From f10e9d4ad826a8feb3535b9e699663a3c7118ebc Mon Sep 17 00:00:00 2001 From: Rowena Date: Fri, 25 Oct 2024 14:01:53 +0200 Subject: [PATCH 01/13] feat(vpc): start use case --- .../vpc/reference-content/use-case-basic.mdx | 128 ++++++++++++++++++ 1 file changed, 128 insertions(+) create mode 100644 network/vpc/reference-content/use-case-basic.mdx diff --git a/network/vpc/reference-content/use-case-basic.mdx b/network/vpc/reference-content/use-case-basic.mdx new file mode 100644 index 0000000000..9014f3aab1 --- /dev/null +++ b/network/vpc/reference-content/use-case-basic.mdx @@ -0,0 +1,128 @@ +--- +meta: + title: VPC use case 1 - Basic infrastructure to leverage VPC isolation + description: Learn how to set up a basic infrastructure using VPC isolation for secure cloud environments. Step-by-step guidance on leveraging VPCs for optimal network isolation. +content: + h1: VPC use case 1 - Basic infrastructure to leverage VPC isolation + paragraph: Learn how to set up a basic infrastructure using VPC isolation for secure cloud environments. Step-by-step guidance on leveraging VPCs for optimal network isolation. +tags: vpc private-network connectivity best-practice use-case infrastructure-diagram +dates: + validation: 2024-10-25 + posted: 2024-10-25 +categories: + - network +--- + +Scaleway **V**irtual **P**rivate **N**etwork (VPC) and the accompanying range of network products, are important building blocks within the Scaleway ecosystem. By creating your Scaleway resources within a carefully thought out VPC-based infrastructure, you can maximize security, resilience and efficiency. + +Knowing how to create, combine and configure resources such as Private Networks with definable subnets, VPC routing with custom routes, IPAM to define and manage your IP addresses, and resources such as Load Balancers and Public Gateways to facilitate connectivity and traffic distribution, is invaluable in achieving control over your networking environment. + +This is the first in a series of use cases designed to show you potentially interesting and useful infrastructures, illustrating how to use VPC and other network products to achieve a robust, secure and scalable cloud environment. + +## Private Networks and VPC definitions + +VPC allows you to build your own **V**irtual **P**rivate **C**loud on top of Scaleway's shared public cloud. Within each VPC, you can create **Private Networks**. Resources attached to Private Networks can communicate securely between themselves, away from the public internet, reducing security risks by ensuring traffic is isolated from public routes. + +The VPC operates at the network layer (layer 3) of the OSI model, while Private Networks are a layer 2 resource. As such, a VPC is responsible for routing packets between its different Private Networks. Private Networks provide network isolation within a VPC and enable you to segment your resources and traffic across different subnets. + +VPCs and Private Networks are both **regional** resources. When you create a Private Network in a VPC, it is necessarily scoped to the same region as the VPC. Some Scaleway resources are also regional, others are zonal and scoped to a single Availability Zone (AZ). When attaching resources to a Private Network, you can attach resources from any AZ within the Private Network's region, allowing for example an Elastic Metal server in PAR-2 to communicate securely, away from the public internet, with an Instance in PAR-1 and a Managed Database in PAR-3. + + + +| Region | Availability Zones | +|-------------------------|---------------------------| +| France - Paris | PAR1, PAR2, PAR3 | +| Netherlands - Amsterdam | AMS1, AMS2, AMS3 | +| Poland - Warsaw | WAW1, WAW2, WAW3 | + +One default VPC for each region is automatically created in each Scaleway [Project](/identity-and-access-management/organizations-and-projects/concepts/#project). The [**VPC routing**](/network/vpc/concepts/#routing) feature allows for managed and custom routes between the Private Networks of a VPC, so resources on different Private Networks can communicate. + + + +## Designing your network topology + +When you start creating resources and building your infrastructure with Scaleway, take some time to consider and plan your network topology. We recommend that you build your VPC infrastructure with **separation of concerns** in mind. Separation of concerns is a fundamental design principle aimed at breaking down large complex systems into smaller, distinct components each with clear responsibilities and interfaces. This kind of design will future-proof your VPC and come into its own when Scaleway introduces further features such as ACLs for VPC. + + Separating resources into different Private Networks according to function and usage can: +- **Improve network performance** by reducing broadcast traffic and congestion +- **Enhance manageability** via a logical organization of resources +- **Enable easier troubleshooting, monitoring and maintenance** +- **Allow for easier scalability** + +For example, you may use one Private Network for frontend resources and another for backend resources, limiting public access only via Load Balancers and/or Public Gateways, stripping other resources of public IP addresses. You may want to create different VPCs for production and test environments, allowing you to isolate potential errors in testing from the production environment. + +When [creating a Private Network](/network/vpc/how-to/create-private-network/), you can let Scaleway automatically generate a CIDR block for it that is guaranteed to be unique in this VPC. All resources attached to the Private Network get a private IP address from this block. However, you also have the option to define your own CIDR block for the network. Ensure you choose a prefix and network size that is appropriate for your needs, does not overlap with that of any other Private Network in the VPC, and contains enough IP addresses for all resources that will be attached to the Private Network. + +## Attaching resources to Private Networks + +When you attach a resource (e.g. an Instance, an Elastic Metal server) to a Private Network, you can either: +- Let Scaleway automatically assign any IP address from the Private Network's CIDR block to use for the attachment, or +- Define a specific, reserved IP address from the CIDR block to use for the attachment. + +### Auto-assigning an IP address + +This solution is best for simplicity, dynamic environments, and short-lived resources. It can be especially useful in large-scale deployments where manual IP management could be cumbersome. When you let Scaleway automatically assign IP addresses, we ensure there are no IP conflicts within your VPC, reducing any risk of human error. + +Note that when you select this option, the IP address randomly assigned to the resource will be stable, and does not risk changing until you detach the resource from the Private Network. At this point, the private IP address is released back into the pool of generally available addresses from the network's CIDR block, and may be auto-assigned to another resource requesting attachment. + +### Using reserved IP addresses + +You can reserve private IP addresses from your Private Networks' CIDR blocks thanks to Scaleway's [**IP A**ddress **M**anagement solution](/network/ipam/), which helps you plan, track and manage the IP address space of your VPCs and their Private Networks. From the [IPAM space](https://console.scaleway.com/ipam/) in the Scaleway console, simply use the **Reserve private IP** feature to select the Private Network you want to reserve an IP address on, and choose to either reserve any available address, or a specific address not currently attached to any resource. The reserved address will then not risk being auto-assigned by Scaleway to other resources during network attachment, and can be kept until you are ready to use it to attach a specific resource. + +Further, when you attach a resource to a Private Network and specify a reserved IP to use, the IP will remain reserved even after you detach the resource from the network. You can choose to either release the IP back into the pool, or keep it reserved until you use it to attach another resource. + +Using reserved IP addresses is ideal to ensure that certain IP addresses are never released into the general pool and kept for certain critical resources with fixed IP requirements, even when that resource is detached from the Private Network, or when migrating between resources. Reserved IP addresses may also be useful where your Private Network is extending or integrating with external networks, or to assign addresses to virtual machines hosted on Elastic Metal servers via Proxmox. + +## Removing public IPs from resources + +We strongly recommend that you disable public connectivity on all of your Scaleway resources, unless it is absolutely required. It is preferable to attach resources to Private Networks wherever possible, and direct all traffic to the resource's private IP address on that network. This ensures optimal security, reduced cost and enhanced latency. Find out more in our documentation about [public connectivity best practices](/network/ipam/reference-content/public-connectivity-best-practices). + +## Public connectivity over Private Networks + +### Public Gateways + +You can use Scaleway [Public Gateways](/network/public-gateways/) to provide resources on a Private Network with a secure point of access to and from the public internet. + +- Set the Public Gateway to advertize a default route to the internet, allowing attached resources to send packets to the internet via the gateway, without needing their own public IP address. +- Activate the [SSH bastion](/network/public-gateways/how-to/use-ssh-bastion/) so that you can establish SSH connections to resources on the Private Network via the gateway's bastion. +- Use static NAT to map ingress traffic from the public internet towards resources on the Private Network, using private IP addresses and ports. + +### Load Balancers + +Another option is to attach a Scaleway [Load Balancer](/network/load-balancer/) to the Private Network. By giving the Load Balancer a public IP address, and configuring Instances on the Private Network as backend servers for the Load Balancer via their private IP addresses, the Load Balancer can securely and efficiently distribute traffic to the Instances. This solution is suitable when you have multiple Instances serving the same application, although you can also use multiple frontends/backends and [routes](/network/load-balancer/how-to/create-manage-routes/) to direct traffic to specific server pools. + +You can also disable public connectivity on the Load Balancer itself. This may be relevant if the Load Balancer is configured to receive and distribute traffic from resources on a different Private Network within the same VPC, for example. + +## Connecting a VPC to external infrastructure + +Watch this space for Scaleway's upcoming solution to provide private, secure connectivity between resources in a Scaleway VPC and your external or on-premises architecture. In the meantime, you may consider installing a manual VPN on a Scaleway Instance to connect to other non-Scaleway infrastructure, and create a [custom route](/network/vpc/how-to/manage-routing/#how-to-create-a-custom-route) towards this VPN so traffic on your Private Network can securely communicate with resources at the other end of your VPN tunnel. + +## Resource-specific information + +Different types of Scaleway resources may have different requirements and possibilities in terms of Private Networks. See the comparative table below for more information, and to jump to the resource-specific documentation on Private Networks for each product. + +* **Max attached PNs**: The maximum number of Private Networks that a resource can be attached to +* **Mandatory PN**: Whether or not a Private Network must necessarily be attached to this resource +* **Compatible with private IPv6**: Whether or not the resource is compatible with private IPv6 addressing. Compatible resources generally acquire both an IPv4 and an IPv6 address when attached to a Private Network. +* **Compatible with reserved IPs**: Whether or not you can use a [reserved IP](/network/ipam/how-to/reserve-ip/#how-to-attach-a-resource-to-a-private-network-using-a-reserved-ip-address/) to attach the resource to a Private Network + +| | Instance | Elastic Metal | Kubernetes | Managed Inference | +|------------------------------|----------|---------------|------------|-------------------| +| Max attached PNs | 8 | 8 | 1 | 1 | +| Mandatory PN | No | No | Yes | No | +| Compatible with private IPv6 | Yes | Yes | Yes | No | +| Compatible with reserved IPs | Yes | Yes | No | No | +| Additional information | -- | [Paid-for
feature](https://www.scaleway.com/en/pricing/elastic-metal/#network) | PN cannot be changed
after cluster creation | Must have at least one of
private and/or public endpoint | +| Documentation | [Go](/compute/instances/how-to/use-private-networks/) | [Go](/bare-metal/elastic-metal/how-to/use-private-networks/) | [Go](/containers/kubernetes/reference-content/secure-cluster-with-private-network/#why-have-a-private-network-for-your-kubernetes-kapsule-cluster) | [Go](/ai-data/managed-inference/how-to/managed-inference-with-private-network/) | + + +| | Managed Database | Managed Database for Redis™ | Public Gateways | Load Balancer | +|------------------------------|------------------|-----------------------------|-----------------|---------------| +| Max attached PNs | 1 | 1 | 8 | 8 | +| Mandatory PN | No | No | No | No | +| Compatible with private IPv6 | No | No | No | No | +| Compatible with reserved IPs | No | No | Yes | Yes | +| Additional information | Must have at least one of
private and/or public endpoint | Must have at least one of
private and/or public endpoint | -- | Private LBs must have a PN | +| Documentation | [Go](/managed-databases/postgresql-and-mysql/how-to/connect-database-private-network/) | [Go](/faq/databases-for-redis/#what-is-the-private-networks-feature-for-redistm-database-instances) | [Go](/network/public-gateways/how-to/configure-a-public-gateway/#how-to-attach-a-public-gateway-to-a-private-network) | [Go](/network/load-balancer/how-to/use-with-private-network/) + + From d45b9edda704c11b2841d7c8f202deb88e782dd8 Mon Sep 17 00:00:00 2001 From: Rowena Date: Fri, 25 Oct 2024 17:31:24 +0200 Subject: [PATCH 02/13] feat(vpc): use case --- .../assets/scaleway-vpc-infra-1.webp | Bin 0 -> 110464 bytes .../vpc/reference-content/use-case-basic.mdx | 128 ++++++------------ 2 files changed, 42 insertions(+), 86 deletions(-) create mode 100644 network/vpc/reference-content/assets/scaleway-vpc-infra-1.webp diff --git a/network/vpc/reference-content/assets/scaleway-vpc-infra-1.webp b/network/vpc/reference-content/assets/scaleway-vpc-infra-1.webp new file mode 100644 index 0000000000000000000000000000000000000000..2d4172a0c3f6e605422fac77167aef37abc048ab GIT binary patch literal 110464 zcma%BQ+Fi{tgUU^_SCj*+qP}nwykq&+is`EbZT?z``!Bs?#e^*8m^sWtI9}9dN+ZB zXi11FYbtZg+x=%V2T4ePY9ukpsM5=jv7JYzbpAv{oK4K$c!|pge??){v?R@4xxC+@ z-y}v=-Y5ojQ0O4@eWiJBEbjJaf5wmBln3oJerHI&zv8|5mp!|z0S5b7JrJM&`S9o( zr*%d?3pr_1w`$hR9vqkvxhD z=eAQlWH!GSL2th6IASB7wtZQi76+Ns5#qakB@fMMf81%}ug?%Vt*6upDJoHi*w_P% zq+7VzVj4BM2Wu?XJXKU_$B1H>PnaRJ3K2T3Ol!*6UoccQsb4=2%D;h#taP72&Kp56 z$rQLiSERU}kC#s?NTRnN1G&`JV4ay}5Z_oxls04=uV=8u8Dm6aximy;izN4@qrRU$ z=Eps^eI6YmpuHvw79N_0bQAn0`HZAKGRLs2`5R3h;w11FGiuDbF?tHk0F&;?@9I`O zwxXp;d-a~*3Z~{AQJMX~wUIeAa>V2c;Th^(|=6WX+bK78QDdlAC2~ zbSOH4(|BEBF*J3(n}YzlBc6;sw{Jf0y_mt_bUqv#LwO&q`^9AKPO}m;L zxq!+Kz#r*g&%M5g~G%Nl8ZrMz-+x$$qqn>o5se769MUENr>*i{qX_-@goIvK73nu-ND5R$b#^U<9Hio*?umtZUrIj9s)7KT zB8X87TP`Nk6_5!C+vmwVZ4B5aMZFSuX&Nu`>Gb43bM#WhXhx-Cja{jB`vq_Kwt9L# zBV+iky8?hztr`XE?y3o(EQe7*<{A`6Z%lL~W_DF^(o-Pu-$^TK|J@%yCYe+>X!0{Jqam0e+cTwSNcjawd4)7j4>j){l~wa5 zpsup+iU8J{e1gQTn2iTO%7C14{Yf?M^-X9YW;Pzi(uz2?_{0T!vOC0Cv#Ee6L{PF` zPB<+o12nzEw}ZLl1#Y-Z(;_PcgSmkagGGYzXZ#70ALE*13&EDLcZlHP0p_}a-vYJW zCQ-p8!Mdp_q`K8gz;@30dlkV~NVhK5kf3g&^of-gJS+?pAWt6x#G{F7ozs2=t&D$| zsldW6HXW5~xP)`SR}u4CbB&N^<~@}j6PCG zPf^4XN!f6oCV0ANr8Tl`r9rY#jrXhf^?`)wrd^?utLU23d}5H*!}-tuEd|GHYQv0lf<3~HMb-%HZ0q|69nfNi%cH!} ztn7vm@dDEYs)Bug6fysj6pR0JJ}44vP~H(1F<(fA!L;uN46kT3@zv&y*oi2`-lHM` zq)dJobeU}57*}zS=IYY~JoO)Zha`NZ~f^Ug`KN(?}_c-VgPBu>^vp&F0fr@0L z6EiFW`*JC)B-&E;LO6?W5LfGqt-w>UiVG3B?Xg+fKqm-249GqEUjy2trLd%P%5%z- z34k(4%tPs4Df)kqXIg6zCs~(F9(&uDcjPk)F7kug8Py{BV8 zV8!`16^S0hC-~cj5e@g&|bQP>Zayj2GO&_F{}CQKj>hE)cA$NOy%l*Zpg+H;?w4s z>P2!zz%fsD)v%#mlVvwL%8LDH{(EDEwpjCsbgRN;zTbXFp~E)r=Ohv zStY4I_@q38+Rh{J0VcV4(k|6!#Uy+WR{3&YZRriFw=*bcRyXXk|MO!&&r04##vJm1 z6>1yz7ZPx{4mEx5{0>8<1TKt}& zrBmulKWC`*tie-YtnAfZZ|NFyZ4DU$OXOK!nl7`g%lANz(pFRsOrmMWv~g(C#O<5r znJ(2(Z&GLqQB;ms$OB|*DQ2qB6!Y6=goGh<`xy-uLwP_#&%l9!m#0~(Kzcw(90`ym ze-F8~_OCJ|T}a1evHY;F*w~f%fPSg6OAxB4Uq_|EDtAaV49}Qhwn%WT$<5K#Lku4Q z%{dkoM>!}sF5#+|wbP}ZFzuzA8yFq&?UzIH$$19wO<7^rX#PoKK_MGSQut_#a%~d2 zgBxI{0vvvpITd#G#@qLdGL9*-<|ZLFJwRmyzO8bEshoDVh1M3^3U0x#{1SuyciLdI z1DL+pwE<#AtjVBI;-mic*FOqr6tJ&jr!2+D;3q7_egvHezj2{~6CpFf7rzcz|C8eY z9A{h>0W5}{*MLGU@>73+CW8_9dU%P|;Y374LS|*U`+ao+%@)5Ob8hjX5nMYGgCQ*@ zjq;%e62a3xTLmj=g~(d*@3_!NcIyh^>%oKcSb%GjYN-%R>hj*}d-5`}MY3w!4*ep1 zg*r`qHu&E?w{#2&Wofb3)-nSeTII^=V3xloWqE%MgVN!u@F0n_Riz;}vMd=h*x3be zke8F8lOP>d_g*E^c!srxIwVX*}cZgy8iWXSoiJ}tUJGmCg#WO7k)@hAINL^W7JycOjWB#SL<6w1X zZC>^_&xfLCj$93)v5)_1kn0xrW_zgdjk5prsVJ*e>tC-b~bO%K?qI(#EP4|URp z!P+MHjzJPW_imu;E6VQJ1(B>HWNTC-e_2u451RFMt*YHNrO2RJQu04Sim}37>+M20 z)zaSp&m}sr=H_-NHM<7Ddg+9i*n+Ng_k>Qvv#vFxmR-d9^w-a;Q_HD<`}KWwi?1mO z7%s#fMKI3NI&Qj>pP3W4HPW;lvQM&5?Uzh(91Io2rv_&wRfNF$dU_BQ*R@$o<}k*1FAjR zZ*&k{yE{PpzbnATm3kyh^?Mx>D~JK4Osd1mI`3)C-`9SJcKg{Nc_GgR$WtH@M1#Dd zv~)j=vRB@&g}axLAMe}v@0D+{VDmbM$83N6Rh*c`x8g|Lx}_hbv>ox%&-~yq2B6)s zgdyoZ(9tH`Gezr67&>*<+?|-5g8Ht1;HPJ$>3hJdCl_(ea#`@qeA!y|Onz`!aiohK z|Kv}Dr4hS78%}Qy!`k6T^q@K-Uz&oknKRgHa}hJ4GcT9|oZ=v;Jz0NXyps#4Sm*@_k1QUce60?EU`%!=v!7wW46*WQSe~ zpeN!lsh_3)r<$nS(eew(+Q0n4yzTFI$?{ILVhB6}%j$^S6ub9?l#o!)Z!0{cY=7=Q z*!A4?Y;wgEi$J^uW7ID7LZ$e(qooVUr%0D*idSzvV_I!n#<2^@3i_j4=X7^GQ>#7j>fbaOGcgd{a|NKnu(&O*=RmiHau4OYIeJ`pvDZ)%|c9U9b59v>w+A8SPB6 z>m~O0mU;HgiJ1<6$sCzx-B&0M3UMsQ2nFgk5|{%Gn4H>-c!GSCjh8y*DFW)Fd}v%g zVg&uj0g+lk?1s;4qmlAo8-%e5aRwTNzR{J|X|=xL{Nmg$_vM~g#D6OMtDI4pE0jd) zxeqElV9(HQRm*)?q}(*hMzB9m8+7xzxh*K(uRbwk0 zjVSND68vCHd@+`seJ8w0#N(VkaXdGdUnciY+!yy7BSSp^w0TP)>Oh~kSy)Ia7|{Fz zP}GXUKcP*b6<25^&i}~e$GwAb+fgOHT1~&xmZ>d@7jc}ViDSE8epe^|qc|v>sC#@k z5>q*Zexz{yd+Z&bmRMN%k=NlBmc5dI#Rl+VBQD_W>pQHvUHkw;YF{`nGQ3>~U1usP zU7=LFlBjoFFy!sqbN0Q72SX3#pb7nd!95N>z#>t#1b3y;%R zyP7}Zn-9)r@jghbeyjgguM38}k|F77b;-`-hpB>1K6epKo~Cn&<5%oF$;c)vTHIYh z$m@=IPWMSMt-DX%zNk1-ZFLz&Sd<@}lff(J{lgGQqJ@)SAb|IbQa-GJbwdTx?5v@O zZmK4hNm74_DS3%R3WC*H(IX4tgRH34KW3U5N>JN_8#+`Tsmn8!eM8!J3gg+w{L?3IA5LzPx~KcvXt!_O*o zrc#!jM{S8_<9cg*g4*hryr~miv5o%q&(5$BluzoVU8xUW=8Uc;<_@CH;Hs^=CNc~l z46=82kn|1_Mvu2x1K8x0tIxRHrG*zmw#x;V(uWSS8cpX?m6PkPlynhcxY}Xpyv4Rp z|0)aHJ9>r~LiOqXD+7M3IvvjKI<2L4xwrNhNmgvxe50Ka0PDiFyoqEL&Lqb4bJ3(( zq?#hYD-*q3@~?_Oxazi1tK;U+?o?f*m==KV@xE@eDOx|$&dFXS85)^-Jq_mhq4p5x zG-?DAEiT$VV;vMsB<=DY?Ez+}^VQl~v;5^35YxkudGFt_oA@&?$eCWTW~*0X zHgN3=!5M4b1T;X-?sAUjG&u@yQ&UNV&}{>2(|<_cn1CajGnl|l*ogiHF_^MHY9@YCjfli= z^v}j%JA3)x=XU{DC*-<~3~mE7q}%)_9z491Ox9xyQq;AXx==GJ`DC1z-mB8ZJRvDJ z@D~6+PTOC1i+PsfTH&m zqNt~UHvFIgs+kO?M?{-myC_U2xtWu`{B2{wIT(ztq{(UJry5G)N>2aF#k_-OOaz1C z{2}Ds9Y>jAMywthW_Q|Ip z(~DTRC8s+M;k|{Dj4h~Q?z&?ap@wFdhlN8w@{-9TIria4@0*kK5%2~9T}~IJvOgdS z0xx)3a)GjDE!76P#UsU3+gZt(1)d`<*crR-bM!0{XrrmKAjOnpSwKXJD z^vXqpQb8{w?MFP5F*FRkQjNJEdv~oTpbgk?S`=tD{)2&KP}1=xuqt1C2-G8aH=j9q z-+n=@VLwU*k6!