRpt@COMtm-l4`cec#nolv7Xnq%wxm2i+cyd;7LJL~ z*9v#fy9N|tTY%er&~svqj;|{#9VSc3o_Kq2e4vlTb$&Z$FEWE$RMnwWoS$ySx9X_> zp04i?3-*;$&74ID zM=zayG@96?jX3pxS~MyZROyOr?mYG=5o?$Su~=lcMHC=rVovbE#u}?k_x0lO017`e zCkPioS@%Qbn~lCoCS`>{BCZ;5D$6|_9ysSTF7p8HF-b0q!X-MN_u#x3+KVzf+F6jz zoUyntAR=yh7MKWoa=aQ*wsMc!5la2A$0v#hsm`;LzAX>@k%Tu^w0fR%))|jyeArMR z^`#hu41W5gZ1c44H0c&(!dZ|2`0f5f8k2@HAdKG;=SM3qX{fw7NfrGg$K|3~ch*c|m^~U+%4S*3 zVQC;QC-0Gw&BITH_6`-te$|8`5-R?FZR6z}Cg+Izso|j7=g?7Ot2vIcOkqaqcEVIa zD-&g2g&QU2^PBf$yH!(eOP{~G<4=#uw~M(e3U^{1n61ZnY@nzTBWM?>0e#Wd?MmY( z<%d^PGEnL>#>al=WPl~b0*|sF-kA4>V$F8iv|Ns_Blk}5j{mdv}|UZm#mMN*hm0^jbqgSUR3hmA9Jn6 ziEnFq{m6w-0qgErlRPg%^+o(I7_f5XHSgRM-q?B5-frIBMf5%dt~n%^d12Y2ef5kp zU?=Ab&Ue}%jdwT0l7-)$VKeq$|Fgifn(cV4#Q&c^x2Ja}8HY;Im4Yf$^&-|>xlHh)^)PT#N z(hW-CAmjM`IDk>TN07m{RE=j7+$yj|fj#mEw4Iw@T7MfeZEQFrLXojebuxo(r=K7` z11cKxdY9<}FnoawuH;YAgu&JWpGl4fjybDy#!i?=g8 z?q#CxN~m@qy9k?VTQlkt#fzCb(2EG8hGF!t6yDPB-B=v?VoOMvAhkoJ3SU3;&a0S| zcfD%ks|9}^4>nE-ZZRUHf!CU6j$iF_PqML=OH$__M{{5Y{bLSBq6~s79QAL3D0?RF z{VPQyA9mCeLTXTT-GG_tyASbFCk}*ks?yczRqi(bq~2LQr$0kTBhO+by>{z5FNz!H z;WsQv+Y8{(q?b%=>a(|Gr#mm=EBJb#A(kj!A|X+RH?OoNEywk0GYaE+fxsVqzefNo z&2MhoUJc1us~VRfxBjDvwY`U9MGBhB_EVlER~1zqyLyCl`b?OMIgP3eHQk+oCJSiV ztFq!^^2A)L1}Sw6BUeY%4>v$Y#o?aDJxF&ck-R194{!mjbkyh{8QRn=fkO{_o$NHU z@@69f-Lf>6e|4PXsKdOHsP)ZcgIlqd)C(FKjorb-a1$1uDY}_V8Qu?#HHG;d4%<)_ zMi3LHbEnXuq&;CmT=P0n!lXe){XrfuqFf10oHp zlA~i*Y;d1A$+JJ*9SkiNkz-u9r8FE|)Gb#xq%c086S6ic8ie&Mp*CvYm_R$xDK3^} zevR5M!9cDluKins!m%{$R8*r;3kdG%dNfnH-DzIsRD2LR>C}ssHe& zQYkF`Nxzbegr8 zGW-!1gSARHDdsy?