From 101c4a6d45f6f216422ca07f7835187e77dee6a4 Mon Sep 17 00:00:00 2001 From: Dominic Reich Date: Fri, 26 Jan 2024 11:16:40 +0000 Subject: [PATCH] update obsd note (certbot) --- content/notes/openbsd/index.md | 91 ++++++++++++++++++++- content/notes/openbsd/mod-status-certs.png | Bin 0 -> 20373 bytes 2 files changed, 89 insertions(+), 2 deletions(-) create mode 100644 content/notes/openbsd/mod-status-certs.png diff --git a/content/notes/openbsd/index.md b/content/notes/openbsd/index.md index 89e40eb..318ce29 100644 --- a/content/notes/openbsd/index.md +++ b/content/notes/openbsd/index.md @@ -1,7 +1,7 @@ --- -title: OpenBSD notes +title: OpenBSD date: 2023-11-29T20:33:48+0100 -lastmod: 2024-01-22T22:02:30+0000 +lastmod: 2024-01-26T11:16:40+0000 tags: - openbsd - python @@ -10,6 +10,9 @@ tags: - git - rust - neovim + - apache2 + - mod_md + - certbot #showDate: false showReadingTime: false @@ -27,6 +30,90 @@ These are random notes -- more or less about OpenBSD. Some may not fit here well, but they could relate to OpenBSD or similar operating systems in some way... +## Apache with wildcard certificates + +I often got errors when I clicked a link on my main website for example +to the weather page. It was complaining about different +SNI because both hosts used different +certificates and I wasn't sure how I could fix that easily. I thought wildcard +certs could fix that because I'd only have one cert for all the domains. + +~~~console +$ doas pkg_add certbot +~~~ + +Run and follow instructions: + +~~~console +$ doas certbot certonly --manual --preferred-challenges dns \ + --server https://acme-v02.api.letsencrypt.org/directory \ + --manual-public-ip-logging-ok -d '*.oe7drt.com' -d oe7drt.com + +[...] +Successfully received certificate. +Certificate is saved at: /etc/letsencrypt/live/oe7drt.com/fullchain.pem +Key is saved at: /etc/letsencrypt/live/oe7drt.com/privkey.pem +This certificate expires on 2024-04-25. +These files will be updated when the certificate renews. + +NEXT STEPS: +- This certificate will not be renewed automatically. Autorenewal of --manual + certificates requires the use of an authentication hook script (--manual-auth-hook) + but one was not provided. To renew this certificate, repeat this same certbot + command before the certificate's expiry date. + +- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +If you like Certbot, please consider supporting our work by: + * Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate + * Donating to EFF: https://eff.org/donate-le +- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +~~~ + +Also adding my .net domain to the certs: + +~~~console +$ doas certbot certonly --manual --manual-public-ip-logging-ok \ + --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory \ + -d "*.oe7drt.com" -d "*.oe7drt.net" -d oe7drt.com -d oe7drt.net +~~~ + +Some changes to the apache2 configuration was made: + +~~~apache + + MDMember *.oe7drt.com + MDMember *.oe7drt.net + MDCertificateFile /etc/letsencrypt/live/oe7drt.com/fullchain.pem + MDCertificateKeyFile /etc/letsencrypt/live/oe7drt.com/privkey.pem + + +MDChallengeDns01 /etc/apache2/dns/dns-challenge.phar -- +MDCertificateAgreement accepted +MDContactEmail dominic@mm.st +MDCAChallenges dns-01 +~~~ + +It seems Apache likes this: + +![cropped output of apaches status website /md-status](./mod-status-certs.png) + +This is **currently testing** because I have no idea if mod_md will update these certs +itself or if I should run certbot again when it's needed. In the meantime I monitor my +website with [UptimeKuma](https://github.com/louislam/uptime-kuma) which alerts me on +expiring certificates. + +The binary (`dns-challenge.phar`) that actually does the DNS Challenge is taken from +[kategray/dns-challenge-cloudflare](https://github.com/kategray/dns-challenge-cloudflare). + +An **easier way** to obtain wildcard certificates would be the use of **Cloudflares proxy**. +They would also create another wildcard cert of another issuer in case the first one +would get compromised so they would actually replace your main cert with a backup cert +just with a whoooop. + +Certbot commands have been taken from +[this article by nabbisen](https://dev.to/nabbisen/let-s-encrypt-wildcard-certificate-with-certbot-plo) +at dev.to. + ## Get some filesystem information ~~~console diff --git a/content/notes/openbsd/mod-status-certs.png b/content/notes/openbsd/mod-status-certs.png new file mode 100644 index 0000000000000000000000000000000000000000..96d4a01a1f15a2ee1911a5006dcfc7a94e7bacfe GIT binary patch literal 20373 zcmb@tbx>SO_bzA-F?ucXtN2L4z~MU;zdQ?(QDkAvg@q;5PW+ zT;B8k?)T5F`s%Ct?*3!%uIjE{y?b@7UTZziiukT5h53&3-CuwGg()K~uJYGkC_XQ3 z^SA%JynWK`yZ`!2Nl!*xM9mX+oZ+R1x$^wGRTrtDqjoKBo&sXFtr4g3p@QYr#o?oA z=cv_)tB5DteL~A#N&E6C8&a23H?MDbH#XYd=rDpgaq*Bz-;sqpyoD=IFY{WC`;OoH zj`Of z4nX|krPk$As@J=RwFDYF znRev-a3idLj!FNsngD<;bPt&j+QO8A%-&R4bg*y=ENXEwv@_h>YLQMpog6PkR4=sv zlYflb&GIyp1lID!Rik*r`Zc)c`eNxZ_+*~k;No)dIqc*dOeZ{2dL7?+b&qdZY&(|h z&AwzpfQ&$O8j!