From b8aeb3dfd90ea3e4403b0cc1d13ca4cd05a7dee1 Mon Sep 17 00:00:00 2001
From: David Young <davidy@funkypenguin.co.nz>
Date: Thu, 13 Dec 2018 20:36:41 +1300
Subject: [PATCH] Added Keycloak

---
 manuscript/CHANGELOG.md                       |   1 +
 manuscript/images/keycloak.png                | Bin 0 -> 32527 bytes
 .../recipes/{sso-stack => }/keycloak.md       |  65 ++++++++++-------
 manuscript/recipes/munin.md                   |   2 +-
 manuscript/recipes/openldap.md                |  69 +++++++++++++-----
 manuscript/reference/networks.md              |   3 +-
 mkdocs.yml                                    |   1 +
 7 files changed, 95 insertions(+), 46 deletions(-)
 create mode 100644 manuscript/images/keycloak.png
 rename manuscript/recipes/{sso-stack => }/keycloak.md (57%)

diff --git a/manuscript/CHANGELOG.md b/manuscript/CHANGELOG.md
index 3949b02..d4f4f65 100644
--- a/manuscript/CHANGELOG.md
+++ b/manuscript/CHANGELOG.md
@@ -15,6 +15,7 @@
 
 ## Recently added recipes
 
+* Added [KeyCloak](/recipes/keycloak), an open source identity and access management solution which backends neatly into [OpenLDAP](/recipes/openldap/) (among other providers), providing true SSO (_13 Dec 2018_)
 * Added [OpenLDAP](/recipes/openldap/), a 20-year old project which [refuses to die](https://www.youtube.com/watch?v=cnQEo4bazIo), underpinning many of today's authentication platforms, and providing a single authentication backend for multiple recipes (_9 Dec 2018_)
 * Added [Wetty](/recipes/wetty/), a remote terminal client in your web browser (_22 Nov 2018_)
 * Added [PrivateBin](/recipes/privatebin/), a self-hosted pastebin alternative (_5 Nov 2018_)
diff --git a/manuscript/images/keycloak.png b/manuscript/images/keycloak.png
new file mode 100644
index 0000000000000000000000000000000000000000..2e6a6c92c217c2a821ebc41ff4f2d38bc21dab2e
GIT binary patch
literal 32527
zcmb@tWl&sA6fFvY-~{&oA;H~Uf?IHR3+_5N!QF$qLvWWtf(LgQ+}&M=H_2D`R=pp$
z-n;j`A5$~cede4#yZ7F`*6Q8iit>`ENQ6jGP*AASQew(bQ12q3prGjy;2<qxpoA^R
z7ovldmNOI-GS=S@G*o&fKBN)eMOscAegh8uJs(Mb7fdA-)F&uuF=18rrIS?;-JiSQ
zx61|QQIutBg#4|LVnf<3k-cPD!s4=$e0k&DWFeJUOR8(tr7h*X$K>7QbS;06eDUGg
zy3zM3v&!EBzpX%-sDNDX4bMQnekf5<8|s?5Is4n2JY%Ci>(1*7J`<xE)<89@#-$i^
z5d^Xz^c080&;R|x#18)V16CZ;4CxbA`r9uerHK9S!vDQ)M{9>Sy0t>l&=2gE(>n_G
z`};Y5lze<T<LQ5I-Dj{7vOqmwrV=_3O{6i>wA5r9sa=^|Px<%3O3Q)yt9B)NK(|uW
zUsj-O`I7CXWxK@x*=d|eDR*&wT|RHyWCOxvVq)TP{x`rz4(eZXRwAOJ<$j^7D;6`w
z(V0AdUm%R=Bm~vWa_$!n2?<G3_FJuw-}uw}yt-ve8?LFt&<Q<#E{~%j5`H*aDR`(O
zn@8B3R~_AC%f%WpXlUr2y}e<Ae+Fm~wv&p^Pf5XJ&~7Nb@s9CRf!qaJQGw=jfr(I^
z{qauS=#*VAHzt0B&L$5OO2_%&kzVt3lU>*Aoz?L(^*@u+s+7%HdAZu(G%o0uvrmIG
zt&Ed}6=KALQ;1p`52fOPRCzLFY)F1^x!3^8_jf%J5ixEsM{QuJpuG~d4VyY=orwHg
zH^9F4rpJjJpTi}(4JTi9CvS>+r8WiufppoBSnbpwcv5dgOCk6VAEh)k@!f#Lz}4~b
zEIuBG4XEBwG%9N9Kc=ATeWs1w-S9E9UbA{5RvLHr1I=3F_Z?pM#Sp8H`*@vq-2b9a
zfhTeQ(dOziWwA0eG-T8pf;zr%G+#Ng(H(fW(#q!PLrkxZ9Q;1`BhM9`f!`~~{zMLd
z@%Z?7q{gV1Ib*DJ&Z_fa3ppY(vifkv<!ClMhL~@vMcRblg?AJe8KkB4@~|EIQPBJ0
z2ro*eKes!uR+GM^wbgNF!GOo->Bcmr<M|BybN{igPYekONjJGnrQ|~vud76*Tkm&P
zC2egPW8-{pR*1`n5#}ysWRv<n7)eCoZ(e1NneAtNN!uYeheDsP;}L4}ddEzmIiV-m
zkvSrfReKHczzJ3LBynj@uv2nw*LNndSBgzOQ->NgW1~&_MNhu<^5%5j)fEALeP%Q6
zE6}XKjX(*J5qA6&N7nvwH8OsRgF}!7Z9iM8G+TLG+TWmExoE=)`7>t*Di;?QJuV$*
z29Dw-`1xE#RkaUdip*t3T2@TFd&i<5oSrup`<x3ETHD^Xqp2(_&JzMjR#M0FWun)6
zWBBYA=!l4j-Vd9hkQ)+mSc$E7`eY4un2scu!}U|jrL#J2!R~*}jWAVjmM30nune5C
z*vSH{kx^0Y*DZ&Kh2?rRpQU~)f?8SIb6fL$uB1(wvtSPj1vm(fkB+(^Mr3DaN8z))
zQ&3=n_>Nh957)Z)mmC>Lgye^m&KH{l004cTTQybMg|TcpmfDw6ll&7iPX$Z?A|8>@
zk}NMD8^#fNw3<97oma(poM<GQ-$%wwCqMd)9pPw`WP-=^U4tQ0-fz`t+zgsL)P0t@
zJ6l~Qz=UShZTVdg8}r+cnOpSdoRz53=y<LsNd?4n&(3z8d3dw=Af8zwpXFqCemO`w
zI5@a(Oa^Rafw(~3Yh8SNe0Pe0FXHc&)@n=w0xeTE&;I?VyVH?&k88#9xpBhDU&-Y%
z&v&ODduisn5|IX;F;MO8?P<KOw3Rx|ohMCCw?LxE{uA$$(^GMXk(q$)t7qJ1k^K?<
zR<4Ngv4T(dc6N3Ut5HXUpDs5irl-^XPm>V#YZ&<8prN7BnsJqn4IFp9$jA3%U><Q=
zj$0-nH6oe8Yqzp*J+y)zQgYHBJqYD#(9cZw8uWTu>eE*#tlF&UtBj7E5EsW#fvf6=
zj}Z4~wO>14v~g3V#ZfO04#%QuLy1zteqTO!DfsyKXtUISm?gjOK4v3PKBug$93WB9
zZQ~YH%;UUwvF3H2H)Ww%zM9HuOIU9{0cY43hT-nz#b^Cl=wSl}GN0Q6(dFz+-?g=Q
zg-D+WPSEl3r536H+=033<>jhgo*ZB>IO^H&4Gnl|td+^@8e!k{n*8$O{qph>7WGl8
zT)mlR#2Vs~qi^Sat%`ZAM7dh^W(UUyEJ?|2{6dDmq1OD~UTN3Yl?2^ptpF*`kjOx2
z(2l-tg`^bcoj(|lVn`52;xbXRnaqV&QbJSn6r|}2b1k_hCad%(4P}pk1l>ZTBXFGK
z2IAZm>U6OS{t8T`(j36re#0*!_S*qt(F(F1hZRbbo7x#}mhQCGjzD(hMyt69i2w7P
zpBdL{d0Y)qNz2MQYgKKn8YCnnFfQ-c<e!|_xScME=Lq^JmZ{zxOa($xq2t~tLCEVi
zY3dm6i5ron<>5zOmoPX~LWlcR0F2v-8#N7$Dfnf9$M>aW#7%&oKa~%_=z273G!TVX
z1F~6g)t87R*~Y}|0zX+d*|c&;@G~*RVo}LYmM`e70M-r7(<IPh_f`QKEjDyc8(&8w
zTBp5W-@ngWIL_jzW5i1Z@=>bLsF&k#B_Sor^ar8|2F1q4UbkoQCJmzry?n}%_!n|z
zO~v~-bn3b4z@%Wd!8h#+b$!9qm@zxa<KoZFodw}_RfO4>&8@I}k^KRU6_(S)?&Av3
zzYW#$YPrFD>w5#uMO9;eQsBhP8%5&kfFWtAsrcpy4Vv_jNenD3ETkjRuq-=FA2FQD
z7uTf6-M{4L^Wjw~{?;w$TI+UQ*^CQyu@Q*YR`EQqgG?JNHu#)!1xZINwoB|XbhA64
zQ#Tt<;PvaTt=(Pm`n|Et*cpW!H^gw9)3uJssHkuI+Z!8u7LD5bCZwdK>716@^IVB_
z(Db{vt+bxEZRNwKOE&5$#h36T-f>U2ueHm>jZs=!S~g4Mub6)mb_ORkWYUr@E*vD8
zYqYbVKMUS|484kma<Q8aL*W{PN-n#tcqn7Kd#u;2SUiCYg$TDCrylf;sWN;mJ7#a4
zq2G>OQESp<yV4sVPj@F{bZP8f$NL84r)dM0het<?SGo-v*XC0rMdC7<L6U<8KjR<+
z!t&LkNvzsqweRawl8By-jm@L{)TbI~Vm>#QkiJ!*-zUE1DUEvDWw-HLMqTEM<LWMb
zHzCNg#l^+dV6A0?O)BZh$@_{p9cR?wBD~*T%~A##bedeifHyEqrVo}HEzafTWnnSz
zlWF?5qM+c$>MOw&$nqOKfWhr`e<m9E`|JMo`}gm?Z|5{v$KwA29Z@yend>^!5#0cP
zX%;1$rYk?`7(!aVtPq1E?&6VFIg>AKF$CpuyB0BxT1-SPV3p>d0u+LpHgRfJ-3F+w
z>RfBQ=R-uD;-#vlV|}zZi>Kp+(vt2hM)k|J%O{H`oc#R!nZkp1&4~_4aR@O>L%)B2
zm5BMMwR=oJKtN7T-olSZN;>h|>zv}#Cn(@pt%9AMRRt#<okr)e?zp6%V~wnv+dL{y
zD<pR;p2k2^&?ZH!L()LRh{2Pmq2VXVSQ7C{^_fl|zI~4;fiExxQ-9_wb+Swgl*<lg
z%dj8-q?DCD8U8LpSw%q)kR$sSi@mu1Dw3G8X)<hF%Dmpt8a1nM<J;|kU2Z@u64g^^
zo1K~-mkeCB>aCz&tcbZ~)F>!qP0E#7gYP;iqJAY`jvxjemws`+5oOn**JQx`77@^I
z+^;*2eZ039qQzp;sI6-?H!L~^F=@4CqG_nmN8@CAeciikNXq51;iMz2)R&W%mM*%0
zjp-)#`zfp9RkTpCSZmU}T%*mPQQ10U!Oj>fM=4qF)klm6KMO%4wU5Aas6RtPWI|m~
zibl1X2U7)-bEcNfd2>g!0;D7)`eo|se^D}rWaBKg;O*>p^=kc7OyBl7yO-y?koFv{
zQT>~n#&quUJ>g=tv1DZiA5}aDmGW9p#o{UF%F3*6x(V2e9KL?+>|h%YJ8Bh98;8HL
zi`zVR%&ON$ojHS{1z4_>gqrFA01S@F?PlU@7b)jaN7S$D1;Y7%%X(r*#_QDEWdT)i
zLNcBCME35oeOIMZ+DP=YoQ%w8I=YP9T#1&}GHOOnwRF-+hs}2+retNpfpC5`J8FwI
z$s?VfcPBhG%fuY%>d2Majcr?nOE?+n(BoOoE5!R%`W+6=&b^Qoom1yv-S0<z8fb8E
z83bE3WnlrTD;iN1wgLbua3f{ERxPR-PUd!3XkAaaqD^D`MflMg3>*;<ANa(>1KQ;Q
zt`5M+y;`j0zvtw8F?1>T5c9jHsW0&JN+yR-j0ZBqq79xk-u)hK?R92>f&O5!9FL{*
ztXuRAZC=?@#Ohh;r80Kn^=pN?b<yMdQ&YL=<!1Z+&gV1dvN^AdZg>P_<Z>7OVx*bv
zk9=-X9M<!ykLM?#`V@x5mlythLHy_enQAIZO5^50h`aRm2J)S^U)L>9AKx-wv+9@s
z{8=zwr&K<NLd<&;F>-&p9D4;W!YxmlomJItu<$P_;WDd#FRrABjpgrudwE|S+U3_F
z^NI-soNr<x;Upq*adB`0Q8QM@(>biUAs7t;C?JdctQ8j=N{ggm_+Mj;5n@9_5Zn$c
zakPnQdHSU<r|OTP4{-GbXn9j-0~!&rvZt8baJG;{P0z{q_Iio}rLT>8_!I&K`^z@!
zlBV0ZR#98qsTTK_4bkq*u_{XBE|zN7)iB-9<YZRUVeEbWSV(NPIvco-$7_xoG8@)%
z2gLUqKdS61&-Kki9nV*aDt#O8=E9=<mh1C;my~QhUqRr!-#Hvbz;<zW=jKt#KdK)y
zXSJJBr?l#ptKZ>?LMqrE;iGyv;U^f-<tIRo%ch<Yor4CBf)F$FYW>u);yRxW&q{-@
zU!giXI~ga^#*k=LPnKE}^YcG<zJa~2uCB7kx*WH2Y0ps^|8lS{jmEKp)QpS~yvs{5
zadADAPhY9BlJW#`=kZ#dbH(}v2!p*FY}mY}mpfAT&Nx$qsoj8CvC~dGMh-z?Ze*1p
zd*`4^nl*_PnaDEs#GKVLOin!!MXfP44|jgg8|w3p=7h`bL70u>{gIc)>&N@9w^QB0
zncjLE^a!G{z`!(a#{}n{y6dcyUH^00@k}0-GJXg%*+lYr#{|Kr5GdU1bHBQeVm(u$
zK=tKIASBNbXN*ZWI57MA-qtMJ9=P153V3~(DG@qG8QdMj=5fd^D85NxOp=Uw86JFl