#j_xFlZ)qeM>mT-VYqF6<$&)$Fs|E8^?rSZWL>RrnY-M1%2o5n z%x8pTLlL4}x-o%8LlSl2z8>MX{Z3=vjo+w3$hqw324o>+BFqq?s_xD>nx2eFLOHvi zC#!IPey^daLe=aP$BN$sL|Gc`k!n~Jp>g4@Y-g2g*uC%=2)LhXt*JXlubmP<4!gYe zyGb&n`@yW%bK+YM#>c`U9g@Zdu=DKY zTYoy_jXc3modx*a`K{*`G~dp=uSX#r76?($Oik_iY4z1Y;0NDrud^n6J)i$-Ej zDNq45gqmKIQGR(}XMN>)!#`wsc_=LzKZ9QCD)>mt)pO$pdKIIk!ca-Ew$79rV{+iq z@|l{}Xc6KAWf&t%*I_`Pg@MqcP^DjOkLy0xOs)b#s$tG|fs{%7kW!}qeB5AsZD9QL zR~~TevC_l*8F4j)6TD?@+l|(2=9jcjX~@I7OH41>rhd-l)zhuG9hKmxiMk((zt@>; zEF`Cr#g(|;L=AzqSfsVMlw)#v4}6o2HiPNTJb`l!cO+=Krh%T}$cVHfVLeoN6Z*T| zmA&8lvt*KLpUYm5;Q}Rp5rETxeuuwCFgu6{e9{!{ihDCc#*9#;#}C0Sr#OMDVp%DU z%E>*4xh@qSc;1-jbKble%i@0swCVVsT2jlC{c?0UKeCx!A)mRDi7g7f6u5=uwE#`H zpdnPMS*1f3OpUIR5AClunHvHrQG%czf2q`uU4OCUz^;m$t?Rd^KYc0~i=!EDt2mz= z8&rNoKSd-b=D5T9D17eP=#Od4O+x5XM$TLLAEp!kc)5;WXF&7WF$7g+W}Z~lkJsKd ztlcNApk*OCwT9LE)BARotcnv>GQcRE>ufHi7?^GS@Ta45*7Tt=ouorMxp6>ch6Mi) z6KV};l4{q$d27kW4SruV1r<=H>7ZYOe=8?dE6lFt@#_zeMuZmmCV1kqyYc|RcwfG< zvlA<#?JmmLtgd%Gvz>7qj^zhVoQGfYarx@kybkTi?3bJslLI%o>r~g7TNK4zs~wDN zalo3n?U!HVO&vV^8j|ehBI~-nhG~I*5e)}*MG@7<5EymApWFXRou9ikpN#FHJ6uk6 z$UCeKIx;pA2=477oLO^ygoQqmdIzSbpPNZ1JIUF3Lv0>+*z+|Y@8nvmJ#tp@CPw{H zgfyq8j-HoZu#9`G_zS<%vY3ni7*D`i_u2)KT-qG294(@Kv3Vs*;qbs@FvyB+Dk9mu z{Dtv`7T=n*!|yp)jxq1v1*TjA>3xhX)G<07LenI&YI<9(uiQ|sb$7RP>q)x@nJ5Eo zu}f|-q6m&xVj=n2t4EE3)ofi4(4ljjO%nFr+Srh}g}L@)siZ{a{aSK{i3!{7mQTNA zMrP>}H|4;&?(-i@j7488LN(fnsNZsZ6@jnCL>Kj7#N~f_J}k@`2in1Vn7!BJ=IWv* z6MWQ3o4YfiPk1V|a9Olw0w@7~Y=^n@m+@C^VhVQ*#kY z#fIfiHwnU`06T)FqN*qMeQfHCyz{Fq_332hn?)l;JNQd{1+eh%ejNUnawQ>CMy@)r zNMTeeVS*+y19u}dtM2S&wI;E$ncf@k;e;jq4=AaxW}}r*yhn%$W4n&j0*_<6rIRzAScX#IN1Be4m-(cq9C# zsOBl2*09dG!F_8|hOyp=eNX?l)KU3;wILDN4ag1wN3Iq~CjG)~m>F#mMdJI$LC5j% zMH#iFDZtUcV)T*#&2rP#eESoRd+{guCSwwl0tnSLJ41^aroWfKRy0IPZ<>8E%lKre zGjWG`eyIf0HLXyK!y#!p3+=4u$P$fuyH<+&+++&TMp|t zeOkMQH72K8V2I2{2rXX`rfI{qIXJ8A;`j`CVn3-wzFWY~`NZ8KU*`n@BPf*xA6%!U zt!NpOa(rw!