*J8xyDaGmFtDz31l$|542-Ba8|?6&9sd#z8$`bsFcodN*LH& z<4Y?>R_>}d1EWV{7k7+F62)Wc<;y+lQewRo6=H9I8^!3B!fKQZ%SPvYtuY+>5|AjjQ@OPQap^B=Rr^-X|N^dju=bDski}k844=AMw)ETNnmo>&E zVpo);YJ{akIulunb2gdRj|9>`#fEy@0!=_QBA(l8*E(i`1P8A@z3ZLMG#zz&|U)|9P7*)&CWj z0o^+1sDaqHCI=QyA{^&GZA46E*-<0^$S8R14b)w$95RfCd35Y6Eq6;)hqj@y+{7wK z>Yvvpb&rVua%Z^zbKnZX`D=wmx>g+}Kt8pWkki?7E1`|%iKypY(8Z)rTd3`WFwU-LHG~L^t1Il#5 zbXqQw=ZYzqm7H~5_l(v2dx>3`966;ez`NEIZ3y)e5)2`RRcUON-|xhj&6fPy1@sU= zY>4|y1-x9wS%Cue7{+$ zAxlEZ20_l3&z89CvPtRllf&ot-vBeSB%OdPX*cRd^;fTRwegSO|AqHHCl&CNs}mQ` z+iR7Liff*?jS2)zI;0m&n_WFXzf#T_ecYS;7(`%*BKeDR{BP2b1l4#2bP&lL8r!?* zi~zruZi&F}UvjE!p?)EbtOxZq&b?QpYT~lDMN)^-SbN%X`8wifd$BjvNPGsT z-z+?mo`|!#&@18=KKMECIH6>Zp;wHXZh!?qS0#^F#u?7wm1?m%d%XUV>n5Re|9d8{ zU^`dUf31ptU|LvawD69kNpC(c#_g4zCcNBSMYcQ4St^orh@S~VE_GA#?nu1(x(E%{ z9ChCPwF+GTVfefWN^o=er>}(-AnkD0FkLktl6-eiqs!>CU5vXBMB$J)V$hc~hsqMr zmvuLH%{bh?k;gGNyOOa_$=Xz7Jj-Xbj#6y#F&@h~+KAwo4W+BP(t&;3r}6<+Zs15w z`W)^OnZxLhB=p_4=SIul-IaXxi?tZbM{uwRwqJTF6;VYCU1w*lf!qxEH`fe#5ZL=q z6hdJyn#Cm_Feni(rTSZ|wNGHd03NzHoLpA#u4WpSn*m~QhpEMT-`;g48B&>O<^!H= zj_HgJYdJMyBV$_O#vv?V%_{2dmIZotXc$v>NJ4BBnW1y5b$*ja+YZ&<5!9TERYAUh zVlMKh*L2w}sprE!7!gq|@k!MIojrREN@xuLveRGeKzOPjvO}j|Gz&lkB7<<01qW=f zKVBk9Kttdk^xZi}aajERPE}27xO59nb@A3W1Yt%U`(;;}lhtuy5>gU6!TfO;<6Sf| z=ic7zW*1Gkz@4E!S|oNKuATHN7kgwkcd$1AM363WCmLA;fz+7A9qCXvg$-}Ph$#QZ z&B^l*P#=9t3#3qHCJ!SGWNK(Xa!Y>PRvIkRHfisZyFMfEZB(RDnNBLYmwHe&=X0pT z*5UrY)$-r;UbwAVOo4nHQ@2pBA-lHd{7}eCK4yQ6?{i^##AoIPd>^rD-Zmtl8vd!U zuc?G{LYSq;)Z`;utf+Eo6B1spj6YzL(iy1}0-9dF;oN%(4C&*5$h39OPQ-?b8$O&x z_MviYqfz@_<2#(Ns zIWJ2*=Q%tJ=N-P1F9UhbS&S-y&;zxxaS!WH_zt4+Nv^pag8kx(W+DQTm?8;nb26e) zQ{h;h%i=gU{~ssTVE)S`Hfg75;iq9;(RfljMS-knlKWi`T2X=s_F3EbU>@9x_-G!m zb(#cUo7O@sfs!R0P-F_QYgh_K&L#52IeS?NV{d<4GL)Ak@su1^Qg&Q&6js^k$x@o7n^{C~J}@6#FmMd3PS%-;=0)9PyQv7U2;+b(Gn zS9B5Vz?u*p{YOL5Mgy@9ZG^h(f-^T2#s0<-);XkB-F8@Eftl~bbwf)$Z9;|Z{u-K; zK}uzfkpqcu`cKbjp(%S=`soM5RJN?TQ7vWXaaicO)s#~9w*>P>GJ*xtOktEzRK8ZC z3~Fw@9zH>li7eam-iz>T`CN%+IdX1FrTD&lXfAC+gy{t0Pco@HM7T7xk3 zztYXh$z6K%J6)EmA?#`n?Qms=ho?c2u5&NkKDXxe!G*Y+RRo`2aYtME6slui5Z~R@ zW@9{)3;`*xpFLC%9z-!DMy+NZsL)3RP4xcS9Kd|)6BOASA3lLf-BpqbECbTIZd?8y zSTN)wT==zla}&ctY2I)xUPPb=zJB9>W5D<{nx*NFZ^;iR7)S>o-1ki+=~Qnr(zoG0 z-$FaQZZ^IS?^$L9(nE0uXowob;UM+**HhBFy}Ttyh=OTD&c3rB0=cY-jqGKTZUwjR z+R_$&y{^ZqN+nEoR%Yg&XN>@E^Q+ZHRue~k^80%!QAn$&(pmilD$HZZGj=kJ<@zhbfP7N%RO%w2T>J9h*Bhn}6bM>S~ zFONDm=8~HSW6=gXxlazHn|iK8xaUoN-wXT8K~SBWe4hrLY6O}-DA9{KWfm6Qhrt>w z%*yHm$yqIh3xpu!o%=ChWv0`*PMe0?(mGy!Fr?Yn3TgUrGZrCPxgc1=05$aM!=8y^B2 zow`22H!(~yb&l~!7A-=^E-~2eq1q#S=9cGFoX5hgY?Ns6#Fz1~J_IgM3CFiiq^EXR zi9Npsd?{QS;A)boMfkr;(h41ukI8KhhS%Fu$&^>r=WciJ{uTkn?|+;adG`KPR59`d z_6-E7LF|lx=`!>}M9nDW4ZCz68MR&Gk?T%N#WSHK%55rtUY z3~x%@T0kNxZIGj!#0!R#fp`mm5hIV7=AEIkEP%Z@CiVsrFLH=4W=107q@|)-SDd2T zM+@5~O5=Qk{RKai{I3g9iPoQBsx{EDa=P5$7uh5Z_^_0b4|w?hX<8&Y!pP0=D!vEW z(vax2S6ZWkR<7YZ9(gxx5Bzr=#2Y*%Z}JFuAPB)ffn7fGV;wfss|3U)#;21_b) z0(Jqc9j1l5zuwkx01=>m#0Uv%*+^8DH^PMLNaht2i;qM2vQ-ex-nwh-{_Wz> zi{W=)0bZU<{Y>a1t`7qxQFM-f!8w_4EDxdl<`B&U!@YoYAS}z3{K94Kzbh{# zG6dtYxa}?fUoN}gnr2u3fhPpgJIiQ(*{)7PIj+GH3oC_%9BM0XG7if${6kz^kgta2V9CGNe0YiLNj6 zDjD?0L3HYi8s9~74}PxgxDByWT2Qo03(oWM;bbI?wc-ULDvE7;iY1Gm7)1NdkZ>+h zNTubYFT{%O#!kfyb{+#bxl~@0O=56*zB2*pf@y4UfK4uRcE5FTRQf3{`JF7Sbv%h; zor3QDQ-~}X%jV0>5ZHp%$&7(?umu{FNv=-&WG~pYm=fp7jl6MddUC|?yyl^d9Er;3 z6k%DgvT*yHb+(CR7Ua$jMqs@6mKRvX4^H>obSKN z!dz$13^?{9Pgm~d-9Q$n%+l**BQN)z(MZguH_K29S_~=wd+akpyj!cCjjgd+3RKX} z=&w(UCn>JRW2tm5n!~Ss8b`Ksw$}}~tB=!$Uqxek*^-x=y5k0{2TCF$Br}<0noB?u zd%@2;`YygzzPhWvvh)WIp0)WRFL%{z(ow0Bg{JEy2`|iTZ#C9R6r*D3&`3VPWYfm@ zLXi8K5GY_@qAt>1g46e+x6at1D$6!;Ce!;u;0;y4Rvqs1-Iy?fDbRBdB1A4`+M*)- zdy2ZiXQcX>A47`+eb(}c2g+aej~^Eq6H+f&jw!Lg558*wpMn!G1v)T&^%|dv(m@aX zj}al$b6X*KEtiB!GY#o`{8&UiTP5;fhMV56iiLn8(jHwl;Z=gF_>D^Y!)TsY!$1v# zNM2*YD*}@OFB@bG)F4<`i%Cx$xZ~jf&@=Bt)Ue+VH7g;;pjL8!SeI2#d6ZWUOxbIt z9$+vh6o-aLCsNvErBt+0hyp?dGFoa`Fq=9-rCY^t$n}Wq9UKu0buf@TKf@g;JPWYwz+d5 z@;zs5C)EPw#Lnhk6Mw=d9EdygQ0T_hdGieH8X`vW75p7_tTm0rkk~Plcn~E-ow+U^ z4I9=ei0yPyOUzCm3@1CW&_NUpa|+KBFDMvqLwo#=s~c`?m%7f zm9sAk6#aC_CsAz~Y~nvXxxEpb6;Zd#-^AqFXm~gnuPt5K;twfk6ARL7Ba(cwLE>y$ zDGC1u?+Yyd#UR!&696Q_s=!I10VEPf-gOWir!7( z1iZ@)4no>Y5Di)3BP!kZ$&Bqc=;tcoVKxWVs)yI-LGI&5|I^s zkelc25t}2*I#QMxw~-1bt_qicsPTaHUxz{uqK+c#yXvo(- z&hS#E2jRGnRm1;#9}4ev00+k9FY7L9aG`gCuM!2gyzDZ><2`NGQ;6-BpjiRG{=Be2 z4<3oa&bszb*}jR2;Ma6IZ7S{K<&O~DQPV`6goA_GdvmEpio-d6Hc7W)gO#4>Q$3Ml z*p_iwV531CyikKzPBgOn4oa%p&eG*}rK#L65@ZI^=4P(X5uv z60q%w4RsMi3}2^P)h;;@@wE?&3yMT&F)_6Ut%RJO=%0iCnzG8w&SXk3%CgYNLJZE} zn$M-F&f~RnBb#m5<|t470g$)g!VC$w+w$z?!91a~V!WffZLCW}1tJVsx-_D>uy^R(YTe1 zWi%_wVDIVIEF2&dS3iLDrPTRg&vxh<*f4NEjo9fo*2wlEY4b%jYv_WS=L+d*x2n8T zd!l(rHYe>QphWiXf>9H`%ke(F2n`gP{EGEl>k^JdubWj}kf9r9ePn_5NPbmNt;E`m zliRl7rA}wl7fvOsw#;~ zDQqnp{SRl_I>++# z-MT#a>52;-ymG%A{jlC{)04fCu3E70AoDRf5tgFzM~{B65241&-_wd&cnK6xJtDsP70jc#LSPX~Wf4dDz8v1JBIS$;?7&!vzUUx@tV7 z(r>XtARj`4SEkKFnN1kG4e5*NRdnYtn^cseOu8Y5x-=540PCyuSl_ax7m3UjWZePQ zew|t5e!p-t+#RQshIO;=JSo%{1qGG=GN6q3dBsxhyA6)f~`y`GIF=2reHTAD~A)2n!HCTIMrt%1LS1`!PMp-5t>R@f_@t1E{m z=}g1Yu9jRrc8@3y>*@{19TDy8GKm|Dl5-y7{Vg;kE*EhDb+ev*;l?cjA3PVrmcFp! z2<6TsFzkX%a6&-vE7Y-dh`SNBIhcin`dy{!{w7O>@E0TNDsM$qo+gIpAp4w+5}R&% zG=V#Ql4^nka_~ECZE4+p4DM9-G&6`5M9~yzowQDO1e`E3j2r*fNuaq@Y9Hm^fAlUC z`M(T_46g~uLH(Py-wW@GreE-ZL$^b50k0~b8(Zw#2;dGrF%-8l?M=@Q1jtUoTH9Be zC(_rD(_z6W;Lg4L_S}cGBr3Et{eg-;AH0~sWy5^|Q9R(%NI{Vn2hV~C4lE!y728k3E_NkUHT1E`d{~i8Lu1B7z$Gl;UYx@$}A;yFkO`E zgAQ#g7(WK%?+lmhGzBxLk1qfHMf~nRK7OAD=g)2uC$ZNZBo=CDJcXy#6hcc`{rYQ9 zt*Gk{3;!v#4UVGDad{TC;9}IXx9wrX*0EBye}B4-=8>Nd=>9B2Y&ku_7UCpJWb}8~ zrGuC@8pwDPd*lAV7-xr!;^DSm`;h3Te*gtpS55AZVx-!1ihd*mA%zH!5XSq9DdwXy z62T&cZFVov7ko49yVN$?=PQsBMqdCmC)7PuynILXj;y22R~*Pi2d6is%aAx{r=SIh zsH$KUfZ`fD9<;cj7!3?~oa?7kX#^kQaY)AW9I*bkl}qp~qH#@33u-Vb6UAc}wiM%P zKxC`{&0ll!vIKLGjn%cc?4kAW3eKE}CmSAL7g;$49}PmFUDWHYUsL167f0+IRVv!q zHH#mw_<$B}jBE|wJ+^IDTTRmE1YF46s$qD~vH#65b9UN1=+_f`!!JT1#+!G|o$y3g zQVuys(m7f?#|=W!rgg~iPo^mkQ_$nO-YoS}MddgUFgej8pQ2Rs6Q*(2&o2bm6A*V7g{H@yYa zLV#)SV{y$pN*bX>O*>cp{sPuPz9kFRoro5{{F~mwXY8K{%P;uiD!XLDT>*zlDyy!k zwP!4LPv80r9V8wH`p%4Tnl|+;U0q~6@VZxd`K`}i#9Z`wl!@X@1izVu6=i#e(Ln=t@deMk;xLsSM%YRcPiA*;j z*JC?(Z+qQcLZ$+IbCaLLtPR#Q1`dCg*bRJ%CL19G73JyC%GsC0m(}*~*+5}fn@?~B zTDP8a@C>7|7iuAo90G^z)q==Mbr*y=NiEL-!`1HAIQMo50T0TNytp1o-EuFfWMgk< zaL)o6@}OUoSrshg~wL zlGDC}EYNQ+W3%AF!Au*2lTDyE8iPsEy2K8I)Vlw$3y5Fd3HK!nh??}_pZVtoO$3t^ zKJ8q*D&z>d{uzdvCxQumk_7xT>w1q{1*d(Ayk*`}9&Kd_JQRjqD~l>8x( zv2&lL=dB>{=N$@H#7V&Lba(S)<}YXS!zW~(cfU`4{3*~of5vt4aH|IliTrXGA}%Y& z3xP}^&{l{AEeTTlcbX%Kj%b>fdGpX#zen@O!IQ>zMj>!OrOj^N;?L zbe>L##v{`p6kcu+?4WL**-i2^9$oVp{h1OdW*%^!H`m}exO8whae)&6QHL?XVa2Gw zf0!=`%hmOFae>i(j}0H8%9So`1gzZ(xn1MPSSGaK!F%Mz5ZInP##`Sq%4j+9HOD}H z`}1{>CH2#{e+N*)b}TElw{7qZJv}0lcz?hQ1D%_`)?Lp>q8UwdJjWuq^RW;%Q$_n8 z;i!nX%rjs6%wb+}^Q+ZOo|?^d;3dePS?`=OlpFb^2LCV?$)*LA@JrGc&0d!eB|=Hj z-A$xxT}D3eDWusG_A9&k7c)dsF_=E%V3xc#xU43g&?^q=S~U)yr9N+#E`>rf2`l$0Cgi_kR`uWE8 zqYS9mB?#eC!O($baBMLLRN+6y<|!b@4}VS8D3&rwc8{`KzpVWsgn;gjl5i%5YAT`x(R=LFpd-?M{YTMAyluQzirJ~Fs`>g& z;gZqT3~xSyVWqg3Dtj$x(8$|m_j+?_7loOT3*?`_`j0;EMg?7Ltc8EZ*ySfyf;>d$ zw_;y9?Jv8et;f99jPgTfLONRmX}QAbL>eX&nn`iM{7*1Nyeg#NnP(%g$nE#33d$E# z+LW%N33T;ctj#>zD$ltS z$|`JgVXA(t)^x=-)-k&@N-r3BqnqqBn}a~s^Oqt-Br7i>CAj^a`u1SapXthGae1Mi zAA`-QUYX1q25|EIKrIo*$!^fx9GJH@*3GmUCc*6=+46#>h*8GfxN=&I?M*J|jraki zm1)NCTHqvHl4O;P}M28g4Xk28Zt*0wSgE?zj+3Y=6GDQ6vh3{;>=mtRZ4tSDswZEzxM?~HXfNnkQV2|?_7#Nssd*k!%k?03Q zgX7v!S(h+lW?#yzj-$4`Y$i7WUtw(@99=$f;>7Y=$!Yn(*=hZ-xi=3EpT7kxX#IZP zrsS9{GP4NLI>e1n?ROcQhp!g)o0`#xHuSq@39Yx82+@BTH+%23g}ou;_0wu!ycD4g z5EX>k6DGGAaOVx09rOVQp!>Fg#@yZ_gD1r1u3ft)YS-^vRYsN@bGP*kgcH0ek#b}A zBw6F$c(8W;b85S5KjtbaN%XsGyXe`6dqQCBu8qpo9DBdwRow@Ezr&nLy4gAdW#i;{ zH{*udHF|Qi^x~VmxsVypbg+PI{6d*or~egX3k(`sdt10>Rb%3Q0D6(AwJD(O*KNL< zdCIzmH$WR0yy)R+bdpkG?Iguz$}YXQOCW!e;}c_x+eCpmnIpFr7F$Uti`Kexgxo_8 zOP*!FyCru(_IU0x$1=3P`-pD@dtJBH%|qx^nKl00G|np8sN;!F(nwF^mE?HrHCn|W zc0|LGAVhyH=ia(WC;VD2VG?KhiEg;Uj}T&C>M-6t-(*`B_np@lljEY1`y8;WWl3us z8*s;NuAOrz4hxr|K^lt5rhKXv`eP-Zw_UFAbVA+PYNU4~N0Uu3to1cE1~b+RF`{GY3Bz`)d5QfzgEp z{-@_5++m1P4@IG9mr_-Fb2Ez_6$Uw(l< z`EkH)qfO7PkNYooJ~$3{g?2t$8ZPV+Wn{Gq)Hp%CTI5}kNho}EIGdeW7ax5^d|8@< zJye^J<J4`gdx!k2m#~BmUQ;PY(R4@u-Yy$Lv>0{a3Z`y+%tE zVQUozZs6O1+qeOo@WQ`u2IMHtoszONhrcT9MV}uc5r2>2T7FT$4%O<}Rc?j3Wm}&4 z|Fu|b3Wt7jsHe;qd%caRYae{QxA4s+i)B7Vasxga!h~=ObFDMaC4U$Na?m5TBmdOH zKQIt&`d};YUq<86-+{1O{A~k&aXiW~b1fR2Heg@DEYT-J8{L&AxI1#!7H1oF?u7SI z_}2P$a9Ft~a#@;Vv4i}Zb*T9oLXStHY`5T%R%j{f2WNZCOb&H=ecS>lVA;PFbAV-; zwRq!lM)7XgT5Qg?TySvbdXbn`@X~bvY_S05r3Jgb*T;3m;3r@g)w;WLUCn~y5U@ms zuy`=XeqoCi^K5~718$9}5Fc010cRpV8E_feiU@=~u`-K?U}u!r{Lp6Sy^EO4a#>Uv z13@1(K4sCFdT#If1nn1Cyn;uGqL>qqHQjsL4VgX^QR&${d*yRScOf)+-C|7{VgNh1 zHiw?7Wjjs|ZeR6XOI9Qzd<`(moZ~WPo*inqclmBl&O7}p(6@G3AtfSQ-;ffsY+R&Mta`{3td zZiYG5fmD_)G45Cg*7;VrS90W4*cMff_=a^SL{fi{o<;`PR?2*~gX@50IRH$M77?=i zyuQq7d79lZrk0i(&n~{iElI^^)n+J7Qd(198&^>k?z_Jv` z5%j$P*dhMYYzG7SD>lotbI?LS``9T?u=i|jmsI6@CTw^G^G-OBsWZx4p62-yA>_sQ z?kYEZby;XPIdyk>fb$tw^w2GYY%uH4L+o~`j({NZjO=S{sa9JB9b0jp)9IP6f zitr@-az)6@qDFK~!tZLQYBds#jV_w{GM{FV>df-!wAwUMjs~r_BQa1x+U=Pp9J$Gn z>B*Hy4Gm&?t$j5SQ}0I_#cfJjg$z8Q8HJ;E=21-jW_VL4XGxTI3Hg<$ltn##67>v4 z8`OuEN2FyEj{fK4MM>$}e7+p_?>YI!T?zl$1+>TU^F}ejF4I#Wx2C3Gj*7me^CEH|IvT+AN@!F z(SP(`{^!U^=^YVYehXpGEakpVWQH4wWaQUnx#JG@$xpB%(Q~s57efEucaC~uIj$$_ zixGc0?zn?@&a3Xzt#u3TcOeWJ=RNx#qe&9CqY8|V63diOMH1eb*(>fC$e zjz8q+(a-%Ecgc*927}p= z1cL~7>Wv%+!mO-$B)9WM%87Z$Mx${7swsN;L6w9X_LN8kGFWluHo039+>3Hg+f2Zh zGqy)rMSE||2RhbnlO4>tY~*r2i;<9Ht-cEup_60XK*&oQi1__&jg~QH8$hPn+>4?; zwxLtxg*1Sa=>rJR?%Q92E>=P_lOj0l?Yc2%uCSny0*v>9*3{+ye$$cIe<*DRFWeNoKkrl^yF=-Pm92K^geA)I;)e@ndh3P2GA(g48~+*y9rbr6$FAV z6#yrhaV8i={#XfPWdT+2}DBl!P^G%mN7O zT4A0#;|E)%b*Y9enimm3#Z|QslJcBBaMbjiuizvAcm>)wQ%IwwGKLkvS)DW&P%fyL zDtv&kS`t3!?Kh`<^vuIoJ{f$l&YCqE_?8!F2H{C|Tnb{=#Zn0X-d8TUt=hJmC1>hW z4Uo?up0?ve02TJwNMT@Nb4slMsW_?@0zkF3$3f%mo6Q8QVRcLJ3Upw0SOaj4oF9$> zpr`d>0#Ix<-v<+jQQo^{TBjUnBSlU2XPyio^_`phLF;irG`cDRz{iuCpIbBO;;6(a z*0Rxp+J1mB&9s`PrlXq8r>fi@07zCYWczt2TG^8n)5TP^DB=!M1Ev6Lb;(mNx`x?Y zT#ru?018WlbcT4Kc}jdul74Lo6{gq)$c zpvj!uMkxLY)~CpZsDsG8ArcW8P0+NHSq@zc7O0S_ZRq7je*U z7O{q7B++uSl(;x7KtvpoLtRiK7buSyjJ5s1^!dm=BC3{#J?@i2FoadLlt7b$PvX}3 z&8mDrW1^YD1Yd_7_esSn&4 z+2j7pJ)a$;t#@}2F|ez>3TE^@&e~3b;0{j6vGHP}%BM?$Lmyj4QYH|QulJKrw4pvQ zbBY=7D48O}xK}G4svM0TD=!pE8NfjcYR}>a0sK1oTvp%RgZ80u=Uy%`vosLOSho}p zZFgln9({N2gmM5ebDd1>KsZwM>Pmh3ncF+yNzJql0s{y=?g1asP}0H2{h|we#R;_P zA%gMR3QEetv1UVJyjJ(cYytRrX>Sm6!!Yg_i-R6_Q9Qc8#K_g4LusM3ge5}An$$$| zGiy?u!^1G{Ez3d|i|!+WN3K z7j}jwfEh0E(IyfD0&G%uE&<3K;~L$p5kLc|m&cD53pF;W>4c_udckpE3czqJ?+2xF z5P%?MmV;c&C5B>kxaum8QM`C4nwlm>n=a23X;FRiz;{o5d^p2rLeH7|lsXV1V%i5M z<#bzj@la#Y_|^B4sm?6V?uWodnkfJ@lXhYz@ZV|TI=M2-sJjizK`|I@icU()R%uhi zJzq1(Io^)~=uplfLc2&@?U3N|P$wFXPnst+{UNz>mK;o?o(bLc5YN{l>1TJa>umWa zPKZ0!`9USW^UXnU6FD%c?$BU23{0(+BPJ6m87|_8$Db4}jtYl0&*13hxnbz{xsZHkT`U!Y!?P#n1_zspp-Sxa4L2t? zHAUmaPl;myupL%#9HxxH%y@BBMB~G)cbDUe&SI#DhjPU*JIhvmXf_#*#*0D1&?I}R zy|R*7$P0~LOc%#Z)Y-Y>u0fZIkQ~`LuGtiK>lo0c=%5Rt7F=UNBB9iqGl&>Tx{P#| z;X#-yNkH3ld1*!MRWau&SxucE+g`VGykSL87<3HFUA0sRhg+L0S=_myP~GR?2rM3=W=G zBA*DF_~~z8M<}Z4^t8?M*dX=ZO)!VAYV9v^H{9Qn_HZZLS55{!NpJiYD2Kb7g1 zi@Qf;|1;np+~r@@boIFUuQ1F^$QUU(s2|;mqYMu;pb@Z`a-{Ljw2lDX)n7+(mCB^qS9u=dzvp0>ImjHbsBa7h45G$6Ij3O+wR*9fKH6HM^-74)5WY^4e zY^^-c!^{n!$J*5(`XO+zNUml%j$8xqS%92eSF^V`I9zFQqjvd>bsf3tVRj;X2v?Q> z*Krp6r+L-7B)Ik!fR01|Ugla3^>Vd#`}Q;Y$8#5I+J_He;hQaTIGooPtIYRfJOi#T zg0&o!pT3Lx?`FwV>}`Xw-_nNzgFv58vknheTAo(dv=^y6Yi3WC?=NkIiGpD!fL%!Ag`I_8DPJ>(qcZL=7D`+-fnRTrjh-m zotvbst|eF@#==*@RoCHmMCScka6@W1#vIeGawdSDaQY_sIKrZ$Y>zTuzH)z+FQYHT zxw3`KK_a&huo7;tXb6+LEgN71 zfZ||UU2zMo2abFe8gJdAm3KN9T(xB99a4C1(3V~xm#Fa zUzUfIFxwB-QD^2uSswNkUymi3B?Ij7nww*m>UImXst9C7k$o3)0Fc!W3iJGHkLLic zdM;d#6K7J=+cIm9-B!nGCb5a|F4(6FHxG5b0&wIv5f-jKLPCMQ{qoD4AkQkymGV4~ zA3#&Y2VXHt$w~R(pLW*p`mnC9k;-|-c6*|DVN#CgWoG#vB9F_RT2CGa4^;JzI@-*} zS7+^k^8qo-)n-`gF^@DN9Y&FxLbQZHX<(vamed%b;kHWR6lLG6{JMu^uM zYf~;$!rG~!UnKF`b=nq1Z-7`QA#z20S)Sv$#1Hdtz@BpLX{Fr|GmnoPQ%Y;39G*(g zgoY^5+?xj#tW!!YdsDWer`FTtYV`Za?c}yB4^gDV1)ycV;;6jFsH154!$^f(_jrcv zBI;~DHbo;qG)hFsd?o>1OC@dIt<9{Zw_leCOf;O|p;G@@C z$)t*AiEUk~_PRz{NR~h}AYNjVQq@c~fqc4DS9aP3XDeF1kTP?*o@17FJ&~R@ak*mP z@{!x@H7cSupShZbPYqN{Y_>^sv4k$0=uD=KrG}mm9koO@iHtwOPZeJ*p<|rqOF}!QZbG@!pqfC%1on~*tXrN%rFSSvD|UoQ=Sdn+-TjF5)%obY+N(g_=t7F z>MJ~=n{jBI-IFfuH8qMKA*vA5JERIRPnNRAai`sSe0ObPVpnZfgL!J#nHh00fu5f1S zpcecTZSr8MirrdSwbZshKUYwBG9`<1_p z5nlXu2knYZV#z|CBR35e72=7dg<&{qtT2FaM`%^+A``0(V2q_<$+eX;UtmQMC1s3@ zdEO2?Vz~U*-35AGaq(Km*)KooS#Hj*oA=D$;B5%K&G1RxQ;4p0#%3 z#Ev~DW>}bw!8?1sdx&C1njFg-7gO+B6TvG9e1S8h_c&!J2@9E|6%8_SBuFYZfQyq?eXzyP59fFr33?&aVtKKG3~{y%4jcoz{}IrsM&_nOhOIL}GEQf?lQ|_$A z5LvY5-b+nQQ3S=2X)P9_F{v1&cS^fqNGJN5M#>*i5#otLN8dvT@Wgku-jk8(&9}zL z)5S;QJ2KP=M{nw?S;U~Bmhwl8Xq|jgNjpYK2hcE(;VtS%{It?8(?UJH!~C|++#_|o zL4^0^3c+d>!SP9h?x8|w>zzWnZ!jJ`Ol{g;G17UTRf#@TJ^1}6g%qazst@Lc}!y7P;lKCe<_L1e$}CQA{g z7?;n#<*KTPi>Mlx9~X&;h+Ju;oIdCh1v@g}<9UE|v|PS{_z9MdD-RiwlGXho`gL{% zfWWnz)wSw`A=FKrl9u$li=Hs@AdMEyGLPWF_@i9qG3t%Ag*r~ zs&huSh^&lXePlvHt_JdQ4$tXQdy#wx1W=F(ao(D+Y6!uM5dE19vW+w08x>h;Ya4k` zF7t3smjy8dAb$Ec5i}n=e%KYZqM% z4GbYD>6LA{mK5ofh&XW6)W;x&E$a8mE{Ejh^?G5kdn5je*tm zyIN;)tYTZPiNvZIfD?h@-B*tjx%8$KhUL7ACyhh}0mvY;U36b29Tt5S3tYsw_Ri7p z@CvL&gBL9k!+sm5+ z=1>=5@^Q``c`Ll_r&gr8!Uhw%#}y(MqGmK9lNgtfEv>-;L8X-U=7TWJQy+g^TOmP z-p2*xa+1do{)|3;lokS(Ni~BNM5BXU2&oK!m94=9*(#}FvHuyr{UjTRHo%04 z*bx{z06d%ATnE^Dm`AB}EzBA48mEiM4d<}i@YYWd$kDL)azclQtcmPP7K}z&L@tE7 zTDCheyGmGtI}``p>*+$Oo)h86kT3zjIEhE2(dsd03y#c-aQ3ee_M=XJvq)=Mb?(j1 zKc2w4MJCfPQmfTYsF}Tw<%Aw)aEm}e{Kfck~#~@+B-DrJc6x7H5#aG2w$FK0o!8s^mw>07do7EE+a(8 zVi2e-DIz6zq50-$8}s5f(T?=RHW+}f=$pK;qH}lLOu#F?x-}y5YIiHgk&+rNVk<}E zA13Yl+t7Q2*Hekz|M&~&x9NqhuD+$_`t;atslI3OuiKTP*_RUvFF4Yqv84w%cxl#T zABo9P)|zSdnW2dFG{44Bz*_@4ujVU28a>%I3c z5TbhRuw9KycfB~#@P2m$)oV{k4Zv92$rm@KZyhJ0HE`aumHf4DoIL;OkQLUF+f0BJ zAU^=GknUz6Anim5&#goM&GBQs=C9|RJ$dm#s#~hLdjF{*X+!NWzh|#Qp4?Aw0^x{s z1|TG^G7K#MptCxe{ZQLf=JFm?>@H~$k#T$COno}hn9T&F2n@|hNdOuda-wbjaOm}; z!!N7;B>8-2ynqfp-F1T=jGIoVo)DffUu2&~`(Btx*c@E)kWLZ+LdJg|mZ48U;=G)( zY0;`UJP}Dp{>`lcnX;u|J{SZfrCUuF=R*47gz6*8hp8u*FZz4+{=lza#jAbZufGJ@ zzE{5Ix8<6}l6HyY`T_JEO(Yy4(15QbJth!{GdKMd~fA3w9D`T=1ol6Ps>$r8AI6% z>;S;JPo4m97Q;!OCm`FHsh*t&2>7+BiGZ9K< z2muESBGwgl)pQJ2Hv=l*jy7CKaQq=P`bUu_505&bs^kb3cH#>sFh1^kLTWMq;3G%i zWfBIUtl~TbDvtvZ6j3t_h#|bOdVU}VYr~hQAEUJ)USBZ3?u2^PpS|!U+6j$q50#Jx zqsD3t3ISLQdLgNy4&TAkKr~Dwv|+NOPlA;`ANM%srxbB2gzyso_3JMXLOGhi*t#VN zWYhwO>3~n8IFpaeiwW?3RLOniJ3S0$WNcl-K%`eoP>y+w+>(#V50ibe7e*Q4M8;9l z5z|3fU-R#-`OQz3l-+N8}!=>A<_-4{0&mrXi2JYiTsdpJh@l0Bl@*i%{x zqz$p0=-6(gXiJ@D%#WS&QSlf`zGu5C4odA{Oy67rYduU_e!PsajWh$$M_0RupTtA> zBi=x70W+Gb!LFm)s(QkJyAD<7GTVvd^2x}n zKfBq%Y+7?&HsIBUs#kSOX4#B-tpKR%ZOpLOt8M~VRvn(X0Sv2}=gVeD)$7&V5@F^2 zI*{e+hX!0n4Xf&$!LDH!RkZ_PRdu*(utGJzx?MEXcl4UOV4P4LnqfBA{Kc_tcg;2L z!0cJ`u^!h|03Frgvcc}?)z1SssmE0nmG?Sh+jcdl;@B-_wmfv~ntD3dt#guzEn>fF zp1`z|x}n!qZJ6m->ZOKe-5>Y+V0Ksagx$0bb=AyL-OBd>=Tf|HE7w`nb*|o5uys|P zc{a{q2RBroaRVo)&vg}xR_JkE7W7ARsSb}DGSi{Iv@$!WUN?~m`mbv4mtp5pI;X1h zFwCg>bpy6kXAIb@8-5>v2WqYy%8ZtgvXG3%QnBLH$2OCHF&0aU8L!a zm~3W6GML#?r&x0yIh(+^d@?Y@!J?`e(W*enafpzX9*21J6!jt#krKi zZYU|8qS!Gxuxz$-q;R%$*EB7j2+N+hwpQ%1DtlA{_jL@|Fk`kD>futm4 zS7F(~qOxA84$8_s- zjw~6RLdR?oN1s-#O(*SE35!QIwOui6cGC2TXwC)nMF%=-*ECa=;ZbQ?EWyx8Xqeg2 zBHf>`bAomfR?Qv)(*_Sriz5di=#N9iS_d#oQ12M7FkDX#C9GCO{hyeoojncFKfRWj zg4wb3tPKhWx7fc{ZyJ^oR;z~Wt_hn5q5{|dfoti3#~bWXXYSA`mKqEaSo=3KB*7qy z%dDXP+S8usLY;Q@&m*f6c1MF?N?HS3+uTkb(O^aD_xTo86*C1BsF_!n(W z^$rt)(UR{+e?+#ZPG>>29K!-+dbTW1BwvA>FObm;0wS`qp=&;p;>rxkVB`ZB2nbX# z14U#DmYHGEz>(Fk!5A=&4yXtQa76SyxnV$wF({iDIBeOXZNjPs4a^uv&L0&cMc7yk z3<%`PEHjXCMI*CGd4f#0%Ftkw!&o#2tY$znBUs5`G<;@W9hS;K;y-9=Bg|ODDjIAz zu36xCIFZ>Riv-Bn4Nc=vED#njK}%Fz+{ze!CtU{0WD&;occhtei;PZV03`i0a|&>9 zgbv})0T{5r$Qk&U$Bdz99J&gPZ5q>y>rVnih*k|M3?`0*nF$IApFa@4yV8a@Gc>}+SKmM~*K zncv{zU4oeoF%0Kj%)<$$dVx6%85RT+X`C+(n87$WbwjfQq(s4>n>8TT%58=x==<@EY{RsNt6}^_qK+HkN_grV^B$4DUOT<(saW( zpt?zBvISy#HR`N3EHaK`I4GFMn@Ox;ESogkU>Ot|d=gQTqX-cYQ9x~&pb+)X0LQ7R zvB=Vf3Ho!a1QDfGHxyb%V^NWa8((O+{u!aPO>>%Cg16 ztwv?@hr&48`XP62zsIvec>K;ztKZNZ4>vsQpRFlKb!90tTI8Njm!t*=h6%(P31tGb z+%CE=ZD24W>6I&Yb9z$3K->e3D_$jUpaXH!hS;U(fytQU55eaIM26?C$c9OFga7vjpI$!P3***@&wrf;A zX^!B4+9u3uG9L>TNplUW%DF@w6pK=W#u`DKhTt1CCY-8@sKAny(aeAWq_qHu`Zq!X z06{5{WNH$~Je~ud(rOoIm|*n)Wc^v}8!%K0lzq*Y8iA}y7(f6Uslg@v>4NFFKEw5T zlX3PHLW&;PePB3tS4tD0egpXSH?0Yee-A6_cLc!5OLBHn6G^`6 z@}NX+ssXYf^BtkOMTj11e7^0P8M`%`sEnGEfUxHEU`4Ssz~Ra&&}vlZF=!}0La^R6 zYlt_If_*2&2FYcN_cl;_kqdunkHr2euxtbnm~;}1;j@~>jFkVPUuMi&9c&?V46f!T zW(F|QM)6x_HS4c%WHw2wGGs6TdF^5{$c!T1X7()6+olnOpbv!a*9h3ikCF*J2X z>wlLwDnWm~mQYtr+DeLIEksmsdal2bg{7gWGRf)*DP)33nKeSh8pnyjVEVI#%?4Fw z)sbNsXD55_A2vTP|Kg$DAm*z_1Us}pPuUHT}B zO(C0XI+%qIU8v*fuK(tXn{u{O5Ha61;SKb-AT%^U{r|}&x7CYg?^gBSNhFd0!-o!y z)i;wl-`qg>`S;i~d*_(earJ(cR~QsK07aZQGwzYZJS(zT^BxMLrdOHJ3tH9GKK9uH zv6p|z92ht_%z86wV65`o2U2fuI=>=Yjx3`ED`s26dNx+DWk?PR0hWjUsnlqXPgpn(rN$F0^G?~6l9NkE@TW#p!+O|owh;bTS#}HCt zW~7Uyt}|)Pqq3|4I~k#yApy_8lIh}hQy17;C}%SVPTinB z?C93U_2*fu8Dx^MnTx$u4MXL?lU8TO^{0rPlAA6uWP^q%!}CKe=`RG2E(;YY=8fx5 z^rVZUz0O_7*9)fyhR0nzDxQg`C?XT?dKKo+5_8<`q0i))U?hpI4{$|NB(k0|p>qIo z+Jg3>2{hvrkq73*3WPX7m`JDX4cj2Q=7Hq+Grv}mwzZq^!1gs_R|L+#6 zIjopn;s^eMnWpc2@EKsWgkeAvj*N)xF`ALntP%!=Z!L1!X}%4l;V$-*uHU+01P)ZJ zr}Ybz?8A_eGCtd#IssU;arN5W`ks_Ny$-FOM6pDg20Q2d;$IN327H$z+ag++7uhPQ z+4HQYMKnm4ZJ9O~bRJ?K93lug*WG|3Ct7Kl#_>j{172wt1nnx`t$K6wjjykpY~6c* z>yD<6i!u^g>*2nxXEzjVmF})V(2D&4Dw35lZdYK&=kW3S=kQuxPnuSRbZ=SY)$CRW z0#%jWo_`UU*Y#+-HQ2a*BHcd6la|pQpvHEqhV9CBOwPul&4Gl&vDl=1k3b7Y*%G{o}wIHYmt2lViGr)rl&R1$X-9BGQ|00|@Gt z!3Vownb^5rN9g4D^yDlC@I&{A6PM~0!Zt0#ccYp$DDrW2Zm~brf}RZJ*J&(9Sa{~+ z)yirD*p+v~oDEU?CFPz`2lkc70Dzohry$%=A=1#$)i46bPR{J;J8aC{%4$`!*%>{# z4zjgl_o-DdbjI0H5%GprQF0N%cFcdiJzs&0QA5=}Ip>kr02*LK`A@M|9>ZPU+>+g|ImAnn}upsVuZE1)Oi2#V%UhQg`H=^Flb>*o=t9;p0|KI=We+K`VKbymU z^*`h0{zkbNI^Cs z1)TV=2Fg?4vvFlY^gFYtImikC&@}Mcljq@2m)A6}X+2ZEB7kaAn3DtAv%?89n#vea z0PNsd)>L$0_&jtyds6FKdEVeuvOe+{!#xPs8PAp@*n@#RMc$%iGWBu08OJGUV6m8b zBsg|X!6cp@G4gZlj7|CSxa)%RIDl>r(cpP^aRzyQZ;WuFnVUuEIf@z?v8 zFJ4*P@b&}X_uifUkPSOBl0!qo1n5Wfrv#udEVTLx^s%jrf6pb`E~-7HdFzQnn=eF1 z&%uYPdR5C^`ffvKHq>HM+?&C^gRKxG`y-y}}|G#-aZbNR^GG-!0sx7c{;^XwyohtQ)Dr6pmO{AM`lm+4eJ-rF!hNh z&8!LJrgg>`v6okl*fV@w@n0Y2*W`cZhvdqBeZ?Z~%9V*vxw~nw0mU1dG;RsX%*D3? zFT}5MM6L~0H6!UkwJiIpiP5^fe%ci4iLvwa1%`9^?I#iS$FxX>FatcptM^t^SMy!Y z9jPV0OSaA03Ow~EmO5h!dpmro`EYhNBI%V4f5nK`Q?vQ_;^I?Z!`j~P`q#hyYo@W+`{tWo|DW*p^mVNL z^+D$O=WXT5KCZY~&{_d7@j}DxuNqQ(hA!*K@a5VSohrGV{00;`37&1-LFMCy$bJPV zlHBnOc@|UH&hwX|*Wq2d<;0NH1HN>-t^W}{%U3m@9^MFW4voxFwYC(G692GU6)F#6 z4St6u<~Wnles$1;J~Pbo7ig-V&ac>Bj3y5}$GChupHMxYRrh7_Va1_5uR)ouKzv0acG?BHOUq6X*4*kLBCpi1#&;z^gd3bLJ zU`kOW*)mPSXB;myM2J~l36Q(fU)@}0c5({PkvJkJ)$4(x&8{fyVyO0s%C}@Ch}vgK z7x83AFVPeiu51#KIJbIxJ~5&K5p^fT-5Y?uP$M^2LW7+wO-(J5yb{Ise#FU%v~^e& ziLKu2L|gv>L^$JUu*^?tqF!Z3!gMN4;sEWFJEqx(hQhefmuAB_eWg)mzN1L?l_Tb* zCm0o9`~3RZlP5oGwbdS+Y@a-N^4XK0x!O8;^5>jX~Oe` zfwq9R2UZ=;npTXFbJrTfLszbaPrV4QYniz^I$-2Z9_vI>oc4EK3U2&=*VvU~`7N~A z-yIreinkskCs}{RP==St@#vM{*O|MjbL_7D&fbkDkMGF-wjx5%x^TJjTSvrY=n$8i zXgiSyv?Fd6xT1B@@9EC>UV<{Xbq`%7>S@NZ+a5hf)*K%}+qq{owWP4t zrqzY@h@mXcDHerJ0IHw1aU@7(|Caye?(@ zkMKO8{=~^qi%2TaV^ZzlsZ!iZ0*pTkMk2L|;}8BANlokG9E&^~hj9<-4|ivkZxx7) znhUNhZp4v)&lv#}n#YCCsyPS|cm)_&jITvE9WOl65>WM;Gff(zQU}hh1w=yrFrYip z<3Zym>mk47_b?NS2u)~&wsEZO1st?D5R#V%nv3(QxKE+DkdcTZmVwvYIYk~3kDHm= zcq?u0t_an|4KpX5fRojT(7`InB=F7R9_TQYHQ10|gcdm=VsU)+T6+|GN%L`-_tPJE z&_Qyeai`+=^Ggl(wt){+pvdvvAY)Cj!f(AYp;;V(+c%fF&PpGRex2RAaXJ){4Pzxf z(e|}aMGQ4?3y3x9jmqR?rBbP*E!>7R8AL~;1EHaww1^+jE7l}Sum~*@U-RXW$~UKhg_uFhQ68XIubmi=Yhp*DhwZa#06Lt7hLMW^YeGiuq!AOSP18x#3?B`&9>1>L z42I$|1tP3NcZ3mYEDco*dkRHgs&~@1_W7rTx5Bw2w0T{q&>G1~@IG_p^*vcqO)P*< z5|04ItYvF9R^v70RSLx6WcRy?!F1;`G>$LXxI z0D?7>tuKyh?cJi=ql&6#LI;c!!w_LfOC}m32bKdC?b#D&zt!1}4h&6Zt&J&d%!Tn`dU4qVtbY)g2UDrun^#PWD23~|p z)U3cZ$rWp=0SOg8dmr!`P~GnyLZ?sCHUkI2f=_`s|38Z4rNJm~;O84tV5RSA@Q;80 z@4GzGXdIOQLR@AL=X}@ams;}r_n2w0x*{H4w!*qou-zZyxXx2#ByovjpI)ez3?Ji_ z=rFS~O-o)!9G_{MmOfxK+erp=a>o*1D1M?jCUN5Ei29#mSA7rfIEpZ7!