zCe5oiFPQN#tkpzBLo4yPHpIk2i_6H6h1f^0O-!-bju_&*T9tV{Pqzk}$H%hQW@FS0
z4E?LCS?e(*yUn!e%X3y75O_jLn}k%al?RDr@7LP}#t}_=vy|(XIgR76m>9Pg;mtF7
z2q_pEA9qW8C-pb)a7in|LI%bu8iFETGNT?A!91p66saUvt0yi~8~v4u$Zh38tgP4h
zESPbbTCt*n|InhzR#jud$W^aK6h1o57dv0MRgL9Oq0=Widt*11vKDq>pPMO3m$Q{%
zMm=7WdhNr>JeWXuG`G7iE&vU_Ck5?FSO_)Q&dsG2rT(fs&7=k=uArb`qfS(+n%TAU
zfofOq?Zx?M?z+V5-flcjx69Wj1)5}cbJ(uA*7bNka!@}{y+LJAJ}Cx6)!oz60fHSN
zT*Wrq^N40;l^Bq4d3To&IA6m{Q7uy(H5-i(u`CNm6Lcqy?C<#j4O6px>hA8YtgJk`
zcisuKi9<#{{u+tf4aIIxa>B|yz@jM`+$wTvBQ1@n(`>hU20WK2auO|aGMU`y_QoJ(
zn%VuAtHm1EjzLz9tbntR``cIAEpTUU1JAri&<Z*$7md7>li;ymrd?Xcb<sssPAr-q
zk00UJLyY0MaQII>NO08F7Z%m~E1w#)8O-WI9_xFuW0^dGZ06&+)MnWAX%JLDRbwQ&
ze|&`WC4S`mCf~`qoL%J6X{?qq5izn~q_!5}URDB2<K_%V7Zx6#S6GNGu0-2m*St)_
zz_5GTyzZ8ky2KLSNJJ^_7$P?Kl|&Nt*O2NFeK`d6L+As)d^W#QKS^m#a<s_X>pjYv
zhdB)dQ?vkqSeTf~O?rR+{Ao9~UB5eBrd=5U$%}~vndotGMM-=S7Z0hM^i}fo<Q<G9
z9n|IowZ+DwLFjaXLeW1Y(xPz>*Y$EGd)9s}9}pO*mu}gM6CC0Th%31JZXX}*wq{mw
zM%YQ)P%r|<Ns<u{*XwWlHn<U%e0!8&1Nb(%I+GgAbILsEq7C8pXJ==Ip$Q4b5SU+7
zR5VUVA2}x@FaLoLa3)qhXUv-RaqM>rH6!Dm(Ay*0>+?OJYPrEu#mUJjEHbipeZA`l
zvCwe^S$n%Guc6`R?CdP<$ma8Tb6i>)M6dY5c0GJePDxH)V>0+*snJ?eGxWp5LV2h}
zLBC<k?<zf@l(e*?mLMNrMo<u}`878;<+Iz#c|WtdVCwsi9PZ`nmHBq7Z4mEHE0)X1
zpE;zarzeM8Y~cGCjEu*~opOJ9X|&!+I(68v=-=UWr+bO-<m?P;bS|kUH8nCK!;K6U
z6(V(l1O0+~J6Y>k_VAsxYMiC~%Y8V)WGdA)o}&gKH2daorbPKvM}8#cgmmYCXz^iG
zny{&pxQj_+!{cU)d@NK4uzw%Yyg65aBeDK<Wvu8%hYdM)3z>156(0q1UmZ#t+`p1m
zi|~qFpM<Q8%&!VdYxg7cTR*_8lj-}WABCiPBA>rzG~|?>SM?kmx6JAM0oy}h{Ev0t
zXE~Ale-az2i>MWL_f*tki2^AE2>$X}=HcP_$nUN=p8a3{j#~kzO`|psM3iW>Uofj*
zjXVAOB9L57P5th>nVGVpqGIJTzw41|QlQE|`AUodDFU+4K*XNLr6<hvZ<G*kq%oKK
z8&vsC@Zt_D{^V?I_1aCYkf=@pdi`yOsBila_3bYt2tsen$iVjh`|zN+-2VhIa_WDN
zL_m!AcY#R2zp?)xc5mVCkziteF8cIuu(a^v>}$$MBD#SsbL9wVXej}ZCp(VB6`TJZ
z*8fL&^Z!X4{r~m7L;|)NkvuI>B|lVeUT%yq6-2wI5r;NkngyxL=>N6rmO5fYZro#J
z%<~(D$Q;XLs6JY#k<?hPs_l8%Zp<MQn-mk3@~m;|WmH($r~E+`a{MYE4wY$oI0-Ry
z7WNQ!n*L++A=8NxI<3~atuFk|kvb_50-4w?y!ao18Vu1`vW7BRnkT@1{04cGnc6my
z7130&Xk4baBi7_}n3yr9Q?;W9OgIZ7{!8Npm+B-DX7S}LAVk~XNd0}o7;qZmfKN9_
z-SBkk<+{-j+B4pv-JG29r^KWBLJFSLmq&5uN?Eas`shS!Xljz#Q|-YKg^)W9kL37U
z9PZapdFh?3{WW8i<Sot5H^TZJEa?s%h?CHitj!bqAhd?4jBAv80D^>8V~8X5cOStF
zOY0e>$!X&awszJgWY2F0E=ZCKqviukCfrR&qSbGm(isybQ?ajjuYorQ-}qAR9&}#v
z|A>=;V>0o-eg7HWk{VrzN-TGwCS;A+cQ%JbP-%X>*X3z0S9r=3GF{|`Q`>J`mWc^n
zX^$0Pe=V-}ZYUGByr(E~>r8*lAQ|Feba3KViyeFTZ=MavPcVEfn(LF9;QJn~>SB{8
zh5lU}6iY9y*A?YEbDEfqhe@Ko&c)Ez#7-)W<;-{{!7!sK{E(mU3Y9_(@4n%qh_}D4
ze00eX=-qV0T2#$*5?$Z+NRDDK1{a2cvfvMv+3Y~p?Fk$qX<m$W=99CVC;IH0TTS8&
z2&!cKofjTGU0Fj>x1g3iPX-1O&u9+;0P}Whbm4s6Bq{rMcB4z#M{bIAg1k05#*9Xu
zkircMN_gAv+XmTK_0r!)dsQ<6@@b-@YcqIs=Bz`zKHWJ44`wV}bW=pmo)V6IAufuI
zMBkcMIW5RWh2P@&c=M^_h3>^W^n+1NU3{fwk{1=B@?CPUn54t#(;0Hi6QCp*_p8E>
zrmzAnoPf*(Nvrv!06pik9Q*;WMhdUU=O1KgbCC%MeieMs<GU|qiB}}&Qc@LqKj~wN
ztqAz<VQ^8bRrBW5WFte@KAjbv#U)GF*;WwD-<zreurf@rT8#^;Xo6c>Y<eWbxBNiC
zPSVm3sU8Z^h6le%#KgqVF{T3jznG!dmmKZciVg$lQ#k|je7<Ck+!N#XC$iz9cTpiT
z$8pm|kO+_(TegW@jry97h@)d*^baPrC8hq6(d>zu5<OIE(v9{1lG;S>Pp`6TidBO8
zy)Q(U+4OR?or++oz<c@2VjNvcCxqt`|LWopm)@I!0rSsPV`R*m!Dug`9E+T3<ix#i
zXgx9jd+gBiy72yXh*A*Zs@XYRK+vpBP-rf3p3_%)LVtQDHBn2qR#sF-OCZ9Qh`W2P
zLysSvBAt#)-didTd$s>&h)oxk^$d-SKhkjP!R~v2x}|?4as-cs-$k9K4f2vNFBv(I
za#0wlqiTkSfnmJHkd85}&ttmwgw5^Ht#_W+S0A9l`pA>!F(ZOthy6oc`isZ4jG4eQ
zwU+EWYr#lAA*;&tJBiqE$+r!5ea-3MI0<m>_xLQgsJ<Xr%zB*s$r)31elN44+V2Ml
zm{fj}qrXSy>IfFu?Aa&IP(OQK@e7_|e*2OYeo{!>N1xg)8ovE_u{zbFo|(?POZ){4
z0`*xGq}^@OH7wBW5PYJ}B^=f`l{R!x@t#|#Pe|ITU`M&?#)9lURWud;nVRU5<Z4D^
znD-O;RV5HB_Wk-Wg8z4kQx!5%PZtT1h`XZ4YFu`1E_+k5EuHJBOMc?nW_&FZI-8p8
zk;eJu{M%iEYim%+LIK*rXjh8Q?=D@x;3=XHZ7<Y%%u?Ul33|2?vJZpSmpk1;`&ip*
zFi<W@g->E2+3~#^!SB0)6Jfp^y`|&Ums&Vf)9!@46dV3jMx|>_<1pjCVSy+=fT0#D
zFuX76az~tTbDKb~C3RH<5dn#!VsP?UFlOc4jM>B<FWH+vFw#R+!6BB~Eckta&w;dA
z-z|l&OU;NU$gw{B5R61RaU}d`1wE%+<9`zo5l}%MgQGuTfg?aB3e4|U5p)xQERu7$
zI5V8r6!s2&kxZI6*m4<#nr0f8k;SObcr4C=4+pL0X*tSkfEu=HAMD+ynba$R^6ckq
zwI}qm955^0z7@gi%7<Sz(X0f_g}xIy3V(k8)S;vooX_q>reX&7?quZdQKgnnb@%o6
zCF0(y?g}%sBKDC#VZDk_^FD|UE|+@Yy=>nl*b++p7{7#1%ZFMzA{5LLIhiK!DIP0F
z$D}i>W{e^s?ZIOqk|NT(#K-yBu1KlSiH}(xiwE6_>${%#&1v8kR^0D}F9hR=B8Qu-
zuksLXHH{*}HfMk8c=PPWZ!u>zhqOFDTtjvQ_?%y%HQe?S=@k|xz@n^c6fJoZ|9H(k
zvbQ_Ff##WlC9UCrmeEdXpZOFqMa$VPt;T)b1dZ*e7$N+FaQyaRLUVj-;joYA4CjCY
z{de|wzpbbF!+^>3E83qa*>_W`M%(nsXJsMdKP<hZ{~()5J&z0uyv3n=UnNKbZwebp
zMN)ncX*6YbE)ayw2_Ec%p+v%T7Ev=U$pFuI-{su1{r3A=+lDtwknohR5e^oze>8$(
zmV|8)?iKLm;~0S__vJhQSR6-giU|UCn4Zs;1s_e45C?zb24?H$30BaNj#YfzE<n2q
z^KirteIp)W3W@Ay|4r(2U6_7ph8$TY%?0{F?gNmx=U`!=#OMt`YP2rK7K|Awc&78I
zF5}_kvV^I1BmyO-ig^|tcLGNWeso@kd6;s}WOt;Xl8NFI6OYCD=lPX_7Jep4Whab|
zdVNXt=%-jVVeamSncc#|jsnB^u6jIrLQ^ax(#K~~Lr|Cd7ktb|c4;!hx0n%mm4w^V
z<MxGX4&(Xgp6|+vC?Fd>mK-(cDbp?@VHDp>g1tv;7MhsoR41&*gQAu?+r3&>rFZue
zuW{~y(4xa${I^H?PF)#8DsATOrgQrTS@-@lTL*9Y=66pn1iwF9aTA|PqKXTdQ6RPo
z;1eo><F$v(K5I?yS}6^Golc<gVEynEL)ss8S&cqTjnGlWZ_l`q$6}eZ#^!#&zx8FX
zo(gQTr5<B+_|314pF4X<0hQu}cRC{<U(x%s2iqRO(zEU(_iYNf(kiOFsdfjI)kZo|
zj%%m;5G(|1B1ZV>&o9-A0r^$>&i29GXR_JLoQFnDJbp^kk0-5z4=2;n#MITHiz6q4
zq@7m^#?yRJoo`vPe!ryjgmR{inVQuxfN!sh6wj1ms1Xr)Q({~ZRA$b&qLQ%Ctta7f
zeST6XMjF}17?3QQ9UVMmE%aT?K@B;B@og}HF_q+t*`!Gy3JT47?NwznJ{xnk(mCU%
z9ui5%|EL8hvzCk0CZ>jK07JvhHk82&_)H}@j=4ryk#@{NAhVsNoieP*teCJ^%!e<0
zj4{|)agBkCg@zJh?+r`^uq=u05*7s0|7`riDoRN4k$dI2&4Wq1JJVi^9{%DsAT#Kz
zD=UA4)@{Huutu*EO{WH6GN>}wjVP&3S&0|_2aT1kVQ+}V0ljd>iKvDBgK=}aOK`Q+
z5r~!Y3Ue$|ziXqVsTWq>L=;j=r3iN^;wx3X=Pw1-rrt|VuTsU1T@IEyDk+r@Ui0oL
z%|6QbKu|pd+2>PE1B_e@h!JIzYYYoS)~8mhjdDX{B#eZqX%Ih_e=Z`x)L^xb?YV6z
z*()YbEJ4eQcP92De5Bi<Fx4Q2bv242UC(Z3GOJ}TD~=Yw-&v~9AtWWZqW?!1O4D3|
zqDcb$uJBIgBrsR?0dm&w#pEfKo8v82lH=kM#H+|sDt-#sXkK7{G23PF9by;JE&eHE
zs6A_8Mi2TbVvI?n)w;817N5MMxj&Ug<C4bT*`ud=;}U)puo=0a)k=jLI21(26<L9l
z#%$4-(as}AW;ZIz-}oISoJMPh5asWG6CQ|3Co%>aQX9HD2c}k$*RAcm?)o$&>JZ56
z9IqIt#pG~5_8-J?Z-t5(I01olllO*ep^;j3hBWmg(M1TqOEC1FV)n*j3lQcg>spQH
z3Ofaql*syQb%!ciY$Ap;QX9cRE{DAjXa;1oqpt2wzb6;m*=#whg`UxCk#cRtay&@u
za_t|Tpl`AolN)`uH3{%~8x}!76^wUgsDo-4<Hc@mgU*<k6d61xtcmX{dJXLUd=6^q
zFS9#GH%c)^-#Xe-ul~%>uZxtgULOafieXBqHd?8_;|$@S&-wJ|tc~D^oLK#ptdHR~
z32%}kT}iJhPeQ3uf@(ePZ%q9~zdpyU1<onef)MtK%bE&tCJ5R3KPw^mUvR8G1`#`V
z+P-yaI=aZ|X=R!)p&^K*o16QI=09H9H&y`A4U!pjWQ1R&A^XY+B7aHf*YxcFTXl=$
z>B_=DWwJ8*7GdgG1U7^lhUw5z3t|f>%Ls>Aqc?jd{nr-3E`a=xFaE!0s9VY3O$>UJ
z2z|}Jp1CpD=^@d`Qlh`Ef0=zq(?)h<c70%<&q=DkyC4338Whj}TyV+c!PUA@kIv<v
zS)sc}wRbJu)I$K(NR$Wm%swOO3xczv$t?$~lbUb#wPMTb_gBa-9ihEDm*3{t7E>3P
z!L>zYiU>HJU^^Q*qt|&sBm60#;X)si#&n+7?|kjimUu4*ctUOxnkX$gOySo_@iH(N
zEsP^_7(jAk-Uczac=<5)zO$Y*-w00usq5a3q*pOvaOro_Rsl6t0O&w7f#naTMzE8!
zMUFsW{?}0<gh~oh3WzmktvIJ+3TGSvh{U4r!Viz+h?ux!B5`8&(k|v?rCy#b5l?u3
z7|AF`qlK%1Cr!P3+gte%GQFKc#LUru2}OBSqZK#?Cl=mz3Y(7td0wAy^Tg$7<!!Ag
zD>eJMp^D;ctNBNss+`@o{Xelo5!yEl5MMcVeh?ojcYjK%oOI?^F^J6#X2PE+PR!hs
zGh}$8mR7{h=VaSq^9Hc^JU5u>Sp<`Ebi{C?-lWj${JGX~)^wi_Km<Ikti>suT@{fj
zK6%l03wf}1DIp>&B*zsjb`OR=!ep>6HMfUGB#BBBM9H%|X!^Ig-j1Fx7gh{R_q{00
z{An#mwEbXu;S!R@si)&yS`gt1WKDCeOYMyyZqUv?S<A%9Ytx3P@}S2}Bz0RM;XH!&
zKp>mb6&8vUcp5L^q1!mwUZEtn1>gD6Gdi@^#u0m9H6x74ZmfpSXA1Yk@aQM;%Cjaq
zu#^95NG*Or6VL15HzVchCywJ5<hzRjy332jkHz;_t~9Zg=T)CLH(`S<5Ki#>XU)OF
zkvj_njk6hA=L%#MFHWk{?)JkYh5U7?T+75pAf0lM=L^3X`vd0(swbft{MkZESPCZZ
z*Y?Y@8xczDl2HoCMAUd7OPf!akcR=Yy(5eU+;M$8g6f0&(eb-m-oEAfVGa7@5kH5B
zpWA)rVZi%B_-+~1_{e!G$OC4;W!`>8?ClS9Lxr%v@bT&CgUP^hRI>z(zW#%U#$tC}