{cvu59)-JM?``QcV-%yMY~%e6HO`W7r&LKBu?BAuc&D~3V?X>JGxZkB zuiw(AAUid6 zlvivCvZT0Y)brRHIWcoZrSP9pb%sshq%cz5|coNH&s%F z8;d%g;lnGv;QrD4K-MhDpkJxmjQGaX2ymbzsbnpI!qR7?k1=-I0sE}BVCQF z#`mn^rTcW=-CJC~Ows#5yl@w=w~Gm%LceE6HY*op&KxF3yRxE!2zv;utkh2Fs`xX@ z2or<_^}2u0q*AXd5dV2%K>eSA^H9?=6XHEtQ_W>_m=J~8yD*i7!iSu=)k~PMIOLt0 z`Z5Q|k+Hp~`0L;BCx02l>}kXP+Gs5cd6YV9!w6|5DKR}hD5Eu_LpIZ4U|W^0>7aKx zgSY^AZGq|ij;p9M22li-p!e{6+Yl_>b*w&%&D_{3!qT(q#M(p;;0k-y3>S+f zz8y2MA(oe;zzu;hM0*(SY1DrH7e2$0?KAD;`SD=u;n&KsxUKfSr1Q}aCeO+yRpd9p zie*2B1SXW|Q>vaxtX|l~wG^lRVQb$q1l~*DYv!3VuNS!Or8sLMM9tM1i?y%LXrl5dZ#M=yARh)Q7^M?U-$A~8+1_y1 z@R0Ja&V)4weiMYIF*GjQQtaQSjlso6!cuIq(+?1$pn7H>4Cu54oo#sVCSA-wb0+9l zxWLWO@5J|26NIQCx}qkV!6hxhr3R#hZD)3>zm;Ia_t{xa7jW~e7$3}@6YRaL z>&55QO#PBu$i`VRX#qZh6-YBXTNOuw56PX(70;CW@dZ@J9!7J%>%U zuSh2TN-oZvqB=5a_^A?hxZ|Yh;CVTk-_h(j5MlIZ-yv_}t0u6IzLO?IWSx+0>8@jS z>~B!lc{5i>Z-BLir{se=ZKsoFoBHG{~mb2T!{nEmM415@d}rnmwvty7(pzqO#FM@ z*gE{N#weS#=Rw8K_SHWKNMbo_g2{xYUOoIQeTK+X5bVSV8Q9EGs8m)(h=OUSc#5=9 zfuK=Hdr^;*m{F*OZwGtrX_AuB_5|9h{j?4Je!L+nKs4v#`v*}@?~{Q}t<#t?qF_A| z#&1p=J8hw-j95mN)1y5~OA?#givs29lW`fOnDn-t(p0aHxp9z4N+ml~7y0O&${d30 z4o%BpiX{!j#3#-@MV=~^WRDQWo-t*`*90YoMzA_n#Y%TP@g7C7h3zE~A=sb}TPTA+ zL+00)eZdW;P@^r_O%?CQ;+n}!EOIACyu1YYxMFgibm2F8WV07nUoG}Kf|;$+p6y#s z6E(n>|DjW0-J{C&gz=QB=U*f}?!`AffHFu(fn~wklu4`!`n^uH;rY8Wc8?IO ztcL^Q%TYCxix$G2`Mz2L&ro(Ei|R{ReHo{{YWtL%1TzhIKSJSa4_DA;BMz8Y z)Ino%24C`lEtZ;p`QC^tR~^nHB<^q~+)*8iwBuMrHUo|ExHdcPkmy4#S*CpK8dryQ z0;zYI%IMa9QSk;$otQC-2Q!uvQWm+Wr;$_mpr*<72TIsU_WPlB{Kn_`AI0KSx!