~lRmf4`k* z3Cq5)+f|^`b+V)Ad>8L6#vK=yZZ5fSRKf6=W0?<071s+;oD>!!k-Q$WL1GAi^aqme zCu6x^@qbqVfaGI^Jod|QDGzeGfRpVf-aK)^Q0-pcJ0N(~DcxEWp=$QZz_22`FM2ZB z)>TJKFqGycRXktY5q8}Ps2|16mU;QyRA;a%LR{Q{deu?cIeOeW;(&U_&SmGB=TxuU z7V-evJ3>_5Hu_d`G&raFVdwf##XY%5b<~a#UH+Nfz3?6hSOTV08;@_vo~y3+05y-d zGUQ5u1qpQH48)47CXiE35!@;_r}p8}h!%PG2p9=QIX5kG;BDQ;7 zZ-VeT`ZumY!H(;0z*`240v*1!ApXJNX!7lgRQpC+aau5Z`o!`e1Y$0DJ==hYKq#1WQo@rZSm*1^_AXJ3eh@u|R2_bAWcUAY2f*!9)g`L>u}wFX24~ z%zuTD3}e_M673S9u)RXzg@%NRSB%F%ZL0Svw0Owd5R1-SF!11zV>2E4+l-t7qvO#f z1%kghz;Kv(hPzmq^BRjF^k zt%0FLkg##Zclh6e=BH})??Oa%Se>Tt#Jm!71PET#p2)27uVR^G7s|L1?^haMbCTqU z>%p=izg|4Tr>3lqgemo7qXZA1N}C0Al58mHgIx3%=QeZ0BNeM8w7?x>SjvO6wr{z4 zajh_Yai{^cvYSs>&)#yS@ZQY2z6nj5;+9AaiFwT@UJVW*82z#MTa?eKK?Q~$ALA9^ z9vF)&2Sbuu1`tgd@zm8 z=4fDYZ~6rO1_79iylqmRm4j`y2aJ10?K(=Turz!_Z6A(C6CJa!3lpOmeA6EuAB`Ry z9Wa)fCcoiz=-{V{{TZY8DX;js+h7`%owl13+$L`e$lnGy>@2T-T;yltjx(hR{DZu(6OHI4QyiI5cwww?4SOJ4f@{ur%D1UGB z4<0itnQF<@s?7!MPdy{7Lk(i8txGyGnGkq9!ONpXZeVcvPI5bnIdQ*m@4aqQ~2c!$NDP~!0ON^POMu=2S^|NK%b`=;5vX(1U-v=*~{ihlq& zKJLA@WqZ;T=P~RcFw%aw{f_vq2R?0b4yKVhBrEFP6usUeYm6+3{Pq9$`06!ag|-de z?0eHNMt}M%UZZt8Dr%*TVn2!EQzF%ldW~rDx@wE*kOJ+P4Zd74XYk6I54FbtRF{WL=@fZ9_~pvZ`$U)CH)%HP7c1 zsF(AB>L>E|JW}McVz}ECenQ7c`XO8oo|IozBr}$~??iOsd?XSEk53h=OxYu(;^j)eU-Qhp zuL3ZkvOwU(uIdSqndGXAxf}-*ZmAD#W?m+y1?ZQBKdh>CzIgkL>Y2!1;anMKSA{m| zAhiJ95Sf-eHyv?2TaJjcQ28HV=H=HWcj>l^_#ZHUx021jjKea`%$fGOOtL4NMd1J4 z>4EBns<5N-VcL(HUm6?}W+M8e`O*aRg$6;)6tqCcH;%)=vhXk zAMx*@PB#B<(N};z(c{(+Z|Fah+wIhAjw;$9SqGx~`N{bm7gsv>(!17f&04s_J;oVA zjq<#3^}TUj27qr#)N9pV*U5@j#myRhol>>UI4KU4YryOWUr}dvTIXX6w08gi)hUcX zv5ppx1i@KAxepIxMb8t8UQeNe<;|8VTEuOwJIbJ17b(JD(-HngC~iDqw+aoD-Jjk* zcZfKC=r!lQ7i~J&26Xnl##nL=eYd|p1^lyY8vM@y+MAZL>UkIK0{vy@UW!9Iag5;x zyLEJqGSz{bL6>9&C)rrG?iA4xvmW#g;s&&QG`32k#d4k2t2dt5bew+$bea@u)}Y35 z&Gd#Ln+4%$8lg)m6pX$;xNQgEIF3dd2{I<8sqdg`sqC!!O{n}bgbCIj@KMSwhiLj2y?P5}RM-|4Z zO2oX!w4q8)-e><%-t^~p`~~N+K(rxE-=rcAOAM_OWvWGT6#x^P)K=VQIAz3a* zW+54Lf_ksm*_Xqr`c{%v)P*yYuq1TF8ahK#1XKrfP=u-Pv9j#ube>%XRc%EXN9fh- z>8LMG#6^Iq2Udi-+7{YXH7Zd#E!m_Ry7-E5zX**a30hCP2hAN~ee%XmpML6?F=J1iW;qP$inwwLM+~ zbodC=L`ikz=!nQF46s{JwdPJwPV>Q;0M#1NmrQTvbQgCROwNiRU`q2?b_s=V0XWNW z6#1SRYwp&B05O9{jP z9=G&Pa#CyebCPPkWL!gf!-=bUqlPfE9ZBwR&ncp2f z<+3|URT7!Bd>=+6vMe%vTx0%DXnNhbRg@x`&h*5jZVAODy{jJ1b3Cbeax>0GqMDIg zfvy>e2|LaeY6*Bf!$eY#p)I0^wP{{U=qw63=a_zE!{nIm;;un>499|k0F!%m+HuSQ zUu6aW^Eytlh3|uv=gB?iBX(7CKo3TaBuj!+zTQhyG~QJflIps##_`swbJATygsCXY zDc65ZKEh_DVz8`dj;Y)4Kz-QCMWj3W2UV?qn1wkz56d2btsQ2muEpI7Bj;T0ABa~~ z^{-d?=)1mxtyLk%KXn+|V48#KM$S~-XtA4A#ljBp(QdnA{5M<}ClayEEQ{s~HRs64 zPuptOtsNohW<7Y60yNcO=;x*tmHW7N0exf5#)@X|2W{ombKA&F+abF?vF5w55!k|# z>~eGJ4yO_H$Phl9k+6b#-=PnEcL#(d>2&X|?`FxG?A9fD)cG!Vfb z86p7D2CsX+BNC4<6)4-2;Y|dKO-LLslI3`T{KteJ9~7^T_y_3_;XrIDu@xy4FwWGc ztXxIN5G;nK1K`Z~Ox&TW=#eB$_iVsyiD7SP(g@>xue?w6Eb~Bu9$hlBh6t+T;vW(l zy~(qnUB{7D&v^CtG>F1xN3c@S{oYI+8VJ!7G|&`4Ge9(wRPJRHY=E&>svk=dkD-f& zB>CF3@*{i>=+@uZt{~*4X}9@ z$jZO23!fSRh&r8|4dpw&>?|*;s0DZf)E&oU*K3`ML{#;PB3|F?S47YwN#zc^wH5Tc z9p0m$ydpwWHphZbKA(qD(uRcJVL3kjAta6$KJmdrVJGok*F`BE7KmilWxXaua-Xu1 z3t4X0nQ#<#iCpAz(ft4*l!~vd*sRoYh*wB;>iNS6u-<)Xw#TLd5rnh@mk3=J?LEG3B55$3IfPnb;8-sqrHjK6(z z34T8x_=P*x8}W=fs*^A zB$I#dO?xe@t}IDjI<6#>W8@;)rVms;L^yGyCQv|Kk+NN#c&=7SNO zF$q=M_m?TB1$SWyJn7wimk%IQm+@XtoHM9+3SPMLS>f~UQCdmncAO(M+Z`PLjCKG6 z5m7{>9~rbex(cD4puEsuC522hhcZ6foRCs-(!_d!gpGtCL$8ggBFJr)uc!jKV5u&@ zwPKopvWjpxyl0q*Ky>r|ity-)G7ty@{WtFqhn;8cULP&;n~7@jcDzj+t7pZk^t7P> z2j)m>mW<{iq0Ow$5E!Yo3(NxGpoBF@(C}tr55aoyPk8+x*1I(wZV9iFw4Sk`~>@2$1S+HitxlC)qn9SU- zp81Zy4k7PrIu+xLH#+9dvhmY%Ij(YW&-sPY{ykNO*m zPQMrnJnxtK3=(XDZF0rJud}hSIM(ux4ITuuR{X%OPJo>Emd_@C@nzBJ7h`|teOQ@j z+<6~X*`mjlvB%DpdY20w9G>@VbrOv`@7XH380R)cs9%f)p7(cUqH*W_T_G3aJWV0& z7h|uv7u0HIK;?c1*U82BWKJ_I{bKAn(jALdg0@(zB}AR6n2Rw06rf*>Jp`K9aH}Y+ zbs7M78{hL%FBf9~01D7A#@?dbHPQdWdac|?6Z|P&YUE;^*Mb7{i*YB$eaPO&)oDWP zciE12rd}?_08p@gG42D`ZvtduohB06-}cw=QZW}}pg{d%>>==XCq#Lj8ck$^N6vWf zk$AqMGN%0ud%qa>0Vgwqx*DzAU1TCOrbaHt`Te-?_lvQ^+-m{WXu^reox+Tsi*f!| z0s6(*O8`jA&&98k?sAOVNU%}#9L zdZLBqLb+L9IA6>i$xeJveXh|LI?Tbb^9lvhG5Fe`GAP=A{; zgXR=Xv)@~;8Yj|ex7+AJriBUpj-CtIyAbq?vD4gDkt1}Z5Ba3vjk$d#W~?|OlLrhE z`j8eQ6AQpd6bh--t@v}`Jqq@2b*(_Aod<_EJ(lFj*@Nl5@dL3y4vPV3#kxafmqv{HIM6i68vzr6JUe2NYj;r&{@Vvy zDJ_fuHC%!_^9VNj(0*Q=J|@$2Ot%a5G|49bNN?=0(z)G@3b`0(z!c|ynH{JKR0GhC zXz1|5yp*`)3n9XFy#y}Ym9ozh6H7~h0M;ChIiW2wQ3F~A^Nv%NCBy7Wvsn>+^p%kt z{5hELnn=rz!RI6@WfJG*TgLfT^BmpimAk{qqx&|A*hQWNEl#~MUS&qa+O0W!cqU?S zfCri7We5QX0XzD|*h>Hu8x0G6hX#J^$qNL6fUDjtu9?<;z=P!1vY5KBcx$20 zZIO&`?DYO5(4X?iK&<$+8Znf^1r0d*C%|#h)1`r}(xyn8uhrv|1iXbrY~G5N=gDTO;oM(cn;Ay_9FuK*C0em{`ZrUGGN@L+868O~Rnb>4HnSS3le zpe+wyP#U5J$$GmFm&u9%naJI?SB;n70Si3fB)~>r5nG^vREqEC~#8VHBKkGKLs6kXOWmlupu zx7uiZ7=j*Ieb>M2Fv(Q_v*c9~DaYi?2*iR_!nBLQ!PMXN%dIceD#wkPb|US7X?_K|mW>#R~7RqtI8T5{A}$0QEHOf3gBA+0F~HD!{>nlion zl#pi8Y36y&<88n(GY@le zwnES#gnNaWAX92O!`6D>fQ^C=6;{?sBmJgWW>=ca0C1OYI37yCEBXuAfL4R z#-%OR_9yY}_;KhWu?_H2kq?$1D3S6bYWHoz0k_ucuH90Cyk&PPebM69kO$UsP zyqT$oPYJ$_2beUGVHh(qvQzAOGLE@X26Y0(CGuWlmGmmQMp~ZY7Q=E|v=J8o3rRxu z?Ou|}Flvznhe4p`3a~dx$Yj^~MDBCAg=IKXIOhOO&>F-5XHf59Ftmnaq?nilOAn;W zpZ9>YTnA)$6<}ylI}X{2*mfAT-rAX|I1Ct_fE*`D25(kg141LpTySoV_iw^&4|+>W zYe12aN#VZ(kk)QJtSR1Th?H^3$5G%Sxd~hcSZdci{L6r9{m_}tnKNhVOXMVs!0N`Y z+(&dGAuClBEe`?*krAx}!CZ7{vp5zpC?UL=Os?)aV#cs>kk%@b#%8*Y(N+i=LAREX@LougkM>lGliN8KOMSM6>L8k6~r|oEr=}W1}H$ff-Z~IU` z^YEHI!a&iY+(*;eHrX_}?eW+x0{CUD+{AU#!APN70<_KKu&B&3@Ifv?Ie#3p+k2BD|Vv~EZq6A^nD<#{9bwSj(gt+hL2_HLzr7#Yq1ic`S$(8CL6 zLH$D2vrL>;NnJ<<_LgGH;fVQR=GRjLuMLysRbX? zBBnKGBAkSSVx)7SS?zbIr z8Bde%LzeJRP&BRGNlj9UWTw3h#m=XC*OVoHo-rqJANs=@FrZ(WV@{CWy=qF6Bhv!R zWb8uQ&@>T#Gy||ZKLUy=?}oM_@=OI83a8r!s(=j{Fl8Ek#(GoG)$O+F)yA!x0JJsj z`>Wz`@y4^=!5950v(PMK%nv*b3|IkhvttS%co=fo3eQG_io)7vtx#pDPs+9G!A1Zr z#p(>xfNT%Z!Kr1YHj#P6;tg~E^yx+(b#+{>4rzHX4X&cjBB5G6xEw_1<>Iyb1O0X* z>ENB>;mUVjA)+3$v7)E;wO*BFB~zB_1#7b0q)5Y`>RpV<5L%kOZn3Skd2wXd8W-hX ziDxjSsX6Kua#sw>m~jsOq zoA&|O0Fd!Ah>1{B^v4BH$$-v+$hVS=B&e>W9K=RBd3%&EThHwiQ*A|(So9}1uI)~9 z+_GAsI&tE|>U2-t&IbU+fZMuPyGa4%r)4UEw3P5?YZ>IuM_pwzJMo6+J`hG7Mm;WqOMKFwIEy8GDAFWkPwSEzuwk zlJD-hqT4-nni7TIyR4KBSWx}-p0RUHc6#e+X6}pk03ZZ!U)mTz#)FXNMlqr4G#q$i zW2J&X=RI2%G!rqX=f#b&7%BI0nV|vrmN5#j*pnFB5?i5Ary*ty8x@>!7> zou-h4r3z@ET_W9IGMG3(z@)e)0}9UK2j#U=r&+V_MI`4hk<>*I5lr)pjv(Toga@V*tqfCwY;Q+yA@Q@<9y1zkb=vcl?iOjEO9`gClyn@b`t> z#O2)45B3)%gN{xM+kGg#-v!3c#h5g}z^aAIljxbsb!i~i01~LP-)k%6VhjyMl(p5jEUT)O%Cszq{CUaeKXR4J z_;o7^{bHUaF9bF>Gj%YXq~_2Rl4_=Ti~r7h`3)cLAy>P9TE# zCK|$uh$dc^u%gP*D&%6!8t?(_gB(#H?1=9m?RYK{{bDQ(*||SOgh(mn{RXvhj9 zX~Aj0cw4yUPUC3f=VI(~|9Jrhpxr!qpVZnCZD|qc7h_|KhmVX!MIdzs;cdT9KREsl zKUYByxdtHnnD}Ic#rU}x109N`zDrbdK*|n5*2u7CCn@y(Vl0eG9GsoZ8) zrmPKW#7b;U?a_V=ZEJ_f{#g@UqYr!}i4&Bz|&f^}Q> zb7nqX2T72(>OMq91D&IB=3;EE?pPCLl!m~Wl-Jkt*$2?iD0zJG8d8Kr}R}phDmd2MnQA{mG zgeM?6w#;(+iSvu|{g-E-J$Z5P?8)_$gNqkW{(xr(C-*~U@#r`{#HXiMF{c4Lb&x+M zaolffyx(0Qb1}B|em@11DmX|^JizvzFp+W^6l44=9(4-fREGVKNv}WqDV{2l0ZkPA z92V4AaOPsH?7B;2RK@JsmOmk@fOA0r@AH4KvGE7|`{%Fs8~pYDxb58HoAzJjBv4A# zzO+OO#!O70#?d%)G4^)d@#uo&0*^OsK=GFRzW@FGGyY!w|N9O87=O&g#f|;dIHsp- z>pg!6I=GWtD*GLRGZ$lDJmX0q#wK9w2>CsCZ-Cumc(RPlR&?FT)7nhn=ZOG0)q6wl z1TtSOc0?Hr#d`hCw*C^KOHI2xh&B;AnhDBgH4n zr_M8f9Ed`(03L+>4FqN_2V32V`$p1f0vAq#L{eP&MCK-9)b?b9 z_Mf26c1$W;-EN#`!6=X-4F5$syaQ4f{C++lo{72z6%WEV!(egY0QV(L7y&sB!;fu} zjvEO=?l1fZ%@savQjrasVV0tCr@4ciABGWK2D$cmVd6-|&6B_qHCs^}_jW^WDpzEGHxiW4h-MvBPblRgdwMq$?#VL(V3wkCEt8#Kh<$)qwV|^S5z#sh z$Y=~I+Ec6kj0YH})^VZ6HkGkWeVRmMoL9wiaWod)@o8)x4{&6AH_pS)xeioyLYeP4 zZV@Vz;f-iORvPtgD!m0vO{)dRf{iFiu3zu~nFe$ow2AA9I^JQa=NS|vxmzw1lQ$%h zH9N7J{hy^XBQjD6%L_$O$DtESVLDxYLMcHl75W5lVfiUDO2MrH9zV^55m; zkxz4McFUrq+FV!&B?jLUNsuD&OI#-Ed)cE)!Rzqg(vFflUt)S68;X03d}WgC94& zO2Y$rd>NT8v<>k`1 z35S(;L3x0eg<9q35$J7%HXttzn&pDRX_1TM4nUr~a1@1qJk3t4PB>iIn zRC=A>bpRmkh`bfLnFb5E^Xn$#Bv*G_JU}Kn>6~c7VH=?4F#6STi^e2?Ijz%j)u3-! z^%K|Yl|;Z!=)h?uWJKNsoT`v)0*-7HFWqm(%fs*YV>Gll@bG$~Vk0oZeoyt?hP67} z6gd*k*nImsK)VHlzW$o*#LL4ED~`_G_Lza?gHPHLl9@1E^}T1%8h)@iwE26=gVSNc zFbqv!rj3KsUzv|hJgu9KfJ{+yxHWDCS5Q=c%iukGWj%0)3AH+N6K-=R`z$959Yzq&XEgiKxLVU-+5xS2MkOzs)#;r=F-4t ztTtk{1zGO_au%|^9J3-A1jgn6&So}_(z==Pc%ZI8lIsHe3yf|kgszeW6|*te#qyCd z8J~v37i#qZ{u}_mM$GuLtqqj{`4E7RWKR^U6G}9HCpK18^Mul%mJg<$;w0G@L}7Lb z!JFF7Dn!D>j8$*hbkv}mWLbftPg5Vjst-5qU6$u+()R+e?Mo`U6*A^-|39LB#bVJqGu3WWfHWn5WtE-&QT*-aZNE`^e=;JdA+om z@Z4{VhbEXiLZb5djth&fPTq~hk6H`T2%p?e6mytWhUgmU+Ahoy$t97O!^W19eUfdq7r+I{vIN1jZ2d#+G8F{i)^;|V2%-|wHN zIZ81DshNwBnqk(6!)+pF5^fD=B<5%n2_;r!SCH-6QQsY)Pc{W&;9)0HWCzeKJ|uwe zQaHst)#W&jjEd$u;K^r5#*O+p0Dis~h;iSVF1S(K<3rxgemp-b% zgGsyzIBT?JqddX1R2n;|rp@V?F8Jnqh>J3A2&=MeDCKKeXc(hX^@n}$cIuZWlz8AdP!9ncDrlmu1F>}Qt$9pb+TfF0FM>m5HeY?MbR|?OzRL7 z87i=p1W;RWdb|I#`Qr;q%P9*O-4#I75?;(M85Gn7QuJ5B`z=QPNx_Q~qgOPYu~>}1 zLPHHPG}Eqjo8$?>_G5+^I@1Tq4+}my_yJ;?38vmPSIb67d{aI?#xbmA4HyyfkdRUH}*F{jlEd$OLsKLcVG=I`i^XitQs*okPn^LZHvE?3&Bg>X-?2zl_k70yWrrqS{i|S9ARIP9 z#3A%STj_UjBXXo22X9yradh)5P8|P~orh6|4tdCMuwy8bs2>Ngn{stWMB58BK-wwO z<7EO%@V{NCc|@G zQEzTztDFNaGWq_zXVVGR&os{hg^-M7Zg*I7v*1p}3<01vrIX|zV-O*g?=sq%o%H+q z_AciSV+cV+ER+SVXKKQnC3(h!U)H&)K<2M}9k9xTr*}kE0If9AB&tIoxPztuyHU*q znL=S`Y>Tb|4sYq1VFw;vQ>`u=!fFhxa6%mfg$j(s#A_uepuI`xMUvlF$Q2+HKxAoR zsrPdCh!_LKNgXpt&G!J&?#MyI(1&s1bis*TOKJBr-#q|;-d9pY6v+s@$pPDkBYKvT z?>>Z6h7|el4BUs(P0QvncdtXCJ1dVF%y^|DkVCXh=XH>^Z$@FkjEaAmT&e(`3^`%g z2Lz?VW@Zgoe}&{_DA1ZONM@u9{_}VH{Ug&>xR7u-P&}&WADmz=mL+~wkJg{8WssJy zjBO^p4uBZ#?I=b-%8YO-2cnI%yP@__@t;?6MyN>Lbb0#SCINMatZ2q}@4ud?I!`h& zD?4hKr}@i1-G;-*0y1L65m&3#gY$eQK)M}1@&unCxm>+83{+%kDIRWAi$hwm>VSeE zlR?TfuT7s`HFeCVA_3AC;1mziN~*nN7(DJ|PAX=w8N~O>;}$I%A019t>j2t7y*~v# z4D}EtvYS{}QMYvyzQxIBC7XY z&WcHKr9<7=Fq7Kvr~m!0R#0I$nF$=!k}xV4r%dMBLPW^8++Ksn#uhm#m*xag382Y3 ze$F^YZJ%i#{zw?@xntl;nC9>`JIM6d&Gp?Kp!5$Q$tQyTn^3OO?8=H36jwIVOx}ax ziw+GPrsgCS>erj*nkqR1#Q+dWr5MQFwzm*-!H$aa0e_hQOFr{8jfFjZd~%V+vJHZx zbj*RlXV(SzX040Tl1+1Jg+xhAmE97NRZl3F6FT$^bJ*!qq+~G+shM#Ot2R>1;IJwu zt!ukql9c3^OXY7e_wqIFQ|6hJ^}oDiPD;DqS4jCCq_WEu<$EcIibb8$--4e%5V2!gn&G;0Q01HO3X%Kwc)Fc zU6JHq#{1xbDw7jkypa|irSSZb-q2@{`6+FC`y@GwUDC&yIs`7#^IU5>sPqXWE(dO~JcO}8OC4xdP=K;vk7 z`o&mU?#og0XalN|TI6gXPl?WL&pYY>sv909&2py!3kahEltxd#7(3hVeN=tBzh^>_ zG*V0|`H4t)s599}GawZ_s2lG!W;lex5zR~df1T$=O}`imRCQSihwPDn%eB1FBlt1s)9P{PXZdO})HNbwcUyP;Y4uPa|zfZuRtvd0|1$3CX zqm0q^^b~w`m{9u1X6D!QD>|e`Au;^RQQL3!i?OiletY0|zYLAda3qvK2oR3-8%(@; z6Ct4NM}kM(>2Iz)oevcp$|l+i}AhcheD}E(7oMzAg^RYTmRCJ^iBZ6a2NZ(elhmN z&2Rqo#QIi^69Rmrf1~Pwv!NG}BguiiBdaD2nlS)@6<@C^a43Bo{W{It-6-bny8-gX zoP0e_zcdrJc+565bPe}@9^60ni?OtBSVG}wK#G*ndAN{vFj0+2hs@*Zs?J4pC^R5e zpd|{YjOW^!=E~gwduvJDnbWVx_~J8Q-BVp|$STcB9M1FX%KoumjFpZ1a0E-7hK8;X z1;-7`397P*`E@onHWmX=L5cu+yMpMs$F2xE4tCXIYDT!!-Gp9Yh_3>3MmmFLd5-L> z(iu+t<))LV)f%Z{S!LTDF8O{}&Ub{6hkYEZTv=S)u(DU=LzjV&5Mwfz25}MC`RGCv zDpiDshpD$f;rk*7bdE1Sag*9|@W5s%brKfWDF9ry!n1*aTJm(czBFt;%|_5UnYj}1 z7p(vhBLW$Ic!D2kMCoEeYi}`ZvY$i7@^5eP_aYoHk?Z1}Bz%-ettw6u63Oq;m8~Vg zxrP5obYgi}-mGj;Vu=g>MtqOKy#wh3sqLL}ocU7+sJ)IdaoJ1#5RF|6nT+SSR#=e4 zWKRjBv?-V4b<#sMB|zYSvfuB$^ScTLpSk-#`LmkH$|5>ZS=uQ8r95(k6jp9?g>1gLp_q-&)FAXnU$co2toe!E=?CccKX zKYz=cjLdCs3jA^oi~-d+VEIH$24F$FiUhPB-Dj91PwdNHfWxE!Xno!pTJ>B}5M(;J z%-4{aF(L;}cV4Q{;boANC_wj;k-()j8iWKztGyY;LbWZL_#h&?x|N z!!fZEpv38VlyqlhY2)kyi1x{6*V~`LMVa}XLRDsxJioP>1e zXst5Yf?+^2T==JKY%FeE8Eg5B_tz$4sBNk}^r9I_a$Y`n>kyGP_y?+2V5 zgSmLJeewtNE=7#ryz#R)7WZx7SUBAwH-x>(G9t^Us<+g0hD*B3qMdmEo-v%C>BWr= z%eA<;aUg;7m&UC?JmuB{@}0LLRlAu^Z0M5CI%wnw8pB6;cSW`LY*?>4LtiKm^+68W z9zsyy)3)5cgF`lxE_$vj8*gUgW5!%XqR88<2>`+7%8>EmK8@m!eCfQ#30>S{NvEX? zAen_2S-*>mX1wI7H!Y4S*6c_PXb30GNy~m#`NMj0fsdcg$|=?-&2&8yipXZD)aOkA!|}*sL30 zQ4cDkvYF;@`kLJSQ56JF!2wpT&c*i_dwTwBlNf96qbnPW8&)vU2)5}k-h@1{Gkn2n zEZ&xh6C4?FOigyqux4)fT$tA#u*6-LL4o`0ynd_kBV7HN9Nz4e^!>HY>wxWf*dug? z5q;bhlt2c)lG;qJFtVC(Wy25t1OUeNrEqXi2v!*H^SQ)zKJRjf52Mgvjx3{|h=?|k zq=^d)tBsAt=f9QFo@krpx4z+jU=}&;0~mTOW~}BO(Dw+Q7-x_ba?wY;D?fJ+@ z9CT&P|0Mlb@uep%u#~kE`&kQ?q>=o#3s5-)j9mbK9}L1i#;=`rEJpd&ML3O*`(kR% zubqoMN4$bC9+L?h-}H>%Ya2h{XT&rO&c4F2NIh-@Ekc_0f>{QT=h8d z{vFZVkCxTlHtkU4!>jmgr~c|?>!{7PKkqzJhh1pFsI_(nzO-^n>DkQFbQ`N9oaN6J z^e}k*$=qSP#*o=%Gs*L;TYq*prp4+YQ0t#)iLZ~cLfqL&pYPVZkc%6;%-zffXq+82 z$2=s9{@3ey|H?L8CS%EfBqIQi7FK5BcyaMPi+v!pGQ-T6qaBQZ-_Ax;4gxT9xYZ7z z#s*rlNIoiX^@qOEDM6j!cEgU0o)c*g^XJc&q7#UXHIqlX(9ycwoAdQkfq`0emazreI0tyFNFHj7F_&I(x&g8=%DpleWEmqb z{D5NdT&xjuV+0l5I?ik~Q34L}wzdak-6^YpmeufI?LIF-3QK(jy2wU>0)a~=&bbQK zx%FgA;R@Ngh5S8qfKmW=b*i?v`>njux2^6;5 z?@TlkXr>V7Z(8Ph&)Uxjh7-|yyW=wIZeqbEJj?yZ{BH;X%qbtEfWdH+$MCauU!V=f z8ylTyR2h-Wj;^{FY>e3q)2H8m%Z;;vpDR<&jb*iG78G4{;jD;N;G7{NT~%0s7>mpR za+}9^5X~O7Go|ZYL)xTy@^SY5Q^}FS9gxrqsOFI%EKPpvQ+?pogW92=kBlY98U!-D zvk_4w+(Q*JDFAH#R8<)(o<@?^Yx(%s}*xW=t8et&&zBkum=SGb-Mz$ z-Fms#`QVQqhBMz+NY|>r;+?atZ3N7znh=FI({1%^9%TjS*2Im*W-!m=91k~h$d@JH zX_$#vbOguCJ#07lpcU6$7YR2;53K1mWL2!%5 zw~(Gp)ZIVybgXJKPSb5z>t%djoxv&pM=}7hKu*7$z3@B-7>S%32{Ply+s&$Vl-FVS z<7a5*hB^3h1*+D^!$k!!ujp{UeO_AZg^1!sxM z+R+7yY%I=q!1RsfYb-PTF5Zv?HxZcKMv;lN%ltFo3sB-mZQ%F=2_}wHNRmev-GFvQ zSxc{o{AM8!6Y9)4pc{n1_XtCy@die0@aNAtkw!X*(B3u>8*5*kDkayg2EVj}xoo!N z^=!k5nWIgdCr=*Eo)ti`)>Q#A2g!iSddO)3AWqz=ecQ@#_^IRmH1J|)8K(T7Ih7+` zEdX?6z1xIynnw^IP-I(cBf5!0mSe05MOqUgIt?|wr<|NnW&|GlJf^Qdd-CV}fc9&w zJrlo8fIyr~13sHkX6TWH;OLO;$Lq)5<^)Jk0ZasBHHg|}U+(L3sstTDAqw%$NX$$a zatE&i0z=7@(FLJ(LW>Z7YZ;F2D0|&3X93f*t=V3EYJT{AgdB#~rhY|lc*>qb0BP3P zVeD9~fxuZ>xLX z+HVtA*Y_xKIsDe3U~KL(g-BNFk(}yXd=*eIa=4umJ<)%*S0&k#48Z8X1J|Av^{(Ad z{7YN_z`k``CbjbV2j-e2z#2VgX_JrAvv!-TQK)x&@CJSktL25}O$EpZ*h7}JHc+5_ z;5E(0vXNp3ju_bw_Q*>vKG*sD;^RWO-04(9gOKT^s0KLM55NtMd6f&g3cs~j40k%7 z%&iRtEMs)lL4YcU-UKBlG78W%=rTb3bcgCG0D9m7a&Ql_#33-$jb6V8CFurF{!p8vy%DkH8!I~g#mE1Jf9Ie6(;xr9?>=6gLOVTE z>(_4C1|WOPdL+$is^sC)UVt#k1iK(DsqIPPptGQ`V*G;Av0K)^M`f)vn`M9GC2x-u zf(6!OKLLlBRE_2PYxwiYb~cuh&?6f+UzEb!!~f8dp;7BFCW1g9f`6NT&<%zn{RhnK6RfY;S$Sc3?g$(7~g zMb3g)z zQSKCxZVTH0dT|Ch_JaKMpYpzda?WoxqMw=W5v%(Tld12w^1&GecpYB{08z<;aOgsC zY7IDLy%}~YfNv>ev_IGkY=c)eU>V45d26@3W`Kyb#{}m4!oy8H*HHzVx z-EDK^7r!V69+)*CCs<7Fo`7JynkL&$rJHGnS9`b9sUJEW4;1hF!0#MTzFyz>f%hre zJl*-Chh)7|6ZaOueem#BjOlMt%Im5=!ig_cozLrhUd+XuztuZF!&@*oby-j-2ZI34 zAxLeGPT!*fhik!@{4Ah zvyVKqj9Ihuedj%}*8oN2$s_jA@Xi{_b->`FH@2Pzh8*{NE_p-q6y_HTC=b(W97+#}6=~-m$+=J1W6q z$KR!Q0f_}Tq0t(z0&weN9JeNpl5_y+3RDFGxv$Jyo#%L?+G$;Q<3I0xaBVICLGo7_ zq+>nWzM+xs3$K@1+KxSZLmqhEX(L%txlS$p@=SgDWX)z#YRyK>@f~M^cB=N`f zJ>kpZc)JXA`zilt#8zn&>|PWWX)q23JPaA`H|j)kRX@M@$e7W1?y{hPJz=WOcIut_ zwY2R!-Wa6jY3^)+YKkN1479L*t`tfwp~1HcFZ84~Rc&q}Nl3ylxq3A4`mQ`v9wjzw5ncszn04 z^ezEu4@2PO#o}-h3AJsWH99^Kjnjv`b>svpf~AN|V*VW9eLv-m0per%!{F!xzYsDo zwfcOUhf~PlOdWCYMPO#culYx9cis_If~MOgQ(s5k@jYcj2{iQ>vo%`lI7!O(@66qo z%>>-?s+^Y$z5Rj=s%e2Fe&Sh)x09vMv-*9fF3!ZdR`m6~0`2?I1okxK=o7Hb2^DP( zlYKz%B`z45y9!4)3q7`BSPJU`nD$nIoMi9lT%}-$M=%1~F~?d%zt4_Yy|j;)I4ed% zUO0jaMc}OK3;E-0oW)=^Ecc;7U!^hTsP)Ms25z%8Ak*BO0_*J$EXjECT21%6RvGp6 z0Q}()D@ggn>)Aw-xu$g};A~1scN2IR%v%u~lgM@W^&RBC0628bJuUcj{6|0V7q+yZ z2;5Kqz@Jmlju$LZocgXY=h34*3wwH2R!{dNbv7~@uTsC7ksBSdp+$g?HD>v#eP+p& z>-@yV{Oc2Ue02ERCtBPBgXMEJ{3|YZ!-I+2xnSHZ}`|mF|X8hVtLX(%# z5{hV?Ol57rc>L=feiVTEidH?-;Yn!e1CRgCKixOK^I!O<|IY9Iz&{W=NII<_+wvyT zM8gJ7j@5DM)0aQo!-uPxANwQL9$nF-FLOTUC_5^XC7Fnx<+n7Z!b9|$sU1-d5_qX!3j0nhj`rT1BT`lKZ5-1=FXrnNTq4b_Bny`IeUY>&0) z`Vp@F+C2hUP-q7<*36v;sryVnjOt-DAu(eppQa z$l|>4xhZ%VEx+(2vAf608~~%^3+0va^+aq7p#Phn@xI^ieee5)|Iy#j+YSQHQN5{L zUU(G%-_kKah>VWc@BU5H32xsSv38{U!)v{qS`MyYM>3H0bgGxLq84ULLi%9d9G$rg z;8c_Hw@(lmF*xoD?u``Wu#a>TkEc=K#GL@}tme69`WOIg?RPLH1q9y3A{isGyb)jx z8AS2zQCk(-#Yg}c%N5;h)}PhLO>^HKsCUD!bV8~}fZ$vR+Mx?ZV47Q>64bwUcV`Nh zALG$IHA~Sb8`gUXWIl>n4)W1w0MHndB5cp(`&cF|D_ldlE%j1xvt#DrWFJvAaOdiG}FuKTC-Z*D#Grv2ns<{UzBhAcq{=tQ;00L`eH)eF(k;kIA zppwU;)=Rv!nr_1jEf~#Q(&U(9H&v}aI8Ow!pr9&mfzB8L^)+kqZ}Z)m>k$0y5r_`( zshP@I852LkjCvbutla;z#+z-bPbKEZPT_pSObT8`%kzpc%ThNhMxF}-x0KGm#^${u z&F#AecinaJqF-#eJs4Dzx*!W`66zQ+YDawCM}@$@%rfLT5xj8nc^v-h_NLNXoE44D z)U>qE{J%dpvW8PxbB*&|8H2V*NCKg!-#1E4Hz5#y^qBDk>bW1ZTi2sLd>*54e!O?V zBj4ibA`zv|8Wa~G(C&6UzjH9LfNyK!b{>A?!YB`IU#N<#sJsHU z4P%ViVQawVG-H;}(geMIqJ`wgKGJKLlnKtx`BnGbb!G2mG9vBg$}Q$nTx?s_BGuDi$^S(&e}Blwve99 zh$pEtJ9=HsSrAjT+UOTM*+jtEtN??Fg6$D39hBVet?TzBezs-T$^6WTIu*+a zKC*@x7;93bJq!s`vFtAMAek*yzAzHV=V^mAEwCe6=O+4mmjfIyGL;Tz+Resdbz7lC zo)`kZFmfl~H;-%x>`hPt+E}v@u|+9xMlJAYdnDa4$u?*x9t9FV29m>Yxb&RwkC7mN zdYYHqAS9j`g4w{SrN$g*1D zyEp$D-S)br7012ZI3NPEIJUp$=t*e#+H^vEo67L9j|~l0@*nal$yX3E3{7NfhqJkr z=pQFx0vs}(Xs%bKmU#gJPqD2a7r21peV?zD`&H?W@92O=f{ByBneLbX;FUFeiOK%l z=rff1f6Wg(mcbf3OEqVF?L9CpuCKoX%{az|GBzI$Ho8vTcN;1CPmILIys z*2yKt0~zeya@OaG4y(UiOq+n>DPd9p?NbO+t$s$NiBkz(Tt;3K6n%A-`9uXYSovFb z7Wk>lcCM9YR9!|CfN-*1Pp0;&6ud}TI?|_r+Jy!1@7hko`rcnh#+qjN;Dh?6n$c@Z za==Mrn@yj+-(e`=jTK#^RzkS5v;klbV$sk;CsRcuWZW#7=BhNq-Nc%S4v!kC&_QOT z4qlT_dxk_KxmW@95U56q@pw~*_XP3peM}%d7s?1izU=VvDDs~G#N>$lnYl0`5^LN5 zb)}6{K49eu4efW4m=2CTFxMn)ZjxG zV7h=7V!q=9Meb-Ioc;6{L*@$S1R6+~8l3OrKTcT{f$jzW3NhP9I`--CV(o~>J`42+ zkfx zPeRW8KLKZ!Nch#f?>F-5qdWCJKkX))*_4HuPr1A9`qjQnCU_XZmbww31_27ZMJ1mj zFLJuVrNPC)$-Ob|dVg#0-}1KhYdwPZ_PO58bh4Yw%ycfpeDgU$C>it2A(D#%{tnJ| zk7^JYE=_CKV7P_Hw4yJgD(4U|PO;R_B?;e{yvk=e1W5phz#FO2u7b*UzA$?I0@#Ljz(E0;u615c#Wio+It>Jqf}NNNgu_h{;A(+KsMNLVof&m&ZN98~&qF z7fw_m0Y7pO->wYFBue&*hvNAGpszbUrFgHZ}kk|~~)6ERGC-o!3$l!PvEv%Bx zlE!-y?Q5~}CM4jP@X5C?5&4LB@HMj+!40i=xD?GHA+MqwvuoR7KVitOmja;BOpT2M zx~4Ft6C>EhBE-7x7xyMc?FAxmq5jcKsfJI=2P1G20&*O?I)Wk{?quOhi#!=LR27$0 zZW;Ilt-*ofCe2`E6zyOJxLv+J>&#@GOo7k6R9y5el_^SB5BMA~d6aVB#gkT(lu$l89uClxTW{H! zk?YZz2R13p=lsIn_vxs2pfLBdL)PB!#QLtY^knY@D2v}PlOCiKcxwYDYi_lHXg{CpTaOr|w)+~TDtFHW1f=BjOzgb#rX#XZ zti$~DPOFN+VPpNV@j5+)HH^COP)_!4G@s%()R*|1eCe^f{dK)>Xo_b;u`-$NQm5Q` zTL7BLP=5Ud9{9By#6Bkr*U^Xh)V$;p2+EN-cV5H#*4)RYPU-QhS7E(F3;=~le#9poG&6c8)}xfkXi~H|`M+KqH}AKt7+-j}Fh*wQ0Km%Po{t{~GSB7>eNRiu+zX@^t2u{e5Z09(J=(FuYT#1Xy%RG7JI=L|AndL~ z_h=j^WqnpGaO_09X-bhv|IJqUv^d0vE4Ra8?>HDBa)0Iw5YCH2r6kbo+O~bKEG1CgqjVoTb8Dj;YhU#>pA%{1MO#%&f6fe)uRMC_z6AO1Nmfc1n?Qz0|?S@Ik+*79|a9nKq;eRMqq4`%w z?Wyu9)#tZ5ux&fBgdjiAX{htOda|JH;wG+p@^uUF`Qzm7?voo!D_y*4t5i>jbP6dY z0A#visc@RC+wnLCP`UNqV!u^Lo-D*CtdJpXX6>q(0BU!f&a#GWsFetiHw4Tq-r-2D zkWB)Eam8?q#?|f{D~u4|@?F1VYB`W~ZoT<*tlX`x;0=vY#RrC>#Pim++iE=9do|dD zSx7}=LtH6NqUru)E0Rs<*I@JISo;~ZUaf>v9a7$BRgz~6y)%wn)8mI+)Q<3eQ-JMVf4I>V^z@>mrAp_Ee9x%CX5Z73R0=R6P)gaU`$&Xww4J56q?keJuAtqMu%}-nqi5e&B|AYGtnH-ot z>xfPfz7G^>oy_gE=r?Z<9smAA$WUWPYCCdyrSZ95RZs*1_X&s zMVcd7F=gPGrX2H`pEfWYJt>->T#ivdMvEnD*PLJl;_L;LFsg6OE65yNIEQ4}Y9&&X zU7MBEXl+ZqO8nV%>oE#wz1{};E#e->b|eD zr3b7o+|+D-t})Ba@(yOjyA{9o=U6^y}l4D1_l~YY7rQF z@D)-;QI2pYCKsB`e>f+ih{U+-9hP{ey#_@|#Qg{wqt}UXJPr>S0;UdW(>0UY&0&s% z*>FNKZ+S+NyIQJT5{}hkak@e8k}Spu&D10_9z#4o3T}O!2yU8yf+(&Lm1Cu<%&bAt z480)>s07is<^v%F4x$2J4Oy56S7u~~1S!Xw**K2Vd`Rv9qmX1{Q}e8SFtG_tY5(l& z$CweBj|qo`2`Ki&cGtWA8XwM8t*lYez+pOH_lVY+)xH-r$_wT4;R^7IKJb1)x!D-I zOgcdOc5FAEIY5pPL{H#vsVfkgAxwi7NpbEh%u$}XJ%I@+LQ7(-LZn>NqBzm-)qOY| zKjwv#lw=DiSn=>MTuxW-nKF3!@Pi*bm{_Bb^0ts{oSt3{*yP%i#pM93-c!6MP{p)8 zQYlyG&pY5!*hu-~kA&Z7>@Qxu{K13Ps<#~pS5po@crf6we;Wrc+2U!4lqaHAGxmDd z;N+245#2Q@NMsY%YdkhJrhdHf)`v`*iF)2R!)s4%1N3Hr{E~`bvL2JHOIC<)E&=!+ zm6ICmd8LH6Kqfo<&B+I*j3)kVw?i`&Xzn;s^h5JPu!brYIFAtyk@P>xFDY>1N7Bbp zLH$S{(9JuHfZ%lBA9jzj9+FH{FcHOE^t&AxYc$OA_4OD+ zDd(j2f&4S_B>OfZK4au++FRwa@(FssdL+>S<*;WI>6Qf--(P5G99XJ zAvyw}9{Zyj4FV|eDqxk23XmVU>5vIZ_mF%W)FAoM!i?!ynSdgJT!ML=h}@PJym-)} zR0(;o_{h(YV`suiN#>WgJ;_0C5;0;DBeQhN2KJ_$HnCa*&D zH8#JrwAsb>GH=@iHhZ0q0{Coell-Aj-2NJC4_|1786PcaorEpJ z>4x`e^vQj1D1ZyB0IkSUZk;1;`al4qYZNb4S97zwG*3}LI;L##0qM~D-^Ixod32747CLpJ_1j}K#ZTT3R|$SX{dhPjdzOcTWZY0eIZ6f!cjx_#gP&`U{g;8wD6Ruq z^(kt;@GCaV03%H3FLn=;JBlNTze@#rzZauLTVKztIn zRE~SY&gw}%)bTmaHV>axsz7gB38etE@?&TbnV3kbZ|S0#AI;C0)aJb;iF4(TPgA>; zQ?w7GQ})eDxpO%-{@8raj;^ zmbsN~QTIMlfooZq>Yc0|1wgJ~>U_eG+@l$JA4Uy=7a^yBLTDCt zlJXewK)fz5R`U2ZtO*37SU1!QTq|zf!*oAU?v7|?>h$#QW?gmMn|~Yy`UaN!kPHqG zEt7|U?mS5<&}7Ue1b~>Fx%Z0G4Fm!RCdoDw3^H{n=Dj3{p#YuanwPLwH(r6raFVI# z7?2OJiBlfZn@fP|8Wa;)geH<4_j!-vd29Y-y{9y$)Pdi?-*8Cso~ifd4t1?Li42g^Wya(HR$SD(&uuVX5s0Xo1GqP=01$CNeQzYWWgLd&kH7qy z8u6@Q33xvlkHo%E+!_aq2LoltA1W3P+AlaMm}RlT;i{Ru7oUJD7)0HzT3}ER;-Ur}1W`2vJ>Csd3#%p{)+MK@a@E{|Dn#@FVf|~F6 zzu;U6athdfW#o^yM7nxDNvZ%^&sEz36nU~H4v&9&Q!K}60a`j-pGAgSm~c{1K&!P4 zNR8xwLx95P*!*k(KCSE^lUA?iQ!z}~R&jpDO`z1+3(|qC*sc)n6=@mCkbRY-j45!2 zHB-ZyU}xPD`&9dY!