z@_0aw2HSQ$136xLcQej?n=Vj7-sfJ>z5*m`#^TNu^XX|F3xB@n87*aZx2l=he(<@-
zMz_010WD4o#r^$c=Q_7p6l(RBE;wnOz_P;Ei%w=omfoxGwBHBO=G(~KF4}nQ_3Ccl
zt4qMB2%9^{{#osed)s<{-8ayK;E3R=tQE@!PG85wn33}1)BatZ!;*GWQ5L+M-jbyJ
z_oqdNmrUVXx;0(GiEiiJW#0(tS3-k((u!$Gr7&&!)9)lgPqQXqTaCv9od^$b2K^m}
z)#y~MEzP63=u)An(>Yn9b9_&`E-vQRo^9J9k9^eQ0GZSpj+}<N1!wt}@s7}qN3y)1
zQK-AiipUf8!yC(2a+(a@331)LZ*V7(A2yfoc)!Xyd=XL?Ys~xZt)mRI)@tU9bS+*|
z9hSgM88@A(o&ToY9&zh9k~UWzH^)S8Xe|uFyNVt0xDI{#rh6%Pc{$=yWUj}4n!UN*
zKc$-HAK_;*clT+4LBIPbR=wWJ+sBPTZ(Pu1jK|8k+X%PwLeTu&D_jeP4%~t-?FnEk
zM*^}rtI=C)Ops{<v$ft<{aarRd7V@3W7Q69Q(6;Aku%sz3qrDFHEOE+#ghB`Yu#?&
znF;d#sQIn!fJnU$y4B(ZbhHG`kye_4G@0BwUg_EVkj$U9aQb}eGR<{JjX=XNKlLyl
z9ys@^28(Oy8DnnCbM~ux<mjJR>+k#yQ|mRm2tqnKBW^FtH6MP2RN_>v2CPP=JreM<
zo8wq-C$rH_OP!3+NwI^c>e^p!)uE`%F57Dd{^atMYZ8&lo@6?r9520`qlW)TXbRU0
z9t#JXFVmew;>j(cZX7P8)N=|Zo0=S7Z3A(Jou1#BRq#me57}b^J$Xj-Jp;V5{4&#d
z?hZ-PqtYgp9=MJ7Z@M3DjnyeqeD22WjOP6SnB04=f-$kX9p+03S7+Yp#6WO%4WuHn
zw6UVlRIBv(Sgxkt_A42sAi<o>pinF-9yP4YMD`bnvXLG}&w$m{i;G)Rbv#tbSZwaV
zPws5xktC8G@#!&Sg6!<r@n()T0KNQp&ecGClHBfIJ<;Yn)YhEO>Y0tnmG&jG%@{c=
zhq96#$suQ^%a*&cTpfgHD+ryHB*aSG+Q#Jq{kjgREjhVwJDV=ZH*l3qd7{P4b(e@+
zP3G^A$`Gk0U5HiHdpBhl<C-kk(BjH;!SMOZCNLIS$(=8}w`8h`{oVB(CftD__n<|M
zz520_-GyY`RUGI8y?w76ayN;Ah_^HOw;zh%3Schynt}s|Pf?Cx;k&@m`E~tlzKaUN
z7f`&<X^v6zlN*)qD*-+t=O`u8sFtx@=Ds~|kr8H^k6l#BiOQQUuy>L9I$COSfiXT7
z0eAqx=?<H>4#eXHLfbuz%o1ki%(bk5%b9m;wukGDjPD1XtieB$%BLqiMjhJTTS41v
zOMnBJhpShePoAz|83y=;-*DF~8asm|Bxa&}ZA#G<tIFxCT{>{MJ2SAqZdVFN;&$O~
zx>%n--@n;9av~RKT$j({d(G5opozeAOyw6zPjokIe585*Gilcz7VP}4;LIi}r<qAk
zWU0+&qIq2^r14%H`5_p^ShFTg#d04yScRzTbNwq;6tJE}(86+(CPIm9AJi=H+Ey)W
z>4}>^ucG!~&(I6sSX^zqZDCA%PxR5Bo@$~m4HG6yklI0SZbl^UJ>ff&Y{CFKH%ry>
z-&TMqsissZ>biOp9i(5jRT&2=-Yhqbtz%dz)fTdd$G*J1Jq^m!6&wE1*yTjT42>l&
zNj+aODZ)bEH8KiUn}*@N4|P%^abd@@<fsxVPNxIUKVcr#2@GCEw1#|i*|f*L`8b{>
z<lRF=`oVBBu`;Xi^DqeOJ0#RNSkl!P>E0_D&N?l`A+S3)#~GuPL;@&v068W7CYukN
zvdu$ZK(|M_5^^nBz>t@~gFg<0vvIklWkO+EOdonYwAuAz;xycRy#wiVLE5N<(M)pQ
zdJ|-Le8h@zFQ~OSwiG-w2!yCIMvQytlBHAgd(}j8ufq#f#V1Q@<MBVWzFjSE<KHzM
zTagWH38^M)bgq3}{+wPGf9>JCCDwV$`=b;-WQwma*#%0K71X+iHBTzDUGYxanZ<le
zKS)_U`MrJvN|_(%HwnISS5ISMw+_sn$a`kzJ59!cZD$Yaql8BG{)LW=zX940U7Od%
zx354rB&^^7swdIs4d}4>>DlI=*M2n>Q)LGeBdEOIsw-ZU^v-<l{Qghe@*{cauMh;R
z+#b=>J>~7R8jhq*abIsQKei{&R{z6y_f<n}G%^M%WSLxtpv(X?F2@W1aF=VkosEIs
zNxO)V-(lLWHqiy{o+m;GC$8CLkZkR-@ctX%!*``0>ij@Y#*XqQ0d=@3IldIs!6=uq
zu0*}yN_@~b21<h*9J8}HfYo=Uduamq`c2TbfA&4oWEUm7ko7U<VqvFq;XRJLdoY_H
z0l_-+@!T!D#}x(coplsiT<soBF$s{T)1%5;%gb^9WOvlYU`~19m}#V3&)$8;^hDQ~
zlzY62X`${ZIJ|H59@9R`_O+Q)$QtH&TQ5^S1Vf~ppZiO=tbv)*9+cUbZv?Xt1O7eR
zcK93~9*e<sieggHp4a+u1tHN($s2P#WDmuPfoo|+J#;eP+w9e@V=Dpm)zuvv$FcMQ
ztuqOjY$xb;SCm%eGcFn#Za=YffJ?H05DrDrU#MjbiZwRWNq4ZUcVM9zjJQNbbYOqJ
zN&izg;FZR8i6|j>iRsASS3$K5K7B0&+n~>fM19{&eL8tQH+D-_ld$$##w;D$8k`+r
zH?$0FX)eK|$%u`+nt?_Vftv(P+=g}xWd(Y8cE2lbdWdcrOXFIls;72lB3Q!^yS34E
zL&fJw^dPw&11A+$Drg$AlnI%t>0mvpRX1PlzG%<*ogmYD`9KYfIg-DPz4|mp!%u?f
zvRbNVela5NeuVd9DDH>p{YZw9`zf-1FVe3i2oBfzXz@|#=FoOJpE0<LBrjLn*AlYP
zrSbI>%jsO79q;%BDe|I5siFmIqKaluXHTSD4@va9v<=JeJ@X$iQOsoIkR<Do!X96>
zyT)Bn&bQ=@t}L_VX($K3Qw%DOHcKLLyR@2p2LP7byQfUxrs)-}m}?v~1Zg1EN-xjU
z1J2mk*!nN#s=xU%53*}+PZbsc>d-}TKcgeHvOp0Be+EoBq;xbh2*&H}84W>OkL{eT
zX3=J^Z0RUz1G8>anm6nAf1oaq%~cgpfou9b#U}gItb{y?o~f0~u_?E*v(v0~@SQ`)
zTEN!0$>*Ldqr=%V0diA(C8%8+UK;c6W=B*S>Y~)1i2csr523v=^GpcmJ?o1}X0TD;
zPxQxr<%~7|##8n=doqVd>eTP4TeZZ-kH*fFGg-eA$b2dY_GmmlJuz|vXG-`_IYyfn
z78~7F#pdkUGa{WgMG-ASZ>KP^`3&J=st~U;5R^$S-aAu@Ya3|KhmMkdh|Bw->=4vQ
z$K~kAcs;P<YCt#c+mzZUltOxskx)hRXleQQn^}ZaXfqn^E>X#_u=G>nPtxX^YqW34
zjB*nY`eM~~Yte5H=Hd6F&gcxa<%Yv9x6ogRoU(OwhidU+c>|k0P=0sz(`DR;&MJW~
z0D7`L5w4dRm7ATY)TLg`&=8(Fv`boi@e@RBeMy<S5JY`+bLM0a{PV67UIoatd%I<W
zWc^)+J@MtPKI+$l?uCkXdoH|@!no;C=!h1FDfac~2JuJXn@mK!jBky?4+IO>d$TY&
zzHDDoAGTCDOpa27`cu{>zHM&&eBa(w%n(U}OnEZY$`3T-DL2UOabn9w{6y~b5pYMR
zkkWB@-kd#WZf`E}94S2MZi8h{uP2g6FgZ(6xDH!<e^ZGeX(`y8eYicZ;a=?Bb1H<6
zEt;R^x&Cg=+vwvZgh6m;h9~mXSX__2Mei(F6WXV)n}b4`*p6)3a>;78KNa7fTuNds
zs8uyXR$m7edo$j2*>)mH^xKs`BkcF!e$%P*_sNgG{dFAHY4<13F@&aadfGSM0a{sS
z8&yLJHRp5pY1kd_+S8rS6R`*^b@kT1Dg^pZuuZfC1l!9Qxw6EV>ZgmQu5+||Y#5r2
z`R|@r8BQ<YjZi)b!BjnSt2P6|Y8Fn`yW3m{*~9Em=kOIyH)d=JQqi}n@tQqxHa9ot
z+Qw8$<frOPWocHHbYlj-&}TN`Uz;$oG-`m@S%-Pt7=5zE2Wa{_vGvO{a^DP(C{2gN
z%&_G@-4*fKb#LQs?I}fbL|DCOuL|c>k+EOSY{tAd8E4_NfAGH%n$i+pXyIFJPk3Da
z^*u^k!H(#P+BVjAybUWNQ-G{*oiv;k;4t}de6$K@k8pOLszT3a(XL$_nIfw)H1~R^
z2@^9oF84sOWVM5TNpEZ-qszGW@LF?Dklp5_KUgSj-=))&KG*{vx?EZ02~4a@9T!I(
zR7%irtAl0n5>eTOi@7v36{Y>NE!Z^2bZRT7(!L|N5If-p^lUSCvk9rqaPo&}b{L9W
z`3e97c{^|>seDQ>w>1V&$w-Or?M{>ay#s*A&&7(aKP?p0{>V&#R7!MXq)LiKh3d~f
zbv)@I4DPP9d7vOYSNFl61>xDB0|{^x|4gjgY>QL_!?_<2bBbvX0@_#_{FwDi%QOa&
znH}xUHN3Nzv#8p#$nWa6v0+MK2yWb&Shu=94Q)s-mkQ4cxkvGKoNaKr@>&ZmNi-RF
z!AZImw~|zZpt#vAc4GvpRiTshB|V}VKJBpMcJKw4){UoVukWoqPNbyr)_@t*u-^ms
zna@twbA4gA^*^3vD(WIQM#76X8pslA*MVHpmeFS|0ci24(^}7)p5t1L?1$H%0-x~e
zJXLscziJ5KyLpeljcaz7bHqj+h#!RCe&neQlyiOO(FcI9T^=_UAF&<hs+61ncV{lY
z@bHammd%_AlUTK<D168cHPcw$Yzw-z>T5zR2Ps;-cl{I}*i(A~&MYdUn6-2!jYVn8
zike7h{j?B<zC}xTLpa#3zfI0|@0s?X?<9cW$X1qp=-8m&qJxTGUh(6)(1XvQ?*46n
zhwg{S09Y)7s2Q-<HsrKPF6lI)&bb?JGQGK9)G4z#11Xf1(gt}Btngpl?rRhABHf+u
zN#&X7x&A(7ZzeG@utJ2wlc!Koqza<c|2yfBt^av70l5ho7TiV>dk$<}LfpCR*(n<A
z4BB=>+U~FqO!twoa*W4i)tx5lF#FgBB19I_6LrcZwL&{!i8;MNCe$n>JX)7*m;0;k
z<!Xvv$xuUR2aN(1JV#{)ys*Dz66Dlint9~IOy_gaWjHI=I!5V;c}&LChS_^%7}M%Q
z{>uTe%beEra*iAyU_AlPjgbWIPeWS%0WL)I+T?zb5ei|Yec#7fbCx7S`o)P7QdyPy
zzqb`@J+kyvuX`lZBKv+JAO`#Rb8g+TZ2LGc9dp`mr~pjdtYUEL-Z@09cQGtYxvhYz
zuddRi_hsA`oH>`{(_NC0I7G9q??|RzT|7%S5~9zrG$RHG9`)Gcnx5Odu~F+hKdSS=
z`&(4f;;J@t!>vAk`W(^N-*G_t$lTGs3XME4`dXov@~wNy*5<AwBhRE~s;v9xBT)ut
ziAjJE&Hz0e0ttUa32|&oT-xZK{as?bS88S1J@dh3C<~4b3yzs%-3Aizhf0vms!QA-
zAnEt5uf%7me}p<STr(mIL;f9|YpzK5Gfy75uySSUT`sBL%vk3xfwCf9`tSswrQEgU
z*M&QjhBGIBHmd9_&4UCfnN_krzpX%?><t#V${JhHcHw2l9r?bJe|K>i|E#VW`gD8j
zd^bw)pU!!p=-|La1%GdJvb`(%9s4Tw+|c<KthkaFEF7E+nJP?&eyo1=znT}s2-BY^
zZWYf##7-anX`prpTr}_giJJcli8bhd?+D<E%L?0=)wkBP)NxZOONhx!6IK~bKlL#X
zU@vz(bVbIh%g13tDu9%DKK;@qEmu|M6j{L(R*Luvsf<l}m%n=UC)|y1aYVl%g+j8-
z68m2fP?!z_c^j-4AEe_1$Do-nMYJa${ofJ9mCt0gJ#Wi4ZZ@VI;cmap=$`F$`nAQS
zBmR?_9jz64XpxAam4e6Y2H`YqW3<J}iEZ4xw7$BuGyYdtw1sQf%x8sYYdSWj4kV65
zt>Bc@Y*-?GJGY2v;tR-+vcvdq2pO5b+L!Z&F>oDW#UjUI`jN~si0j9uU~OwbnIoX0
zg1-Z@r*;KZX)@pe<WLQvk9U**zNX$Ve2MBwibW%j6&8c~qIb`qss?2m>c64X?|l}6
z@di6W7N)m}5aJ)(^SVlA&11ula@53Zh19bDd$2xNN*+?6wUSzMfPZCE&qJbP>o&^C
z2b`99?DFMRogStCZ+4pPwCPEAZ5W8!jhlG%uP!dWR;tSqAd(4RGVLta*w`Qah~>+y
z&bI`W7=hM21MG>Z+Z5|%rb}SzH55t?`fJ-A`{*^2(ev+U%avSEENV>{%JpC&N2*$Y
zvc!St%}C8%K4=Y_=mgN_G2Llx%nv!HK3H^$T>jl?KN(cs#czLohQHQbAn;DP5bzp)
zvjzW5O(D(AQjp_iKy9(U%ILFaTpwf#f9{gB@If8at={%Qu_!LPh~hd85m(n-h=oQL
zqA=^T^=m)~M(6U72)Y8+lnzUL<%6sGmvT_qb3X<~+jq}b#tf=4h<>o~LFV*@8_s#Q
zRv&tc@e^MYjqSXj1nhkFwdIT9*<PMa-B3M0I~;A**eobHXIdV_(`*4lfrjT`%+4>r
z5KPwe#Lof)sU*<yTCdCAeHfrOe>|I^c6vo7`?b-&9r1;icVES&ow6V!xFu;e>JG+M
z<=~0AG~=B|iq;=eUO^Ofzh7)qG(69bW&puJ9S*S(CG7S?c4Nvn0t|W4N|C8UQcZSq
z3?2ClXrVJtGfIW~HdN9|T!s?R)jYlavfExlrKj^k51RYd4at>GV_tSF8d&iCiSE;T
z@q59ZEY!vWA8+QDhOqtpbF%$}Mjyf_;qj6aeq;LO!Gae}qdd<JN>+0x^3x;#1iu9P
z<j#ToRc$zap~!IC<2=7dn61bwP%||gNsdgjr(lE5D+X4ie4WEI5wj<4qA%}IX{=w#
zTFq`d;GXG3m3Okrrt7C@xrZHiAyfT_C&o7)4_X+)fUTK03Bex;z4uJ=8;vsn=G$E=
z{K--H2JJtO{#@DFgUQ~HhKNefGoKl|72o~!{5O)}>I)UX!4&Bq|8rx1%1Ob#%Qkz!