}@_&GEGrac>n9p`KNm3tmx3-qhwp#7=!2Uz${|Im}`bWg9*B%|&Kst(8-18UNM{K_UaHqzGQ zjqhN9OM{wVyU5M0aF|O&J@2+BTA63k%0o1+mw zp2dSIJlcrO*MOuI1=7?9$_8$~3JNUz33yE&ztnfyM*db#rOb6tA7f)}&@14u3W(V@ z?!r}K;|e9zuOXe1iR@g@mNOjtRQqTEr^i)Qw%Sgg#`1={5`EQe_-&Lq3AG-#_j~yF z=>Mj)fTBuEYz>c_iGCT&VMG%i;jI~baAp{`v49@Yr@xkl@H2O6gp%NJSZBPJ2ok5P zqYb%XcIT<6pee?YOkaMSc&&@wR|sJcoamK|ir5}mty(BgJV~G_Jt|~)@dI62!WjyE<)a??hv!Tus(wGzkj!+0*4LlVeH93y z>K{@R&Y6!FoplB2=ni*CjDZ*tqX`;7<$+ zIg!u0sB;q2|GSCL6~G*~vM|MVpcvH<*$+RF!=_62F<^KxEq+ZkFvl?V(3nsLqU~8t z%2D`0&DX>`+3#(+esOm6Syf`0$2|GRJZ|JZ@4FN#*s1={4r6-Vudzxfhabj!@FTpe zaZr$r24oa2tm!ZgTw#c@)9VRgXUN=j@7J(0JHPZXpH7c288jmM$I;|rhSfsk_W_HA z9l&X1bax}yWdEJndAJ-pVHR9GDh5X*T&bk8mBo*VUk5)YHtA=c6=_J}8*Ofl2KsoK z+dd|K!8e^IxS;MpyB`<(Y3UJXp;6k)Ey>Xr*$I+N{Skz(iHD1#s6qyY%N9Po0&R~zVYvOyn6p^8>F zh;KoVKv?(qzSO{>Ra8}0Sy9HjZiINq`)~XMJkt|x0sn#K*xlRkN7=H?IBn0I#Iiqz z9u?Wy8&G9^hMS$NdbBJorGBMvHl63M**uo-_!KuzfDd^dee^e4@k}r{ZJb6{fIn;* zXwzgkLSkq-M@FyR2Z)(oP@;++C{&X+EsseHWPN}CtnThHBtQJewtnH~^{KojGkUuy*D$K5UYRT65N(`i>AI~t5q{i=5@SkDu-QGB zDBK)h?h@9_Q1Mut^Up#H@O;$=T!7<9X#Vy(s!_Ucu^GeU?}DcxgaS4$F}=jB&_))g z;z{k8xQG?C!0LILe%u17t<8(3-Vx1n2VMZ(b~<&`OB%I3h3o+T+Tisy?(vqEbK4Pq zTr#6U=UTDI8{rq#j?PQ%xE98LZl7Cbl8T=Qqmy~613K6C$lpoF4`vW$v4|g(OiWmY zE54{Pr*T{@Mg0%dw%Sflv*qD0xM}5?2XRu^7&YKXT9I#N@A0C|DP*! zs%chjfn`0=m#WBZM;sTKP;0k;cm0VA&IuJM!=W*QEWDZ7(?7-RAM&T9*KzKD|NOU% zgZ8Uh5eENZ9_`7O>vPibm49Dv38S3>HN4Er!>>IvbEVmm^5Pu5Lxa;yO_(y3N?{af z>(jZLPH|3qJ#$qCdv#CIG%KUH)%g!OvjAVxxc|NK2m)RP+R3Js8s(qB7`BEelqm>T z>rK#RzhiE1(u%KyevL(CVQ2LB-Z5dkppUMl>|m^=6W%35rpy7Ivm8mJX#slR3q_*j z)`lBhg4%l0Qtt6Hzs0vYPrSQ6F+U?qnvKn!Sjje0X!}faJ{0@W{?|+U{oD$qqI{&o za`OIM_rV}-z=>31Oej#>F|W`9FQGcm{bEA%y)cjcH=3!zi~>hAtcAMos_~tI%U|}C zE!-Xr-1a3>PBX+juPa2#em0Iqd|=cz7}>D;gOw1Uak{cX2{r9 zaV@6vd3^&;Ke1|-QguVpIoykxh9R2oJ+as%Y?L+Pn_*s9cPd(i1~l)`*Xi`67Hs5w0~tw zB5X!|sS?+)KYWWKqnK99Wyr_htF$lg1QLW$FZ9SVi}A1YJ}&*1`-$9qTb(Qmf-s{P|}o)kFFjs{bAeef`hYj#yyw= z=5?rg;zl-h%`V&SM&2XLjvjL`g?fk)68HHWC57BSs+79&WB;_L-NZFUi(N`rEqAEp z+eBh!uXRhlVt*-;{g~jC8(L`1)Q9rMUgzW2QUgZS>D6AeEaQl}8Oq{G84<;5IpoO! z^-kGY)Dw+Kk=2l?|Hu$1F@K+({7#`BQ>MIkZQz!D!Rq6uC0v@~%mj_Ff+#bYRPp>l z=|%*{%9Y07h3nTlG8qiL*~g(e`a`~C7UlV)mBb;FhYo&EPF=3=fsDBI14oZa!@#q# z)?ITxH?4{5sh8R18w5O`$^5)4Zb(gMv$wI^Es&~-$@@H3tE=}9>V?c2_=g2!KP0Y8 zlUX=846DC;jNWYDQ}_m(L;rh|ko7P27kQJL0K_vzv)_G8cuSk0>)C;*I&fD zYoRGP0*$TExy-sdHR@r;@CM3n`AXP9w}$^t@E7ZNr;>V8ynwdF-Q)zO>a3O5W=r78 zPS#K`n$iCr;s2MzQ+vCGY8W|GO(-?GI0UrHqsvy?cSQQ5?bRiAJDStzGEc4X=hz_gdno z=LyZ>5dk4Xh3uue$4XwOrKgX7YVIlcG8kyk&~Vk=_WJ}x_&3e<*E;MxeQXNP03t)? zpJ%3@0np{W6}nJ4du|7JAgf`E-B`iwbaZg%+cZ>uL05nAjaZcLvv|)vK=n?!