%-uUx>Ygfzvb8&A>fks%LEs#$$F$*W>a*eP%V;4_1+9XrDGLk zMd!zz#Zj`c^3wlxl(|;{brWBpjcsxI4Nn|}Nq$&UKr1Wb!OBP(?DnBFr~1}%!0WpL zx!<9-`XoakvEOy}>3{907M6-DXCY!jOvtE7*6;P~EkVx>$t7gjP4kqQB)b*)6lWQrx^4hyLbbxxV`3`& z^50aGS5+X8t8?fMnDW{-M3F(S1DNi0L^vjDV0IF@(IqSoym!!&s4o=do>8zYXDz!tjjQp#e3(Sgbk`g`8CGdF98@$QYTDRYfZ@p7$%}oNf`3KDGj* z%WXi1CdFRHpuptAz;=CguU-6g`(tqm84Ioh!Z4if zE9T6?rrAy8a1OxZ<(8PEUi1=xch25afgw9=!)>zhAb`u(-#(6JGlBMdPcmj2rAvb| zin+nyAcp|9XPcW)ZIUT`v-1hqIhI}p(5}DmegLcV&KpDqyxOtdO%b>Oxw;8=_Hf<* zzx{=>QRZzycmbE*{iD7UwG+)VNqcMRg_xrA7cW5q4NoSB4M5m-AqTyj8b*cab% zMoiq0gr^pw97p`s+uHzKt8Tp4@*+IhcBeCvP2**GxB!K;ereJlznT9Bm+7|{azum3 z`4#|dFGQqaeY*jZ)4#i*knQt_(Dfk`Q|rjnBzV;;bvgyh{9&`SB(IRRv{Umm8k zV3g`@be=x`Dq!0=xG>=fU=Wi$EDq!f*6{9tENx2wDw~B$p=4z0>4*rjpL+b^FlM^v z3kYWgL>=7SHO1*tG6w5qjFIPvI>4xx8u{_HO4d9)!sz~E$nG{mxeBieM*rA|wzXUl z7_AImf5eEz_u)S2;QRE{PKk!(FU|*!!EG-yfx^hvkyK|}=M%DOHj1sFc+Fd_WEzQ)sSY! z%`C(Aud$~c?Fu^a{Rs_)0IT_6Qn+eKhCQo>kr5ATWWX+$0ckU0TD@Ao=0S9FMJ}M6 zBja)Ts5&@-ek>)~S0nrCV=DNl!9oCih^ZiZoPlP^X}3ed%IrF2q6Qo%>HF7hje~M` zz|P$FKz43e^>u)N93W2KXF7%-B{DgZK1?CbcB)`>uMz^=uKY~SV}eK$<2_^&@Is0$ zP9La_Br)kplCkN}ipU8p!VVHphUR%O4p${&4QRy%kDBdo!>kKnS|7!eBt!rB24;K3 zo;ch_7GTyc-t-;u`TImd#un;u^4cf$p-!jX>2w}m_G#|?oZCkNxUC2Fyq=wmMIqb* z++Oe0J8g09ZZd)B3b`Zr9gLUh9MIw=1$dJ^0kq{mETm$eZY!Azfp0E#mLY5 z9{BAr8m&ZBr-!Y-UiInqZ#fHybQq#5P12YR5!AyujLyElaI~_S3I4?6U^6b7`5$TG zSG2gA-?;B(4h=+%k(I>}rx6+0vkRk~W%~0iOqp0@Jz$Yx#HI6(HOCgMIh1RSxkUZM z6W32!!17}TmejZpY0<}H5qapGlj{I-s_W;iOu3+Ldxm5WBit4TjHuHE08FMV78reO zw|APCGicF>w!~(s=T%SG(Riz0s%bAMg6x!}X%pJu~8(B&Si02UCL2Dk2(H5s5 z2#o)>#Vn4s704k{^A#NSAlPn@eUKpLp!HO-5O$N8}JB#QPBi=TMn;O~$*sccefySsmYLLc@S^xYz!_1Yr$Eu|XC zwB{AnAg2{rBBL^Jl#F=HS|v05m@GhrT-^Z*jfCMGaBIpE^j@Fx=DklZk;mtiUJMevwMX*8CE(LYi6&Vnzi3t@F>F2H;r^x@(q(1=>t@fFp+vbvoW0 zVbM9rbgw&z*Yt~1zoy9*Ew6D;heIO_f1q4Zj$6&T9q+%@Zr}t0i8r-X+3qfAanOub zaTurYY^T!}k;4hUkC5SH?gxBfkz)@czf5td216@KTu}@RO8_G_u5$G0Z+Jx?Aj1)( zNW8C?dnVzIe}D%?urdDqtHT*WLx-hXx#n)(a3*5mItq6;<+HvsmIP#0}DzJR{e~?Q547ZiN06xsT&`jyYzIwF|sI zBn2qb4A733?}o{~t5B_c=4$O53dppRM4#RiA4P=>KQ3~0a{-HL0Prm}BQ$H%D8hQ- z_{k%j0=~J@{-N&&bb&EPzycX1%L?4S_2kC@Q4g0zprr~bo?3zdxxC|ad%g1w+g%*x zI9R37*1Gr=Ehp5I?RYg4e+Gl49F4dpIgr2u&yf=<%Go_Tl-%!U6bB?o9IRGn0_a)w zH7GDm!l{F+fyo~+8K5m8F(w6wAiZlbSF2M-j>{X8Fom_%YYlRr2l2Bhwyyx#zD6r% z>?_nj232(DLNevy`ydKrI?IS{=w_U-2Twd~|4GBm%&CKjf3x&3LJD*t9Y#$E95TqQ z#&bZiV9?nY03+?2B}rI^z)7~W3B4GR*Un{5AXwYEoTf&^es7k0UZB|S+3PrRMavVQ zNiiiN&3%Cx!%_;?9BAgpid6GN26@9cYbb>%;8`05q)z7_eTegYwnsrK&=aPSA0Alw z6M~3J_XBz_Ij!nSf01`JQXfY89HZ|e+7Gd7qipwEjAA5aTQZ#ciXIR>VG> zoDcYC>J;Eq@SnMfhIvP24cH}FZ9&l8K2Hnf*q;Cv8f^e*H8S9g@7-{>)gKgD$;>Mh zG;9k5XodE_{$Ac}C-{ydS2O|g3aH?!{aWN}0G7%1T617!uMtx!PGS(u#=C4+1?0(T z(t!2i)XwLVPcFlV z<6sV$=47Y=x#4rs73bl>WFOs;e<;#s4l;uNDpB5VFXDhuE>7|YwxSDTDO8ms%y_~o zHqhv-uh6=rjSmHcsR=n=^j@|zef)}+3s4jqEx35 zr#gY;0{1GbBZ&DEv&Af1e0aa(l|E0<9N?t;N; zT0YTi^+%3E0lHeQy@R2-Ypj%4n$3lU1#i14CSwu?Mpl>~tqa!4aABc2pN>BaAnKhe z1T9%Ncn~ku2>IB*EP~R^wg*1x?rDocoI*;MEkW}*!a&Q^#II;M;O6iPe&t9qGa%A+ zY2}9~1OyNPpiMJA73EhPFR)bn4saciJTv8hsRMy>AIOPdo=7u1p`2>?Y6J1WDBV-_ z*9kKHxIUO2+9|E$2bsmKSHrJpxx76{G#B2Ttl{yNqq%zox+Z|YsE{K{nZ{($rl}<% z3l0yOK85j=0L23U$TafgDfH23?g{8G;#W+2oDGoDoz}Q*7}_zmcsxNa8MN>#T3$!# zPo>Js#Bv8!FvL7E950uD+QQ08*<|AZ=>q}ZP5oL( zJ|@|?R19Orc1tX$8&*&e&Nqy#=u(X*{s=q3q}F>WzBAk6TMe&xleO)E4DySKjVs(& zVnl5A6!9xs4&?I`Q=rnTFCr*MK=DwJsAC|wYo_lMR~dh7TYw*GkTZY01OfWuYeV0pEJpe#xDb`C&WDo((P#2^| zdL&57UIsEqjO}hn|8wNF7+*j_6IAdkTCOjYv=*OcWQItlpkPUcPP1<-ZdJF6TSfa^ zsI(sU8?uU>K>;GARiieSot66ebAn$qa--@RvAUqs%nxysv|v>Rd0xpwfLE ziMRN=CwfKvik8d0oByqyj;3YY9*Rf-u#{lU+*>A$Xi8r$miP#@nXa>E3LsW8FIB z!pNGUx2iZWaHO0?R#2nJG=rwK9ixIg$~L>6Ay>5A#8rZNv!6cXor5PZGIf;{QnIbs zd4l9QL!&?6252!LHK7T`_4#bfT9zF^Aa6;h9hw6~M?G5jOp}5W8PPTHD_Wk%>F)?8 z1G1CxN&vLlC;d(-on^{fRW|8iF2jm7G(CJYrhb{@$4XfSY?1vn96$gN zeg1<x1>F3~ltAzszYuBunkZnlCuuR7^1jV!ppj}*AcLI3m>wyH0o|TizBysb2s;iBA!xQr8a8pnm z;DXs4^X$>G_bXa((NpC8;F$6~|F>5@p`7}zR5`B*22NqYDED0OQGvY*s%&fu0Ku)| zG7mLmeX=N!@dQuk&wn+t<9-U5C1fMn@VVR8hndazs4(!zmE@{uBL0nrZQ4c^I}hST zf++XTp_yC(zoG>eJlQ}6RwAYxuv$Q5EVDVj|3F29|<=|FaEpM?u!>7$sk+F1CY zF^Zpu$Ajuop=sb(w45$@gQsk*hTM4a!1seHk(C+SRb;v!?WxE~!@Qz%Qj6H}S?_(^ z6Bt;z*UCWID6?!CPUnZ{&#|EaOfB%)<{%;9wmRATg}NaNd{jWsBQdl5{fZXY7Sex^ zU!0W%H=p^Ss@g!R@acctPnIqqs7Yj9>gm>cG7NE0hRJxd>_S6)PdKqj~ud>21gv|ye%mQ3WBa*qb$T<=Mf}CjB-b_F~+%; zBT3_Nj%%Yan?rpz+;D_US4B-6tQn}lGH3i_RWmN)Aq`5kY^ z+hA_(P8X0_qal_JW$stBU;-Q`*e=x88vp<*V9Rj2cpiNOyxH*={HIST0vKAoU!h}- z2E{6)uDtz<7FhT=yM}1|JSs%yW;uTE`Ng^~^V#BQHc58Dl(#*lpk-vr#}52nfLcw7 zBu^goUG7}b0t#_#o7-AkAc`p}8uyVBmGuq<*MBKu=Id`e)Vmtr)XKf9P7{tRHuKW< zD_UUd2PMq4U!3&+C?i&ZfQTl>E}wR@uZ5PFSh(Z)bcN^DYD55SC~?1{1!a6VZlxJM z0#F$cfd=G4fFK9m=I27moAZ~@}ttIYPw16J$0&R62wU`wdh&?^DBiHnJ z+rr@L{kBl+Gf2ierK44UDt4}D!QfiZ73T=OG9&?{{2LwUUFkCwb0(&NoB?Y!0K#`D zxuRu!F{2^zvT~#k!S>ER^SqWewexc{iS9a;Z+^dAM=M@8`}Ht)I$|*G66EIv`y;AvwB|N@!p!?zA#~MUy}i zTHLv^vJL>u42v5Z*5Eg|GPd!I-r$zodVa%S@mF|=bjL%pPQ6y|8WQ#KD;m;!*@}09 zAMaWGm)qsvo_~I5j2Lod&=q)bT5tq#>4D@nJAz(ag2_y!p{Y zEg5U|*n3^^F>-|R8X8)0-!&%@bFCHxcd=5hkj*slE1J++pct?}j)1_CpS`&Fe4Mb@ zJNfJn7-RLU-&?8l{vZ1|a^CcTr?jlw>iq%H&NcBXn$Xyp)OA#{WaG->#+&^)V*)bv zb5E{Oai7OVMAEy>@9O$1JOtTmA#Qb=Ag00hEV-gdA}&RZ*Af86kbjtQ?G-q{sp{Bp zuqL1)DSIjMX59BUBT%!6(5*poMI*0>gzlp529mpqAy3_q1e@mQx>bzPWWWTVPSRan zyLkxmcZak9M6TJ)@x-q0IC4d^#AKL+?byE91`~)dw2lK#I^3fD zcHCtN#(J&Z%bz;l>Ec(k%~7nIIZ5Ey@n#kTfMJPrAsMXSsXB+0wGd{yN_Zf>mxqvq zDQh-!+y-`nCVoW|^ycEL669{+$5X5Vr$nGZk!uA`T`*X@wq>e&G+acWX_<62f*l~% zZ35Hzx&z4-O;&YuBDE7s9rL575IBJv&P*UXt=$*CNM)uXk#Uj88L^he)!+45e9SXl zK>!*%S9apQ^T{o^I!%yZ6IAglTK$<(*L`K0A!;yCGEyI-Vg z?FlFL2HRXZ~1l(sgWjrMQgNIu6RxyUBf&%i4g>VWYE#hYxSF$ zte$UQ2ULVuiE0j4CmKsd(v5EXVMfr0dW~^^0B$WT4`tr*&Yvrq(4-mVoYt>@UxO6F zymzV`VO-U%$^fPiObiCgClxUSHw0K5m{Y7v?0wsIe&?-_DM6HFwjTst6zG4F@U)C$F; z_lY!YbyhY3Wltv3MhpUZ4?O*j)eZ!6vOJ;8JKg}fqDewsTV0w%qyX>%c5+=loGIOy z;ICz)!|$zV{baS$YoE{#CTI^b@3S5hp^)=;V46DPzXAQQB8mUD=Lei%6> zBGP_&=e~p-yofR>#?)yn0YU@6qRF0IX?2Tf-mylGG8_OPUu!rmeKPMd?+Zh0E2T}E zEqTYg-2IA1jGZ8>cs!9d`@yv4Xf}ydwMiVS%a(^mzu4rx_N2((YZbH+0@<)oZl#b)P#|G}`+y!(Z!3Gz*H14g%0E zERMT1=EK+=e@xKuJq(#Q6ankCa(B~E{(eQPw+AInmr+ClgvlEcyQR5dYR$%q?r0|V zFu{j@``!h!&EmUyt>2YI8_L|TXp(XXWHiDk6w$mB&KY~&2~Pn)Pj<)FCj$}udhdc? z_zZ$|Tf58ro`?5k?pHJcx~hA?gt{&uCjm|}W@|uab&|CY!sM^lC^x5@T<2wsEfa`U zji!)T0GL2$zo5+hiYAaZEVFtn2w+xFPOxSu7{=nda1G$RnwObNfbmnNG=PgI8=l4( zV54S1-to?xE1LV)d@yw8U(lq`<~?uBx&)x{W3sQN`n1E8)Mf&j%^$Gbq{s*Ay$m7i zH6_LjvW)$THgsQuwt5_N3vS+FUt^Y|XL+m5_0lOQ^PV@8hmkz;X+*sijQ}q^vYh>j z=FnGNN1*|pHP;&ZD=XHNnRyvt+BVfEmFvR23qms>61HhJsbCO$8)G$FyGOE%pXKLQG*ceD z5>#IUVVdN3F0_Dvlg1d6Rk$vH;w-h?pF*7P*`s&7s~q`!E^{{)-?X@Bop=64v-uB> ze7(;9!odRKL?CK^>GF@ub-DT#O)}!O7#E7`y01ZCyf0~YHbG*|a$`*Eg=_M-iZfWF zy!Su?eCmJC=>uYl1^K{MR_dN0fo#Obq~a>cf6~t*w|Qn!<%#U2WOsVFtRy&UIAM4A;$NPch+3doR^tbN$kJ-i`iR6YMkd|7X=KYOx$ z@}%EWZ_lhDg6tjdbndT{h`QcVHg7;mc$quH?Gj1c zJb-4mW6jV2j@c@0)=ImEPaqF+-CMcXfK@i%@fFYUt?BB!KCZupvo4VYQw-_A9M`H5 z#6|oIHypA}A;EC8%sbxdcx$F5rbz@oulji_vgebJ-POWW8<5zT7)TNw?joDm{mkhhS8hRjvg{Oi0aPQPRk-+_a7O%7N|LJ*7~9H-v*!JZVFr|DTg z-!?(hVKnsb2hfIo9X3}q!E{>5i01TAiiZR-KrUhIvP4W}N`(DNPAQ2+<|t8IC9BKe zc$XD|>z<8Q?|4^Ju6V9E`8L3*I;asj%M<`kd_OEWxhZ#Dmg~? zj(3^*6-^*C1QM-q15(LL?RVDQ?pyvdpAxCP$}p@Hsm=eAH=1x{nN~k?5q0Ez?{VGV zk?DXHm0#z|*RvR#b~_YQUIYZb6Z5>rP`gsQtJq&5F32u>jG&b$&pX~F>{qmjWo0x8 z7y?pY*S#PRGn^N9BW8l_5K`W9q_~I4%7EuVu6sd4`Al8)WYLfwzkwYdIOj}Caq znpE#9@2C+lG&2!HD^ALwMfTaPt583SwJ}|p`V~#g1iMjNzoakK_&`r2hrDO;ukg40 z&+O%HH#f`{&nXlmYs}A&>DW6>!UWw6lbpi%G4V<ey6Q`O07P2< zB(LxLZ@;)#ugJN(yyX|$&)qOaHv!re2ZbB^_%wGT2dK&dpKFh&>wj+3PUdZMBDo|e z4NPg?2MKVfpu%hx|B4zf^_=mwUG|9U<PPWb`9^cBXE0Wa(l)pfkEPAIPSWAe_zHE z?<1%_G%(EDB~VGl;^N}QV$4avNb3tUYYu0Ru%x82Q}PK8;8@lafQghbIo&nCkpD*7 zu;(Xqg)CbD@%o#l^oDs{l?xx|-vGjOMDHy|K2Wh|A0XNXP-$n*kalg*x9| zagO3|&eo@*=8ASqx1Cu99eF^B(&c;kuJLrb8&)i_au;x87F4Tq!C9b%B}X1jCTZs4iW?3FSL`8D6P{q7iFhRn1l_Vrp;m@D=ly}&Oo;e! z;7bL&ooSBZhF!BYi^C(N7i-NY>nfBy_QO%J_uyT34aQ_1e4)tkY%(ST)WBYrkwvxd z)fo{$;ap$VnFtva&Wp%`##>8_gTjwQAY$#u=P=dxo-}Fy$G`lL{jTi$7207Ij}VMM zT%hj%2Y<-F)!ELTVMq^h5s!7~HZq&z|qBr&p#N-199=Isp_dTmLVyq>yB`?&{lVeTM zOAk;Sv#FRDbEOt*0?+DWjes=etg#`wAu;pXv-3AIo|oEMIX+heNF>nAI}@0cmRql4 z);<_S1ujFU;?i+N(vyZ^|K8tqM~bC;fPI394_Fpo`@RHNr2)hNqC41x;oDbJ@84+d zl9aWcLndfmTr`ZGymsG&uX$2O(2ml`I4EF=3}9-P^rVoaPI{1?9D?r?tPfZ)oLjI$ zBlq3jZ?*cL&ab`KobJz<@xIoRXa@8;R-9(G24vlJ=b%E8=L45+XG$hUdlViU8^|8R4~Bo!OOOthKBc{PO*tjU#Lzcnuj(3Gc6%K{VEN%l`feW}A;|Qpi zPcPXT`@D)9h5^~V<8A$7^4szX01mmfPIPo*ts^w~VDl%hYqS0Y_J};pZgg=|lq1*O zptRjFELcYUbf6m$0rW*)Axf}>W02CzxuvjWg?rrzLOm1-S(eN4C*E4->AsiD~ zkX-!{W+xh#i9BRD^BRwDro4~yE4Qz;dHEWE-AdyaaDHd~Yl=2~VfQ`%?sb4Bz=Aj- zIaGnXw#X$0^IeCGESfGm02ned2c()+sho^t!Be+3>>CY?$gsYemr~-(H8?m?{miB~ zAI!;92KzXVGmspOG1ta3d%!X{-tn%kI5<>7Hmw47$fU)lLct2!KpZ%TBsH-Pfw%>8gatx@k(G>DjySBStxxY*oX1bjoXV{J zrW{qmJR;C(e!}F0Y0d{p?$bj(F@+dYX@g{iRnq)uQ!@1TG~|j?1!;nMG!j0*MTrn- z!o;`aIeBoC#6bZQI)FO0-6N#>nHe4ajNX1o-!x2Cg1_mH^Lu~*1}z4lZ!h~Rk=BFX z-god+Pf+DQd<^r(pQUDS-S(QmIx+hN;Ao~5l5uCDTz>0uKxWI{MpdTk>a^9VpPvJ; zkUNeX0)me_2A^&1=BKx%3ZT~kxdVkbpGbAGCo(9fWIO@gOr}_IgB%OV`T6-r!f-wu z&WAslWwn|aVL`1S9ez>LLNZT$%FCx0@&i`9bd8-QUjZLE?b7?R+%A#h0Ihyw6ksqw z8ho-mzT)h+z$U+yr}}jNOu0?4XG7RU*B*xo9~Hc4a^fNcJqU`iC6nl=Vn~w+72Ix! ztmhQ><`NjE>;owK)DDlSV1WsT!+AsUz8r>m%wNFC_vd}#k364$(s;};INtHDw)u`Hhe;1=N>?*u6(?W<>f}I8uzxtTB)NCIpTFws=;VlU z{6Zh29}FBYWuuFG+GYYasma*2{Q!QBb-Tm>&`C>7%BjrgwlqF;IAQts-{W_))&Da} z1OI{u5AlSD84-9&mnN4D778_3Z}P0_(Z)+b!|gS$uL(jUuUb0vuxkVWOA9N#oIg1Y z;E&LjXqeTP*4DNo^4<(BMhOo&K{0Ut0$%cI|2%C7V2WQvnz5%A{#s2{akOKOEVz}D zjDX1%a$;&BlDW#F$SOacOXmdWewRz=#QE0-^T>D@Y?ajHLZ?d&KvAfW8c>lS$OLXFvE^_EcVhERRIcN_y z6S4!iV#2g(WW&iI=Si+W4a{JKn@BEgTV3?mCS&s-QQRr)?g1Da?|4^P9H6B;c-qQ{ zo87`6IWi;LxjOm#vpcD~hxDG31c-_R$tN##1`+HkNe1inugu&JT4Pf_4tNDR=ret5 zm{B1SFu>!@&&>qD0kwgDUq-YDq6>6x0<`E&dJz^_h2o1I)A4x#Q;ZB83Ic05*XV49q)dnY?XMQ0Ud$5Zp;lDYUgz zZ39xAh^{gvs%^OsH6A*2IAgU%x5a9+yijhZUyaHAmPe0cc1US3&@VS3Koy-)*Z0N?Sd{cpjm zy-TJ%1`NoXU^|d4kn7M&NT%Klj9g;0B5KHCW@pdLPejoOP-VqP1p@upJuo&fZ#`%M z45DYEF^}8>-EsDNUy|^#*opDI<6VbXx&@3LlbxkOib-rhtaW|zNOQFk&qK6{0JDyh z0J-63vFczhswn%T)J9+Xq_V958CkcYIL3c=#f~A-2zI38{AaYKZ3ukVkIbEqqOV#o zi!?`umlntxG6Qv}*Rp}zUQ~CnUqF+6!kk(r1}z;5XsJ7zn*P?mW74Fe2p9r~ z8l=={3lPWT6o6ThhXI+6$T%`Sqg;i7#p0^FeE@FsYve34S5w`jWv05um^SSLcUuFG zU8lvh79~m_;%=4hVCx z_#;i=LMa$tk?30?vT6}_2!1MOV&8NRJBDz(j)3;Qj1clL9LSWzOtHYwczTNQghhwR z<${WHs-vqD(N%^|{>EyXkU-W{B}nnGh|BgdKEaG;_Z3r^g$&Dr;jhGSHc7iYf=Fr|e`_0%6$=M6t zd!hI!nbri8WXd~{c|&J9RB_K4;u9mBSOBu2*A|r1MrL$YAhR(UF|s5bjg&m}PORNN zb{HJ*cvnyS&x%XmlyAKo0?qIz|A$*YQ)HUqPr+C1e?#jACq#RELo60zZxAtI;3RWF z+4F(a4wyTOeC5k3C~}!Psn%e?{MbOo)uO^G0bC41HK15XtZP|Uy0COkY#DsFs?b_& z>_~zv0LSK|m{TP|C9u?;Vai?6xq9-i`JIrR`ew`L*h^srPt-uuaHR!atnHE7Gu03GLz3EX|hyMp$6>Zy&5*C!v%ua+MN z!2J$?aupwInE-NEgJHSDu)AjOXngN@*WpI#3INlm!$KCVYm|6)^QemQwTP`qkk$)I zq8U{9;r+eLuM$#APsD;j#jXJG@lN1GYO>fJC>kV_jzEI)9Sd-*RRG}1jJec)_Sv8X z$7Cc>(ab32O(si#)8C?sg7|@<@07Xo4;_bKmuzU}P&l?Tx06XTV)zoIvfH`3EvLNX z!zO_BdZ(QkxsdtGoNOhbsyJTIR4z>_d7+ zPGgHH*UbUNehj$R2q->uE0En@Ju*@h6LV4mhM;t~VNiL~QQ+)rwaQ6Lhg)b6UAikY z{C#*%Mv8NXS3O(`qq`< zz2j|=papY|%K-O8p1BVJj}0ieI}^5km>vK%k|6f^qnNDy$Q1>Ns%n*CC9%bU%6?Ph zg8qsklPK%g@B$eH$Jdvqs;BR_WX%;|Ch&UvjLC1TRzv!ioy(6j#UaUX7zNj)v^q5v z2Kjv6%vKy(e}~5PL{kTs1H5>8s`?Kg>Cb?*Kr7)Bd1C^1-|?=j{a($d9i;9phV#9q zz8mkRW4C%$oCvH)Db(G?=g0qj$J-MQ; zA%_sgz!P~?f|NwDLHMtMtWG8qN671dMin(LZfq<*#a=!ZVEo=ca{K+C0r5tFbj0&7 z!N?hxVPp|`C!bmz_xBxdlgt=caLCQ!+xM&qLjhag7zOSZkTEx0!ytXhZMCwSH0Tzl zZx#S#iiEKa8!Z$dQ?ttB{MdbxgT7p3oCbCoF>uW2$Fa@Hb397SX#5jK)t))`m*i2` za>686WgIVygcHgg4bO=cRQSm6_@)E`6sifQUiXDsjac23Qvd=EUCl?4i;Ls`zT<5Y zdVu#}sWqUB0Gf^)Svj4lq}>tYt&vhos#}4v zWQ*`*tR9NZF?lq`QPC9VsyF{`PjSfv6LPn^R0uqAFdaJkM9guh`9aG7EhaBP0nPOj zMPZ)BBFSMbm?Y;6!V3P?CyZh4VXmXAnHZFNTX+{5mWDCnzY-cAr!S1LGhB#=n^zbjWl9i7V2{ zC6Vj6ItWU{QoRac{ad@ zqX>@fLP^dbBe%FDToj5q!`WP!+!7w&mgBQ;7%}2LVj?o)#BwuXst}OvAWyI2R^C6= zwIPqnPcUK3#3 z`KGB-ATr4>PkkT5A3YN;VGT|%1V*rNN@m#u>Tw(D0wd&rTyW@c9KLz}$i2(!-BkqH zyuLR{u#XCd9Fqt1R1b{$@6G(ZyHVW^NSN38g*#>`2 zr3QrWO`Z(MIe+^!IxnLEM+Oi8q(KVg*uvS3_^qxoxwO2|uidYJt?NG?5i{AB9!?|| zpM!WvP$dK~$mg*(3^S7%btC7~O>mm4;lb((^~Q3wAR6R!P{3iF{`Y4e5x(cj#$D^U zC*$v^)ZYE7{C;Fs5UoM&(&z(pu<|>vum`mcX)IT3+)ztoW(A++pNXd`eBwDdkq63( zB4UhjbYP^!sjy-H{k&sB3CP-@Dun{anQG(baHSH+-&M>_HOKKFjvRJwYFH`jF~=Q# zKU{_1(Qr>nn-vYr9FfB_&h1-L76w*Ce2-ZI_=*~!|2qx*G4f^u^>Yd)zl_2szUa=k zp~sIMoE*;>cEs=#HJK^$Q_0SWC=m7^x4byrHy%tZcSIQj)k5J+!JtZ0H=i7|+wE^3 zLq56(d&R&UP2(3sZ4Bf|j(O64(!c&cR5n9Yt65-H5b#aPO%>-%G`|O26P{!+vs;dB zD%APz9NGm)Hjhf*I-+C`a@aqwL1u6%_V=FP`tprSaM(BXvm^fHACD{`go>=!If{QExFX=q>k#SP@h^j$7fHTuUz{>15%f%P>v zr-I4tp-f#T33+$X!mQ;qqVdtZm%{)meJ5Coq6ldDdSgBe4u_YAtA=nR4&v*fM@no; zjv3C+Fph#*^KkgD31-_f^OmeR=1fR-Ae*M2(s>oPm4mBCfxBfGE}J5b3kGIx^QlTa zWMx{E%^yju&|*Tj8G*`6vgbt0$-V%P$m}NEd)9rbzlNo*r?T4G3hbeLV-&EaXQAu? zA-V$r+Cro3KUkRS-9QAWr|P+3l>=%RC3JZMy_T zf5yD#8n#t%^p|rH3Y!~Dc1+=Ahw`+&aDcFTfj_~Ukf!jf_OX;>3QEAlAYQJ~VC@a<^mBbnN=B8!Ca zzHSK%7F+)G;7LN1HL`=tFQrSMbw*i}71!I+FA?ahNsVuQR1k>WrJ7HXN%2CAf+|rX zTj^H;B2%V30*$XGGIiom2+dZXtvdj^?G0V?OJX1_jQ~TAo|133(kyFsYM@`Fr0Zy46Ox873vTaoR8VAXh zm@?=<(Q5ZeV4RxQRHXHen@>RdDdz={)iT@BC3<`zNyll+F)3ClpI& zp7FQ-Bo)iypJ}2Dzis z^Uzdnkw3@jT&LRh8dNnTE70xlnDsyH;`AT5yifq{z3B|=`e>>5NPSYUM5Y0lz}n}`u-|@Z#-&qrUfL&kYYEg23=zA3~6!4BIw{#gGCdFNK@?Av-i#q;bZ4Ft0i6IB6 zCSeA&8M6nt(@_12sz5x)+M)1A|e*z&-aN@aGLqyvhcrT8exr-2>v zAppaajrSXt!K&vKFkRglCWj%n_*ZYf*+g1ko)O!?ELp$>?|QO{W}!l|rf8B}aCke( zgYP)qAftF9x1$5OkgdNk?S04F+9A&u02Cryhql@~($65I9ObP+eOW8U{pXCN0lJ+$RrV7TT#ijn26a<>m>k; zK5Sh-cI7oUN%QN+%LRK^Uiw{CGBkKZfct$?Z$C0WKYRzgN{*f=0CmPZctJ)U`fz13 z=>hlw&t0}N%EcBYaQ7YW`U`{Jcf2jQ_?OJm0_}6?8lS#Ntl(e;W_>=c;c>NKe4me& zW24cgB92u6MpE0Y(rq&o!7>x$?t-yk(bk9jX#)~ym*+A7*j^6<5*E(XN-#{3gvyqA zePJkB19q)eO;ju*XB0SJtyYWI(@d3oChY^~*#p{s`#aSsP5}-DCYx||l0yhc)=b@~ zjY$CCeQ4>_>JhfO}N1WntX`rNUsxLqZ6=dbN{j z1p)yS>}+dLgJ7!!bWc$8$=hODhLj4v`I{74iLqS)WX<<;ASQ12 z9q$?}h$-(o-qA;T*7KweSRATmJwVwM`0fje2|~GCxM-uk78qb@J^s+N|LKEMIDoHPexQ@b51KX z& z5Ogv91Tix*?V3P~q>VD_Jonr!t67yh_NZ;R)X7 z9x&tW-|y#$gKQ;1MS|{i_=b^dlj$Qc59#PybE`oXfbXeNJ_KOOdm$?%mwxDRKj?WG za*Sk}SeU@wcf4yfgq-+2SQeg4etSuzE{qT_`b5LjM1X<1Ida6LXf#^Hm1EDI2C)7s z_D%>UnGONPdS@4s6=*pch3uQ>9y(OZq%@ztrm~=OOEcA@K%2(5C5*PKoO-*p8Q`M| zDC5<0PAC7dz1zjuQEVUN%iHhmd#3hzzdsqi7rYbZVI|%T%+-ta3h)Ax3g9meu?F*s z_N<&=;#HtBHDBGd4vmWwIk*xCQW5@f5z#ZqH*%B`P962EsizGG81@M>ga{h50^=cN z_+%Ru;&^N&;&LiFWU@!J2Pb=gw0Qg?si>tK2xjwTNkz1(bWA?KQpz+(N=YdKQ|5Mw zde4!56hr*?{}6Jq#(tB^|A4RYf&bJ8ejxduh2uZ<>wVzY_<%p}=QnrE|5ZNs(W8IJ z-Mm*ROxi=hNlp?}Q6o;u$7C+3&&A7cFUXR?1%{@e_tlO;#OW&|ACl8%vfH&Yrk1$u zJQ-F_0g5$L9xX9U>1JB9wQo0mqn{ zZMqadye*f>0`!YjDrl7@04O9wZ^kh*?ASN6s zB`f(!f2kK7J$m#LHni2b-}C5S{(a7G47rI6e$d$caM{<`vC8f<$;z!t<^%ZIjsTadb<>>wYg7^QvW=Wm*Idbmj zeuq2mxZ~aLc=vZt!tca>{?-!A1^$=0ihp2zfA|QI@%%sbTmb>q14_ zH|2fLofQbg)Z!h^ArhprdjyVKG+O&x`}>bqG|1gyrHh#`a$HePw&k|qZPAeuFzSLY zNoo8D7^&gMpUe&Nbx6QGYzgV!K{^J4Vw0|Y4q@?*_f9^jd#2Q1n-KVOg8xQr=w$aLEU{OaL^cy2ppX(pW6C-{X7jo zKKBTE1nVi$t!m*4pAKOifB~B%k|e*E>^DC2wlPGn(|xkux!`%n+Y8YjKgm_qkEW9t zov2OJY7>u4hgN;`Y{n%dRC~?=10j!HeXqTec?w0!+{lJ9x-Z_RkcNVm{g zNm678IJAwJ-pC8Sei@BEPNU-xBB7m5ncpavZ!^A-61%fnAiz;sQNty|P@`k}LN|i9?4W&UvTZIrd{gk(tR7Hj$ zl21lqN|Nw_)fMkJkyjQz&zR?nQGQq|uk;uPpt{mrAXzzOTq2x#|F^pJL)*u9J2U&t zmbSxT@QycmwafX{6=bVayKxbFnd`_%9x*ZmAR;{^r>`ha%QUu# zM%y+#p1XlX-ya1s?Ia!J`>7<(oBGJ~L2wj4C;e$|IZA4g5D>&PtZmY{_}vRBsdf1P zrp=dkyn$k(`oR&Ji0Q3`+mob0`zo$;5wB3H6LVNq#(qe=sALBh3sRM9y;O2FI94)I z-tZQ`V%oo$L|0EOlWqBui5NzOA)L6(%p>~C1aRko7kL|~n6FENlod03(s8_ViA?j% zyU}!SfrvwfEH4SmZ6fGcS@KW-)6(3fj> z9d9^a@Gl^&L@;7T$+c}6(hOnQmj ziCWk#hPPiP8!6ruX}NSjPPbtTiVd2@2j;-Wtk8w@%Wo||4y*-UDNTVW*eo}SY;bsg zj^l^8zyQ<*Kx=p5Uj_)ufw8XC3T6}!1(6yDR;wPMU@?ivgaMQ!dAt?Q1Ag(W7sX1- zMLzR1E)eoQ0Oww)c=Qs`5Fe9IlJNHNTqGY5**lBsYYq%-7%c z|GmVddB?k`)Z1RYSlpJ|Wm)(HZja?=q9g1KZp>Xjq?&UE1G3IV6-2qYP16fwdBO2@ z4*iMrl$(el<;gO_Ku*bRxeZJj6^=l$z?exLK;O8;Bu#^Qb%l8y72R{xgFblFq;f|A%l>y)$qYrZ8G!Cl(ZVu<|o9};dHTJOT-LX#^{;FXZ z+SmAWBO>|OJzLdP-&>9OaJYO!5|u`FfbH?DbzM00v8~GSZe$#5a6M-7iAUe&nB@^7CZ7Ye59Q3&-YD~vTvk||2C!9q zZ83GuT4}Er)>&u&jwb|~UxeGwJOf)uzAB*Vdso_(#YN`R7+>W1ZRjv}>}642>3~;wE?hlc@<9t+S>@Hjb(yk5%yr>Wp&@ zn#EG8+KGLVMz~ecP;n8wmr7!#e0{T2m&24rkq3bsHi)Q67mNmqf`P80?pbi}Uk6li zY9$DkNaJA1>Ta{64JKwD{hCT?)szrh_tdFJDrzc(^bhV5KvxXq;P-pAKV*PlZYE(B zdW)e0%w@AolbRuH3AY6bh1w}L2=-=ht3G~-RrQInPGXH;jzuyJyG{~BH^sDJRA#Jjt*nZcc!#iuJ zkxhsUWAYM!r7@NJ03aXpqB-3or?VgFI`dQxUvdEQ+&T5dw0)9(j_UsX92Vm#U`o}_ z+YVG&``}^kK8fpqh+d<^w^=efu1MGh>i{3yzWNqIOl|#SgylAGSJcYG>qQi`+V0~M z2!~`HIKTzok_-C`p0ap5Ok*niT|{PM*Vy0TI?QK*8sFJLeN#d}uJR29nz+I2c*i>= zD?YsubGusD!W?-*O;9IG2{Vs*(uE`h-mE&9F&86AAk}U$WbRcpRniLv&-drTRlO4- ztf~&aP1Gl;4OfUPMJ)AaI8gsHQH4WO_pqOz0qk*e82x ztGIRPdZKGjaB26A=dG*Ua?8BY0o5a`S{(C0SLMm5iV=$Bxl<4{I0ePq*y!!HmKgIe zRF?T6;4KRgxvtn`)DN^0xsdczll{e+xtFZt2rh`&slPaTFHe$QMrg z8t}9Fmdlu*c$)a^$^GzU7@Dg7#{lMM%rhfLHiz!%!eha2_twn7$#X*@dS0o?P|TAYzM=v z!X1mJ*t>o5WDNl3$#roR8jw-l*v#EVUf@}{N{~a*B&!0G#P)gnAXXDVFVaI>;M=W$ z40PuKucDlQ3u&q+x?@UPjD5TW?XjBaF^sm@>t1Yp$1!SH9QQJr zYUIm)x1#0BeGi_ho-h#q#?4(%SO!s^{&v_EV=rxKIM$j{^lJ zIX)rQf$^!g!Hj&a#zw;`|gjid)G0Si11+>-kJi&6i`@drzQxFJ~t+%Q_gTM*_x zuPYr6o_D-uL~-n|?y^;~vPi$xvoUOmK%9Qo_Ot3VF;vDiJZdq?>|YeH%yNNR!)M{hpE@0}q3T&8v1V)J+24aT zzspi{jT+G7$PXankxQKb7j|k}cqz-!{k!kw5sd8lNcaKVea9P~a%;fHHs6?Eio;W0 z&S0D;0?ktPz%l1Kl#TtudFo8|16}U{1d8;;&vM)#21X zS$AlNjx;iG^UHIa9pj`B@EB27PvtnpJOgypHmG47 z3x_!lAK2LQIB>h~ctc1r2CZCJ{MZvw&pJYdQ&75cExW~#*9k6xuYPqx%vj5rFv@|@ zZd90opgpy<^-B*;X+m3JFz&C+#xi}>!vLoyQ!?R)5e(;6NI(Yu_PKbl;`*C;tC-$7 zqk~&2D%FUbl2h{xRiaWoM9IuDZn-I(t8;=?|9RM!fI8ip=tLez=*}G@^I`oS+efpu#ab9_Z$b% z>XG~)Q^8O)9LfM3`%To+B&V6?#wP~{v`#20W`A-7+}*HPj(74SDuBbi948f}N8U7> z5FeRqRL`<~PJN8772er_D{iYHBTossaFfh3jN`!VzT*ut8#t13vrhs8f>A;y98U@) zG0mUhz##O{3ff$lk|YdAnxn&;dVNn5_# z(86kLDdy@s!DNwqYz0QLU`JF|t-cp2G7X{VrAb;9;HN#nbon~$d~)zVa*&K(P*i{+ z8$dyg3m&-)GXwNVjGR$9#4RKIa|O3DFNDK8-jOu?6FH_@o54}cHp!Qe(8VD$Hr^xE znVyt*?R%0F$o_=LThQ-P5ZQ`e)WgwXf{S26~xk0~Rv} ztHc^_nmzwF`!ZqXVE|(9KC0{`~qaX*SijIf`dtv%m9!IBlZ=7Ehg;1VSQ`q zINsv2BlJ*~kwB)$-0oEYf-+$>M`8fyDf=zmWV@&2c}i3ypFg!zogOjf9W+1iBEsUE zDG|UchQA3^yJG09*?T<|%-XCJX_Nh(GOeej%A?NKN&g1w zie_bilyO;Oxv> zVpu^H0@NS~W1kQ}-cljsF{Ae}f!*kfOo4WM#GIPhtbugz+eS(?OE;PmXtc!yQ7WYG zBay2~20~vw5aRV7ks^Dc89|z0q(bgT_LRu!sO2Y~r07s_5-W!zb1K7y=gJu754QYq z;CA2fP9el*2%UK4YY?MCh!TSy+n{u-X*VR9rr}2c#mlSEuK(*+2N1!K z(fv0W5Bk-_p!TW)ml&}Mrypg&oJCOTO+jSd__Oqp>B89C-Hu?CHsRNbb5kE#sC2f_ zz7!!vnkJKTGn%pk@t*HwPiUQ1Y@OyBVkA9H2&oVSGyO=UPYI~_y+l^mnrcfhV%!*> zi09k|t~*GxnqdN0u3Q=GM{bnopE_{CL%y7p2&6|OG))upDDO_ulL8C;?7Iw6G{*R0 z@-CW|7&($dg8(2w-@fW&__Qzct>qkvgE%wW?@^L6nwg21qq@h&)FXM5*_fI-m=86p z#cD`KR;}`?jjPA@o;}3Lo4E#ffHDm6Udbz5$e^^HJjY)JEoO(%IHA=A7lit`{L4z4p} zk4+F%Y0!47unbIxIN;G^?Gk-36I+PL17yxZvW6H(guO1PdtbT~(V$3S(pjCR z{H93}VJ#LJ9z0hz%z0-X7<2s{&i)uv9NSU2#RG|Pw*ko|C`6TlQVp7sp6XeyJU$!X zfU0B-zT>afMqs=fSZI@)5F=uUC!Pw$^qBqoo?wUSOI!khp(%OxNyM1N8)Nt{$<~>p?@k$DT;mW(CH;g7^|lmoyR#j9Zk?ml_L7)AW70 z!ocN~pB5`pq(dKXTJ#fjyfGIJ>;b6YQ9x8a#(2?;iXA|JFyT3ZfFm&(eG8@RbqwyD z64a$S8O%XN?Pj&9EHJYm7vA88(qseznV1IP(TIe+mBfV8T^XljUI?Hm8DsdsIQN3F z3Zci2`xlZdYF$M&?atcn#H~%#8lIot=*<+lw&etiQV^Vj(OTu zOTL&Te1VDD?upvOqc=Y;c2!S*75%qk$#-grHyGUwc^GjuW5OSI4j5BCegdpnSrLyX&T`Bs9ze0C}ksU^GF?_U&ZGqm@|yU zfz^kL%{YB)ZINRgFQirYqVQ@!qXfvP0b`D_OPxS$!2LC2^}C(Jlu+7U{3$ox^e=rm zWtQRNa4^f_;+wy(kP2&S-91o^syaZ_e=x$%S5Lb6_g~x?$BT`Ycf0{#P_q~U!`EqY&gMZ35^^bhYcMS?hW8G?DD=z;Sop?p2h*fZi zTR*d@nCT2;JNT>vq0TwJwO@9ZLY)oIoOir~Lxc8nf13<2pCTnSRibVTEK}u1ih1mZ zWHQX}(x90t>=wgMU~gcE>|nEFQjtpDfK4IxT79ygY;HmEp^Z?=yTLy6DYg0@J!6=q zx^W*Do7MV8jA0%cHF?KdLENRqz!|Pl%(%7G;pnX|Z%y&XDew zSGzgBe1kbI+R$L;>Y2iZ)}uFx$ZSC52C$^~deT^NkFJr~`xk%ln{IlqAJI@55JDwS zZ)pj$3v$qo3D#IucUY%E2te8eWxZK~1+YTy!0Gh^%w#MURG} zW6YBu_lu%n)?SwtE4V;!kk&630PD^%R|~Y5CxFEmGmIs{p|b*DA8r$W7`UD9JiJ0n z$R3%FcyE9xEUUEC+(J*!5n|-_i{IP^f6bSC21|ZKxceF6fT!q^63)3FR+7sBh7yCo z(CR+H6&mh~W2B*Bx2_Y%#hZ7$gTrce1M+W+o$_!YUBbPInx$xe>y`Rv7$FCMjwwNT zH!v#0XC&s-GL^#~d2`rlwZ0MPoLVKa$bYp`o{<<{+8|~aq56n~6c|~i{I zxP-DBZ1y(Pj*I6|yd9?EbudpNEXM?0SkfY+_#x{BWM6Lq=P^^ec*zjXNel2IF z*;sb4zso;J`4szHnCHPEj+T3Ye^_>iGyb|~ zN!QBTNq30!#=)w$U*gz@8;RUB@7N#vk4>mx1b`DA-EzBzE-wM%)RX}O{fSzdc*gD_ z<&}pUDeh?