zMO3grsF9&xF8*CbZriV3Z|&RdoDOep@TGLb4^P0vcQAsc;Gyq)*8H^PmGNE|e~?LH
z=T3ui-{oq~#mg|vN2cjX&pu=I7}D{!)yRj&t7ODOq&GsY_?$>~cB0w<1^w*daUK(b
zj!LK_@j91VF%nB)j(EzA<>;d&+hIYD;rRDpaTdgn)yzFQ%O}u#LhFGy&6F3TO>7T0
z>B1-1Y&?QjTAd!&7^l3Q@&(NUS1$@NaneUtywx!~uklzQWmQ~brsxggFN)dOJqMx^
z7l*%Z=IS36ss+BSsf(3d&JZXzgempj$5q?*&Z<?<@S7o3zZ6a$K8D{2zQQRbeozbw
z@vJ1wmy*KfkXu5ss7L=m9L%ZwaUlt31irCFodvRcOU99V*a|y6Y@AF1&wBN{nTvfa
zP#{NGUB%*;f7GiXbPJT_Ab6I~>KJt=Ys{dYYSW9e+Vi8JufO^H+lPm#$2^CK`K}4B
zlCdB0IScmWU0UQ>$Iz)mkB48i9M}@UGfX?r?73^ER^0V|Pca4~$zwuJ3GMm4-j6E&
z+x_{8FX`u^*R<;D^4`Nc(jz=;7Z}ODmlTd~TvMR)8lwfWhVjRs`{pcR=qtacfGqK5
zwwB6!Qbx3y!!d7<KL;z-ISSU7_6LEuq=b!EWcK&=J22E;_2=yD_Bv<`aeyt9r7AQh
zzv|)#L&~?lb5`s4QXU!SPbJvif!)1$gztDP9S+%lSh9$TLy8X_NTiFAaw7XIZ^H29
z0)!(llVm7oakp^QoI|UUG6QyO(Wh&#Hj;&;|3*EkUt&(9Kx&64?^8aTDfD1yh@dv1
zzzro)h#Erj&PKu94+S>3SigYhWzMgW@0LQ?r@?Nm0O27Pb$3{5aq5T>wiH`&Cf@kp
z`FL2GJI+Kf141LCru9=XUconJf(P1ipWU`wBA-jt9_IEH8V2d!GeS=U1<Xq#W5@fF
z=STq7g?nu?hNjje&ef3yyT*jOM-LmBn0frj6{36-sj`R6_XkHjOir0FamB|R4m=J>
zkjF$fy+62I2me%FRQ>a2ety=Q(RTj)CS)5YR@;~=6(?0FZrN>z$yXSkGCr&<pL||%
zqVuy7W1UgON2&II)B@mIqgz`wmx;6PG&CNBtl$Ez>6Z+d$^^8<p8L-{wJPwO{De-}
z%cKY)r)FC*9!)vf|47HF#08Yu;0?jPf#WVvxr2b@aBH#0TM6+o<2+B9Uk+W@awd4T
z#(7HQN!MeV=Y)S-CNyP)=aY$0Q%hJPK~^dfB54hrE_bZbw|CjkKa$yI`%S=HmX$B8
zIX+d{=Aj|(=G5X{eyFAl_Sx*U5fk3!$)SR^S;O#eks6_2eO?zVUb_c{7Mt*&V7e^5
zqn5#KArn3#V+HnT@h@+_BB0l-%;}Nx&ZBos-aj=mNH@#ITy0)KLafZ}-`-+Sz0Uzu
z?=G0Va=fGL1s?G=)^1|G_q{m0pQHWK5AJZc3T`xnLSE4V?nw=gF<Q!S+-MEcDanm<
zU9=*`2Y3TUGHMPLvOZ7k7W`tAn)r>L+uQyt*)xTJK}q`rFlD7L?yEotd{QYz9VvCu
zIk2|N?XX8cp{TGe9W<JTlK$My%irnt6!KL=Q^K`_NSrC-q=N$SnFv91lv<*aJrtcZ
z|Ae4bU2<tN{PpmdjuK4tB-mn2+1YWe<eSu%1y7tKGG^qve#fd&^}za8!#$H!o;^ra
z^~T*=I@F;oca+6NfG-nTH&Lm`4ABIN)O3ARSaKf4<cpV5dlR~}#>ZOi>z_}t?cb`h
zI&vN`4W2V%%}F#IcefNA8wsUQu@uU*8Xk_qWlXJ7VKuJO`uFEKvb<iMz*YxJolX-e
zj%&>!w+vV~y>!)G@e1D=>2Ah57Z&+`3YLh6r5Szrh}zBcW8S`}x}7=oo@D0N5I|ie
zeL1k2vCpMr%*sSC*i^r%p|RF7DJHv8|0O<r5WXptxovr|wlY2cfss@FQ7Ppa1Zwi1
z7ULrFStbAReNj?ej>_tpvdOl*gncT)TrX}>d~FG%3r5lwCL4+B0}!>mSGI=kM{`ej
zuTihnJ$h7jDz8lFLb#lgB0a7Rqfkeh-J51gEE1&Jl$u%{eys|2$`Ez!^wq_Sc=3c$
z`!f_vn>UUo&U^9N&8yIvWd>02@>$WBgZ@11f|j<pDHxGVAi>hDHwtE&!^0W8x6$eB
z+r{<3{^R=F9n_mwNrr(ytAC@0V4tYa6UF);HBqZD@VdZ2mv>j9d4^wi`MQo|E?fU3
zpM5>hmJe9nbrw*aaQEc((By1M8B{FQe#!ba0cd|YidIs7;aYzhPx1yjVG+OmU#)#*
zR2*HqWfClSa00>IU4pwqW5M0sU4uI$IE_05cXxMpZ`|E&I`8}4wPwxS`)Ahludc3I
zRi{o>pL3r5?7g4Fh+y<f?~YxVjiUWi*YzEaw~ebu+t*~Iffb(H^or`YCQ~=70f+YY
z0NtyOb@vo;{8c*_0$?#ebM1qV4@xut^}Flh^^W1oO26skx)TF9KF4dylgL-Rc|T)n
zr<fCAiu*PeP~k)HCg@jz)IF7Z_`&@sT24r_d-(`e==jL&bJ8ZCIb76G@JRe)jQ975
zdUn(>imhJnpxx4H?5Uc_mh0mK$@nd0nFA(0j*`Pj5y@Yq_^YBk4e?J7@K896&7-v{
zbu|?F!c9dH#;{K=WOfaYOqOvsZe_}DsIv`^mq$d?dWAXPWr`a<BXYr=%voJxW>E-5
z^bGa?N+-8WQ_;l=y2WF~Fe5}E`!jDaTRO0|)TiPJFPkD34z-|wMz60Vjs{iC$Y+Y-
zEXrL(7dR_G5tW`W3!|GQ0QXBsOGxl?ZOHW9<ju!b(aj4h+1sbXgZV~_uD+#k{eJws
zRZW^A@!293%XEbmuzs&w+P2?Ou+G7^MpN4HEWLg0_SD62akEpAog}AWb0mx3at}X4
zYZTu`_hV6W{h6)xdKIANc@8M>J~^d0rt+-z8TMviFYj9BJdBn+zPpRAuz!voQbLZY
zXn8`*+<$&|!2|F<i27Vj>nj!wYHJO<`rH_|*KU8sw<+$PC$=SK3Rv3-Brtw^n~K>m
zH9+*RWJ}OIH^^<kXwhUbN3f4w*TZujBYJ`kW}Z^y%|Q7$%f-7q>NPFy)oeaMNC6FE
zoE<;XT%lM?1@ORX&1Q>5mG_Eev#&u%jFLNSyNssLI|nR%*4)nffQTa_3YD_|l`*xh
zb^uL){;{73sL4&`yh1sNlj0*`5P2rR@VI-6ZuUVI#f1z@Rh(c*NWi-D%muvQ0L8+F
z3j>6%<CM<17e9@~DGs)HSKgLX_wmW7>I@LC?{%zmrhUIPL3gOwlL~%lORFNLmlQiW
z9x>Bil8`kW>RtP-!ozlIM%^&AMJs@NX{bB(((X7T<Cv+E1kV*DE4!OK8z(eR#wf<5
zT9T25J5@vxWF3VQoAS0R!q62g_R0J3ElPwGN$vyh{1ds^%~sXpq?(qp>IxMX*##m>
z81mGqx*yxj;E>U$C<l<0ATN3P$(WE9m!QI^L~)YOI7x?RC=ACt7IJ~&A>eJ6z|F#t
zuERsvXF@{@$O^UVmIPC5b`A~4a!<~jP)P)8<8`vJ&L=2PMxU@d+gY*3UWQ<W!C1{F
zpDq6EtpE|Oz;9jIdP54kP?oLUmO<wO?-6@5U*5^GE<#><23?w<z-6JLv^!!N!tuT%
z5iVJ1nBoe<cP&|#coLhg779<P2^45;;J-?Z`muQaCVq171^dkV9{Q?-9K-Wi@bZ$`
z7--I<s-nc)w6UlxwtFQif<vQLwJfcwPv)Aroni&dkpi;QhTKuBRA_Y#&pAWhX~~g2
zp<jxi)(wT?6VA&Xm-}4`;2%cCLQY~+G2?RD%QBUz2-BvyBk-EEgz+Ml1p*M7<wU{;
z)oFyZ>=YHyg|yaX<UTQQ7OodIOivo8d%>vKekgIB)<)9YLnevtgy$rOk}Y|MBF`x6
zIynXfNxpMv@II7fjIf6$DRY@?Z+C(ga#-kknucXa6Oh8U_Tav)+0R<A;V4mAT8^3h
zeECr_S)o35dioe|ZP9JK()lETh_A_VnT>uh8V|Mxu<!o;1>`?Sy;N@ta(EtNhL#V#
zzgi@@rPXd$#u3u0mU~g$Xc^dA+cwNw$J;)rVtV88Nc*kuu*DK$4p!nSQzx({eo2Bo
z^Z=`yn952^X{(tV1_2M?p!F|aB2m~IR>}DY)>Hr8?A=X6DMbG=FgWf{TMVW={`;G?
zl@&3q2~%SGnE%q!l{5G#vpet*F3Ifjb0@nYj}1&Vi!AK>d*&KF6-*;jX;FpH5oSsp
z(++r5UD3oX3v)y;@bN1_bbb+AJx>@^N-HlZ2tI^`vS5H>gwPng^U!9mYWwg=--X>M
zs;l&bR@w04`^-0LUvD)W$<PrhN+~pOTd|SD1YBI6Vyd<cM~BA^tgIrLHf^!?v%DPW
za|gB_>^WUtI1OcZ{tIwWWKaCQ^?l|x4RLfhm}z=Jd2}4y{zG^N0s`rKaRP#oJQ<>Y
z!}_H9o0RdxKL+#IcHgQ^1YPE_YierTTxs!;X7*c+?7d`;!v2GExDP60)G)tG>WZUO
zn;P4{aE=n=p$^E&5Petphl)o;@2#$WxakUF=jNuFX-I1a%SIu4PD(E~f=y(a)4_-|
zSb_z*f{WOGpOA7D2jFzL8OVSZMGnE8|8HlbVh*ru?L0G6lt*T^5EK39w4{u3LqW{+
z|Jmx@>7)#7Y#kjXFdkO9#)6me@;KCWxSj?$M)BPX18UuUHKjGJVZT?$fP3u=h?y;b
zI(%t#s0D7j+p_WL4-e~*;M>C;!S`g|n34(_eaXAb?_L*lIWRfBZ}FgqAho>VPHUR;
z{FA%mMsjh)JkHj4sQS08-)nIcENeX^$B|a;z9cQ;44urjWBRUU1U=R7uz!&)f6$>S
z(LM0^;igVCcPy~Wo1vA53ZcDA)3YY!8cS9G<$;ZsUZ)#zND%t%g4)|QCe2e%`D^9E
ztU`fDxOm6CVaB>=;8c^xm2L9G=H{%VIP!^sV-0Y9>e{#N&r3_={q^gO)W619kbU=>
z0q(Tp9l$2>C-=uW?^Z{r<^$KXTwk2cTUD6QlaBB{j@7|#vP{rvfIjpD6V=|@mGLlU
zdv}lSGu1@2(b>1Kse3Ql*M}WD4&Sf3C9GGA-YMZZ!=356t_m&@D02s&VRR8LE_`{q
z{HC0eZb^J!;W_}?;(|Iz-`yR*`rKmiybu8F?XnRk7Lx4e{Lzv5pIi|LK5xEu>A-cI
z8O)jP<qAO+`((UK-7mfz6`iF21B;FZ5T|UQwi%#E(?v+&yQelFw~F3u>i4r4-hC@?
zeL};=!bzzZ+nWgEzdmzEtVkQ7Na)Mcd2w}#Njr7?fu8tIb5Fn6)%=5dDdwZ*nCnIP
z>cH!p&xgG=`B6J(Hsmurs5yi7y917<^8&0QcRq>N#C)sQLM*ofzw~dA4mMBZ_u9{J
z$7jz_&*Fj!rh4m@fg*pO+-PJZd#+h|BT#e!ODTsE9c!(#FiGRVa+keaH(B^dAlWq2
zBX(cMJ9XBbPE=F}AAtbpdq^Su-ni!G5*?t@7abdKb4XV_#Z?*>o;fZL=_NSblSSW_
zb@+@@tL`G)+%yU2#FViDyTt*|of;eO+h*3zzt{c1@^HmTU3(oh%3Gbpt8FWD8mp3d
z-YWhTKQQglaYDcDs*#!^#<Js;GBdrl9N~;aT-0NA>*6;HzAq=vBNTF3jAH%O2v4&{
z-<$kT@dlp0kFXI!p<hkT*V{yhQNXY$DdqULfj4x+i-Sveo&}UUek{>ffU7*~eO=A5
z4?f<`#RZX$u5O><Z>1Tn_3x!)b~{w;wr=5L?hE$k&2?_7ca9w$1ViCMp(&)OVRj>Q
z4Zp~+et^+ZQ2yB_3;%u?!wXG@Ey33By$=9!F#)zDDEJCJPG&n`R$~m_MDaywdjQ3o
zH-$IJPpOHzYw<+_@AuvmoUcR)uDlE5YeQWqgtknNe|(;hqPq3?J&__E#G|F|WQckr
zSxv{knT!F+z#}JQUkVNP^CyI|Z|+e8f7(Yhckk_NPfhR@g`c>>0hL|Xj!5mUibjBI
z*CnmDAM@7jA?_Az2n0F%NgIWC2>u{5-JkP=9PVb<zRay0ogJ?mk6ydD8+*%X3W~Xh
zM<5dZRq)F9?<FngX-y^)32sqA4!@n(qWTCf8C=G@9=^guT^H~R$+j<zo!=uFmnRjG
zp94Q(`W{)#p0{?xZ}DgBOVSCYHO*&Qn;cH(Pk#Yb--2Dn9G_1cq~*~;%*+t$r{ZDl
z*ami823JY61{o&J=G7^lpv!HhCtYu##0lkq@iQz@Z-|AJl?;v`cpN3D-;VrtvYj7*
za#c=6_^zZH7e~ctvQH0s>SzsrbVNmX+4`OljlY#_#qsy;4Mko>Xo)rm?`r7gxxZm)
zecIzD{W#a^Zq#wjyf(oz@&0#}HvQ}KmI}HSUX^2pX!Sr;{-T_;GEnI=5g#RsW7g0m
z3ewr>)+T`oORC|wI6f01dSc0Dt%jNcPXkE%Gh&wf@w!GUD6@~V<mjo0aJAD~Allx~
zT&mNj%YtR<*C^w{p(EmVkvc742cw`yv%|z1A0@QZqlInS(5f~QGK@E!*bg{p><zf7
zlI=wd7-8~I;VdEsFVXlGr|dlY3T&AFOfOo09Ilx(N7c}A$2It6M;s3=S0yN+NrgBg
zBJ5rA3`J>odd%qx8XJ=h`hrWygkmY_?hLHfp?Q#kKp+EJ7vwH82Vf95YSvyXOT6JJ
zm9r3LA`}WJO9q99eTYL?FrZVpxRFT*fbTv>d2+L)(}b#^anXMbZAWCnC1*rDh^`I4
zuTO;<$AkHLwA9oZ!p76%5i>P4QT~IiNn3<9I4m5xbdG{-<BY#KuH*7PWN(TmC8<?*
zKWN~nT>q1F@BdG(0OVAQzKr1jJG11gI4ONMt+gPPXUDs;yu1i<R<xM6&za|(T#xEn
z>mIL{r3E-ED$R`-_n@*JAefw3;x5k5_i88+thC|6QphfjU<v|gw8PMdtg$Y&f~vcf
zN>Ylm@ij>DXX{V%ti53`$GN-?DRS8Nl+^Z&r8RL=RSpl9j`|2v+|D}hzKFTva@YS*
zLf`1?r{+I$;OAapmj@o0<W{6Y{z7;zDmoOg-sr8jzKti>xGaTtI5g_R&c?y=6Rn%&
zmf2omTEgwLR;{FjQwd3mHj5QW!Yv_TH1{MwD5_MPLXn;rQ1u%#0DFY!T|3Dt(+p6Y