`1m${ ze#_EHY4N&a9v~PQLbRBVt?gk%=Z{sLpWv-L_3S4o--&&5d5I!K z-D#QNP`ylx^ibFjSkaNK#Ej+D;_7uIofQH88Us5%s}XM#2=gB|*d5S-RNq(<(etCr zNo7?H8rhBn*g33bj3w}!WGRrfTwo$tGCQuv&QNWBn#Z+j4OHneS)DcaC3tk~G+d^) zc8D-6H~e{5idcyD2(Nq`%9TLyABHqKG+rM>i3xuyuRF8gZUjp;8;%2=Datelk`gLB zpr5Ic7pSJ{?;=)Ro~j#1pC_2g+Z}SGAs_40eRlY71}G(GAFm#ZJSSu!)7PFF`fGC( zt$Ss10e|;D3zQ|6i2*euLhge7I@*(;aXgiT^-y0{d~!dM{L$N_fKvmFoH@6TC~tqv{$BYc z1)PxHR?U*+2<>~26+cHQH0Bb6%(#NipZB55-EXp==r@IH4+DfTXy*OB>HFNxmU)Y9 zm@3}B_G)X)i~o&PA#C=au^tn%#cwR#3*xMV_cAA^?w9%* z;%N6eQ-CJ1-(V*=5E^+3HI2363V)q{QkGWmv-;MBJjlNPyLXWN+^a%T`uo1|c&#k) z{o~8H+0Pr7f4ok=DZ|a^7T}AVve?=8j{t?1t53cQZQk%QvC>roVQ(6NE6P-clIVJb z0(CsiOO#GTAX`T>C2uNV43!9+e(C@k7(R)?x7rtZF%p<-rZ%H!sc7K@l8aanx_JDh zARtwsJN6lNcIM(HbU;~Wngduq6N(R@=`=AUB4{ZkCdJ>-mCOL@v#L2WlL3>)vG}yNbu9M*o zGw|PGr=M4Mv8=%I0wY)3mOsxob0jbDmUHQ{Th_>|TfRCGU*a5pi67qq^3+os_PY;N z{Dd`>XYz{qte1j zENo@+H%b}iI1fC2_u}S96GdVTohJS1Z1ch98H*s1Ug&&XFYhRyPv+&+7aX{f6FXxzNs zc!UQt(_gA+?D5%b54m=a{W;(50!$Aaq&im3kuB)AD|PxkzGlX>p5cjG4k*6KQoXnL zhS3;DZt0`PFp82zPaofTNv(8{Z}DU4IDO2QWj&RoQrG!Kev&qUDk9IE8^)e*S?cs1YW3r}I zm)>=t1qZi$DV(I1ya)Yhq+v{Mjla>u;ye=KQm{+9_x;Zd=&Hd(DPG=p{BD%wx>WrS=8Px=@QMakZ3oiA4QJa zc|JC8`3wW`#;$wpa?hWp2OhIt;=b#Z*^CIt)yhrc$cO-+ScH5QZot)5nRr+x{*X|E z2OG*R=#*5UhZeXIxTm=v4*(V6(lCJc73nG3{j2ObGsJT+*OK~6;T1tNnc1$i(Yfu`0`ui{57JB=O_z%eR#6DL+PgbI6)6E{}00 z*63Tni8S#=jBtCbzJgAkB6=mruS+LsnwVAxScWLsVZu-;6F-M$=-dEXaRKYhFG0|` z@xv|LPk_&7yz2w&I6!t=pNxyK`d7TTGBMA@mFuu(S3-<0OxOT7s;Rs8FaFgAehJx; zdvc|?9%>IA677hU4gC41rVupA=eA${aSW)ca9TnoSYUGTv)TsFu-#>2Z~Gp50H7bE- z@ed$mJ8bC(U7-}e&E{jI+z_%>I%2-{MY}lFgy?Tt@_CS?vu6nz#?eQjg-RsPyYQ%L1fi;xPsmGm^ z^3lW$B>*I8%^tMz-VMJ(k0AC{5U)qwUehh?E)}u{<7u7%z)=%Edep}hhgWw| zeUM06nW<0Z^(*yev1C(}8qIjap)sYd^Cqeb`*G!I8RZh+7s*p0)U9(R*11;4x zf*Kf9~_Ec@R0`|8QU`{rT)El=-#_)^E`{5!4VB)zdzz;M7F$9 z$wF+9Sq|NXM4IVP5{lEWyxFcMMDU?wh{CP2x7*m zN#XMl5}cebG;uef>E@K#jM>}60l0rxqbN<+z{xL{PJf`e z6Uz|ix0WYP%KN7=S{WNe&+zgf51E3CsRlQGY}WKYXTDo0zxHn`Lyu+Q)l>@j(%r%v z1L{Kzf1`p;s36DOinyIR{m^N1w{lW?`#mf@O>LYJGt@^;#8`zfr{1sAujzxtll@1J zzZKUwWFg{{AKBlkqv^UyO1V;)5`0D!=a0_k>9R>4z5ADUYJNv-d$ppn-|g@{oo^Q+N?Ck&09=Z51k@zi zK$AwsnQs)7gz2kAqH;a+6|p6DYD>(d^mEBr3XpCB8+}}K28`-O-)CX&JpW!E-q=%5 zsaK~dm4cFgoZc+R+r2GoZ~FdD>47E62mnxgqW&a34u?CHfj|Eg-@FP`0}ZhZgK&UW z7ip;=nzI9E-%}L0?|RYdDbqTVOHsh64SR;39iPVAQGccQ>w_D#3~?J0l6sciN}dwa z*C_ff&CnE1qe5n89<{WP>RH)<-9_1vx}Z81F>oQUP|LqKlNJjWGm@1FGBq?I%aUbr`(FQ}&Se>*@})Jt)qiFsYT&Yd0ro`gciNRn^`!JW6PsFrhl&lL*=N?Fmsd z-lO|$9$APLAv>vyfJx^m>^J;u$WSUxYqa@biuW+-Q%KP7s5!!2B7!zB7R*7|G5iCe z$aZq01$3`*okT0UIv#|NWBIK0V%s>W3uJW+ z`yK2#XF>h*T7!R95d#Ej=_R!wu{rA=}w9%F+SrHMX?