*?)iV_WwOpi#MipH8aQoINe=Pu=R@r?jF=MC_g1)7CG)|N$B?;?qe5~J z*}{W7=Ah-IP~^dRapb_XsHgy#Bb{w*`vE=vEO1qA*Tn8FItdmF1iQw}%EP|iFI1jz z7IrJID%@&urk0RdD5>1!G++T(hts1Rr6hy@#EUTL$*yzm%8WD{fnz{dV2bQYZlLEo z-b(8d8+uqf`Q3&I0JO?;;jvEXJsyAyLAUJHwX$J;CxGOE8rMSrPTi`cyilDqpF&P0 zS7rdk2&tEsVw#N|V9=YCe<;2OAEr8D)x*5RFQ8Z9qEw##f;@x-@;lUl<}|Fj(r=R` z&x50s5^@y<(L3B5?e$oA1!KN92S*FMoZ`q2^QMw&rAt8 zyR&z3$g0K=DYbZab!|=0B1tg9lGD3(>Fjn5PPa*{48Tim69PdarQ-0r=9c7$F2A5bo#&O>1qIs>?gx zA_@)$LNe5u3v5-oiYlS(w5vZ8oqH5bHo+U}4Y(65eCQ+^yxPwjd=S_fIr7We%uPZm z{lw63@rn&>Z&Q*LUDk7K2}gB&R$65Lt@9i6ZBiG8vb2~0sD_mL=2od}gFAL<=qki8 z=^bw`cZ}!@2c5!Ohbj+VEXV5?R(i@naX==XH@`nK_&=3W3k=L!KRgXSK&d&c(I8Aq4O*6|IIolx4r+n#g#nl;T+u#{kK~82bqv z+Zo%dE5);!cLAek$tNa#zp_yGaXakm4#iWvm?5lk4`?vAY&Ofu7maM~6O(>qpss>( zf@Q;!3z6<>jQV6rcLiCoWQtU_te)Xk2#`-G`zG)0bG!5{j;BSWn!F9F#;%WFAg8e; zOfzWZ6q68wJW+ ztk~z-5tqp4L!cB6VIQYF@Y)e;#o4W@{KG-u(xN74m zEj9JlOhIhAq#9ggVA4C@U>@|86EIUI_68ggPh0TM{qeHQxd5)8Y%1hU z9W3*5GZR`O(WfW$fsPikCSr$>B6*T(^Xj7yA$aen^>-M?S*>_~Vo8syYu~ZI5xNJN zGrX|L9DnkKZI_UcWEf*L%j(nMir++-F2+3Ha&Y}$Uwx;0CI?J_K){4AjSS{IOKFbClhNn}UK6wYQty{Zo zMld{SbMV~qs#ta6`RnWJ>TWfAL)2qs0Bh8B7A0ko-tiWEa3x8rP9AUSusPTm=gF42 zgPn8h4mO@XW6Z0VWzL(7gRmMQC=Ex50J*Qk6OTS1#O?@BB!LugI8ojhFLrH1D+U?g zXH`|0cf3VP!E>7|m$E0V`AABY8HC12y7VM3BGpuH+Fffo-jfuh>`SCWHd=Pm=tLd# z!P~mt%?{FFRW}%1Zru~6%q%hx=^bw%GDs^mRia=H4(RE|k>ENOGbT(8Jz-z&Uhg}alzef;_~=t%F*VFXLJTB| z*ZH;Qz2?-Xu|y|!CUQ6UZpLx;hhLZ)$9?jA*#dGF0H4#WS+$%qD3{+4RAh)q?|2(_ zNWHsoi+4|au=XX-HRtHW#Kb4I^|Vd2_4M?#wSD5bXC1j}&kIkqwY~7f#DX4=qId3@ z=pL~nL(gM^G)2C4_^~FbNQxnvh^tFMb`Bv$0JeC}$>~N{3)r0%e|oIyyyId-!ArWPq>k>2s9@fPMBt99G`_5b$N)$#FQMk?cae7r;`sOo^}X4m~w zYoDafp0LhDX3H0~DTLr}5|p{j&GOB5W))eCLcY=F7w1X#(K5o)|LT3NhyP|SW0i1 zBISzHlw(#;et-7Ro}jFMyyLBwkNhKU>IR74yD^c=;L2_3wdB^+Tyy@qTS`Cg(81S8u>bBN* z_aCh^Su#n8>djmC+$cLPTGxtM%dL}Xy9VGQ2a(?K1}e{E_q|z3>uToXY}D7?*V?vE z(7H6P@1Kdiw!X@(?Gx1*X$@kygHOtYa=2)mK;I4+8v`6f&5z{()J@*;{t;jD(`m+Q zo7NEebIHo+Jv2s}#B?W(1OT+fbK%dL(tewFMBRjo@pUn+SI#|U#0GRUU|o;JiZGRzH?kByN6U{dyTP5Ws; zdsK%yLc%{ikeeQ5iEOI-lD%@dolREmPBlbH_hdjFgE7mxgEW3z;ag^>tLR z$U&rcykUmA4=DxYWDNG;f7@P7>#Nz{&JZRSnO*5Cjt(&*ggHSl>Y3Y?NZf^}(_>@P z5UBXTGgATavr>HzBO}Fx=ilw8yXi-aESnP35Fx?z5vf041-g1w_oN{`rqyf>cp3v_ z%{bvZ7Dbr!j`#D}&(uFIc=dU$1MoqmHv80i{I6|Wh6s`B{qve~c>Q{>eQ_?t0ptL! zOp^eDK$%3rn+4^x$k>=C0Wb=Fu2xQ5gBt0@k&*f(-yV>gzEw+Ti$0sG28v|m$a~K( zOyhtP%BYi&Ov*iTU;G|4?=u$9h2IA{#{2;jO{(ZYq<6fdA^YT7=Y27+OVwKig|5Bd ziQ@bChg0>+TI*6iaE9z2O8PylO<}?udNlBMeiB3?qP-BP6`q z4EW6~(XXAzO%mvs1jPBn&hZPUYL0JtR+Kd4v8^r*UAs-J*O4@mzROgh=mr zJNrx}t-nRzU+eql1AbfK-M^%7(KcdxPQ3d3`|fLP&vj{*jH=FSeSgB`bzF~Yec3;9 z$l4O%Uv0+5pi|!QmJJ%VN#`X$-8&=9GFa+k&)4Ineav(I@GswgD(PKdD%kOn0)GQ# zzQPeXrk?u+Y?cyutU0FWL8N!Qm)PqbY3!rERW+a2)o-Dak}hfe@_%Z{FVpxT`)I3A zzbgIN5L?RYkN3@0^IAB&l)lFe7VY;B z;QbasD@aq|Co#)G_6g+z>{C6N;vxr;-tiu?&lbe1wIt-Mc!<%Lcj~qi-zjT=9t@w$w*t?6 z^Y&OXXL4nQu|9iuR|P7H$g%`Y%8e+P=!21MWiY0-7D0&gj<>a1>-(3qXgaTT^@_K) z`<`U&rGFjQy7c*X_Nls!S3Awbb*n@}RqMPijT0h&!E!V&Cg_rPyf^eS`#ybbZ+`|$ z*bk~q=Cx}Yk$q0)I_M`ra$aizG;R?5Rx}iFb{gPYgmIf|6h&o`-to3q&F8D*x>^#B zO+ByQh{}tngCcTb_EFXP6RnviQ`RN#c*}++=kI)Ht@G4X-T%51*1pZ7>}>p*9kB~OL+esi=NDMVm%KnJsC(^hyzqP7^mt1K zQzA&?FT?XJla>|DY8~pzftyM>s&FYozCU1^wUMI65;r`nlc1sqjo$Hg&X;IU+Ga2N zTPv-#_Le>qmGLSqYqvwwz4N%%V%=+Ra3^c6UHQ4*|3fErKA+cm!n(@5m_(Pn<9#a2 zPHnhc{)soeq%#QGar1ca2^)I9Zc!VZB%C(6hAGg#gv-`4dve`E0S8SC`CgLN+%s`e zione9LKaQ$D=~l=P0<8Ak3;|}mEFVamdhijNC?_S03h5V?}{}_9dEG6C=Eg)?F4g$ zI*UE%TIw%lsG4sIep(#K|2@BOkve1q2*Jb z+W008GK_3^F#f>+qvB9QDc_9Htkq8V9w;RqJl{^@PL}!wG zE|)tj2C1(CL_8D>qd38LzRy-myK)S}A7c~J1GtU8w*4?6ASnqvGW zVXSv1w_v_q_qmX{?ocCroSvskCzHwefcSkA+3$xNV~$+}w)q%`?E*vsnjL{GgVWOC zWv)mdF7owP7B@B&iBTlKf1%;2%nK%m9ho0zB(#Rr!6S2Sj#Ux)j~R~U%MybE^J*#+ za5w^BADf&mCDKm^MWkXB2mqiBrk3>ZtJ{#x_cGgA6iivY4~@%}psnjj0KCFd3sPqk zJ=@6b2j6wZur#X<(nQ+78&7==YiHXb(EO|;?;W(vhPgeBe7bkAwB8?k>sWGhL-z?v)j-~=3nd}nTJqp_L#$aaqERP-dD z-`H3j7mmCdVyj0AjnDk*oiz|gGBX13K#ho$p1a{$v*Yp}mm)CP80VqfSWN9Q{^vBC z33w&cy@`liy9}d3l%EGUJlRZrw&SwHiiX(?E2NGmL&%gP`C8(f{7mAJ!NX-@Eg*7K z95DgV#Cm_Iqal z+7;FBHnac*MljVT<`9o;#fH#A1$Z;KR_z$xe(y)y{@6i6&UedfNm2l;?f#o+Ox9u% zB?~i>H+~b-!X-DQgz}u)Ok58IwBz{6z={<$((MDIKqO9VBD#sR<5$PZ=$)P&I2rF$ z=fJm7S?*>#bw<;^cxFK4vFNqO=dzNMCBwR~Ze*A+(algahlvk>z>&)U1=cdx1@Ifg z!y4d%_0v|;OXi#B@MVQl-d>!Iv^ebo9~fD?2Pd9JjacpuK+utpn?MokIGMGsA{jm0 zf7$sHNB^8wV6uH@8gG^DPas@6E=ht3qeQes+}X)KaBXJFw_ZX*G9rvVb4+Ldi>cRY z%Bc3>Ki$`w+yn9Ly4R+eKNotW_eDoUb~>Ec?Q(JdI~y%6?&EEc!2X{7;$VqQbwL;z zi-LH%LVQ~dLY$3e^yTx#!QkS!xIcz1k$N9~nYh~GgeQ_4-G1*;7)J-_mLwb{4=-I} zvY&kIRLSnQI!8kfUznH3ry#D&Oxb$mVTA@VKvELGC=r-{-M0ibnmNVJrV{`_oXV(q z;KUMXy_>HNk{&-S;seV4YxizK>XjJ(-b(NcQ2N18Vv&V$#5n9+Efa(3QpLvgkb zg*b!5fq41hYCs**#69EfJJWao&{QLD_UWM+f2KZlyytk-326TN?#xGio+!kBCq0f39JBofJUhhvYGWp-==w^HEa2F`-e_=0*_F8-ms;O zjqMw;+y%Ni##J2z>clA&|^Be=1BsR*#<)?At6 zvq8(duXBjcP3~nw@0OJDuyH;RbGv**h11(|&9R?hlnRJKmcZF%xREl5J)mb_m& z&NQB&icu&?nVHdOdcBR=PQ}iQbxHBcx{wLq%Ivffy#Fn5D`Xf0vg{N@oHvlK4mZa0 zQ8k&IMouxus|N<~Zsa1_rt=-8WC+QCh`=-|g)9IX9nHCoCP@dNv8JUbFOi3faz3l3 zl+iCXo9&HZJRKOHEM*2KZ@!*rTp!iKe)dret=?}Z@M?h6pUL-8oy!@FKr<6Z()a!M zb`QY7s1^xKzwT}W8|ie-2`M-E@b7nmcUU(4{#Kmx*X#ib$1U2nVYApLU0deHJKiHg z8X(M;Bz#gr*O+#cd2^E`>(t@1{cPQt#{WBgQvkoja#9XxkaxU4@*{a8{=($3wQ-NQshTiH-to?oC(R(Asat9^ zK~ri`>rgNjr8HGUB)wRq_s^>UQcGIR#RNPq0XYljhhqXW$d=5%T82{-WwJ{sSBQEc zKw}+&5WwY?DBNh!@$69&gS-Xj439l)WLH(~oS&eLkL=Qg2M z*7XsRZ(>@wam`l;MNHZJ`1!%OfIRF^1|87DS<2g!6sCx?^*CHReBhZ*_$+ zwmXSgs#x*Y8>RM)L*&8cPpmd%Jg-|BBA9C&WjPUiy=JU2H||`pE!VEhGIF%)u86$H z>#Yq#@1>~jy!U#`bAR@5JZP}yaU!9H=X1ey;i#sYFr|% zFd7*RpkE?k>=}_Qi<2G(W%gEoR*+H9K>$%kW7by1iR8nmsI{kdS`CiK+5Y?gw+jzR zB9rXm&w8doN9qeF`~SwqzGCgzSBwdy2Sg|3Q{IQGJKo#*Z~n~alvGccBky=;iGV@8 z0qUJCn(lMgpW56!#isEZbka7*h5<-R}^X6Y|%Y{Mq$# z0Lsh0L{N;4VA6%j+O-C`g~_0lk>LpmHhQAX8ga2iAf1gSRS?F=JKk9$s&YhMs1w?D|G?1>z=w)(0WAFSLz3oJN9M8@r@I&IVjiK5>T zC9s7>KG#@E+0qZYk*+-vA=U(h7baJih3_PiSL>Bi)?iwR;ppeP)wNRFKCtKW zC*S%pYS=t8ZbXEEB=2~~xN$2oJCo>D8~{?Q@Q7|Uh6Ii!aNZeif@E)R_Z_bRv?LsjC=l5e8wP-7<9tq8!NC76EXEA(f*t0Kjx$H}0TYoxU=V_v-$1Q4IxT zjJ)HWuf&GZ&jbRg;c0c12kp@*`EKC5eva4wTDG`9AQ2I{_A#16U)~`Om%SQBJd%MV z?|3_S-nfpD=F|VGrB@SyRYRB~?|APbcL3a*l>w{>e7tja1F=d?hD`TYXkOgZ%(A zu`nX?(c9aHtlf7!$NqcQjydImm*b=Dd8M2&8fL@a_vNJ3+C=o8x<&64z}Sj}={TsT zBiT1BkKXZam?zc5A?p+5z$fr8DMx}o(GERN%qww?bZ@21@pT^AHpS`3coe{O$2&B% z^|t3MaK&6b-5+jd(mUQK?jkX8sE#ejz$Xo@u!r_9*dbo_e?_`nFsIDv-Sq2?<3wc6 zfC=b*;OXcxneYsGk&ZKIMPhhm+~+$s=^gKeD~&Q&X2UxogvbEA0vVLbR39&I&(6&3 zb1Rs3(<5vXIrO7=%c zE+yu8*hu&0_Yk;H-v=PlJKhZ|cab@Vhit)?+KA2#L_04sb=pJ9%ewxinyL# z57CjvOI~-p0ng$$4SGqR7;v-xZq#hg-#i0RhVD!Ar%)#9Qy> zKpU|^$lrS9yiO_YejCGwPZ1vZh{LSCvD407J+zT8_IeE?m&()G+UKo14k_KJ4I{A^ z4u+Hi0Sw-}S}vCl(zx{=z^QSp*G$^b)=UMc_K@k8f$IQ=3S*w`1A>Y<2b()ccoi6M z2*4oaT20g^%lxmo4S^Io#^AM{t|=he4kyrf?u|T5?^9U1Dn<5-6kL#L_4?d9#n4N{ zYh7Jm?Asif#6S+Nds^3IzTdt=eyknZE&>ju&m=F4>PqmhxC#e_DZfZ>^-ysmY<=T9 zfk8y_5f#@Vmv&4!rxz`Z@$UQ(>Suar}H} z384Y4eZ$g3yWN$VG^7Zks485z#=kiv6nh64qM zmt#wGopM@KO@tVs9wq0xm`#GutL-vlc6LOKIitMc6L=kvsee-mIDJ1U?#_FbMy*ff z@pregnG*QittPTbyKI)_I03X;!k$}4q<7=0z?~$&KkvI6K!;z=d)_H{uaBo|SC?`) zct0}t=}i%sjmTtngzX^{F8vnAdky|#v*`e928s@O6|y~K%%x*KS+k$;zJ0c41Qu}K z^=MQpA&kkMz@4w_>KKZPC8I&*Gj{TDz=@mc zPj6=^r164?wCnY@3hHc}gKYL5>P?C>LzI(Z#IcJ_MgsxH`m2Z#%8)ah2R45hk@$#N+R7V=N-+O&%JJ!BG3| zd2K%F)MbJAu6M$pSnyk_5P9eBk@yMoCO`Hl6x%&AVq1Mj5}8VX&OzVuFij%DTLf_1 z?J$Zt<>5(dF|?DAoM{0L+wCC}vhlg*gXAZ!2>)Hf*N6l-vWz!Z&K>qIb zHElf)XIi5PU~X+TUHBek34Vcp|87<{Ss2l{BWNE;rIV zijk11L1m*_J>6hpNtQ2HtHS`QzVXtNryHDD=Q}2mO@hbY-NKq8p_%d99k)qWO3tl? zuspwO5#okNy5lsMbDKOqW|Yv_lbH!436c^=j0{?%AWD;fRg*nc;AF4BpLe`1AfY#~ zsSpj&Z%+W886l#f34kB4qy5{<^?vicIK1(#-4$&xzTfSBlY8yMQJ*DSs1en>hp>Zt z78GW5+Zk@hYlNH{7Kg(%tSs*EcXxd1ddE9L-Ep{qj}ONVIlpVIdO)9dylr4erxXGW zl5RMv{6Z$jj#gE;WIAQ|JN(@pA87A*i)>n=gIKfowMaC;OYNuLt8%er1EUw&%T>QW z2+jx&mj(!Fm&?1m>-D?aSOawH+;ztwQ8s%jZe6#hW>oKBkZ|UZ&)?m4`&N_&#b?WF z&WO}XuSjiGtfem757iL+uGjDG^my}*cUX=GF{~!==N)egAZ~X>g4%b5vehL@4+$-Z zoKd>$GK=NN95r2LH`GXw#oPYw&JVD6yc>#Ch+GSZ!17lg4*|5 zE4Ni{!i?BGy)nYq?yNlycxL=}Pr%>Zs#ev8GS7DmbH^s`#G-ztnsDOJJKk0xTr2U< zZFstrM!2{8mB^7J|9I(!Q!p$B_Kr6OPo~p+HR$Msga_$3OYZwIKi=`S2v{-qs^L`9 z$!ig5=v)qP?&`yg8j%Dskl_H>JKooh4I=xElkuRN7Oo1w{CLOPD(HaY>Hu7oobc5- zIx{+072e?M;`>eJMQSY|pb-dgz2i-mNc~`GfbANR%m@h6p;|DQAMbeE0~s(fHp&w% zDnkv=i$olJjG3-2t={U`ki^KGXpj9EJDuh~Naw6djVGW10ALSjFl(S& z>X_)j)wgf?<94sgTXb1Xz`)d1$lJKk0igxN+psahDC z!M@{M4x?ONXaqxmz2iOc9A=h5Q+xV|-r`Jc|NDN-k9WK+BN~v9dJqA=+XYM3LSS8% zMr>omBM@W2-tk60IQ$SA`?CE|lOlixZJ%9&96te=AMbcu zh^V_e6D~5Xt=0^ZwZmzro%X4tvpL$<^)q>{HIYueG86oN^AbP@m}4=pcf3XYW{~}* zI#1?HBHNg-o6;fuho<$B_u@eqAn$lv2s;yc&TXSHKf%4C(>L9=udMIh1#GP7wD))B zJ_War^rbr%`P|FkecwntdIG&Iy%Wt`t-pZhtsbOlZG&Ke*8%3oJKh#TJ2T)g$N*+$ z01%b;D#k|ckU?GEbH6sUHA#@Gb*1wMws|;g?5{I?4{BjEug0PU1LPfV3*qep4xL&v zKu{hX?G}O&3V^-iJy9EUu#Vmw@+8NWVgA5<5RJ8VH*ND=V1B&gZ6Ea3X$C=q9ns8w z1_1kY>F$mZixyt*c(;MUmz2%LxRIwd1Y2&-eD~__JAYsOeU*F4ma_Tm;g^oy&a~kpT6n$V?dQTEEOe~5@30*E-J0Zyeciu2q|Jex z*{7H}KKb{1^XhdQwE^;uw_VgbkpbEG!=J1NV1!P0{2cN^8Suy)Az08czFGLeW_1^= zH>Y<7K+Gy}QorJL>VkK?t)t#y(iVm_-SO*xFWc^;5eWhIj(4rbg9}2+pd(%cQj0;x zNVEqSz+xY-3Xap|Qx=(4GYsjDAK>uHMkbTv823T#9q%~k($Hy>DF=8cQoQuRJKlBy z5w1J0USrm?oq7RDLZ>^fmu~2hJ1vO>H2Dss6^Pxa*AV(_ikCik$J-`?XzU%}WT|K5 zh=w8EalP!yfIo7V@2(8?yQ~bZ-_YE5pFJ}HDP+3f9dFBk0wv#vTHspfbjRh=4Z?^d z-7&9syyMsfdY#)m_&^%uX@C_leejOAMW6vN-oMn7_8ADB?$~k189xF6uy?!x9)x~~ zBqPlRC~FYpY61V!KDazD^ODbCYT(d$SDh?{4L~y}G2|=N-ymoqCJ&mxKG%IN^L| zJ812@?>mTtJRkua98o6yUM=qL?vSSu7j56@Hv5%Rl<^vnjzn6LZ@pS)C?+k^C1@*pm=t``9$N&s1LRHEPB8lGjl0f-|1i>p*3clG_<9qOckF+hY2 zz#5cu>wc;tasBS*n(jw%BF3)gyd1Puu9MR_yfc5XrF#^9)+Jgwb=FHX>rOQ;%R{N}?{0S~Y50!JAHG9{phive`2Oxjd&RQ7 z*qN-r4cbH5Fu~#2VMz6f6CciYy}N_!j~sL2fJE7A0hUU=!}a~$?SysavR62KdJR99 zBM_i95qu(mhWB^3cKr@E-tPr|@D?ael9pbvfIP^E>Z9+p_MWWr{ilnVv@3M|X?Mck z^UoUA9_I!i;f@=yR9@)!;O}m>aUW42;x5ts&}E>dB-ehFB>kO zJ9R~SMCLhmY!qT>^Nx3k;KASBY~w!8o!2MdvHMgW@92UsapKrn{Alyj(lVfVIKcNA z98QY-ue*5+z6&49kXRyU@^^RqI`Oqa`Hq7-Sk$ougoCy7({frFZx6!*P@AxLpT|aT zx{$vp&O6?vfe3$hqn-E*BYnqHckE`lyD;zTaB-q$cG^pBJKT186Dxt4JIN6Z4P9PB z0#RtPL=fTcZn*6ZXK(a5AZD)8{u(9qD8j)c`pz=wy?fC4ZB1GQ4PV>z{X$GbEz;qPv=e3j4! ze;TOn7~*W86Bhyt!%BtqOxh2|@MT^If~Kj3dRnzG=N<3zz=OZLb2FKDyp_s#oMO^= zZZ4L_0=2II00v(lJe=e+NizmIkLcP2(%CZKn`fx$lLOB2!{PwXXa z^U@*z=k*Cqs^?A&i?W(iltBPOr-~~r+){7e@ve^u=pFC1HNumJF6_9DEb52%n!s-9 z5Qlj!L;C>h@3id;ynV8yDnBkCx$OK&$!GlbQ{(CxM`I?SRTTbtEkm7myz3(ZddIsN z2fbBu)Be{U^+?x%HnY63nAbfB18(=+C~x_4KXVa>6aKsj6)qjwR0QUA4{zS_uF;4D zb^F|LBtyU+X+I=^rbKq}e_kU|uD6FGQqq|CCJzDvXbryk-Al8(ahXVEqjuRo6#jXQ z#G7}#s|jRpV6sAH@`Juw-$rbeVFy8XYQ3<4qoJM!b5y}5C@>j(!> z1m^V=Z{G2)&&YJ9A9n?#1cBx5IoRjFl@B*9ZyyHz)cMLdH5q=gTi~wfz*74|tA8>akM^dLnDk~*l zbE{*x+{*xjgQn(2xmhkZuUS-77s?Cea<0+h*UPyso}{^+!1JJOsxu0-#RXybK}{sUmSgatJ8U zj!j$#AnPKFXy{xY)3SUe9Vy2k0f}{4K7eL2?|5rCl&!b{u;RRDOX`^p2FTe|1Hj<| zlvnQST|nT!2n~s8cYZts+xHuk%)QzyJ4b=lYS4f}#otNhU$}E98VfJ{&IF_bX&mzwkF+o4zLw=z-YztxLvr z7JHk8;q+JB%&!JWts4g~4N1p66VN-}xg9zJ{zhEvu`;wty;}uGscfG$>x6>>-v{e* zPeU3->s@=oyjCI6#G`01;Wa0Et38`W1mCZaon&?UeubPyc5g(Fo*mL4@m@eDm+Eks z@o~N+$WWUxgN2oC2VA`|cLel~cfe4&H%!l>=yR?Q@)G4bqr9ru?rv?)3m*!`4k>12 z2!!&YM7(*&TTcPS`5h-cGF=y32b4`5EQu31pmYaKp>ZV>2PuUq`5Z(uCtW=ek~~rX zAg=T|HV;K;o*TgnBL|@4f4^!_uUD}w&p>bYGN5<7VTVxn&cAZXpc6a5$6!C6_nwJa zGv2f{>x3IKaSd!;)LxW`H}80>svN2bYH`dHaIFslC^khwHvIb) zGRavTNoqj7$tw4@9b}W_YVYY*n2^VT0(n`0$@}Bso?m)(a`WiNe;n>8zz`$s8o|U%+>1kc$2+D&CxvI`eGdyn4!oNYYs~U#eYe~k?VtN? zS+h>~cfJv^54EldiyZOh9dAX=qpZU_1v?bDEtVmO$wMWl5a&ckF(bg72o0=6!JA8J z)to3~TLm@DOYE*`wBOcdB@xE1MW9odsZSb{ENX zL3}*i1-5q&9c)5DUIh^P=s~>2hXC}>bn0L9knB9v>F_oYosE5GCZ;ieziZh%86$g) zMV>_D2~8U0$qL;w6!44t@U2-V{Cz;{Q|G1>6eZ%#JKl-{*Gbt2j;YR)3kn$96+)5= zB3&{P!N9NtAlou3G$PX9592ysbUhz6f3Y#CMr;KY$a`hvnRUZzcHHFij(5z#aY$5r zrX`y;F}Vy*|9>+GONj0*;+hoUy0C-8W0+Rw5Ghgg89%@>bL%L*q&|1M_mN(y@ zb{`tIFxfGhkZpyZxy{yqnp0}I6Z?9Zd>>hCHjAE!!$TymLeTR8)rgIE!ofk0Tb7fy z0V5a)cN7BP$BK6O1RH&aOz|qfx`C>5);Tzb3@v}xH^DIF$^G(y6dWC#;oDt5^wKx?NYt40mP_iI-84T@ndOZ`mO@R(+oDRleVnnT#aTLC8 zq}c9#FCyDvEgqSLq9*}8`|s_Hx-e=p=)BsoR{tN}=)jo?fb{|ZoVB9a?MUFzxW)Od%$TcAG#Wn){`g-(jA<`%uk(OWs*aia2!C~!4IBZHYhM#*qX$QjU30Tv?}_#6f(eEzV?{e z6ih9PGY+ZI8MFI+J>&v|;91SG;oH}%T2;%R@7m58Cio!TGqKqW1>CymY*sJ;Fu|)} zs6_lWpec;=tHmfWg(9)_C~xhlb4I}P)c~JZ zlgUsLrACR4?RNbi+Xu9n(-SG})(A(bnB$H>La7Q3 zO$0DORmpLNfr`A0_AsQupe@{}aKBG3*pcZRygSP4VU#P1etHwgH1kfp%Yae9&yw6j zxz!BFtWW)rk5&`0oG>(`~M3B%s-hN0P>Dl zz-gS0*46bW(g=oTXZK*i2dz4=zGY06+G7@x-IKT45U*Cv40+00`PwpnWnp7nOW*02 zx$%y-MG=`|>Xh+>t=-p!w$?P?@l{;>YSE!GISO9mbTs9kAThED13CaP2(}r(HnA80 zXa#%?!1dY3GU@8-QmEcq5+5A+z}$Gp+s^v^7c-uKAfR`={SXW+Ud0d3GhF1F*UsAcPeCQUV}WMv95Sqx{`1W8)of+rn65qOy28 z?|6gO9T&UNtLyZ9Sqb1YPDfK_p70i#>VvgU&;SuLh@hDj?QHiR0Nann>}r(ir6rL# zIa5c-RY$ndg*$G(1>(jpEX+z8+U6!;)V zV|xH-0Ez?HCx)v@4(FA0_bPb<4rM&y*RIf+8}E4A6mdX-k%`)3K-YZ7KB?s{TvT;> znY7meoW|*Bz4Adtq=gj^-l+ziK>+6%YzhE|wso-!YLwLWoocOyc{?s)Zg>s1dg$wm zqcq4V$}=n8yb*i2S?)}ejPfgMm*jqC-!Mi=l&&<()!e@{CX-z4|4Sx7?Ot_*R%TD^ z_U8NDZzwv@(Q*fZ%cjTt`)g@qBsLd06BDUK@^B`q|}O7I1iV4M{#qrJMS8{$fT)aYDRe!7>PI4 zL<2yEVJd4~4@t&Ql)ow)D*&!AOv#ALAKQTdzlB$c zQbNwx)QOC0x0%63^DLGdzwrq^3K{n?U^5u~1+Z@qMTgpl2dc>3RAc$>TN#!EO%JEN zd6gl)j1VYguz$ti!W~aJz-=ol7EB5bVT2`f8h%hH;4a0Xni)1PlBdsF8H#p>Cbhp* z0Sb{6@eUuUpd|%8>E&2)LdoN!Yk^w;wX%EU;}Z#`&1Mr3(~|!J5+} zqpAQ)WI@FrH8iI`)w>II@-%>+^*1p~x3<+d zqT>T|;~j5JSp%9@t~Lk;0aCjr;D%(?%OYPiKWk|jB(>yA~I`9L`u8*#*(;jpD9gSqjJx3cDPoErJr zp!n00-p4P2j~u@a*me*N$xDE48QG1O>p%2(wIqNtqK>T8!gGR?=9HIv@;YEg0rwE& zoFuq&6~G=yS=~ng_7+Ki*g?d=Q}1QsgOU4?DKI$Calqjx$%y-rl@W4 zpa8vuUzLrO1ULo2Y3Pe91jW=C<8W_*be)(DtpuEjIY^5Pz0Z^eP~CPTc;I1izcFBr zL)%+2n1xV3UG{H(FJ#<@SjXl)Z{4v1o}F$Hw!FRugQ@Y3x2nW2ks4Lkuie9N2Ph4C z)fXHvld!6AzT-52(rjkC;X%6ZH6$H)yti~vtg&P_-+BCXM&9~m&sw{^ zUf;a1pMC|dJD$!v-n@0k6-4?#wPqvc#yj4MlE9&9WV}4BkP~EGfg#B=fOr|zrlIyLgSA=Rn2Um-PkQyu zmx3YaP;IE_MkdjT)JBXLMDKN^iOW9xJ|Qo-iNoAK4^%m>1U0u-T9dA|Z9TtcKWV_Wg)KJ9?KW$SN z$#$;J3v}oqd>oJx8U7!jDD{dW%9H?_VFhsg%S@R()&_thk2!}(lM!mgLdESzU9e~if-TMnh?HIXMP0aPufOzztiA3l6Em05w>5VV~ddC}J_U$c+ zXhkYnThaiTMUpdq9bA#op3@wdKEs4jK45%fyjei+cw2172D|f)x4z<;oSZ$)TW}Gy zT^cja+1jZzAbOpeR6G;#Ai1$#oX|VoxMd3?Am+tVSF)yt%6(1*iE`~OC%^BZ?l`fM zilcl*XC#xnNO*#bt@uZhm;5aXBq+)6jiY@7fEZ(w^MizcdHqd}8X3xpx+F^$iONP!m5=w#&GiMCHh52#dG*6jcl=}(22Sj&y2>+sdf|HoRd5XRl z2?yMd;H9s0b#Sk7{rDq_1(D@GdKEN!7mpwRhMZNj?2T7bY}IK0Tyx=bjlR&dDQT7$ z%FQLlNzVPnL0#6A!>2wW5tFf{p+t6=wYG0p?Z!Yim|8QiTGKwgZJA z@tzA+65{~R(qP0k#S_aNQG_mUCV9&0M4Gm}k52$fP_+?_UF17HZXc>vwsVka-pxzQ zQyvjnZHtN9kfT8oj)4e(-PE9b-2uR047Y58IPZWUwE~{tl*AGl=R&g#0By0_L5FY6}pYs53S=dTag!vLYGQ95PgzWLjSn0f4#{ zRc`}@_d<>vG&me7Sh%?WPr_aJSd@|-!13m@fUYmcKF)6opqq6Xq~Cm2;MT)W+&4v9 zMkvuPtv%|t*Be%|89O(Z@Y@-`EdOHBci;CZ^P#n6lKH*ov$`*x#ijYBN7kxsUHF4-(vVyHqYMG02zaO62ds=Ed(kj8DXp-0xty0{wG0S3=)L(p%KJS2*FCh2ab z+p8&W6$w}+;Q#<@4xbb}rfr~_WJPhC_a%$o6!%W!# zr0oAC1ZC^Pug)9Ew?S}_F_!>@2?5|Rc{rVgz5Cu%sndhxxoF_@tMf)m1_%gLyF2kO z##cM+SppEC+xpC=b%pf$a@~g&Xc(L{!(D8^*muO|X3xy~4kx$yWYi=xNMFq$MMKg& znFMX7Kynk{ZM*|FOQ>87Xh!q=Idt1WA9KQgH6TcFOFA@OV#Wot?euiqd$0PsPgVJG@3YP_?9_Xn?zOgY zO3^1@2DGqQm@AxxJH{zEECuFhldNL!_j3-VLZwis0C>p2W>9vt!3baok*)up0z<0E zz(=unu~rd*4#-1*&R8GMB?gS*bnE=H{i6=ZRuUq^dyR0S3V++a;Oyjy%3Ng|m?hnd zXig~gPRtJomV88#nLaHjj#fTBxR&;k-9EtV?Jk-dMiw*57ylPb9@?41qi&jQh&t;C zUMie|pUB5FfV*POkTN-?Blx*t%^~C!(8k;SQ9kQL%eiB04K@DaVX&61cQj* z>ERI{1?a_;!&+weRUOI(q2F!$V=?nM&NvaPOrXWg;C`~FwSzl`LZ z7VN-@h$k!Sy0c<h=1e`k^J`^QyyN%PI(G z;5VK#80`-9Kh!zn(bnm7E*s&&WRR}b0mQ?3XzRmpFL>=t61j_9_l^#{)$D|mB9>#` zM+G>^^ydKRH#@$=!#T6tAI*;#HVOZ`&^I3X&WAb=cOE+9UEgD-Y&u%cZ1mmt%F4YO z11BO*7wwlI8IH(hRBzz9-`zKv+;QX>Gmwy%0rU)fP!%1XhttQ%*ifDp`HNrnvGn2I zmJcn&KKkN(o}iDW`RUn(!>aK?*rg4;GV&nplmh|mxh|(q z+o2A1GMa~??LmNHYFdLR1n?Yb8 z;_wb8KFWDPpm)4WXPB?N57 z{ji42kZFXot=8jHtQk8Z=WpE+sMU@ng|6fUecth|)xL~R=&hNvK5RJg16Jt|e;9;U z!ywJ>(P`^*MYvhPT%$TYpN~3XpV)%|O*@Li`T4wR;>bmW?>R$TWnKrq6<4c6(+{>v zjFhaofDf`Um#dc>f&PdSkLryn;q&w#_`XBeqGYOb3=V%8LT88Ksd$J;sP zwhS-*E+3rQOs5@TQHQ>i|m<|)<9q$_L8#clF`gO-X zk9*bhc*nbp)EUb=-k4*S&CziOn;-9Zmk%?Rcf9LkacFx)1l+Mr98&Y+9q&3#*ZTjR zD7CNC(O76#V0ygcUAL9{Abro9JB0s$=gc;6nq~9j9q;lH^OkqK{ZJ2^Tj;0qhY-8us8Xxa?*J&(^(cbgc9rxur z9Sx1Yts4f)Cj z$UENULw~*F&0BZer|WbyjMrZ;i_bP^fV|^fua&!-s+{k*AJ^$<`KLP~m{k9WC8)NZ9>E|j}`KqfNpx1rOf?Sh7 zDT)5Ciyt09ETLH;%VJE1VExglmam-E6=&j_(~B-sL?Emyv_7^PG|IWzhi;SQ0rIu zR~h;Jr_HG~r_23Xz2-sBnyL2)k!^Wty#w1m4H(23x-v8w4lNGn}p5J!3L-ARov^ZN$l=b%mQ|Hzc12sY0(8EU9kp7SJDfP8E`Et zmB3gwt4ZtzhMy~vV3^_IX?m|&WH^?dwLMd-;n?k%92dI_()3ZVfBA$Yw7-`bP8Tc1 zJd6ZmwrcD*6B53U_Wi8z?I!IWp6c;?o7PnKWQsx?NFpn zA+k_5_#3YO%1V0LT&P#lyE;J~D>J+d*FSY3uRbmHAp+KYPCb%Xg_XHeU$dY!XDbFmJ$j-aw>)!{VR zYNOtn;GBBzyi--xVC!DoBMe)y!_?RZmuCcO@`k%ftU5f~LBq%i#JOPI^^a zTrlj-CsqAkt4S~xVe6_}XFNY6`VWf?;QANerun=L zFz1i!tif`&l&KCKtAkwsT=jDG4n`G%W2gB#U^85Q)fxAGhI;B2-5BC|dT!4$^z7_n za`a>O>8&s>zJ2ZA{mWi!&+ChChpCuilI)z`=%%9p9S+3$$qS(Kna(e;E2rE>oP2@{FI|x@{Riaij$OHC<&mxE7D@m z3DTC~#vsLT6DAWxf#MIL$6y4iXGtO==|2i|nIRFGWDNUUe@WKpD2{RT!X8m_t+c0> zq<^0R>6b+R9z8l3x=>A(VJfte{-Uz3ti6cFL(re?f*V>g-{?I3sKasS)%fvwwa?B+LAaV|IPUp@XHG5^wWZW&86~eIpu1u|Y1_W^?qU#<8HrAx&}JoLOG&ok;b11x z+EMas5>dvA*jd{~F4<&=W9;M4i|oD&V%Zny@zK%JAaniM9m6#<&S zxVM&){#_{%MmfbW{pI9C@&gS|kK1$^%Q!}^;ri2*Gse-un}?_rGm-#>4VMr=7vCa@n@=;io%`4fS5Xx5kq48qskT({!GD=3@Mt3Gg4zX-wE9NRLZD=JB zBtnAWvcz1H){X5bmJet{;6^A=kmn=ssUJe0^jO3$X%0-^@##wtdt7Eogpze@v0N-4 zg2yZW6A;>Z9y&j)zbXnu`{lU!2mh>^b@K^AX;+H3^^zM`zm>%dC9_7UW3rV0k91J} zZV9GH@(D}A<&$R2W-XJ4!e*7zh9LQS z$<}X~CGqREvU~MH+o!ENM*Y;KNU5EUhz-XsGnzQI{Y6SkKtp;zTi#7OCEyf$4I=qs z@w4K*WT1tThI8)5F5eW@4YZ4-#~=O5nd{i=>LslVV@puGp4L+KrMDuU)fKyG!)O=0 ze2UpG0~33pCspl{0Ffk#bnT>!p(T(?R>r$ay-@B#u4qdJz7;#iBa3HXUD>oU0}NsI*jdr~@}>4kKBlYq5C;wE59USx++;93g$iz^qT7ASq+ zYZz)~$8@W@R1S@ofAA-7ULZF_tw!bkq>VBMuqRKSBrmG0k-TWRl;EZMo#R-}3uoK0 ztalcnfA_L-UI&3i%6ic_M5-o8-_^=_9c^u8zmAmi+8rm?y_zrUbp(C(zPxuuP>YJ( z6`e~wKdAq9$It2ie#g%#=YGdMBMcwxb*;Yf2!DlL&0rEsVOS@Y5weawgBc5!%kP}+ zVv7&HPg68A#EU(Pm(Vg{bP2hE*3oFZ$ty@_jBcA^nIZ3(q8>tA14gY_UT6jeJ%seG z!DxJEx@(ds@7O|%uOMe>zoV;JV^^Ph136!Piyrd;@soEP|NOVPd&O9&CGz>c%b&dC z9)D!UfHRI|RF*+`$2J;|zBr|Ulj9ws>)khKKFe^T0VDv#W@<MTuk@;fDh*$?xo9^U6%#rd!KHEb?E`)RlvfN zP3ux9mmV>M0BQ8FLbt?>`n}h4oB6$1Nq!FUw$+F3dOK%gfzvH;VanOXb_t-v(C=(# zhukR2iu3|AqI67h;mzod88NVBlRnuJ0mr5Pl=yzhI^3buq))7Po7Uck7!xJ$x#A}a zNGVQ--NDwV*;ckSyM;@2KWHCpL(SUW8*@whA={T>#u6mEfW^bs43M0l^O%;;VzVY7 zsFNC*KvgU@P6ZCKosTu`B@?OT3SBp*-ebij>mxq znfU$GU98c>dB&ndS2&}PCA&c1A={NJr6pze+UP+Tdv0c?U~S`R$6fF7sE|3}%&Ue3=;K@K0`%9& zm;eSf*T`91IUr(B2qB)iqi`Y6P=n>@-~AA&Xe8zl%6HyrEw0uqE1d;Es^zVk@RULZ z7Xib-*^j7!B5ZZUF^K+oO`zrdiWu9RH-xx@?Ij>m|M*trHw8dn8nt82jH|Xxw_Gr; zSuzL|2Tr;dN(y8HSX7={j}Ke)qdsfhC=S~?11ZbEth%8-vq}gt>o8ddK()zso+Q)Q z3V_^8e%jkf&qj^cAvSk2`KJM0wZ696p#3D>y4S9TMPOnKzs}Nq)dDNSh-Kb6uH~Sf zPwOjd5}gULPsmM90XU50i1#kP)g0G)HLuvcBr8DiZH%HOfMA6mlUxV@D0g(okjqqS z{e!mhu#vQnxu!aY1-Zy0m%}zZYC!SF)H(q16`8}U5NJzBmZiY&@6ZSzO19fL+mlgG z&d#Q@XDcZLoZxbjr)s@I#6DomK*gsQLxX87vT>ShM*?h%VlrN8wRIo4X(^R(C0P8MjF(wKY znE9Z-CNK85xm<*oT(bxkUaATBig-A0N7cOMPzfxu0>$5i534zrinz4Nn^Lbso`(dI zPfbaHho}6%oNslAvaE7B1dY6^R?%2WYSpGlR|D4Rd|D|B4I3`3wpk6kIu7gz0s@SI zx|yAcvMt!o_~y|CAlMe|leo_J>md;v#cxD@>zoKQA=(I;PIoZ7fVMj?QqHD#*5#Ov ziNEzuV%_e<;J2H@1=x||Om#_U@OctwMEU?aW%cEPU!-%&WS^Bu;xiy(6gWfZjE-q} znoF_DFEq%m$k@F>-ivh|B}1@M8!rCMl*@-@Z5WpJ60clr8jx`kaApYhdZ);~#qTsV zs>j$$o|uGqulCyMb9>Jx_X^xyxHrRvoNw*$1^z?