zcb!+~Qo@BB<mO~s=HMA>KTunN18A`K$zkf=qX6qc_nui62i3VEcu0aH;$y}sgQcSi
zMy1exRnF~7h8Ok}auT20p>eT_8=wb{*aM>uWHE<FuCo~=+<>-TxpQGX76qL~{VuM2
z2%=#HooYvUzwql_$q2s^Rno|n8&LQz>)7Ir&?G4t%^E76p#LUDm1K}Htln~<L{E`X
zI~h?INt5tWY^J0&P3Q})();SV4-qkJM@@c14%MQLI7JB?djsW)GC|j;ZIhiPkiBY5
zJ~uO-(VJhHfEI{5zbUOUy~)JVjuEHt^}~m?oV{6ys6M`L=>YZ@BRAs!L?HQay;V$d
z<4P$7PEj{5eRh3rM0xqfv?8y$Pl|C+E51KDLzjH0yf`lzFIy?RNlp%5=JYVROQ2Ao
zi*gPuJ8EP`8jGbp+p(Rkg92eL;XgT}hXYbH6x5xZnPPxPuZX%ZZ^_lOnU*6~!?ITG
zja(kNb2$)gV)DpI!2e+=oBC^hkE)+`mAsbK)}6B_IsQzNyh(7zskR8o=}Gu8CEbYW
zlh&^Y$y9d{#G}g}veURXpjs-m@QA9_y5Dbc8O8I5EP`T=2F3~ito;9kjx*X54XU?!
zx-(?*Q#i}pxdpsJ24-eQdx!9oW%Wwsc`eyd;dn}UaTy{+#$>Rc(osGbXs?9rB<W8L
z9KecEQa32&$u<<Lcur$V2g2T9+m%yGHMA6b@O0;E^E;FIp#V_$&D6$rW0Lq4O$2pF
zvPI@6wJm>ium$=d9u|mqOiq{ES;l8a`}5^TsmV1Q0|{-BLsp7Pvq-pd=%6dJ&$^-*
zxV(b#KR*dr5Xupwb%1_TW{DO;k-w69md^Av&vP2fa(_;~?e&*CEBy)xR~wd+_pC=V
zi$YyUFyLQ_Gb1i@vsj)|w#n^L|H%#-XwP}{&SYOxtZmksq_VQ09$?KNojaiStIW~a
z$s5uYnpF2I%!lmgNnQ^Q`w0ESZLgupVjWBB7d9Oq{K6a*Pa%<48o7Roay2q)7KSEi
z#&j@S`28vrO+0BGtG}oDqcw5&m#iqK$;HZaJ093P?9e<lc6Z+!HVDzxbeen-A~{_2
zeAvJ*1fkh{9?i|6q|gU8_cP19B3l|9WE#m_YP3?~(j34XAsG!iF}z>Eo87gA!Tz5}
zE%g2!O$2ZyEI$fhi<K>SctpC_Y9H=D1fgw}_J-w@XVu{$l$`8OjwKU9nPC&JuL$qY
zt2}+2QRfH`_G&>C_WZe*<=-+J$c2&3U?ISC)U-$vp<yXhNSC#$Di>4(*I^7V7YAK8
z|C7k~t1KN-WFgN;G#*D6FZrDayt?uHC&@@4WVYK8FNi&BDw`yuoZggNvJXbWEMkyM
zsK%3I>Wc26OpGvmLxIVhHV>z!A!yhR!_vY(8P`feK_T?e*wmQl@AMmlWm{-6hBIG!
zJ@s|MbS{`3NS?mRNVSJ@Zqr}mK}MsZya}Mq^?1Fy6v$?02>2Ni{wM0@AhD+1<&jFi
zM@>Ug-N%2PjYeHzF1o%oRx~a`0Vp&auce4xxiZeTu1}ro@JLJ?g;A<@nqN{G+k$xH
zXn`rKKqiZuDC~(*qFS!Ed&Kq0Gnl?uwu0$<k+b<_OX{JlKlz57WKKfAJgc`mX>2cX
z)#wJf)Tss+?u$r-oD<tImAVb->bJo(qgYZDZu3^Z`cUSP4{v2DH4|}dkicigrO|^p
zSdg%VlbANw-hD0ViL@;2iAGtp|CPoth;JTh=g+B7Yf|a44Q(R989E4|_RWe#I*C3Z
z_+e7SylO)<w>WI$X>?!RT6%J~zM5QdD7w?>2c11RzVC}Yx~O2jV)}A-Hk{QPv%e1+
ziwcWah$Y!rfrrMb=oeVUee*mPREmUQV+C_I*}8crG6u{}dsB#lf@n#suIOonV|_zU
zf=hI4sbllvF$&g4gQYM=Ivs{FUV8y)zcL`A4H&r)`Gl|4ZiA|UC+7I|&WO8hSMvg$
zv_Qv>d)j|yNzy!mAmjx5pQ+m)w2Ogm_?z){OQn^KC=%CYl62wrS->CkXnlnF4a2)}
zrFAeS|1(p~Ahsw`FBz>^gDV@GrxSYOT#cX*2q8YJq$$D3oHytn(h@jCH0=*1x%d=)
z4Gh6geTTA|PG({0cWqSHUVsqYomIsm{I76RgsWfE8?tN~Nodr_q09R3YUtlU68z=A
z1YrB-!7&P>CT9r?7h$3czc`*Jde^<uIgs#)oVD1~z6g0O%8;XF%S+(=Rg)1o^QHA9
z^aJ!YjCR78dcK9XcOCnV_qm<Yt!iADf~NSt91?5-iji$FuHNbs#~NVNcMnY-99C$Q
z7cM(<b;)i6sPR|0sn1b~AU{Ya(&`Vzl1=|@%8Qxm;V>>O?HG4=s%NI*#ELlQZy4nE
zxq&nuk^-^?{dr6Gw<W&d@xtaJX1kSPPpXzzuJR!T2r8s=U%xVbGo$;RA({J&K`xTi
z^Nqo?>oHksh=w&_&)H<V(kHVF#h$%kGMW1xy%67f?X%}8%hAR~7vKWP-~NCN$5LZI
z`d%a8Os4Alg7%HSJ(B|o$v)C**4G|mftI;SfE#}Ob@8#Rb@*pnK{WH663<f`!S&5L
zN#yukoNtd8G)$o!mxmr!YU<pL&d>OQ;f@GT{tdu6YnKIMZ3ag6%?7+GUw6+V|2ECB
zr-{=C?zQ88tXClWkm&=>Dohl%=4f&7$nC9=G@Qd9R#5I*S(9FH`CN3a$6Izs;_1AC
zLOSl0GVq30zoX`!KdL=l4jnW7e+^34F3@2noYHNZLqdknvj|}ndtOhhY&K09@FZO^
z_^*r=Cqy20WW^jDt_HvQq?D~ZH9baTZUfW4?Tz7)wVpoDh8PseRg9B_c-OvF`lW+|
zrOIJ93gp)jZFGA1Y?ZDpRfyR)Jqp{lh2!tC&pWGj$Uk%e9ni{*57QHuZ=0hlVAe?>
zcy$PnqW*3cb9Z%8W6S99ExF}^$CNV(Kpi33_HcfJ|NS^2yYfZ1$+Zh<zHE8O2Vv2o
zJ-~IB@9h2_g7G}qAh@K&-R_*S2=ls5ykp3lqfKD!TJWfW*7%sety38Jgr~)h^&M&c
zRT|coO{MDWkz{90xr^le>c<`b#W@cz!VY$mwGWN1dr^pf`DQ&(-0cAO+WqDu@@)v=
zelQ%q_XR#&rnwPv${|+0!@DpqLXN@KhEH5b$0eDL?`GjmdhNkf*TUk`>R69w3?tXQ
z*dKiL5pQtJ*=$<i$y;cdiSC-X@p0vk9gibq@`w-#_`eK}O}<))Y2#C9dPAu)G<}S7
z0m8%}I^MXkJ6@F&b#x96D05-znhNpXYgLzrxAI`~u{t0Dv`5n$I%_mD^xi2MxjN%I
zqM6SVQ8A6kCGj2*xdCaA%s9rb=;a!2eeQK*{+e&mmdIy%$JgQ?u)Ulq0LTn`wuz%-
zv`%1frz7_84R7nVog|MKaB-7;)6?^;yKNW!8|u4^%=@vb#C>&)!)6NJ%^vNpBm9p-
zdau09HP4v50rBXQ?ZX4g>#MyC;pcB#Wf1c6Pp)3`oLJaf0!||9LEtf_7lDn0I=sda
zF`3VqPD~rAxX1RYUz)+r>FkFWXq&)vJq&+u72u#GiLY7|@*RC`WaK#}uH{05?^RWr
z(`UzeeX%3yfLr`~jiaX6e}a7?%02rZa`+2A&kB6pRBp_TG2bu_v)H|MKE*63{jRa2
zKeFuT&DA{r+M!zJzkbQ0E5?}ybn`x><>c9A%Zz^`mqm_@W=sZ3>x>smPqYm6d+Sne
z0c9L_X-D;M`W($OQ8Hfj*={pCLaKq{?s_{IpT_u!E{;&#DgN3ap`sW5=8XZQ!l(H1
z^sn!Oof;_Q41M+)&s*zaRxJ}9l-?4Gl--Lq+=I>*-Ug@8;t<|`bKD&bzJvR^NfKUL
zyVdzd29vA%Z9k{z{SYa9uieFEZ6Y_|8$Ms}@o|Zp74Xu_oj`&lirGsqP<dnGao8#8
zSRs9cXTO?IoDGHW$F=$|mhLwtxxTk=$L*J{t+zcE_+ET#+Am8$adqeDQwS!P_dmba
zIuxtqi?i-<>5=#@cr)<hIdZ{69Mg=~jrPP+jl#qyWsk(wtM4}LU4eYANKGDS3#sqG
zj?o2&lZit~ewVqZc&~Yxc6)rs{n2f(8N^m%Y^plv^F(CqSlW{5n*$QxwPOZ${pRCc
zQsY=WRYLJzb*B;Ger<|10e6Oy{mK#dAiu&d<-?|VH<P)c*}>1nt;bDwv=J#Vna{pU
z9T)g#&(hxHSbqjt=!pT~MwgFgA4Is?l~Lp2z;~Dx>Rmu(aM>v~rg}nskGz=oa{`Vt
zt#yTy9o_rz7FuUE(P}y5c#D5uY>4S8k{^1O2ag)bzfBg0XsOE^Enr1e>HMZ3eNTL&
z_I3Gst4iL(V_#&vo);5nUv3g;A!9=}cA_q3L}2*)ZyVO_Tq1D(2fXBZCQXlNIAia;
zy6L5)bj1t#de#D)Ph^6j1918^vH|xLeiBDjL*4Ad2mJ8AH3A;Vk*(hV!S~P?r5i(j
zEb1G=05Htw^=J6l?9~LxLh;-BJ9<p%`(cyz3X^l_#yuU#PyC%lTb<_yF4gw}{z)uF
zBRi6>Z(bf2dG?*+ZVCnZIm1AlayY%vo%ei=FBjcwOLNtA2BSz^TrwZ2>iL~rg6%Ih
zpPXG?-csduk{k8sy6Mr8!~UumU;OSRaSbNsBjY~Kh=@GT)>=U8!_5c+K1}t#g4;3T
zH}9$lZ{e$FpYzOt-6Yj<(c=mB8mB|WzXZWANl`KF$Bz$8(b4VqM`KOXy`Y%P0v0zH
zdQ}E>8J#;Ov1mz&e_i+G`JT%6w?iH?_gz_P^FGYHd^0gVQ#t07+^Sn(^d0}~`_d!b
zn%wLU@H*0Pq8RtjxMjkmWpaG&rrEkkJvm+)SP?f4_{U^Si;}>5;hJ>GanErqmh7<e
z;f&FDbz|h%wr^m<A$Vzr{(&^&FD3*XE55#S+g5RXm#J7y)(0ck{8u`zWn(fsL^}|J
z4~n`VT2JOpT^fkCKZ&P`W^$^GNkTd^ytCpY*B<)|t$s-omrolEm<j5o`W<UHV6^=g
zQ8NGEaKOLKQ4%Fav1!`Htgf!kWBQkuC?v!7zd>z(t1uY+0o!mhdDeS5f3|NLOeFui
zqze2p1Kn4}gpG?Emk8dzY~Ohn3LT;SH!lGm<;?>OR4^T&Q@?<E68;CAsWOXFmatcp
z9yFk1)wLFv=42X=>B-brP9IzKAsS>5Uii3wBJt(euHfC)R^MVT9L1@iu;w|pP<@^X
zC7M3Tc-R5m6RNID2bF?cAywXrT?)Ro`jvjfyZ&QKo8KT*nlbZ9-`?jhuM!*KE+_3e
zvHLeC*n))^0D$6M%*bTWqA!2Z{ZBB*l-_ySSlM>Dw?Ot*894U~oZEhq{cD5X;I1ft
zjQj=o0*iJ`UI{b1->kLfFmG#Np!DjI2E|mrP@31B`G`7~T-mg?D1)=am-LEdMCY<E
zj(agKTHEJ0HzQm+5H*KF=z>!3T}mTj3lbV95gaU*M+u+OwCq{`(gb-o`5Dm#w|zbA
z0|8=VCD-eXj#LWYvVYH6>Kz+cNDfjgoKiBX(yNNsV=odk?AH2=ugK?3$i!I|h%5l~
z6cr<#VGdYmd(u3kN5;kmte6ZHtT-)SS?MP7E9^<KvB41Es50wE10n)B%YskEi*|J)
z5+;9g*li*3Lxk+@nJ`;I^qiUj`=t6E@GWdgL$zGRh<(!pSM>(rG(y{RqehLGmQ@al
zyX2A;6XAVZxn0%+idr&NV6@FRhb#WzN<m+V`G+D61|n~YyUBb_{l^C0Hm`^=S!v3j
z95w5G>{xWacOI&V1sRaYUOmd>bem=A>poz^PEAkuJnw#q8uA-xL)h+fdC8xNEg2Dw
zD<M%W*#>d%giWp=m;$bZ#)Z>uu*#sz6e8w}pot-01-ngaV<^I0pe{oAc6x%<KKn{z
zO|h6oh$LaDMnvD<%E8euZ?9r+Wo7CafuO{>AV}#(QqC5&!LA=kp~}R9%qcSO(s>f;
zb2ZMCBM3JzLMg*?k=kY6*eCf1^n)SUi9#(x^!i-SfG1YD{}ZRncmUy<o%e6r=$o#P
zCl+!Q7h7Z&Jmm?RG8*cxbk^6C&jX(p&(<V3&AWB#KYM5#N~L`^ZwcL}j>pJ&>Q?kF
zyFqt1TWJb-nnqv4Jw6!q>MD+UL{D^Inx5}3_`&5-?{NvBPDZdo)^}>CGSp-fz0|fU
zy~?G(uc@(y$Pcq&e`=QeFjN^64wRd{leJn=0hs4tOf(ZF$*4r$PJ*1PyJsYaYd>3a
zv7z29{`K=8^P^y7q>_KSoIfSTLENltW?4BD`P~yeH{&R!YE#YebD$h-6kACtry)nB
zC3<+lRYe6C-seBYrtlhO{Hf!=XfUKCkUTD>QcpgqB|#F*lC}Y8C39T2nKgdvq(ya2
z2Z$Q8IA|W}ck#oX)eA8*DuRTukOqNX7>l%r5Ui<%$KDXEVfZiQPN`JkQQ^VmVcw)*
zjjDN%O+&6xu&bK(p*JNMR@|;M(aDTkjy|XrBvL-kZn8y2EU{ipPmxk2j@&TD^(|-c
zRu+$02wuY)w+f;BSeOvLSu!&&T*hKB`XiU!Y--QqBZO!$9}dk)qZgjY`gRb7N5HHK
zr(K;G)9&$4k-bfZnz9oc|0$>YKWm3Q`z|1-MKF2VjiRkzWHDwW!{-&V&+opM^S}s;
zJ~aY56Sr{2Z_T7<3$}n?y7n;{^ihk3x(G3N!*PYw^R@8^#EH|Yc7tZUv|BQG!p*Mr
z#t2LNaH`T8ha?u)#%ERUgxmK1mP)$3)tBOasuDs0Htpo=`Go&X1xy~wT3n68PhHK@
z_d>!wquTC76XEh|Ji%ZMcHW8cZ500uEm(z>l~S;_`=?k)3y10V*&ptv+ntt)Mw#4x
zBbvTSUIEIZ&Mx{-C=f29fXw$#80>ZAwRzZ5Y3TZFIFU_^wG<+*voa|Lg_PIX&_A2L
z6)uHhlI-q2T2;WJ$}K9$`4p>AM5Fm`q)+raE96j7QadX)Rt2AG!<I_Lcb0QDg{Qw9
zeya5Nx@&9_i8Hw*J!pMiz>opi2K^7kCuO`nO;i&%tT)aM)ZXo&q8@pm-oN(fd_(#V
zaEe`-I_D&oLn?uad`6t1DdpW1^a&AL+eD*ec`2?kTWeI99j(oYm7}^&T-LlPiM_&{
z=R_O=-%A1J4T+mvHXf-VU_Aac53v!UB|Alc)2}ZFDkpF`gs}y_P~|vQ|7f1IXBpGS