`lS+G%AjL+fkyxGB}_`{4lD}N3%@H5zdt_fx)rphL4&b=83v$Fk4B@r!!owRc$Y`Vs9zltffINn znl3oGa{h*x6@D0hLVz%sF%2U-PeN&?vtzYAi@)>8oggySG&`0)JkM;3>k0W8L8YJK z8MO4#?l*#;z^y4K1=VOIGUx@cf!vi zpkqpvWJ@QZmvM+ZKEUyeQFPnB+6)!$-tzQBFfg6zS~iOozUkl*Y1+vfBc_MAXla@* zt89{vUESekDw6MAV^ne}wvl%@K|6;J3&D7{)qtDaWrrCWIQayRo3J_5Q^*ZfgWRl7 zhGPtw*APf?^5P#IEG6ro{e8U^tQ9uiW*hP-#)=n%dadn>hHKjWWVf{&jdzRBN3Tc-vK22QH;dlXY;sVsJ^z;_f&l%z- zMxTgU51Gm6&z?x0E@|AV?wK4+;bjVM`9fGi&4_xv4&3tNV9f0>!k~8vS@hYiwYXn< zMdiMd7!%6wgFCq+SSbIK?Vnqjy*Z$L?T^RLGQArM;#YCoyz_(n+;`=QvVr6?$qBhI zBt`JI-9mof1eCrO2NsX6+1SlTQe*tGwKjwvqxGR9xxZ~=SH_PZ6SMq|f3 z;sfMEBQ|A}S|;rr@EX{)rq&fx-<70pvC+rawa=ixOVQ+Wzixur7U5por1w4WZSrq9 zW~xjUzjJ&;rxC+}hXXzO+2f|uPE zhZd+Eq%sZq_<7K55J`n56+WZCk=`m?-2Hy#n;qK|?U#+%oyW(1d|?uKB!k1~qP0=0 zKeX2?<>`mU1yzGIGBeg3XPHgX|KaaaRQImiU21q=c<6~}ADB9ucdj|~U+0YsMf~~M zCU~$491+oqm4vWi3^Tyrt_{e1adW^2q{eb%#nHqkVTxTeZx8X;ok8*3{v_}E8}(Fz z$XPYjA>yirxR($7Ye!mMXiud(A)_BFYJ6+VOT*51&SSH0gaVaI*auOHxWmEwI z=Unc#)y+Zh2^ zQ3OlHp>gOumWH4u;l%kEK36>o-f3U{7FN{Pb&o_x6kLeu3PNvX14sGXFb{_@$KI7& z5XUR{1X+7=`Y1+2LjG*mCfs5lf*_-2Qds_Q#>jstvp4>DW-b9fxo7(7zx%#}<1&q8a1my{w&oA86MqaNF1G<~4ebT-gb1CweV96IZ(!iulNN4;0= zQ`HO45MxWHcS}h?l<=CaG!p^&2N>%QS)BqAJ(qh5c&DhkH2p@0WZI5OEc+65ahd3% zt7hVh;J8n)9}nWfzIK|AcUx)u!RlLi+dfvhuiDGR7d^<`Fg0{wtu6Ldf3j+Nk;)8a zJWD0O6GP4sixt@(Ui2}$4Cs971UKiJ4}A({=p+j_`G9+TyvCf~(Q{5o#a(fw9}DVY z42WKv0(8FMZ;|32*>2Ia!Yt}ZIgy5?oSeKbFm*2fnj+4*d)}&aaK!znuytqQ@55@- zE5dZ03inuP>{@8k@6q8&`&#%piRxHPXN5I&eSn`}`}YCrauNUdHYNZy{}5vl7RNH~ zExU7hL7Uw!4pVHWx69;@oAFOI=ZP!8h(JtZj{4XB*(y!&89#Cu12TQvc@(tzk-1%h zX;g#KQ|s|f1DV0lMXhd%63L8yb3#9>eR(yX93Vr6d4T3&g?9w!UG!?GLl-hC9A|f6 z=?%9$Lee*dLZ$}U9UL1ux%Nv2JvyNRUe%)|r{64=B{NqzWeaTgYD#}u0>tc@fQV9p z7u;v~OAJC`;eU7$7G)8fAA$M?uc6;kV7a`S;nfEa!{+V{MD!uRPbUP)OLA(WlB z8~)q+_RqH4kCer4n#!O5Uf!Izo&Am(@Y&GNMbThW<9GVbbKaYbzRf3p63Z+5kqR?3 z9BJ2#9&iUI1%vko6G2f~XXx6%+FT#czjTEB#9vtMN(AL>WO(m%iLJN7f{vp$f~aS8K# z7Uelfu^7{u)El1#=9%hu_j6^95+jDMwD&I$X(|^?w{rA7&Uvn~1)f(=)OX0-eGotc zIPP7+oz%emv%bbJgT}ti&H%Dm~s_n~n9#IQZ zgIgFryONb5a5I&eR5o>!8SzEtzmYXuxaD&EGJLn`Zdh}0QrqOQH@Q9v_1|p0VO(qL zG{G^O8M6!-pAEpA3?$1znOi+g1C5$FUCLn%ep|}fB3W{lW&ph_{k6#P-6dNm(xAFK zoq%|B=%a()8TB0LbXvx$yk=`!Ppt9-%X^xyKM2 zxy|<_>2y(1iqhp$7&+sz;uEve9J}|l@z^WuMsp-tfSxoPyG+Ps~;Z=l5Ay0?g{S@`rl&@SrUtw*ClwsG<3~)5CahUV4{e0-v%~ z`#jxSJ>nsB00%NQ=2JKbIxET;l|at=XMSN%{dR)eC^6$C>s+!;=-hygujs^upYfak zY~>aNI=b)|et6nbc~CzregkE_dkpoe3_Qdu(c$gLED3AvXHsol3`fsyE6e3*QMv>Td^-4J z*>+I2Zubf~*s5C&LJ+Yw&uVLGVw(+42(FkoPT4?<{m7e&It$Js>L}$+9u(kP+ii+? zXjIFZC)9OFKvwbQvSA@zKhI=jVtY%*oxQw6&&#H@`#t7wz~YyCRJphXYzQSh_kAQI zITUwV;TP)sX)87_W0E^Tw0unrtxb8z;lYv}eYaB#HhnIg54-HLK&a!