-(SP(G{YU@NfAk;yNB^ZW0RW$i B4;26a literal 0 HcmV?d00001 diff --git a/network/vpc/reference-content/use-case-basic.mdx b/network/vpc/reference-content/use-case-basic.mdx index 9014f3aab1..2285c5a852 100644 --- a/network/vpc/reference-content/use-case-basic.mdx +++ b/network/vpc/reference-content/use-case-basic.mdx @@ -19,110 +19,66 @@ Knowing how to create, combine and configure resources such as Private Networks This is the first in a series of use cases designed to show you potentially interesting and useful infrastructures, illustrating how to use VPC and other network products to achieve a robust, secure and scalable cloud environment. -## Private Networks and VPC definitions +## Overview -VPC allows you to build your own **V**irtual **P**rivate **C**loud on top of Scaleway's shared public cloud. Within each VPC, you can create **Private Networks**. Resources attached to Private Networks can communicate securely between themselves, away from the public internet, reducing security risks by ensuring traffic is isolated from public routes. +The architecture diagram below shows the infrastructure for this use-case. -The VPC operates at the network layer (layer 3) of the OSI model, while Private Networks are a layer 2 resource. As such, a VPC is responsible for routing packets between its different Private Networks. Private Networks provide network isolation within a VPC and enable you to segment your resources and traffic across different subnets. + -VPCs and Private Networks are both **regional** resources. When you create a Private Network in a VPC, it is necessarily scoped to the same region as the VPC. Some Scaleway resources are also regional, others are zonal and scoped to a single Availability Zone (AZ). When attaching resources to a Private Network, you can attach resources from any AZ within the Private Network's region, allowing for example an Elastic Metal server in PAR-2 to communicate securely, away from the public internet, with an Instance in PAR-1 and a Managed Database in PAR-3. +This is a basic infrastructure to leverage VPC isolation: - +- The **Scaleway VPC** contains one **Private Network, to which a **Load Balancer** is attached +- Users access an application via a domain name +- The domain name's DNS record points to the public flexible IP of the Load Balancer. +- The Load Balancer distributes traffic to multiple **Instances** also attached to the Private Network +- The Instances do not have their own public (flexible) IP addresses, and are accessible only from inside the VPC. +- The Instances can store data to and retrieve data from a **Managed Database** attached to the same Private Network, without going through the public Internet. +- The **Public Gateway** attached to the Private Network has its own public flexible IP address, which administrators can use to access Instances and other resources in the VPC. +- The Instances can access services outside the VPC (e.g. hosted on other Scaleway resources) via the Public Gateway. -| Region | Availability Zones | -|-------------------------|---------------------------| -| France - Paris | PAR1, PAR2, PAR3 | -| Netherlands - Amsterdam | AMS1, AMS2, AMS3 | -| Poland - Warsaw | WAW1, WAW2, WAW3 | +## Advantages -One default VPC for each region is automatically created in each Scaleway [Project](/identity-and-access-management/organizations-and-projects/concepts/#project). The [**VPC routing**](/network/vpc/concepts/#routing) feature allows for managed and custom routes between the Private Networks of a VPC, so resources on different Private Networks can communicate. - -## Designing your network topology +Advantages: +VPC Isolation: -When you start creating resources and building your infrastructure with Scaleway, take some time to consider and plan your network topology. We recommend that you build your VPC infrastructure with **separation of concerns** in mind. Separation of concerns is a fundamental design principle aimed at breaking down large complex systems into smaller, distinct components each with clear responsibilities and interfaces. This kind of design will future-proof your VPC and come into its own when Scaleway introduces further features such as ACLs for VPC. +By using a Virtual Private Cloud (VPC), resources are isolated within a private network, enhancing security. Only authorized services and users can access the resources inside the VPC, reducing exposure to potential threats. +Load Balancer: - Separating resources into different Private Networks according to function and usage can: -- **Improve network performance** by reducing broadcast traffic and congestion -- **Enhance manageability** via a logical organization of resources -- **Enable easier troubleshooting, monitoring and maintenance** -- **Allow for easier scalability** +The Load Balancer distributes traffic across multiple Instances (virtual machines), improving scalability and reliability. If one instance fails, the load balancer redirects traffic to healthy ones, ensuring high availability. +Private Network for Sensitive Resources: -For example, you may use one Private Network for frontend resources and another for backend resources, limiting public access only via Load Balancers and/or Public Gateways, stripping other resources of public IP addresses. You may want to create different VPCs for production and test environments, allowing you to isolate potential errors in testing from the production environment. +The infrastructure separates resources like the Managed Database behind the private network, ensuring sensitive data is not directly exposed to the internet. +Public Gateway with Flexible IP: -When [creating a Private Network](/network/vpc/how-to/create-private-network/), you can let Scaleway automatically generate a CIDR block for it that is guaranteed to be unique in this VPC. All resources attached to the Private Network get a private IP address from this block. However, you also have the option to define your own CIDR block for the network. Ensure you choose a prefix and network size that is appropriate for your needs, does not overlap with that of any other Private Network in the VPC, and contains enough IP addresses for all resources that will be attached to the Private Network. +The Public Gateway allows controlled access to and from the VPC, enabling secure communication with external services. The Flexible IP offers static IP addresses, which are beneficial for setting up secure, consistent connections (e.g., for whitelisting or DNS records). +Block and Object Storage: -## Attaching resources to Private Networks +Block Storage is useful for persistent data needs (e.g., file systems for applications), while Object Storage outside the VPC is optimal for handling large amounts of unstructured data (e.g., backups, images, logs). +Scalable External Services: -When you attach a resource (e.g. an Instance, an Elastic Metal server) to a Private Network, you can either: -- Let Scaleway automatically assign any IP address from the Private Network's CIDR block to use for the attachment, or -- Define a specific, reserved IP address from the CIDR block to use for the attachment. +The ability to connect to external services like Transactional Email, Serverless, and NATS, Queues, Topics, and Events gives flexibility for event-driven architectures, asynchronous processing, and scaling as needed without overloading core VPC resources. +Security Features: -### Auto-assigning an IP address +Resources like the Secret Manager help securely store sensitive credentials and keys, improving overall security management. +Applications: +E-commerce Platforms: -This solution is best for simplicity, dynamic environments, and short-lived resources. It can be especially useful in large-scale deployments where manual IP management could be cumbersome. When you let Scaleway automatically assign IP addresses, we ensure there are no IP conflicts within your VPC, reducing any risk of human error. +This setup is perfect for an e-commerce platform, which needs a scalable backend (instances and block storage), secure payment systems (private database access), and public-facing components (load balancer and public gateway) for handling user traffic efficiently. +Web Applications: -Note that when you select this option, the IP address randomly assigned to the resource will be stable, and does not risk changing until you detach the resource from the Private Network. At this point, the private IP address is released back into the pool of generally available addresses from the network's CIDR block, and may be auto-assigned to another resource requesting attachment. +Web apps that handle high traffic can benefit from the load balancer and instances, ensuring uptime and availability. These applications can scale horizontally as demand increases, making it suitable for apps like SaaS products, social networks, or content platforms. +Enterprise Applications: -### Using reserved IP addresses +Enterprises handling sensitive data (HR systems, CRMs, etc.) can use the VPC’s isolation and private networking to secure internal services, while still allowing selective access via the public gateway. +Microservices Architectures: -You can reserve private IP addresses from your Private Networks' CIDR blocks thanks to Scaleway's [**IP A**ddress **M**anagement solution](/network/ipam/), which helps you plan, track and manage the IP address space of your VPCs and their Private Networks. From the [IPAM space](https://console.scaleway.com/ipam/) in the Scaleway console, simply use the **Reserve private IP** feature to select the Private Network you want to reserve an IP address on, and choose to either reserve any available address, or a specific address not currently attached to any resource. The reserved address will then not risk being auto-assigned by Scaleway to other resources during network attachment, and can be kept until you are ready to use it to attach a specific resource. - -Further, when you attach a resource to a Private Network and specify a reserved IP to use, the IP will remain reserved even after you detach the resource from the network. You can choose to either release the IP back into the pool, or keep it reserved until you use it to attach another resource. - -Using reserved IP addresses is ideal to ensure that certain IP addresses are never released into the general pool and kept for certain critical resources with fixed IP requirements, even when that resource is detached from the Private Network, or when migrating between resources. Reserved IP addresses may also be useful where your Private Network is extending or integrating with external networks, or to assign addresses to virtual machines hosted on Elastic Metal servers via Proxmox. - -## Removing public IPs from resources - -We strongly recommend that you disable public connectivity on all of your Scaleway resources, unless it is absolutely required. It is preferable to attach resources to Private Networks wherever possible, and direct all traffic to the resource's private IP address on that network. This ensures optimal security, reduced cost and enhanced latency. Find out more in our documentation about [public connectivity best practices](/network/ipam/reference-content/public-connectivity-best-practices). - -## Public connectivity over Private Networks - -### Public Gateways - -You can use Scaleway [Public Gateways](/network/public-gateways/) to provide resources on a Private Network with a secure point of access to and from the public internet. - -- Set the Public Gateway to advertize a default route to the internet, allowing attached resources to send packets to the internet via the gateway, without needing their own public IP address. -- Activate the [SSH bastion](/network/public-gateways/how-to/use-ssh-bastion/) so that you can establish SSH connections to resources on the Private Network via the gateway's bastion. -- Use static NAT to map ingress traffic from the public internet towards resources on the Private Network, using private IP addresses and ports. - -### Load Balancers - -Another option is to attach a Scaleway [Load Balancer](/network/load-balancer/) to the Private Network. By giving the Load Balancer a public IP address, and configuring Instances on the Private Network as backend servers for the Load Balancer via their private IP addresses, the Load Balancer can securely and efficiently distribute traffic to the Instances. This solution is suitable when you have multiple Instances serving the same application, although you can also use multiple frontends/backends and [routes](/network/load-balancer/how-to/create-manage-routes/) to direct traffic to specific server pools. - -You can also disable public connectivity on the Load Balancer itself. This may be relevant if the Load Balancer is configured to receive and distribute traffic from resources on a different Private Network within the same VPC, for example. - -## Connecting a VPC to external infrastructure - -Watch this space for Scaleway's upcoming solution to provide private, secure connectivity between resources in a Scaleway VPC and your external or on-premises architecture. In the meantime, you may consider installing a manual VPN on a Scaleway Instance to connect to other non-Scaleway infrastructure, and create a [custom route](/network/vpc/how-to/manage-routing/#how-to-create-a-custom-route) towards this VPN so traffic on your Private Network can securely communicate with resources at the other end of your VPN tunnel. - -## Resource-specific information - -Different types of Scaleway resources may have different requirements and possibilities in terms of Private Networks. See the comparative table below for more information, and to jump to the resource-specific documentation on Private Networks for each product. - -* **Max attached PNs**: The maximum number of Private Networks that a resource can be attached to -* **Mandatory PN**: Whether or not a Private Network must necessarily be attached to this resource -* **Compatible with private IPv6**: Whether or not the resource is compatible with private IPv6 addressing. Compatible resources generally acquire both an IPv4 and an IPv6 address when attached to a Private Network. -* **Compatible with reserved IPs**: Whether or not you can use a [reserved IP](/network/ipam/how-to/reserve-ip/#how-to-attach-a-resource-to-a-private-network-using-a-reserved-ip-address/) to attach the resource to a Private Network - -| | Instance | Elastic Metal | Kubernetes | Managed Inference | -|------------------------------|----------|---------------|------------|-------------------| -| Max attached PNs | 8 | 8 | 1 | 1 | -| Mandatory PN | No | No | Yes | No | -| Compatible with private IPv6 | Yes | Yes | Yes | No | -| Compatible with reserved IPs | Yes | Yes | No | No | -| Additional information | -- | [Paid-for
feature](https://www.scaleway.com/en/pricing/elastic-metal/#network) | PN cannot be changed
after cluster creation | Must have at least one of
private and/or public endpoint | -| Documentation | [Go](/compute/instances/how-to/use-private-networks/) | [Go](/bare-metal/elastic-metal/how-to/use-private-networks/) | [Go](/containers/kubernetes/reference-content/secure-cluster-with-private-network/#why-have-a-private-network-for-your-kubernetes-kapsule-cluster) | [Go](/ai-data/managed-inference/how-to/managed-inference-with-private-network/) | - - -| | Managed Database | Managed Database for Redis™ | Public Gateways | Load Balancer | -|------------------------------|------------------|-----------------------------|-----------------|---------------| -| Max attached PNs | 1 | 1 | 8 | 8 | -| Mandatory PN | No | No | No | No | -| Compatible with private IPv6 | No | No | No | No | -| Compatible with reserved IPs | No | No | Yes | Yes | -| Additional information | Must have at least one of
private and/or public endpoint | Must have at least one of
private and/or public endpoint | -- | Private LBs must have a PN | -| Documentation | [Go](/managed-databases/postgresql-and-mysql/how-to/connect-database-private-network/) | [Go](/faq/databases-for-redis/#what-is-the-private-networks-feature-for-redistm-database-instances) | [Go](/network/public-gateways/how-to/configure-a-public-gateway/#how-to-attach-a-public-gateway-to-a-private-network) | [Go](/network/load-balancer/how-to/use-with-private-network/) +This infrastructure supports microservices, where each service can be independently deployed on different instances or as serverless functions, using the load balancer to distribute requests and queues to manage communication between services. +Data Analytics and Big Data Processing: +Applications requiring high-performance data processing (e.g., data analytics platforms, ETL pipelines) can use managed databases and block storage for internal data while storing large datasets in external object storage. Event-driven data workflows can be handled by the external NATS, Queues, Topics, and Events service. +Mobile or Web Backends: +For mobile apps, this infrastructure can support a robust backend with an API gateway (public gateway), managing API calls securely and scaling as user demand grows. +This setup provides a well-rounded, scalable, and secure foundation for a wide range of applications, particularly those requiring separation of public-facing and private resources. \ No newline at end of file From d936e0fdab21bac49bf1853fcfecde4289130c74 Mon Sep 17 00:00:00 2001 From: Rowena Date: Mon, 28 Oct 2024 15:16:57 +0100 Subject: [PATCH 03/13] feat(vpc): use case started --- .../vpc/reference-content/use-case-basic.mdx | 64 ++++++++----------- 1 file changed, 26 insertions(+), 38 deletions(-) diff --git a/network/vpc/reference-content/use-case-basic.mdx b/network/vpc/reference-content/use-case-basic.mdx index 2285c5a852..4e70b3643b 100644 --- a/network/vpc/reference-content/use-case-basic.mdx +++ b/network/vpc/reference-content/use-case-basic.mdx @@ -27,58 +27,46 @@ The architecture diagram below shows the infrastructure for this use-case. This is a basic infrastructure to leverage VPC isolation: -- The **Scaleway VPC** contains one **Private Network, to which a **Load Balancer** is attached -- Users access an application via a domain name -- The domain name's DNS record points to the public flexible IP of the Load Balancer. -- The Load Balancer distributes traffic to multiple **Instances** also attached to the Private Network -- The Instances do not have their own public (flexible) IP addresses, and are accessible only from inside the VPC. -- The Instances can store data to and retrieve data from a **Managed Database** attached to the same Private Network, without going through the public Internet. -- The **Public Gateway** attached to the Private Network has its own public flexible IP address, which administrators can use to access Instances and other resources in the VPC. -- The Instances can access services outside the VPC (e.g. hosted on other Scaleway resources) via the Public Gateway. +- Instances are hosting the application without having their own public/flexible IP addresses. +- Managed Database is accessed by the Instances over the Private Network only, with no exposure to the public internet. +- Load Balancer distributes user traffic to the Instances over the Private Network +- Administrators can access the Instances via the Public Gateway +- External services are accessed by the Instances via the Public Gateway -## Advantages +## Detail + +User requests go via a domain name, whose DNS record points to the public flexible IP of a Scaleway Load Balancer. This Load Balancer is attached to a **Private Network** in a **VPC**. It distributes user traffic to multiple **Instances** which are also attached to the Private Network, and do not have their own public/flexible IP addresses. These Instances are accessible only from within the VPC. The Instances can store data to and retrieve data from **Block Storage** and a **Managed Database** attached to the same Private Network and not exposed to the internet. +The **Public Gateway** attached to the Private Network has its own public flexible IP address, and administrators can use solutions such as SSH bastion to connect to Instances via the Public Gateway for maintenance and administrative tasks. The Public Gateway also provides secure access to the public internet should the Instances need to download package updates, for example. Finally, the Public Gateway also allows the Instances to access services outside