$b~ z4u6?8L6xEEGo6T5>BXNEk&i-6)(j5On8?KL6ue-S7fThsq;N$vb^&9)Yt2^7%QQzU z^eqm<9mJFoV*7Oe6O=&deyB0>+lBU+0zrU;^1**Qz!}BEjbNv;8AI!es@y`1;IF<; z-$;1T0Lew(wrlPCcLpxexGv4>IfP$7%SRlRQ~ogre%?q4u`C-WSnrPPPMIYKZt`?o zDUifk3-5}4zsS`8Q~)trVpRb(8TJfQKnQDx3ze2xZy3T7HO(R3WT>$kZPmgdE)^^$ z_vWUCa`X?PvO@FSS!FkODy`DAQ3K~NXY!pJDe|_MJ3gX}e4Ghi-;5eMNB0>t4KYc| z9{83bd+-aN7w$jSw~DWB0LNNQ>EC=jl$r9WzzJ)7v2v9ZS+KG4#)CpjEkML*Ox1to zXur*Fl@6l&pN{`5+`q3OON>Tthqgs;8Ejq>qXt4EZn?WWU%|g_wH@BFi?b3*eX5{k zUglTt>pUy0wMy4s1PbYVg^lk{c@20Gq0L`ax0ZC&O`fmSlkgyo)(|HvU{q*=jj;*$ zsc2)WwPK!8ZCx%>Bu}tW5Eame+agFA*vXH?hcsYqHO0iTP)!scTqaTbAglJW&nF62 ztw0lZf~RfP?im(94n#Ebtto1$ggOcwgaJ!=YrV+SfnfoLuYckG8|;dqA}r^i zMVIp4mizep>YgW739PN~gb0l!4ty!F|9#b_^Xf;+l4GSywXvf~TLPfK?dT}3In~sc zCVl7{x^FHorDpHo_@mE2%3n;*fV_Ryk=zqZi-_IyjvgIZozX7(AX~9DEX~u>s#BLs zub%I$;rPW-vJ8jp?3|mXP;RHKwOM>_21n-%vjSmEcxCpJFNP79=O4pbU6q~yTv=W}btbG{`qpGO zX;)g>6*LHHI!k>b3E*w8j$Ab83CeGMlHfwoUc~oiR7agL%3hJ}BE|5!+_)c*W4T67 z%7DB2zikZd-d%iat#n$a7!)jjM&UQHhzm&e$R zL?9`S*$#B~7F<@v`^n|B_*nVVqh=4Q4!Kil9!y~r{TVa=W3t~IJwKBT$S0Xonq9n1 z9iLthO1zP{CizVSKm7EsR^@2LLeTdV2}_2y`2;J#W?*Y7i|W^0zQ?~q_WKrzC>qB~ z%TLEcrvSr-mMzk%B!LdR-;RkDEVjLvNfd{~d;GE%@-x4nF#ozsd}7nHN~Y066;!~= zPGts767aUT=D{M_Q9L)GyP)52RJz{tYfb$QCvniqP_#J3Du7DoZn7d7`see}p~Xmx z>IbYP2Gu%I#2KFwW{Oj?h#yM@-vevElk@!j9MR5(A6TE+*kkC5g8Pzg4A1>L$X-^y zvwRt4Go5>Sai4kv((um1(hU{diuBlv^8VOThiZBs8-FMD#-wvDzB`s zhMP+T|0Z^S(XOpjHs{tZ*;oTENl-z#7SHYuIL$}xE4_Y2dPB`SIquZM#MV6MMTE|` zH72%jp)8t>+?Gb7R{{s*{M1^fE(01D*T~#CzzY2Pg-XuLbsp4(TF*tLX~vOjMRKIG z8#L+p>M(TUOVr*Qpi}|&|L~ZYz9znV+t;1!Q~BR# zC3yWcP5m8g{huk=`#vL_00}V(F<~(&VF^hiF?j_^F$HN^K`{vhF)?oWnTr3>!NbeJ z#WCc6@1W;k4