~8VB~7TS&6d zd1Gd$=i^x%Na(49F!ZAQ0axzNT6>$n`7b2>TuFFH24?k$_OY?EQyplaX)5#{7mCz2t^#Zo(IC%l@9~9@fDA zA)k8Fq8TF(V}vpxz);c4+Oxgl6KV=~Gb#c~#oW&mA3NZYfvaen-A6>opz2ehK-EpX zd)q)V5@bj?S2xAZlNB6xPg?1FKRtcC{805ay{pl%&IIa6>G1t(33p*nuB&tnbbsww znSFDX{}iv5$LhwfZYTd#9Bf*q%P~$LL>Sh;lq9!b^-6B;{nmPKP3E;;;OF!A2sU9$ z=ra9yI|D@ZpC6P1UeS-~e1DERr9EetS6Y#QRkO9KD`9{3rh_|vxee}8x709RMaaIy zr20z={Ap3){2d*t;fou-CTrd9FLX-4YDHnh^4>D`RQp zC}q!T%(Vrwa>={-0yo-3OM%Ktz1^10S2QZyTN|5n?w*cwtB{S1TIhqS2+ zIN*mU2SizrHA`*39qwTc$G%+Xn4L6Bo5L@S<5oxzlzy5dd7P(1J4{Y;vyKWr%xuqG z0xXWJ<-+@inEeQ<*Zi)V>WOfDG49>eYNJQPFEUF-l1NRqTE^%PRN<`=8tv^>wr~JT z<=9BUKCi*BSyU@v>u`Fy^-CePKJF=vbJ$Q_*Gl3&i(snq*~!uC+HQmNz`Yese#Hy{n+Z7G(p5)g;Eqiu6HDS(3 znF?ei>b&y#Wny7#Yi(Z{5HI=IUoVu(P^Xyb=my4O&6b@G21Av^J4Z`JVJ2R;6T^k+ zs}&BJ2K=K}uFS!P=SzlTOI2fs4L7$ZTCJ|v516~twx|4$JCU&&T}7#x)z$Z3uBu_m z>D$OQ0ea`9NbOv2R}w4NO_1ES{asUYK!~k1FNXM`{Ta`P4eOn0I$Ru(Ca`=}IRj9XH6nGLTB{dy0AcLZ`Q_ z{VLeJmG0!~wE$?fBq4CyYn+%L3j)t5k)Qg$CsB==0SX&RzaSMEPCLc{x4E2(BmG0( zXS^tmui7eQSjM%&>@P-T`Q3f)d#MTexJ`Z#L?-)3T*$Qe-pK5gM6C)f<_j3?M|o&w zu=w0q2qIg|xNo+ax6ajKtCAS+^_GRUk~dPGw&yZ1`5F_1)!RBRKmXZVF1F>JFH>B? z5ZE+Ij8h5VY@HDfENMK_C$nvDvq@1Xb#D7%#NDxu<}*=JLUIBv8dE3(5@%UwpI~<8{cot9uk* zZ-r-z3-pVO^AA&biu;jA@)lXMgKtrPh!%Rr$J*`rE@1f=i=6ZD?uo#P3fI}%_&h{}lYY4y53|h9!FNxH5D-EjDG>&Q=j)7hM z!>?^V3ezT|T$gi=oA|jttjG`JDID=>^%)I64vJ?-z}X%}m@07~;l6yF5rLKPty%p1 zkgq+jR7alVO+*JRQl=4JZ62Aq#30?_7sSJ3G7T>d{G4-_EJ370nPT=;hr*QG=;xs- z6{)k(hqRJkoYe1GxDf5TpJh^w=XR$Vl`roJ;EI=-s@#TS7RJFR7wAbamX_}@*8|3j zLDwsQ~e08+2(d zF?a=Ge(1V`h66))$-tEkVRf6+;a>}Hh&;-KAu3UXl=G&a>*Ef-355{HxPMh7GLCs!XtcgKr*WG%V7|CQp8&QXuz$U()(FWyxM}W zyihSwg^Y!kZtq%@ge0GIgQuI*^}wbwr)i<%f!hvveb;%;T7_=3z8_lFxp-#=ATDX9 zJ2FbYR|PENN22GqX}u(Eon)SJ7BK2pWe{AzX*>;%9p$4zEVybf`h{j9Bb(gXl)_xi z)a*>OI&B3X#E|3(AJ@=8<%l^GRG!WvYKelZ%;KdaB~<45!Ub=KYM#zCGG?^YzK_uf z(i{%6W^V=LLVOQOKRH^F1BeZR2klKLm2k z6^C<=(^*DUE6-}BOZ(yuGmiK_^RPQzY-Y>iLuTT@NGAU=p2?g);V8Qiw8r&Wv9Z^+ zOKDLa;>H{OD5w!)mxs12k72wwZfESiC&I=JFZjYX@+a3M+Jod66INEkgg7_frwnja zWaS>BQBNsPv8ivKNFPIqTJe(II^$p?fLLSkzD}&?I&~sK!5d1poAmQ%$XxZgqRs7M zGrC4qwTUTKMzJ`K!*+r=y?Un`R`GswS;^(RU+#747r%(BiJX+XHvzsTWHF@?w8={r zC#88KY9WNV64poN`f^EiHsdtTVu1NfzgWSFQRQetXQ&m9?e$L`KWgu`@@v`h-#pfg zNlR2Xbdf>}-#-=WB>c9vfm)&Y(6zhP5mgEe=6k9AAyzMxeGUcY)Mp{=(`Pba+QOd` zcpOLcg%M-p*>�V@mBM>uiQT(H5?pogs}i$*x6wuo5y5hJSKOMq9D4*w0s6`98W{ z`SlPJDd$Hwm=bocDAjIu!fW-_EpN~tOMQJ<3~cEZt#KP3;lG{XvFc5RzWwE_KSH7+ z)fHw{iR><2&-cP8WV4trwI@d&g0gtU3Vi5No_c+?#h@ZWdhEnO-D%KA@w4;IamfPB?2s<+ z8dAlpu4=08JZkVC*SgD@qr1$%hOWs5zE^|sFgyh%r7>5|(&o)_UTkQ~C*O+@b>S`B zG3KZW&`!(yd{>X36{1~cB6ai8c!~QcH+Hd0HKEuY}9rlxfpFUI=kEv)_oNdGC+!mbO zs%x&nh&=mh@aJs}c(#g}d2RY=KiDYbF39C!DQb&6qlEP=z$l60F5md?538D!ZijE8 z-9A+B1R`TF{OCh@eFDDbjvV+L@tsVAAJq$Ct$6d*lU3MBveAsa>2Flxvkd#;?Z_#L zU@mt9FF!xjsn;Vf)jw>4We7AKVGj7*V(X%v?_@~b=_(GUwFSQn72g>H<}aD zvVtk49uEo> z=EG@JZC~)q@wiDVYBPeTV38#Q=Tw%5xf3OG+}%eR_?J#&HrI_s-@L`kbGOnbSB8up z-a!^(`o_JZJX8KgfwnsAdzML`2cg`vh}7l&{?vq;{Q0whL1$mw&y|ttvoPcxtiHtu} zlQbJ)d7R8Na#X<{e56X&cBqY_P zWmI2iUDb5b$p;@K4|FFAQIa5#q^D;8m)w$m9U*fXo2-8Ih*s^&E~N8qMQg)$1tnR4 zg5}#c?ob|Gg8n?Q=C`mKtZLl(5;jRM+@9wWCu%QPRfgj!sq94q|IbBPNIJ61^4zL% zOULi~-hve~9R+QXe!1zwixM2s1vZ*E0=3?(L;_7rctliGcAXx@KR>_m{7frEyPNq; z7qu8%m7R?t+_P}-TbE{h#(*Q4nu#QI=OX;gC->uzEi+aVoF@~c^vLZ75lD`#7G8&V zGN2o-o|7x-L3TEB_rgwrbB1h&d*G;uMGWs8>Ob-+9#yenOsZAz{0FH&{za#SHFMfS zd{_a&-0efzP~-FG5~GHXUS%yCK^26RJ%8j~LQe1AkIGaXDjrq?HpViQozYn|q70wh zoMS@!#z;k4E{ZDDJX&9MrAo{JbJmm&IAE1+U3Y>1md_j)ya7r0@4%{BepCK@4Ueuq znKFXDlzmz5W!XLa!w8&BBCFN|o;GN-#2%0p9Jq*~4(o!s0^F}ss9XN3*bi$kq4>!+ ziyY|YSieB6p^E*DeWbS)&}%9M?*zoM*ypv~>=mwruk3>dcxH)+WT)L?33I4OB@*<# zlVs|GUc-Hx-M$9{g;xJWu@&^Gb9IUcKA0lOV`VNWZXndYLw^F%j-8eWG_z`$ ziL3GSG}jbQ-CeP2RrPS!m2GA_-ie15pfqOdgS;#*sbzFHu)_tLJ@ftuJ;==S19$zH zU4vrTWy_P_eFnJUB-e1d?T%u>tp(S72fBKb+zAeJgi66*z1h^Bq6i$I{N$eqqzaGK zSiJmLxBvL@N9BAdC7C68q_|e%^pH793OmBz+L)aF-a)}qa(lAdf_EHY2lC$6a?E>@ z%tLg!Knq8nO=37IIgQ)tG72n6m4y!{eCD0!m7*06!Kzm5(0k^?_x~xHd`;m!>A0&o zmdgIa(~4)p9roIfkOeBeY8_=RHKpy={Zq+)t!gkohM-zL8Rn5Y_!K8OP&QFjk_g%>81$@g@G_StM(WG3D|G451QX?Nh=&0DIUl2I?RDqmbA$j- z%#6~8O>gxc<^;8(3IAtQcrTN#%|b>0zB_O}RM7W@qhV4~`u;F6DOoD~>L4wh@ZgUA z)dbZY=3xM-#l@4z#kcd=J?Y}|)`?pQIKCVi1B)L@zBdmI;H&0XzQmN8g0T>pQZIs1 zNt3gE=xL;Xaqe&9hd}+m|aSTp3BM z$9T@rE4+wYd#YnACyNI2^y+9|*xw^IjLqf5^oX&7+>vONkw27V^qDYMEY8e3R_d>8 zTi)frc)4Ee?cosJRRWR0vv&W`b~E-@vWBRE`;q>LXRLOFrr@`R!~z}A&h!MSC3(u> zRAF5fQ{^fyh2!T!WI2J>f?=AvWyf+kt(bpI-! z5V}ckr8WOBnKZk6{&{@tI`1YTIxQt^-iLN}!Yr5eg|o`GlUe+pO(Hb9YyZw_>Bh60 zEM2f5@ui}bfMPzE`{9Bu?7lZ2yFH8b`jnr@d(DDB1Gp5&_FIS|_MrQ(KUR55G+#HA z@3&4*n z8PEsZ#jEE_GI|-xMx{S*&Jfc=XZ;K{ne`p(O59hu^;u+$ZK_s_2|p7fS?Dbrb1{q7 zbVALJr;|4huPRCC*@P96(mfQlV#{=Q$obR6)e?V<$0vVifD;r7ZFoM)m$AOjrnTI? z;_OgaBb1#OP0GIZ01aESj(5E1WzJ4p;SIXwj>-07;+F?rq^aJ6l*P!rhBmUaKO(aD zt456+rH)jt+|^L{!B%Yw8AUy8PyK-7pTk{w?MCLR*T!C@vU#NdB1Z~S5WAPKC50BH z&0JuC1Ci#lP8Z}S2lu%r^Ze|@ml|8@ZS&QJJ#qEwCI-9D(#j@B=`ie7Q`-Hj=@z%; zEih=?@_z*_4bt)k7oz{XasGk#o%#06_MHKzPMwQPDPRdEmRhb)u9%-Q#TMt6C<~p< zkXz0lWpbap4g4A7Y$()E8z-+IYS*^Q^_w%%^3rmo^wJWgh5-Zb&8}fm!-R?K7LMm} z*(@PdvGzS==ASEPvANBM1-#cghG2cIFiBB$WvOC^rQxLrmtB7XW?sNF8BMpR)oczA zZ8`0cxNq}`H^NQ>ttu;T(vxAWtN+5V=C4#}**LkGAurM^KL!liXXp00zC~2tfBUSE zn5rIdoBygKBsVuLhgdg|^X|}CzYV_le)Jais@HM9C!YCS+p=+DS`oHXJuLF0@GqFf zZ=TkmEgNSYFYV!mo&g&c#6GF-3K|}`bA3=r1fiC@{+5js5vxP^Zf~hx)90-4`@qAOH_54wooanv+^a;`nPFS^MAyFw zhg)7&#mhaS+fL0YOiBas9b`G&$d1}dZ zUVNUvaplXI`F#vdVBs72=s!i4qBw5DrIf7fH+K)Nu{&Ac#UMEcbu`w*HuM!pcEB__ zYWGE_GO(Z3yz!YVOYLoUyQqeTFG^(e6v=O(MS)Wp?H6Ax<9^M~sm2PldHJeiFY$#Q zZ@sl-$O@xvgYTxKKD@Zi#tVNnKxN|k0n)wJ+#`YsFKhplerDJ4$rQBs#7u^~&^SLG zm_YBe>JGbJX*HahzRd{94xZIPPWMnIQMDDftp-fk`WuO%Kl#S;;7|vx0?kBCasZXDiq0{b9Y~P@bdYc!wyd8ur@5_+K6SJ8Vup$ zU%bDfPdLDD^Q`O3NstL%?2ukW#Pxz@02x%TdAbzRZ7 z_*ci%`1hLYJ$tUy&UYkE@X8jBCcq-SS7xv<%CXM8!@xUPO2MUaLz(^ksM zeCXU?lG164>$&*nFB48W+XcMlU`^}V3RS7$+ny8MGBd?(r?{VsEzYmyk7I1QO7?SzFGFgx zZ@N$ILQ}Q5S0lcpO$x<*wS5Q!U$n|U7rqi(_h_?ax@bwPoAJ8S51#RPnsj-W$7L*9 z)F!(P?Xi^DkXFZf={{1;_%c68i#c9I>#&|uM(q1Ik%F`HRYvVdWf1}Y!VtLiT&wEW_=Quzs5bkS>CHUe#IdR`^?%pQR6)59ZsY?QPvCR zQ#*r8cy)~~wd(i(TAk9!Y86Up&$-Mi4|vb-upFG&c<;mGd5$XUxsEH+r?aLq$`)Tl zxnGf-Dl~C#^-6Cpb~CuC%$0k1{KM|7DxZ1;Uzd5?qKrO)#qY(~H>;KCg4LOgjkAvX zo;A5!RRHl0PToh>)E-qwvl=B?f9`#p3HGWK$#KGo0;Di}nJR_abH$ZHL|oTTEXo#+ z8QF1bx-p35o#J%}$v!YaO2P09v2XP2sX21W##dVYY6D*06^CVRSDpx-+vK>@+kB$S z>(H{>R=xV!6MKd0Dq?K=4{(U9Xytg(6*3Xa_lly-ER;l@GjC;NRM&cJ@YWr(`jjqkto26*IalCRm^ zCAQo5`S01dIV4r^{&?P(IFALxRTbJPX-r%dn9}e(Be{ol)f%#*{GWYG^jtJTRjE_I z$t%5mZ6{4K-gNZNi{wk|wdKjQek%j-eGt6z7s(A<-djm+lBNHnGAttdPEze_b)C3g z?DKXn9Nt|)uCwNB*XzRVPn^#;w;LH4J9_Ltw9{pKcm^IttFz;M=XRw~2UwndR#=*O zXXkWfGPTc&;3xSdA8u`#tU#6?<8k1Ea9pBI+qh%KttIj{$=q%Vd0?f2EI&{#`UcBv~i@w$Z$Ndp0&!TqdbtY4~ z8+u2+u74ZMZHFPsDr1a2?-udCU$^S3I@y=M3BD%%^ctPM9pw~zjx#$V+$Pr2wV~fq z&)W}Ykd>$Jx|2~_^z4+y02;ad06`p;Mw_Eu!~0W)@u#-sz;jZz^s@6Xv!>Dx(3b)>c;Q(MPOavj=zm}?Rft#}u{W{4zq;XChUeb0^GuB%9< z_BTKC8Y`@z^s@3@hZ=6V@rl#4u72W`B8}QiTPUya^JZywkylU|vDhkMQhTC6w^|ko*Mf`p%P1_lr z@e|(y*XHWsAG`19mrKjK(}>l=SnUuky8)Wg>L zQP&cyc^_W*&AxQx;OoS&C!xF3^VxM(Z!;pSf{nWQEZ4qxaQ&U2jdzYZT;Dn6h_UMN zGtarDPm?`|_!{X%C%mqydiOS9;=aWLFJ69#Pq|m8zBoK5$h_}ihsCi;Snr84b8f_M z>FaAW@z&j>(wfGzM}>jcj>T~58X4z-b<1uAY)-u3850`%g+JXcdZ~ZJ_c)^Ir)zZj zmdPoWk27N>m*R=fSC?wF^w!BE>Eq1x8`r zS=JnUB(j|J=Zq6ANxkAZuO|g-oYgz?A7l? zrVX?__592CH)qWHQOQcWJK}QLt>{oesJ&Z)V6Vsb@C}<|T6_;fX{^%_=|*4mM!`qz zd~^JG)peD<$3EZfHkPheGMPU*{^yJnznmwBY^^qV`*}K9+8%sF$O&2z=Qd77uEX$U z?uUYo9=(uU+;W1WwK&816uHG{(W=d!`}eupxtx7lBla#x)BykhwCQfHBIVeg;Cqi^ zqpqAkbLvE(pW9-cwb3l77~sDFsf=+>OcU|128isk2XoWOq#7$*P#ZQ3`# zN0<&aZ}b)?UV7l+yG*E>KY&GDeSVk!u&ZU|f6dCQE{=;kco@$F)&HvAI9vbo-(D9a zO8>S0FyoZ&Sbe#qwT~9cDR)CZFitQ|004l$3$aSHyP;ofMoBG)SyA{l=ESZY=ijlR zW`KWr>{FYt;=tmrJ|@$W(i^`-h4muIN%g?q%S@1-e+q6E=XfA15c@BflOb-iKZ3-C z5XS_vqSB%6!8ic`0RCo2U-|m1%L48GJ-cfRnJ|0Brr-yK9H