the VPC, e.g. those hosted on other Scaleway resources which are not compatible with VPC, via their public endpoints. + +## Advantages +### Isolation and security -Advantages: -VPC Isolation: +Resources are isolated within a VPC, and public IP exposure is restricted to Load Balancer and Public Gateway. This enhances security, ensuring that only authorized services and users can access the VPC's resources, and reducing exposure to external threats. Any sensitive data stored on the Instances and Managed Databases is kept within the VPC, and not exposed to the public internet. -By using a Virtual Private Cloud (VPC), resources are isolated within a private network, enhancing security. Only authorized services and users can access the resources inside the VPC, reducing exposure to potential threats. -Load Balancer: +### Scalability and reliability -The Load Balancer distributes traffic across multiple Instances (virtual machines), improving scalability and reliability. If one instance fails, the load balancer redirects traffic to healthy ones, ensuring high availability. -Private Network for Sensitive Resources: +Use of the Load Balancer to distribute traffic across multiple Instances enhances reliability. If the Load Balancer's built-in health checks register that one Instance is down, it is able to immediately redirect traffic to the remaining healthy Instances only, ensuring high availability. Additional Instances can be spun up and added to the Load Balancer's backend at any time, facilitating on-demand scalability. -The infrastructure separates resources like the Managed Database behind the private network, ensuring sensitive data is not directly exposed to the internet. -Public Gateway with Flexible IP: +External services like Transactional Email, Serverless, and NATS, Queues, Topics, and Events are also highly scalable, flexibily facilitating event-driven architectures and asynchronous processing. -The Public Gateway allows controlled access to and from the VPC, enabling secure communication with external services. The Flexible IP offers static IP addresses, which are beneficial for setting up secure, consistent connections (e.g., for whitelisting or DNS records). -Block and Object Storage: +### Controlled access -Block Storage is useful for persistent data needs (e.g., file systems for applications), while Object Storage outside the VPC is optimal for handling large amounts of unstructured data (e.g., backups, images, logs). -Scalable External Services: +The Public Gateway, with its public IP address, allows controlled access between the public internet and the VPC. Features such as SSH bastion allow selected administrators with the correct credentials to connect to resources within the VPC, and static NAT and/or advertisement of a default route provides the ability to direct traffic through the gateway to and from the resources within. -The ability to connect to external services like Transactional Email, Serverless, and NATS, Queues, Topics, and Events gives flexibility for event-driven architectures, asynchronous processing, and scaling as needed without overloading core VPC resources. -Security Features: +## Applications -Resources like the Secret Manager help securely store sensitive credentials and keys, improving overall security management. -Applications: -E-commerce Platforms: +This kind of infrastructure is appropriate for many applications, including but not limited to: +- **E-commerce platforms**: A scalable backend (Instances, Block Storage), which can securely connect to payment systems and privately-accessed user data (Managed Database), with public-facing components (Load Balancer) for appropriately handing user traffic. +- **Web applications**: Web applications that routinely need to handle high traffic are ideally suited to the solution of a Load Balancer in front of a horizontally scalable set of Instances, to facilitate uptime and high availability and grow with demand. +- **Enterprise applications**: Enterprises handling sensitive data (e.g. HR systems) can benefit from the isolation and security of a VPC, with all of its additional features, to keep internal services running without unneccessary exposure to the internet. -This setup is perfect for an e-commerce platform, which needs a scalable backend (instances and block storage), secure payment systems (private database access), and public-facing components (load balancer and public gateway) for handling user traffic efficiently. -Web Applications: +## Tutorial -Web apps that handle high traffic can benefit from the load balancer and instances, ensuring uptime and availability. These applications can scale horizontally as demand increases, making it suitable for apps like SaaS products, social networks, or content platforms. -Enterprise Applications: +Follow the steps below to create this infrastructure using the Scaleway console: -Enterprises handling sensitive data (HR systems, CRMs, etc.) can use the VPC’s isolation and private networking to secure internal services, while still allowing selective access via the public gateway. -Microservices Architectures: -This infrastructure supports microservices, where each service can be independently deployed on different instances or as serverless functions, using the load balancer to distribute requests and queues to manage communication between services. -Data Analytics and Big Data Processing: -Applications requiring high-performance data processing (e.g., data analytics platforms, ETL pipelines) can use managed databases and block storage for internal data while storing large datasets in external object storage. Event-driven data workflows can be handled by the external NATS, Queues, Topics, and Events service. -Mobile or Web Backends: +## Terraform -For mobile apps, this infrastructure can support a robust backend with an API gateway (public gateway), managing API calls securely and scaling as user demand grows. -This setup provides a well-rounded, scalable, and secure foundation for a wide range of applications, particularly those requiring separation of public-facing and private resources. \ No newline at end of file From cd3daf2ab65bd16206eedb92d7f09340919e0924 Mon Sep 17 00:00:00 2001 From: Rowena Date: Mon, 28 Oct 2024 15:56:02 +0100 Subject: [PATCH 04/13] feat(vpc): first use case draft --- .../vpc/reference-content/use-case-basic.mdx | 40 +++++++++++++++---- 1 file changed, 32 insertions(+), 8 deletions(-) diff --git a/network/vpc/reference-content/use-case-basic.mdx b/network/vpc/reference-content/use-case-basic.mdx index 4e70b3643b..a785dfb5bb 100644 --- a/network/vpc/reference-content/use-case-basic.mdx +++ b/network/vpc/reference-content/use-case-basic.mdx @@ -27,11 +27,11 @@ The architecture diagram below shows the infrastructure for this use-case. This is a basic infrastructure to leverage VPC isolation: -- Instances are hosting the application without having their own public/flexible IP addresses. -- Managed Database is accessed by the Instances over the Private Network only, with no exposure to the public internet. -- Load Balancer distributes user traffic to the Instances over the Private Network -- Administrators can access the Instances via the Public Gateway -- External services are accessed by the Instances via the Public Gateway +- [Instances](/compute/instances/concepts/#instance) are hosting the application without having their own [public/flexible IP addresses](/compute/instances/concepts/#flexible-ip). +- [Managed Database](/managed-databases/postgresql-and-mysql/concepts/#managed-database) is accessed by the Instances over the Private Network only, with no exposure to the public internet. +- [Load Balancer](/network/load-balancer/concepts/) distributes user traffic to the Instances over the Private Network. +- Administrators can access the Instances via the [Public Gateway](/network/public-gateways/concepts/#public-gateway). +- External services are accessed by the Instances via the Public Gateway. ## Detail @@ -55,6 +55,10 @@ External services like Transactional Email, Serverless, and NATS, Queues, Topics The Public Gateway, with its public IP address, allows controlled access between the public internet and the VPC. Features such as SSH bastion allow selected administrators with the correct credentials to connect to resources within the VPC, and static NAT and/or advertisement of a default route provides the ability to direct traffic through the gateway to and from the resources within. +### Cost control + +Creating Scaleway resources without their own public IP addresses saves money, as these addresses are a billed resource, while the creation, configuration and assignment of IP addresses from a Private Network is free of charge. + ## Applications This kind of infrastructure is appropriate for many applications, including but not limited to: @@ -64,9 +68,29 @@ This kind of infrastructure is appropriate for many applications, including but ## Tutorial -Follow the steps below to create this infrastructure using the Scaleway console: - - +Follow the steps below to create this infrastructure using the [Scaleway console](https://console.scaleway.com/organization): + +1. [Create a VPC](/network/vpc/how-to/create-vpc/) (or use the [default VPC](/network/vpc/how-to/create-vpc/#how-to-identify-your-default-vpcs) pre-created for each Scaleway Project in the appropriate [region](/network/vpc/concepts/#region-and-availability-zone)). +2. [Create a Private Network](/network/vpc/how-to/create-private-network/) inside the VPC. You can either let Scaleway create the network with an auto-generate subnet, which will provide the private IP addresses for attached resources, or specify a self-defined subnet. +3. [Create a Public Gateway](/network/public-gateways/how-to/create-a-public-gateway/) (TODO should it advertize the default route?) and [attach it to the Private Network](/network/public-gateways/how-to/configure-a-public-gateway/#how-to-attach-a-public-gateway-to-a-private-network). +4. [Set up SSH bastion](/network/public-gateways/how-to/use-ssh-bastion/) on the Public Gateway, to allow administrator access. +5. [Create a Managed Database](/managed-databases/postgresql-and-mysql/how-to/create-a-database/) +6. [Detach the Managed Database's public endpoint](/managed-databases/postgresql-and-mysql/how-to/remove-public-endpoint/) [QUESTION - NECESSARY?] and [attach it to the Private Network](/managed-databases/postgresql-and-mysql/how-to/connect-database-private-network/) you created in step 2. +7. Create and configure external services as required, e.g. [Object Storage](/storage/object/quickstart/), [Transactional Email](/managed-services/transactional-email/quickstart/) and [Secret Manager](/identity-and-access-management/secret-manager/quickstart/). +8. [Create your Instances](/compute/instances/how-to/create-an-instance/), using the configuration best-suited to your application. Do not assign public IPv4 or IPv6 addresses to the Instances. Add Block Storage volumes as required (or you can create and attach these [later](/storage/block/quickstart/).) + + If you are creating several Instances with the exact same configuration running the exact same template, consider creating just one Instance, configuring and installing it to communicate with the other resources inside and outside the VPC as required, then [creating an image](/compute/instances/how-to/create-a-backup/) of this Instance and creating the remaining Instances [using this image](/compute/instances/how-to/create-a-backup/#how-to-create-or-restore-an-instance-from-an-image). + +9. [Attach each Instance to the Private Network](/compute/instances/how-to/use-private-networks/#how-to-attach-instances-to-an-existing-private-network) you created at step 2. Either let Scaleway automatically choose an IP from the Private Network's subnet for each Instance, or used [reserved IPs](s/network/ipam/how-to/reserve-ip/) to specify the IP for each Instance on the network. +10. [Create a Load Balancer](/network/load-balancer/how-to/create-load-balancer/), ensuring you assign a public (flexible) IP address. Do not yet create the frontends and backends. +11. [Attach the Load Balancer to the Private Network](/network/load-balancer/how-to/use-with-private-network/#how-to-attach-a-private-network-to-your-load-balancer). As before, you can use an auto-selected IP, or a specific reserved IP from the subnet. +12. [Create a frontend and backend for the Load Balancer](/network/load-balancer/how-to/create-frontends-backends/). Choose the most appropriate configuration for your purpose and application, following advice and tips in the linked documentation. When configuring the Load Balancer's backend servers, enter the private IP addresses of the Instances on the Private Network. +13. [Create your domain](/network/domains-and-dns/how-to/register-internal-domain/) and [add a DNS record](/network/domains-and-dns/how-to/manage-dns-records/#how-to-add-dns-records) (e.g. an A record) to point it to the public IP of your Load Balancer. While instructions show how to do this with Scaleway's **Domains and DNS** product, you can also use an external domain and configure it with another provider. ## Terraform +A Terraform template for this architecture is provided in full on our [Terraform Scaleway Provider pages](TODO-LINK). Terraform allows you to create Infrastructure as Code (IaC) to build, configure and manage your infrastructure with configuration files, rather than with the Scaleway console. The following snippet shows an extract of the configuration file: + +``` +SNIPPET +``` \ No newline at end of file From c0bd597cdb9c5dcc9aa245eda3ed3c8dae671036 Mon Sep 17 00:00:00 2001 From: Rowena Date: Thu, 31 Oct 2024 09:20:56 +0100 Subject: [PATCH 05/13] fix(vpc): add use case info --- network/vpc/reference-content/use-case-basic.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/network/vpc/reference-content/use-case-basic.mdx b/network/vpc/reference-content/use-case-basic.mdx index a785dfb5bb..7eefabb1f5 100644 --- a/network/vpc/reference-content/use-case-basic.mdx +++ b/network/vpc/reference-content/use-case-basic.mdx @@ -72,10 +72,10 @@ Follow the steps below to create this infrastructure using the [Scaleway console 1. [Create a VPC](/network/vpc/how-to/create-vpc/) (or use the [default VPC](/network/vpc/how-to/create-vpc/#how-to-identify-your-default-vpcs) pre-created for each Scaleway Project in the appropriate [region](/network/vpc/concepts/#region-and-availability-zone)). 2. [Create a Private Network](/network/vpc/how-to/create-private-network/) inside the VPC. You can either let Scaleway create the network with an auto-generate subnet, which will provide the private IP addresses for attached resources, or specify a self-defined subnet. -3. [Create a Public Gateway](/network/public-gateways/how-to/create-a-public-gateway/) (TODO should it advertize the default route?) and [attach it to the Private Network](/network/public-gateways/how-to/configure-a-public-gateway/#how-to-attach-a-public-gateway-to-a-private-network). +3. [Create a Public Gateway](/network/public-gateways/how-to/create-a-public-gateway/) (set it to advertise the [default route](/network/public-gateways/concepts/#default-route)) and [attach it to the Private Network](/network/public-gateways/how-to/configure-a-public-gateway/#how-to-attach-a-public-gateway-to-a-private-network). 4. [Set up SSH bastion](/network/public-gateways/how-to/use-ssh-bastion/) on the Public Gateway, to allow administrator access. 5. [Create a Managed Database](/managed-databases/postgresql-and-mysql/how-to/create-a-database/) -6. [Detach the Managed Database's public endpoint](/managed-databases/postgresql-and-mysql/how-to/remove-public-endpoint/) [QUESTION - NECESSARY?] and [attach it to the Private Network](/managed-databases/postgresql-and-mysql/how-to/connect-database-private-network/) you created in step 2. +6. [Detach the Managed Database's public endpoint](/managed-databases/postgresql-and-mysql/how-to/remove-public-endpoint/) and [attach it to the Private Network](/managed-databases/postgresql-and-mysql/how-to/connect-database-private-network/) you created in step 2. 7. Create and configure external services as required, e.g. [Object Storage](/storage/object/quickstart/), [Transactional Email](/managed-services/transactional-email/quickstart/) and [Secret Manager](/identity-and-access-management/secret-manager/quickstart/). 8. [Create your Instances](/compute/instances/how-to/create-an-instance/), using the configuration best-suited to your application. Do not assign public IPv4 or IPv6 addresses to the Instances. Add Block Storage volumes as required (or you can create and attach these [later](/storage/block/quickstart/).) From 19b9fe526e62050712243c37204b806893a537b8 Mon Sep 17 00:00:00 2001 From: Rowena Date: Fri, 20 Dec 2024 15:05:15 +0100 Subject: [PATCH 06/13] feat(vpc): add use case final doc --- menu/navigation.json | 4 ++ network/vpc/how-to/create-private-network.mdx | 4 ++ network/vpc/index.mdx | 6 ++- .../getting-most-private-networks.mdx | 4 ++ .../vpc/reference-content/use-case-basic.mdx | 42 +++++++++++++++++-- 5 files changed, 55 insertions(+), 5 deletions(-) diff --git a/menu/navigation.json b/menu/navigation.json index f5b5fc3171..688d290e2b 100644 --- a/menu/navigation.json +++ b/menu/navigation.json @@ -2919,6 +2919,10 @@ { "label": "Getting the most from Private Networks", "slug": "getting-most-private-networks" + }, + { + "label": "VPC use case 1: basic infrastructure", + "slug": "use-case-basic" } ], "label": "Additional Content", diff --git a/network/vpc/how-to/create-private-network.mdx b/network/vpc/how-to/create-private-network.mdx index e13fa1c281..5a834dcb22 100644 --- a/network/vpc/how-to/create-private-network.mdx +++ b/network/vpc/how-to/create-private-network.mdx @@ -48,6 +48,10 @@ While DHCP is built into all new Private Networks, it may not be automatically a 6. Click **Create Private Network** to finish. Your Private Network is created. + +See our [Basic VPC use case](/network/vpc/reference-content/use-case-basic/) documentation for full details of how to create a simple infrastructure that leverages the advantages of Private Networks, including accompanying Terraform templates. + + ## How to configure CIDR Private Networks have built-in **D**ynamic **H**ost **C**onfiguration **P**rotocol (DHCP). DHCP manages the allocation of private IP addresses to resources attached to the network. For this purpose, a **C**lassless **I**nter-**D**omain **R**outing (CIDR) block is defined for each Private Network, from which IP addresses will be assigned. In fact, both an IPv4 and an IPv6 CIDR block are defined. diff --git a/network/vpc/index.mdx b/network/vpc/index.mdx index a1795df18f..2dfa8ca66e 100644 --- a/network/vpc/index.mdx +++ b/network/vpc/index.mdx @@ -6,9 +6,11 @@ meta: - Learn how to optimize your Scaleway VPCs, Private Networks and resource connectivity with [our new guide](/network/vpc/reference-content/getting-most-private-networks/) detailing tips and best practices. + Read our [Basic VPC use case](/network/vpc/reference-content/use-case-basic/) documentation for full details of how to create a simple infrastructure that leverages the advantages of Private Networks, including accompanying Terraform templates. + + +See our [Basic VPC use case](/network/vpc/reference-content/use-case-basic/) documentation for full details of how to create a simple infrastructure that leverages the advantages of Private Networks, including