zk}XHFSHi;YViqFvlP8;IE7U>QB*?Cs$*6D$r*LjTRNos$779l~B<xQeX)`Y?g_adO
z)qx~x1o@;T>*m$WmPgEj=8l1NJ5p4AeBCav_!t{rL1|7>!5YmaF4!#VldW2Ic5WE4
zH5lxW>nKJG1Y@-Y9{z};W^ru~H1n18jZx&Oi5XGOCsb=fo%*C-%{#Z`6f|vxGZD7S
zu5w*$N%9UP#r&0jC~q;Cb(sTse0jrLfYWDO;q|q83x!EbyT!z2f5;Z~#PH1ZokbDx
zf)Lf#=FmBh%yinJJarMrfKv5~Hl1o<_d3Eutq8e7!3s@j<GmliQX61t$!D0<Vn-WM
z(~7)lo30{B)r?eJ;GtZKdfj}?esANh8h86oB!K4U8qC-#N-EwjArBe!vnv`GSZ0Jc
zSq60>SxYgp$Qr`1yNJf<U)e~Tc}j~`q$)rK9|+fF8?vM5Y|wCsYdNVeZsS2LxC&Z)
z=%yY7<#t6>RIUo;GABI<PM}L?gL3O`zC%YgOf7NQ#z0v-S@gW_hqNEF7^hj&<%Z6B
z$dWZ*5haOFiR6!%?4h4+^S&<hLyptoEk@!P5FyiO^Ifg*pqsNEz>O4Hm-OYyqTZEt
z&Q*r&@?GcMOT_;i5O#Ctl~s9l%dfBcF2J)PX&mR7!$IX}hcdl*k@8b*pX!tz13YV^
z1X*%S&CbR@Hu$wTn_{uf6(~v}zCsG2<g9%pCg%>9^X{5wND2K#h_yy_&8jdjKk?^<
z4`*SuuM9jb#X-vzJI-y-;gr#9n}=q44Q578Z<TbGt5MR|+dVh)#<inKQ?dw8+|lR!
zc5&%*j!)bLZ2TyiV_LVexXm+<y@77yw1!IrXPI2B^WJwNi)T#RG1<1Sf#tWT5cb#>
zrnhB>Qj@1Ycn=qx6k=S%CpXn3wQJ*->G;y(I`qP(*6{O-T3Khxj797<IGyijYesGK
z0E9|YVZmmA_%y{w**mC%ak|`93mFFCl1vj#3q}l#UvKoRdhC{xz5nvDgv!zn?VUA9
z#1M-R$!EPkF1O^6PGxZ%O=L;f<Oo!JjLP^F=W+!%-PkW)?SOVhO!p<10z12CRqi)?
zn~lclbNnHi{wH4Ow36`Y=lK6%@HPgdp(1nWz!|zCrer3>Tc%&bwNcB_N|F^F{mN4A
zlKy&>4$y-9GL|tP_o-QyM;%X_8Be_>CpC)7*{2TGg@2I5S2VQkGZpo#{ZxQBfTx@U
zthI}>Bg^`51mCfhs-Y31AXa(=g=FO1TAAA!rh7T0_Wxv>6P7kjRzqd=*mi52r&X*>
zKe%U0R5S^nT#tK{pTv?klHo6)(+DQQAme)@A1f@q>1{X9>V&*J$U{c6{;1*#p*f$r
zw5{HCBv7E3f<w4@JB0>dyyfH&bInS6aqw)$)zA#o9wJ+v3MsEe5C*{WhB=A0@#YoG
z>U=P*d>8X4QXEN(H_-{vp(>PVixALdt^tZBGe0Y~$HtK3r_Kh%XBCc%Mq~q_#XsT@
zqWm%F1AgF2$|R4mmXeTBr4%+xOe%<RFEn=r6NKy~<#TBm4cTKB><)NWs)CL_Nnt=}
zLeM>g=~dHU&t1a*u*qp*>;2UnI&BW!^?xNUVjm-;;|6;x+(_Zfrp*2PBncMM@#pLM
zsVtWTJ4-1rog7TZda>g3OCjq_x&7uT?X{`yYIwuQr^5>i@ML${xzeD_NPJFcfEyj*
zT-KOlQ0d(T1r9Ptk}CjTrgL9%ExMIKTbtgtoP<x$)GAA5c^&s5q2zVg<amT;v(OHO
zl2cEp+y(s~wgRD)iqb_SZ>bVClns97)kCg5D{}-OMnOJJ6A_|>1+cU+s2!(fO@$2X
z2^-ogXj>N+b&e%2W8&bd7?!c<J5~&o9UNGzjR6Imq!t?b%}i%77d)c@$F}z<;sMO~
z&>^9u1?_K6`m-b2B`aYNO(VdA3p(J9UK(ffjSrs>p@BeZD5D6~Bl%}1aS2Rx0bLFh
zZCLVCC+l26Q$-eZ$&13uq<0o~_c{vepGIj9llVs}8s^{l8v}Bbsqt*aO5}r8P$^eM
z4!<K%%JzF4tR4+)BxDV?hq1Rnl|ciSogi^6)V3zG;}dFzRpOBzG~kaLlxLRJ28M%4
zgXECs#+^ccSVqPnb<dhP<Dd$|3P{(E0Ji7lJzDjt<#dUCuUcY;zG@@pDaN^`BE5`h
z9)4rg11mAgvHd=0<@UBj9U0-#@bbm8GbE0-<Nb$l$g*L?>?bCfk1Q`6ReMLuh`W5K
zSV-eiTz<de8%GKfF1n_O@to72BtMkP>oEsNle~>fJpH7e64%n?x_mph-j2wdOpyIn
zWRc*p%noH{W2d(eze(v@y_yF5XNXUu#TmR{isF)O0aFZwWW3fGR2ggQtJA&yV32&t
ztbgMCf;5#doAI!hH)zFGM`K+S15V5khka~bd98IpR%o1;4Z|!z`V>ArH62w@^d(Lu
zLIEa^+#7h$R?U>vQy#Htdlu4tBx7tcjg$UR3+N9EY%#w){|HCXjxUu)c?74i(p5R^
zgA_1{me)Za5_*3(*;JR{L++72k@nvwm5L@lPAD6eCZIHHq!z1Bg}S)Y-O@vd$@-T|
zwkR@Vm{R7a(o;D!6sHI@VmW&H$KDpI_{?cQ0DC{!ua`WtOE%gdjvd`vU20Co<u$lK
zWn9YY4VRk6M+4`SAFr0S=!9%tHgCD74Og}BKUw>nlqcSwdH5hVD-vj0;VHWv9axm~
z<&5<eNqzzUb-r<#g||AjZl)`y1Ks39qTQMuGTf!8`2>VCMd)#45)!agN=-yf`M9+C
z#+R981Qaa=xbv-Jdr7DqWHsJEJG*2(6sJJ2kuFQgGO$u^rgG{o$_XdY@a%f)oNb$H
zn?oTU$rb~*hf6Abm$ivS(5{uSWb=k9Uewd<o};>%Npk4Pg9norCl|`J49c_=UN<Ne
zN9mUbULGn6>JXZB93iG`j&?zi*-vV~=a!BzjW}pjJWlI$(~G;a?)^U`c}&~16@{lF
zp}^S|Jyx?REI0KIODHyHqGbz=+8u-GL$$p%zX>l3Pqkq<a|EZVf!Uz`J=_hk!VO<G
zGufuRClKlPDtvorR2&2ii9icGm@D%OPpWC5>X9++xEOV;C36eP9Cv4oC@I`CV#KU2
zGyBat&d{I$D{B|~q>7)zPa0A%pKcDUlyN8s5M-@g|1v9OyabXHa}R!cag!Am<J_>7
z8;$|l4t>u|3UH-mThqZsO4Mq`#Z7rKf8Z{gIV2ar3R8jB#@tjYjQYaiUc!u(D|GqR
z>+=84#NL`t|FqQb6<Te%`cU{Em)hL~TA&u=6uM%;PHgwjHJ7_fB&DwjBUmWrrFwl9
z4B9~ntJa(iHtzpjVlO}ab3{#IVl-W8-GO}WfR;s`sio&$=`{9Q8BsySkK?LU>zs<F
z6amGQ`l}MAB}U}BX)loSrBS5XRo*MrZxL(e0tm^{)Ol@)Z9o3$)Z#A|k?1Lihp~#K
zt}mqUWyPQ4*hQJ0Z5a4fQzOPt3S88aaco1eJ){zGVL4!!DP~C}d)N1sF|ARI6F<Ia
zvY19uc*3&Y>sO~tL4;+v5a-L*);(Nuxb-uz<PS9{#ll54$TBZWIyT^lrkG?dm`xRL
z2R@^1kJMs`nb~A;nv<hM<*l&e<Q06SwrrbK!J1T`N%Ntjm@s@Qhm*O}SpJ0AXssj+
zn$>|~aRH!pu`{rzL&qw30G!~Duc=rqB#i4F9kSxe)(-1r0yWK}lhthIg{Y-a@wn21
zZ|r`nJdK-i<4~2^5H0TX`8Y_VHS1R@FI3ZNC4H9^i&?TU00`4;^}6NCo=BU(i2gRg
z5yDAK0*>3gL&X^gudK<K?y;Vz6{XD2GM_x+#D;O2$zs<EFiV+QPQ>5GY8Z-GDqpBz
zO&wlNIZhW$VJ+ElK$?}%k?5uy0kU9ny_b4jz(G+B82o$4ecc*AaYtWQ8GTXTzgTre
zz5>lKu(-YS=o~hA)$gIGw5g4~b~Hm)SP~V?J=Ki;!wLooqviMcU_}*>`y8`mn%2<?
zCanwuCCIoxMMs<|(z5hz$M8qzP=YIc)_58)3sv?<F`&bgAzeGbLlCjmeZ&f`Oaki%
zSnC#NR>)AgjmwA)HpEg}^p;OEJ~wRMvd^sXi%>WGs`KH$>+SV&YV(;dH78G-{Y!FI
zUj{JN;dh|<pTQk9Z-Yw{vKA=L&wI#&_*7axiOA>9A5c<XD<0E=tS0EfA5I&$>uMX}
zCrNuAzWopxY1pbMI4HWUtZIvKgG0!_t)1171Nug0Ig+iF<IMuuetn(+-A=E@mGfdO
z{#n|rH}cO(!oWC9`I$xTssOuNSH}s*N=hPl#1j>mBRQEYKR>T%ozC|n5@17p)GUcD
zWo~w<7(Yx~<M}fieP@qhU_n`KwkGyxHB`siXVTB^-&k>vmO#{mK36>S%IZ9r-I`nZ
zjvr<%5XGdwgDq3ApIS?cl$0zEvfE65LXu0B9A9cg2}B~<LOG|~vufZ486(xEYscGM
z>Sx0zIn&(fDedJ|k?K!q&!#j?8St+)#(=>utm0+%)f8$A=93-;jIO4#kEwiOs=|oQ
ze)u3^s>u|pm0Bt#dvJ)Lp}wX%9-SCAkq(|NqXbx$BL)^yz?C@R%a?B#;aPtjbnQE!
z9YB<U?O4S5c+-Pe+0+#P?hIrHSEX5U+R_mVJg@C(2i>QOQiqA;rBC-Z_c45w;~5iU
znJr;7<3`I{IvJ;71u)j*O~I*S*Y2+=`(b$8&wYPvii|9yf-d#7iUoCi={rf@FCm}B
z$tdAq!;_@sBSpJ!LNqVu0~u`=e}9LU_bL)p(CTau{RyXv?8;F(U@@Cll1E3M){+L9
zicWvK!6lX9rN>mWkcdA4hchah^2^&Eh+>F7(MXtFlbkBe=T3Z-4ZIz9r*plzp#O7b
zn`4Wvd~Lha4y<!iIotN}<<I?0MDN4Y+*VS&l$%>wnt_Ol+Si944{8$`D(vL6KZp;d
zn8a}^$_ImS_2H0a2TWU~?Tycjd{0?!Cto~$HpW($OgHYmUKSaJ2k1vFBEfe2=@WQc
z(U!MGho<pOJMTTJ?ibe_)!>9^z$;H%ncvt%ZvpJ@6!Q){5_oLm2LX;$-v^}(KFFPv
z$7PPQ-TEL$L8x39oy{pkSsrdmTVf))32>gi`=JhHBI-YhdJt+h74?91dABjVk=)9U
zTp9;?P3^!J!aW(u&^Fdm9bv*h!k0G9jTJFmB>u!pqZws_Wqi-q7SVB}sfJpiMB&ti
zOs;FpN$c-trr3imb3ymlxjcK1Z~y`vvi)Gs#fvCg1(z&frf2~l$38<x_&t1O(-94i
zyM$=_HMd)bJw+Qbui*MH!?h|5&O`V<Td=}!(^h{4*uN#Q#xFO;FCPF+n=iX)@okWr
zCQnkBn-+(i&SABW;sofX$Bpf7K&J3q-@S>#5=@hcJwu>=Hz0ilTlB+RtMP0@;x9g0
z?p`I?joiCSY{sOV3EhFsiW2uH`DP!^mm?&fyCXav`R361y&?WE)}+*=jX^t8HUK^j
zl-S|(tt~d~>$f0x?xh*m&vRJkpz&0ss_lI20EMq$m)w8S^!vtczRA4jX(oAD%Y#wU
z`{@hJ{R5PLZ1Rp!u)YTbAeeUR>L4Kya51}EAQ5~Mtg}0l+!ol2O)A{`GvOPOI4xN+
zK;)oocX4@sIT@P%gQi3Hcmd||mBDw|Fy?%OR{SrF4`%Lqa{EN)N;ZP>x-h;!He4*-
zd)i!CM{9@r?EhAMSYpWK(eObIVqmK>bqeef9Awe{I1y<?uE=EDr6q<O#dupSLxO-*
z;8s!teD>wluCt4Wn0WDDHuVu4kL50Yy5n#s^x&_n7(QhFn>P5B^}r{1$@qSKGSliq
zZ|OkWHwEv6*cXtUS-lO<w))<e&Qn>IxprD%r|bUJcV?+GE<|id-2v-<ow0l7`1z|S
z8yRKrite`M?)?=91N()M6MFK<rx`6Iaf2e+h@tP5F#)-Z-<Aga^wo+K{nAwF0viXD
zWypoHf3f~eY4VFKaoN1Aj-_c*TyeL4JK9QzN5K?-hGp&OOy77gJv-2v7~l7ebnW85
z7C6maEmRTwlUbPBF)}|$$#{!n5HP{9seLiAs(YQu!wEnv)?fEHD|GX53QWU2>(Z=A
zc8`oT0N?&=e26a2Z(hJ>`ziHmBe2ml?eAc)>cBxk%kFtinBj8OG9<-oT<R{(vhk3I
zzLBnXDHh%aZ1CH-IvUCpUhL{Oqa|iP|B_0X!msVm<EGyaCP;#xRA>q|I&zKa!ge*;
z-}i&aB-zUR|H(mvg^@Bks%vpEx%Qv)1SaGBLo@@Qve(JP)cB*3r1U?pMkrNY&c79M
z3fRChB=GJOPH>qsaLqXrBO{~!vK4T#v#<F0d*I@QSXLR}nmj8uEr{uI6u7$oQf=f+
z@6XnF;?;x}ep_MV29$!!y*<Y*b?p0Mq%vV6L`FsZPDpTGZ-9V+csX<J*gk)MJ2&2r
z7)f;c>vqgZ0{%GR4f%t0FxjUp2P)5JgHVWJhK7dN2+)ef@m6mC2t>fg4a7{0YEG|B
z5cHOTAMsy~0SlXpm&rP_z4j)&GtIw}7Eq}WXmPaV^@C7Opy)r8(?HJSN=|kbTQbsr
zbv@(K#DO)9*rwtJK$y6jr&4rH%g6VX@0qH>J)F@U%T^&NltNM~P(u>GiAhDj)54(o
z`k@kG*>~!H|E0(+FU>jldnR6fkXS^-=Ue??OqGm*l_8R_<Cl>M+l+<Xnd{>HYxfKQ
zFW@}miHF-&u)hu|XM#4%c=t5SbsVC89y2*rQ_tQoa|XBK=4jvZ0=}lh1cf2|Q<p1Y
z`+z%ys1RF$7;^B_M;G24{2U#B-7YQ(^(GX}EQYG6Fce+|#pRIuv@$A|YxV`2`({zO
zyz=DOG&kjG#R#4{+;^ggFJYhjzJ&jzg(TBi&9o9z%9}N?xX>#)eD~2u`z@9|-+!~5
z&)-lVyFSk;!^T_cLC8u*kiOOpQvU_7V62C2LwxIg(!OVBn@F^6c2TuX)Lax$zDjkp
zVqzceNb;cXRJS&pAN&Yo5mhTfta_3>kiy>%<4!uXq)sYEW53d%UVQ>uWMy&Dl@is7
zWToFp>POjVVV6V`)NKy`REKb3?{Jpm{pjx#f^6i#bz8++vUNA;=hELt^`$(lJEcU=
t=_-`^dEg2%ytm>BXMYI}@;zPr%45QL#|-8TT+IH1q^O)oxsaa!{{s9MXL0}l

literal 0
HcmV?d00001

diff --git a/manuscript/recipes/sso-stack/keycloak.md b/manuscript/recipes/keycloak.md
similarity index 57%
rename from manuscript/recipes/sso-stack/keycloak.md
rename to manuscript/recipes/keycloak.md
index 3f75015..35547ff 100644
--- a/manuscript/recipes/sso-stack/keycloak.md
+++ b/manuscript/recipes/keycloak.md
@@ -1,7 +1,11 @@
 # KeyCloak
 
-!!! warning
-    While this could stand on its own as a standalone recipe, it's a component of the [sso-stack](/recipes/sso-stack/) "_uber-recipe_", and is written in the expectation that the entire SSO stack is being deployed.
+[KeyCloak](https://www.keycloak.org/) is "an open source identity and access management solution." Using a local database, or a variety of backends (_think [OpenLDAP](/recipes/openldap/)_), you can provide Single Sign-On (SSO) using OpenID, OAuth 2.0, and SAML.
+
+!!! important
+    Development of this recipe is sponsored by [The Common Observatory](https://www.observe.global/). Thanks guys!
+
+    [![Common Observatory](../images/common_observatory.png)](https://www.observe.global/)
 
 ![KeyCloak Screenshot](../images/keycloak.png)
 
@@ -9,7 +13,7 @@
 
 1. [Docker swarm cluster](/ha-docker-swarm/design/) with [persistent shared storage](/ha-docker-swarm/shared-storage-ceph.md)
 2. [Traefik](/ha-docker-swarm/traefik_public) configured per design
-3. DNS entry for the hostname you intend to use, pointed to your [keepalived](ha-docker-swarm/keepalived/) IP
+3. DNS entry for the hostname (_i.e. "keycloak.your-domain.com"_) you intend to use for LDAP Account Manager, pointed to your [keepalived](ha-docker-swarm/keepalived/) IP
 
 ## Preparation
 
@@ -24,12 +28,13 @@ mkdir /var/data/keycloak/database-dump
 
 ### Prepare environment
 
-Create /var/data/keycloak/keycloak.env, and populate with the following variables, customized for your own domain struction. Take care with LDAP_DOMAIN, this is core to the rest of the [sso-stack](/recipes/sso-stack/), and can't easily be changed later.
+Create ```/var/data/keycloak/keycloak.env```, and populate with the following variables, customized for your own domain structure.
+
 ```
 # Technically, this could be auto-detected, but we prefer to be prescriptive
 DB_VENDOR=postgres
 DB_DATABASE=keycloak
-DB_ADDR=db
+DB_ADDR=keycloak-db
 DB_USER=keycloak
 DB_PASSWORD=myuberpassword
 KEYCLOAK_USER=admin
@@ -39,7 +44,7 @@ KEYCLOAK_PASSWORD=ilovepasswords
 PROXY_ADDRESS_FORWARDING=true
 
 # What's our hostname?
-KEYCLOAK_HOSTNAME=cloud.example.com
+KEYCLOAK_HOSTNAME=keycloak.batcave.com
 
 # Tell Postgress what user/password to create
 POSTGRES_USER=keycloak
@@ -49,7 +54,7 @@ POSTGRES_PASSWORD=myuberpassword
 Create /var/data/keycloak/keycloak-backup.env, and populate with the following, so that your database can be backed up to the filesystem, daily:
 
 ```
-PGHOST=db
+PGHOST=keycloak-db
 PGUSER=keycloak
 PGPASSWORD=myuberpassword
 BACKUP_NUM_KEEP=7
@@ -69,28 +74,31 @@ services:
   keycloak:
     image: jboss/keycloak
     env_file: /var/data/config/keycloak/keycloak.env
+    volumes:
+      - /etc/localtime:/etc/localtime:ro    
     networks:
     - traefik_public
     deploy:
       labels:
-        - traefik.frontend.rule=Host:keycloak.cloud.example.com
+        - traefik.frontend.rule=Host:keycloak.batcave.com
         - traefik.port=8080
         - traefik.docker.network=traefik_public
 
-  db:
+  keycloak-db:
     env_file: /var/data/config/keycloak/keycloak.env
     image: postgres:10.1
     volumes:
       - /var/data/runtime/keycloak/database:/var/lib/postgresql/data
+      - /etc/localtime:/etc/localtime:ro    
     networks:
     - traefik_public
 
-  db-backup:
+  keycloak-db-backup:
     image: postgres:10.1
     env_file: /var/data/config/keycloak/keycloak-backup.env
     volumes:
       - /var/data/keycloak/database-dump:/dump
-#      - /etc/localtime:/etc/localtime:ro
+      - /etc/localtime:/etc/localtime:ro
     entrypoint: |
       bash -c 'bash -s <<EOF
       trap "break;exit" SIGHUP SIGINT SIGTERM
@@ -107,25 +115,28 @@ services:
 networks:
   traefik_public:
     external: true
-  internal:
-    driver: overlay
-    ipam:
-      config:
-        - subnet: 172.16.39.0/24
 ```
 
-!!! note
-    Setup unique static subnets for every stack you deploy. This avoids IP/gateway conflicts which can otherwise occur when you're creating/removing stacks a lot. See [my list](/reference/networks/) here.
+!!! warning
+    **Normally**, we set unique static subnets for every stack you deploy, and put the non-public facing components (like databases) in an dedicated <stack\>_internal network. This avoids IP/gateway conflicts which can otherwise occur when you're creating/removing stacks a lot. See [my list](/reference/networks/) here.
+
+    However, KeyCloak's JBOSS startup script assumes a single interface, and will crash in a ball of 🔥 if you try to assign multiple interfaces to the container. This means that we can't use a "keycloak_internal" network for our supporting containers. This is why unlike our other recipes, all the supporting services are prefixed with "keycloak-".
 
 
 ## Serving
 
-### Launch OpenLDAP stack
+### Launch KeyCloak stack
 
 Launch the OpenLDAP stack by running ```docker stack deploy keycloak -c <path -to-docker-compose.yml>```
 
 Log into your new instance at https://**YOUR-FQDN**, and login with the user/password you defined in keycloak.env.
 
+### Integrating into OpenLDAP
+
+KeyCloak gets really sexy when you integrate it into your [OpenLDAP](/recipes/openldap/) stack (_also, it's great not to have to play with ugly LDAP tree UIs_).
+
+You'll need to have completed the [OpenLDAP](/recipes/openldap/) recipe
+
 You start in the "Master" realm - but mouseover the realm name, to a dropdown box allowing you add an new realm:
 
 ![KeyCloak Add Realm Screenshot](/images/sso-stack-keycloak-1.png)
@@ -139,16 +150,16 @@ Once in the desired realm, click on **User Federation**, and click **Add Provide
 * **Edit Mode** : Writeable
 * **Vendor** : Other
 * **Connection URL** : ldap://openldap
-* **Users DN** : ou=People,<your base DN>
+* **Users DN** : ou=People,<your base DN\>
 * **Authentication Type** : simple
-* **Bind DN** : cn=admin,<your base DN>
-* **Bind Credential** : <your chosen admin password>
+* **Bind DN** : cn=admin,<your base DN\>
+* **Bind Credential** : <your chosen admin password\>
 
 Save your changes, and then navigate back to "User Federation" > Your LDAP name > Mappers:
 
 ![KeyCloak Add Realm Screenshot](/images/sso-stack-keycloak-3.png)
 
-For each of the following names, click the name, and set the "_Read Only_" flag to "_Off_" (_this enables 2-way sync between KeyCloak and OpenLD_AP)
+For each of the following mappers, click the name, and set the "_Read Only_" flag to "_Off_" (_this enables 2-way sync between KeyCloak and OpenLDAP_)
 
 * last name
 * username
@@ -157,11 +168,15 @@ For each of the following names, click the name, and set the "_Read Only_" flag
 
 ![KeyCloak Add Realm Screenshot](/images/sso-stack-keycloak-4.png)
 
-Proceed to setting up [Email](/recipes/sso-stack/docker-mailserver/)...
+!!! important
+    Development of this recipe is sponsored by [The Common Observatory](https://www.observe.global/). Thanks guys!
+
+    [![Common Observatory](../images/common_observatory.png)](https://www.observe.global/)
+
 
 ## Chef's Notes
 
-1. I wanted to be able to add multiple networks to KeyCloak (i.e., a dedicated overlay network for LDAP authentication), but the entrypoint used by the container produces an error when more than one network is configured. This could theoretically be corrected in future, with a PR.
+1. I wanted to be able to add multiple networks to KeyCloak (_i.e., a dedicated overlay network for LDAP authentication_), but the entrypoint used by the container produces an error when more than one network is configured. This could theoretically be corrected in future, with a PR, but the [GitHub repo](https://github.com/jboss-dockerfiles/keycloak) has no issues enabled, so I wasn't sure where to start.
 
 ### Tip your waiter (donate) 👏
 
diff --git a/manuscript/recipes/munin.md b/manuscript/recipes/munin.md
index 6172d2b..be55f96 100644
--- a/manuscript/recipes/munin.md
+++ b/manuscript/recipes/munin.md
@@ -94,7 +94,7 @@ services:
       - /var/data/munin/cache:/var/cache/munin  
 
   proxy:
-    image: a5huynh/oauth2_proxy
+    image: funkypenguin/oauth2_proxy
     env_file: /var/data/config/munin/munin.env
     networks:
       - traefik_public
diff --git a/manuscript/recipes/openldap.md b/manuscript/recipes/openldap.md
index 4b28826..7315d22 100644
--- a/manuscript/recipes/openldap.md
+++ b/manuscript/recipes/openldap.md
@@ -45,7 +45,7 @@ mkdir /var/data/runtime/openldap/
 
 ### Prepare environment
 
-Create /var/data/openldap/openldap.env, and populate with the following variables, customized for your own domain structure. Take care with LDAP_DOMAIN, this is core to your directory strucutre, and can't easily be changed later.
+Create /var/data/openldap/openldap.env, and populate with the following variables, customized for your own domain structure. Take care with LDAP_DOMAIN, this is core to your directory structure, and can't easily be changed later.
 
 ```
 LDAP_DOMAIN=batcave.gotham
@@ -53,12 +53,15 @@ LDAP_ORGANISATION=BatCave Inc
 LDAP_ADMIN_PASSWORD=supermansucks
 LDAP_TLS=false
 
-# For the oauth2_proxy elements used to protect LAM
+# Use these if you plan to protect the LDAP Account Manager webUI with an oauth_proxy
 OAUTH2_PROXY_CLIENT_ID=
 OAUTH2_PROXY_CLIENT_SECRET=
 OAUTH2_PROXY_COOKIE_SECRET=
 ```
 
+!!! note
+    I use an [OAuth proxy](/reference/oauth_proxy/) to protect access to the web UI, when the sensitivity of the protected data (i.e. my authentication store) warrants it, or if I don't necessarily trust the security of the webUI.
+
 Create ```authenticated-emails.txt```, and populate with the email addresses (_matched to GitHub user accounts, in my case_) to which you want grant access, using OAuth2.
 
 ### Create config.cfg
@@ -329,7 +332,7 @@ Create yours profile (_you chose a default profile in config.cfg above, remember
 
 ### Setup Docker Swarm
 
-Create a docker swarm config file in docker-compose syntax (v3), something like this:
+Create a docker swarm config file in docker-compose syntax (v3), something like this, at  (```/var/data/config/openldap/openldap.yml```)
 
 !!! tip
         I share (_with my [patreon patrons](https://www.patreon.com/funkypenguin)_) a private "_premix_" git repository, which includes necessary docker-compose and env files for all published recipes. This means that patrons can launch any recipe with just a ```git pull``` and a ```docker stack deploy``` 👍
@@ -341,7 +344,8 @@ services:
     image: osixia/openldap
     env_file: /var/data/config/openldap/openldap.env
     networks:
-    - internal
+    - traefik_public
+    - auth_internal
     volumes:
     - /var/data/runtime/openldap/:/var/lib/ldap
     - /var/data/openldap/openldap/:/etc/ldap/slapd.d
@@ -349,46 +353,75 @@ services:
   lam:
     image: jacksgt/ldap-account-manager
     networks:
-    - internal
+    - auth_internal
     volumes:
     - /var/data/openldap/lam/config/config.cfg:/var/www/html/config/config.cfg
     - /var/data/openldap/lam/config/batcave.conf:/var/www/html/config/batcave.conf
 
-  proxy:
+  lam-proxy:
     image: funkypenguin/oauth2_proxy
     env_file: /var/data/config/openldap/openldap.env
     networks:
       - traefik_public
-      - internal
+      - auth_internal
     deploy:
       labels:
-        - traefik.frontend.rule=Host:lam.batcave.gotham
+        - traefik.frontend.rule=Host:lam.batcave.com
+        - traefik.docker.network=traefik_public
         - traefik.port=4180
-    volumes:
-      - /var/data/config/openldap/authenticated-emails.txt:/authenticated-emails.txt
     command: |
       -cookie-secure=false
-      -upstream=http://lam:8080
-      -redirect-url=https://lam.batcave.gotham
+      -upstream=http://lam:80
+      -redirect-url=https://lam.batcave.com
       -http-address=http://0.0.0.0:4180
-      -email-domain=example.com
+      -email-domain=batcave.com
       -provider=github
-      -authenticated-emails-file=/authenticated-emails.txt
 
 
 networks:
+  # Used to expose lam-proxy to external access, and openldap to keycloak
   traefik_public:
     external: true
+
+  # Used to expose openldap to other apps which want to talk to LDAP, including LAM
+  auth_internal:
+    external: true    
 ```
 
-!!! note
-    Setup unique static subnets for every stack you deploy. This avoids IP/gateway conflicts which can otherwise occur when you're creating/removing stacks a lot. See [my list](/reference/networks/) here.
+!!! warning
+    **Normally**, we set unique static subnets for every stack you deploy, and put the non-public facing components (like databases) in an dedicated <stack\>_internal network. This avoids IP/gateway conflicts which can otherwise occur when you're creating/removing stacks a lot. See [my list](/reference/networks/) here.
+
+    However, you're likely to want to use OpenLdap with KeyCloak, whose JBOSS startup script assumes a single interface, and will crash in a ball of 🔥 if you try to assign multiple interfaces to the container.
+
+    Since we're going to want KeyCloak to be able to talk to OpenLDAP, we have no choice but to leave the OpenLDAP container on the "traefik_public" network. We can, however, create **another** overlay network (_auth_internal, see below_), add it to the openldap container, and use it to provide OpenLDAP access to our other stacks.
+
+Create **another** stack config file (```/var/data/config/openldap/auth.yml```) containing just the auth_internal network, and a dummy container:
+
+```
+version: '3'
+
+services:
+  helloworld:
+    image: hello-world
+    networks:
+      - internal
+
+networks:
+  internal:
+    driver: overlay
+    ipam:
+      config:
+        - subnet: 172.16.39.0/24
+```
+
+
+
 
 ## Serving
 
 ### Launch OpenLDAP stack
 
-Launch the OpenLDAP stack by running ```docker stack deploy openldap -c <path -to-docker-compose.yml>```
+Create the auth_internal overlay network, by running ```docker stack deploy auth -c /var/data/config/openldap/auth.yml`, then launch the OpenLDAP stack by running ```docker stack deploy openldap -c /var/data/config/openldap/openldap.yml```
 
 Log into your new LAM instance at https://**YOUR-FQDN**.
 
@@ -406,7 +439,7 @@ Create your users using the "**New User**" button.
 
 ## Chef's Notes
 
-1. An upcoming recipe for [KeyCloak](https://www.keycloak.org/) will illustrate how to integrate KeyCloak with your LDAP directory.
+1. The KeyCloak](/recipes/keycloak/) recipe illustrates how to integrate KeyCloak with your LDAP directory, giving you a cleaner interface to manage users, and a raft of SSO / OAuth features.
 
 ### Tip your waiter (donate) 👏
 
diff --git a/manuscript/reference/networks.md b/manuscript/reference/networks.md
index ec29f3e..f73c05f 100644
--- a/manuscript/reference/networks.md
+++ b/manuscript/reference/networks.md
@@ -38,7 +38,7 @@ Network  | Range
 [ElkarBackup](https://geek-cookbook.funkypenguin.co.nz/recipes/elkarbackp/)  |  172.16.36.0/24
 [Mayan EDMS](https://geek-cookbook.funkypenguin.co.nz/recipes/realms/)  |  172.16.37.0/24
 [Shaarli](https://geek-cookbook.funkypenguin.co.nz/recipes/shaarli/)  |  172.16.38.0/24
-[KeyCloud](https://geek-cookbook.funkypenguin.co.nz/recipes/keycloak/)  |  172.16.39.0/24
+[OpenLDAP](https://geek-cookbook.funkypenguin.co.nz/recipes/openldap/)  |  172.16.39.0/24
 [MatterMost](https://geek-cookbook.funkypenguin.co.nz/recipes/mattermost/)  |  172.16.40.0/24
 [PrivateBin](https://geek-cookbook.funkypenguin.co.nz/recipes/privatebin/)  |  172.16.41.0/24
 [Mayan EDMS](https://geek-cookbook.funkypenguin.co.nz/recipes/mayan-edms/)  |  172.16.42.0/24
@@ -46,7 +46,6 @@ Network  | Range
 [FlightAirMap](https://geek-cookbook.funkypenguin.co.nz/recipes/flightairmap/)  |172.16.44.0/24
 [Wetty](https://geek-cookbook.funkypenguin.co.nz/recipes/wetty/)  |  172.16.45.0/24
 [FileBrowser](https://geek-cookbook.funkypenguin.co.nz/recipes/filebrowser/)  |  172.16.46.0/24
-[OpenLDAP](https://geek-cookbook.funkypenguin.co.nz/recipes/openldap/)  |  172.16.47.0/24
 
 
 ## Chef's Notes
diff --git a/mkdocs.yml b/mkdocs.yml
index 2c7be7e..65154a8 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -85,6 +85,7 @@ pages:
       - GitLab Runner: recipes/gitlab-runner.md
       - Gollum: recipes/gollum.md
       - InstaPy: recipes/instapy.md
+      - KeyCloak: recipes/keycloak.md      
       - OpenLDAP: recipes/openldap.md
       - Piwik: recipes/piwik.md
       - Portainer: recipes/portainer.md