accompanying Terraform templates. + + ## Attaching resources to Private Networks When you attach a resource (e.g. an Instance, an Elastic Metal server) to a Private Network, you can either: diff --git a/network/vpc/reference-content/use-case-basic.mdx b/network/vpc/reference-content/use-case-basic.mdx index 7eefabb1f5..9311b8c18d 100644 --- a/network/vpc/reference-content/use-case-basic.mdx +++ b/network/vpc/reference-content/use-case-basic.mdx @@ -33,6 +33,8 @@ This is a basic infrastructure to leverage VPC isolation: - Administrators can access the Instances via the [Public Gateway](/network/public-gateways/concepts/#public-gateway). - External services are accessed by the Instances via the Public Gateway. +Full [Terraform templates](#terraform) are available for this infrastructure. + ## Detail User requests go via a domain name, whose DNS record points to the public flexible IP of a Scaleway Load Balancer. This Load Balancer is attached to a **Private Network** in a **VPC**. It distributes user traffic to multiple **Instances** which are also attached to the Private Network, and do not have their own public/flexible IP addresses. These Instances are accessible only from within the VPC. The Instances can store data to and retrieve data from **Block Storage** and a **Managed Database** attached to the same Private Network and not exposed to the internet. @@ -89,8 +91,42 @@ Follow the steps below to create this infrastructure using the [Scaleway console ## Terraform -A Terraform template for this architecture is provided in full on our [Terraform Scaleway Provider pages](TODO-LINK). Terraform allows you to create Infrastructure as Code (IaC) to build, configure and manage your infrastructure with configuration files, rather than with the Scaleway console. The following snippet shows an extract of the configuration file: +Terraform templates for this architecture are provided in full on our [Scaleway Terraform Examples repo](https://github.com/scaleway/terraform-examples/tree/main/demo-vpc-app/). Terraform allows you to create Infrastructure as Code (IaC) to build, configure and manage your infrastructure with configuration files, rather than with the Scaleway console. + +The templates include an example "Task Tracker" application to show how the infrastructure is used. The application is containerized using Docker, deployed on an Instance in the Private Network and leverages PostgreSQL for data storage. Full instructions are provided for creating the infrastructure with Terraform and deploying the test application. + +The following snippet shows an extract of the configuration file: ``` -SNIPPET -``` \ No newline at end of file +resource "scaleway_vpc" "vpc01" { + name = "vpc_${var.app_name}" +} + +resource "scaleway_vpc_private_network" "pn01" { + name = "pn_${var.app_name}" + vpc_id = scaleway_vpc.vpc01.id + ipv4_subnet { + subnet = local.subnet + } +} + +resource "scaleway_vpc_public_gateway_ip" "gwip01" { +} + +resource "scaleway_vpc_public_gateway" "pgw01" { + type = "VPC-GW-S" + name = "pgw_${var.app_name}" + ip_id = scaleway_vpc_public_gateway_ip.gwip01.id + bastion_enabled = true + bastion_port = 61000 +} + +resource "scaleway_ipam_ip" "vpcgw_ip" { + address = cidrhost(local.subnet, 2) + source { + private_network_id = scaleway_vpc_private_network.pn01.id + } +} +``` + +[See the full Terraform templates](https://github.com/scaleway/terraform-examples/tree/main/demo-vpc-app/) \ No newline at end of file From c7e0c5fa2cef7889707b9b95b3474ea2a42bc153 Mon Sep 17 00:00:00 2001 From: Rowena Date: Fri, 20 Dec 2024 15:07:31 +0100 Subject: [PATCH 07/13] fix(vpc): corrections --- network/vpc/index.mdx | 1 - network/vpc/reference-content/use-case-basic.mdx | 9 +-------- 2 files changed, 1 insertion(+), 9 deletions(-) diff --git a/network/vpc/index.mdx b/network/vpc/index.mdx index 2dfa8ca66e..df8420ec0c 100644 --- a/network/vpc/index.mdx +++ b/network/vpc/index.mdx @@ -9,7 +9,6 @@ meta: title="VPC Basic Use Case" > Read our [Basic VPC use case](/network/vpc/reference-content/use-case-basic/) documentation for full details of how to create a simple infrastructure that leverages the advantages of Private Networks, including accompanying Terraform templates. - diff --git a/network/vpc/reference-content/use-case-basic.mdx b/network/vpc/reference-content/use-case-basic.mdx index 9311b8c18d..782a129cbc 100644 --- a/network/vpc/reference-content/use-case-basic.mdx +++ b/network/vpc/reference-content/use-case-basic.mdx @@ -95,7 +95,7 @@ Terraform templates for this architecture are provided in full on our [Scaleway The templates include an example "Task Tracker" application to show how the infrastructure is used. The application is containerized using Docker, deployed on an Instance in the Private Network and leverages PostgreSQL for data storage. Full instructions are provided for creating the infrastructure with Terraform and deploying the test application. -The following snippet shows an extract of the configuration file: +The following snippet shows an extract of one of the templates: ``` resource "scaleway_vpc" "vpc01" { @@ -120,13 +120,6 @@ resource "scaleway_vpc_public_gateway" "pgw01" { bastion_enabled = true bastion_port = 61000 } - -resource "scaleway_ipam_ip" "vpcgw_ip" { - address = cidrhost(local.subnet, 2) - source { - private_network_id = scaleway_vpc_private_network.pn01.id - } -} ``` [See the full Terraform templates](https://github.com/scaleway/terraform-examples/tree/main/demo-vpc-app/) \ No newline at end of file From 61897876fc0b8fe9bf783bd3534f0c14cadde5ee Mon Sep 17 00:00:00 2001 From: Rowena Jones <36301604+RoRoJ@users.noreply.github.com> Date: Fri, 20 Dec 2024 15:56:27 +0100 Subject: [PATCH 08/13] Apply suggestions from code review Co-authored-by: ldecarvalho-doc <82805470+ldecarvalho-doc@users.noreply.github.com> --- network/vpc/reference-content/use-case-basic.mdx | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/network/vpc/reference-content/use-case-basic.mdx b/network/vpc/reference-content/use-case-basic.mdx index 782a129cbc..47c6f042d4 100644 --- a/network/vpc/reference-content/use-case-basic.mdx +++ b/network/vpc/reference-content/use-case-basic.mdx @@ -23,7 +23,7 @@ This is the first in a series of use cases designed to show you potentially inte The architecture diagram below shows the infrastructure for this use-case. - + This is a basic infrastructure to leverage VPC isolation: @@ -59,14 +59,14 @@ The Public Gateway, with its public IP address, allows controlled access between ### Cost control -Creating Scaleway resources without their own public IP addresses saves money, as these addresses are a billed resource, while the creation, configuration and assignment of IP addresses from a Private Network is free of charge. +Creating Scaleway resources without their own public IP addresses saves money, as these addresses are billed resource, while the creation, configuration and assignment of IP addresses from a Private Network is free of charge. ## Applications This kind of infrastructure is appropriate for many applications, including but not limited to: -- **E-commerce platforms**: A scalable backend (Instances, Block Storage), which can securely connect to payment systems and privately-accessed user data (Managed Database), with public-facing components (Load Balancer) for appropriately handing user traffic. +- **E-commerce platforms**: A scalable backend (Instances, Block Storage), which can securely connect to payment systems and privately-accessed user data (Managed Database), with public-facing components (Load Balancer) for appropriately handling user traffic. - **Web applications**: Web applications that routinely need to handle high traffic are ideally suited to the solution of a Load Balancer in front of a horizontally scalable set of Instances, to facilitate uptime and high availability and grow with demand. -- **Enterprise applications**: Enterprises handling sensitive data (e.g. HR systems) can benefit from the isolation and security of a VPC, with all of its additional features, to keep internal services running without unneccessary exposure to the internet. +- **Enterprise applications**: Enterprises handling sensitive data (e.g. HR systems) can benefit from the isolation and security of a VPC, with all of its additional features, to keep internal services running without unnecessary exposure to the internet. ## Tutorial @@ -83,7 +83,7 @@ Follow the steps below to create this infrastructure using the [Scaleway console If you are creating several Instances with the exact same configuration running the exact same template, consider creating just one Instance, configuring and installing it to communicate with the other resources inside and outside the VPC as required, then [creating an image](/compute/instances/how-to/create-a-backup/) of this Instance and creating the remaining Instances [using this image](/compute/instances/how-to/create-a-backup/#how-to-create-or-restore-an-instance-from-an-image). -9. [Attach each Instance to the Private Network](/compute/instances/how-to/use-private-networks/#how-to-attach-instances-to-an-existing-private-network) you created at step 2. Either let Scaleway automatically choose an IP from the Private Network's subnet for each Instance, or used [reserved IPs](s/network/ipam/how-to/reserve-ip/) to specify the IP for each Instance on the network. +9. [Attach each Instance to the Private Network](/compute/instances/how-to/use-private-networks/#how-to-attach-instances-to-an-existing-private-network) you created at step 2. Either let Scaleway automatically choose an IP from the Private Network's subnet for each Instance, or use [reserved IPs](s/network/ipam/how-to/reserve-ip/) to specify the IP for each Instance on the network. 10. [Create a Load Balancer](/network/load-balancer/how-to/create-load-balancer/), ensuring you assign a public (flexible) IP address. Do not yet create the frontends and backends. 11. [Attach the Load Balancer to the Private Network](/network/load-balancer/how-to/use-with-private-network/#how-to-attach-a-private-network-to-your-load-balancer). As before, you can use an auto-selected IP, or a specific reserved IP from the subnet. 12. [Create a frontend and backend for the Load Balancer](/network/load-balancer/how-to/create-frontends-backends/). Choose the most appropriate configuration for your purpose and application, following advice and tips in the linked documentation. When configuring the Load Balancer's backend servers, enter the private IP addresses of the Instances on the Private Network. From 70c91b2aedfc5e8aa2b17db3a9ac9f7418a4c17a Mon Sep 17 00:00:00 2001 From: Rowena Jones <36301604+RoRoJ@users.noreply.github.com> Date: Fri, 20 Dec 2024 15:56:41 +0100 Subject: [PATCH 09/13] Update network/vpc/reference-content/use-case-basic.mdx --- network/vpc/reference-content/use-case-basic.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/network/vpc/reference-content/use-case-basic.mdx b/network/vpc/reference-content/use-case-basic.mdx index 47c6f042d4..047d04bf22 100644 --- a/network/vpc/reference-content/use-case-basic.mdx +++ b/network/vpc/reference-content/use-case-basic.mdx @@ -51,7 +51,7 @@ Resources are isolated within a VPC, and public IP exposure is restricted to Loa Use of the Load Balancer to distribute traffic across multiple Instances enhances reliability. If the Load Balancer's built-in health checks register that one Instance is down, it is able to immediately redirect traffic to the remaining healthy Instances only, ensuring high availability. Additional Instances can be spun up and added to the Load Balancer's backend at any time, facilitating on-demand scalability. -External services like Transactional Email, Serverless, and NATS, Queues, Topics, and Events are also highly scalable, flexibily facilitating event-driven architectures and asynchronous processing. +External services like Transactional Email, Serverless, and NATS, Queues, Topics, and Events are also highly scalable, flexibly facilitating event-driven architectures and asynchronous processing. ### Controlled access From 88f5d6d4d2de6b5c9d9f06c14a6449a0e727cb21 Mon Sep 17 00:00:00 2001 From: Rowena Jones <36301604+RoRoJ@users.noreply.github.com> Date: Mon, 30 Dec 2024 10:26:07 +0100 Subject: [PATCH 10/13] Update network/vpc/reference-content/use-case-basic.mdx --- network/vpc/reference-content/use-case-basic.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/network/vpc/reference-content/use-case-basic.mdx b/network/vpc/reference-content/use-case-basic.mdx index 047d04bf22..2eac094e8a 100644 --- a/network/vpc/reference-content/use-case-basic.mdx +++ b/network/vpc/reference-content/use-case-basic.mdx @@ -23,7 +23,7 @@ This is the first in a series of use cases designed to show you potentially inte The architecture diagram below shows the infrastructure for this use-case. - + This is a basic infrastructure to leverage VPC isolation: From d1b86b6f7553fbe8161545d7d21dbe9cf3e5ce08 Mon Sep 17 00:00:00 2001 From: Rowena Jones <36301604+RoRoJ@users.noreply.github.com> Date: Mon, 30 Dec 2024 10:26:30 +0100 Subject: [PATCH 11/13] Apply suggestions from code review Co-authored-by: nerda-codes <87707325+nerda-codes@users.noreply.github.com> --- network/vpc/reference-content/use-case-basic.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/network/vpc/reference-content/use-case-basic.mdx b/network/vpc/reference-content/use-case-basic.mdx index 2eac094e8a..437ab9286c 100644 --- a/network/vpc/reference-content/use-case-basic.mdx +++ b/network/vpc/reference-content/use-case-basic.mdx @@ -59,7 +59,7 @@ The Public Gateway, with its public IP address, allows controlled access between ### Cost control -Creating Scaleway resources without their own public IP addresses saves money, as these addresses are billed resource, while the creation, configuration and assignment of IP addresses from a Private Network is free of charge. +Creating Scaleway resources without their own public IP addresses saves money, as these addresses are billed resources, while the creation, configuration and assignment of IP addresses from a Private Network is free of charge. ## Applications @@ -73,10 +73,10 @@ This kind of infrastructure is appropriate for many applications, including but Follow the steps below to create this infrastructure using the [Scaleway console](https://console.scaleway.com/organization): 1. [Create a VPC](/network/vpc/how-to/create-vpc/) (or use the [default VPC](/network/vpc/how-to/create-vpc/#how-to-identify-your-default-vpcs) pre-created for each Scaleway Project in the appropriate [region](/network/vpc/concepts/#region-and-availability-zone)). -2. [Create a Private Network](/network/vpc/how-to/create-private-network/) inside the VPC. You can either let Scaleway create the network with an auto-generate subnet, which will provide the private IP addresses for attached resources, or specify a self-defined subnet. +2. [Create a Private Network](/network/vpc/how-to/create-private-network/) inside the VPC. You can either let Scaleway create the network with an auto-generated subnet, which will provide the private IP addresses for attached resources, or specify a self-defined subnet. 3. [Create a Public Gateway](/network/public-gateways/how-to/create-a-public-gateway/) (set it to advertise the [default route](/network/public-gateways/concepts/#default-route)) and [attach it to the Private Network](/network/public-gateways/how-to/configure-a-public-gateway/#how-to-attach-a-public-gateway-to-a-private-network). 4. [Set up SSH bastion](/network/public-gateways/how-to/use-ssh-bastion/) on the Public Gateway, to allow administrator access. -5. [Create a Managed Database](/managed-databases/postgresql-and-mysql/how-to/create-a-database/) +5. [Create a Managed Database](/managed-databases/postgresql-and-mysql/how-to/create-a-database/). 6. [Detach the Managed Database's public endpoint](/managed-databases/postgresql-and-mysql/how-to/remove-public-endpoint/) and [attach it to the Private Network](/managed-databases/postgresql-and-mysql/how-to/connect-database-private-network/) you created in step 2. 7. Create and configure external services as required, e.g. [Object Storage](/storage/object/quickstart/), [Transactional Email](/managed-services/transactional-email/quickstart/) and [Secret Manager](/identity-and-access-management/secret-manager/quickstart/). 8. [Create your Instances](/compute/instances/how-to/create-an-instance/), using the configuration best-suited to your application. Do not assign public IPv4 or IPv6 addresses to the Instances. Add Block Storage volumes as required (or you can create and attach these [later](/storage/block/quickstart/).) From 875437a574cfb5aafa48fc64db9cf301038d048f Mon Sep 17 00:00:00 2001 From: Rowena Date: Thu, 16 Jan 2025 14:18:39 +0100 Subject: [PATCH 12/13] fix(add TF link) --- network/vpc/reference-content/use-case-basic.mdx | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/network/vpc/reference-content/use-case-basic.mdx b/network/vpc/reference-content/use-case-basic.mdx index 437ab9286c..ecb6a9ee43 100644 --- a/network/vpc/reference-content/use-case-basic.mdx +++ b/network/vpc/reference-content/use-case-basic.mdx @@ -7,8 +7,8 @@ content: paragraph: Learn how to set up a basic infrastructure using VPC isolation for secure cloud environments. Step-by-step guidance on leveraging VPCs for optimal network isolation. tags: vpc private-network connectivity best-practice use-case infrastructure-diagram dates: - validation: 2024-10-25 - posted: 2024-10-25 + validation: 2025-01-16 + posted: 2025-01-16 categories: - network --- @@ -17,7 +17,9 @@ Scaleway **V**irtual **P**rivate **N**etwork (VPC) and the accompanying range of Knowing how to create, combine and configure resources such as Private Networks with definable subnets, VPC routing with custom routes, IPAM to define and manage your IP addresses, and resources such as Load Balancers and Public Gateways to facilitate connectivity and traffic distribution, is invaluable in achieving control over your networking environment. -This is the first in a series of use cases designed to show you potentially interesting and useful infrastructures, illustrating how to use VPC and other network products to achieve a robust, secure and scalable cloud environment. +This is the first in a series of use cases designed to show you potentially interesting and useful infrastructures, illustrating how to use VPC and other network products to achieve a robust, secure and scalable cloud environment. + +[Terraform templates](https://github.com/scaleway/terraform-examples/tree/main/demo-vpc-app) accompany each use case. ## Overview From 2262738442dd0c13709f4ab99119c397f39c1fa2 Mon Sep 17 00:00:00 2001 From: Rowena Jones <36301604+RoRoJ@users.noreply.github.com> Date: Thu, 16 Jan 2025 14:31:30 +0100 Subject: [PATCH 13/13] Update network/vpc/reference-content/use-case-basic.mdx --- network/vpc/reference-content/use-case-basic.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/network/vpc/reference-content/use-case-basic.mdx b/network/vpc/reference-content/use-case-basic.mdx index ecb6a9ee43..658c19c616 100644 --- a/network/vpc/reference-content/use-case-basic.mdx +++ b/network/vpc/reference-content/use-case-basic.mdx @@ -25,7 +25,7 @@ This is the first in a series of use cases designed to show you potentially inte The architecture diagram below shows the infrastructure for this use-case. - + This is a basic infrastructure to leverage VPC isolation: