diff options
| -rw-r--r-- | .github/workflows/upload.yml | 32 | ||||
| -rw-r--r-- | README.md | 33 | ||||
| -rw-r--r-- | auth.html | 122 | ||||
| -rw-r--r-- | bitcoin.html | 4 | ||||
| -rw-r--r-- | certbot.html | 8 | ||||
| -rw-r--r-- | cron.html | 174 | ||||
| -rw-r--r-- | dns.html | 2 | ||||
| -rw-r--r-- | gemini.html | 103 | ||||
| -rw-r--r-- | git.html | 190 | ||||
| -rw-r--r-- | gitea.html | 109 | ||||
| -rw-r--r-- | index.html | 31 | ||||
| -rw-r--r-- | irc.html | 801 | ||||
| -rw-r--r-- | maintenance.html | 2 | ||||
| -rw-r--r-- | monero.html | 2 | ||||
| -rw-r--r-- | nextcloud.html | 212 | ||||
| -rw-r--r-- | nginx.html | 9 | ||||
| -rw-r--r-- | pix/auth.svg | 1461 | ||||
| -rw-r--r-- | pix/gitea-push-create.png | bin | 0 -> 6546 bytes | |||
| -rw-r--r-- | pix/gitea.svg | 31 | ||||
| -rw-r--r-- | pix/irc.svg | 57 | ||||
| -rw-r--r-- | pix/irc/hexchat-connection-complete.png | bin | 0 -> 44139 bytes | |||
| -rw-r--r-- | pix/irc/hexchat-network-edit.png | bin | 0 -> 55960 bytes | |||
| -rw-r--r-- | pix/irc/hexchat-network-select.png | bin | 0 -> 40520 bytes | |||
| -rw-r--r-- | pix/irc/hexchat-sasl.png | bin | 0 -> 59369 bytes | |||
| -rw-r--r-- | pix/irc/textual-identity.png | bin | 0 -> 45779 bytes | |||
| -rw-r--r-- | pix/irc/textual-network-edit.png | bin | 0 -> 49037 bytes | |||
| -rw-r--r-- | pix/nextcloud.svg | 1 | ||||
| -rw-r--r-- | pix/tor.svg | 41 | ||||
| -rw-r--r-- | rss.xml | 1317 | ||||
| -rw-r--r-- | sshkeys.html | 24 | ||||
| -rw-r--r-- | style.css | 7 | ||||
| -rw-r--r-- | tor.html | 97 | ||||
| -rw-r--r-- | ufw.html | 193 |
33 files changed, 5029 insertions, 34 deletions
diff --git a/.github/workflows/upload.yml b/.github/workflows/upload.yml new file mode 100644 index 0000000..a6c9260 --- /dev/null +++ b/.github/workflows/upload.yml @@ -0,0 +1,32 @@ +name: CI + +# Controls when the action will run. +on: + # Triggers the workflow on push to master (including merged PRs) + push: + branches: [ master ] + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "build" + update: + # The type of runner that the job will run on + runs-on: ubuntu-latest + + # Steps represent a sequence of tasks that will be executed as part of the job + steps: + - name: Updating website. + uses: appleboy/ssh-action@master + with: + host: landchad.net + username: chad + key: ${{ secrets.chad_ssh }} + passphrase: ${{ secrets.chad_pass }} + port: 22 + script: | + cd landchad + git stash + git pull --force origin master @@ -5,3 +5,36 @@ A site dedicated to turn web peasants into Internet LandChads. Simple step-by-step text and image-based tutorials for creating websites, email servers, chat servers, server administration and everything else. Suggestions welcome. + +## Submission guidelines + +- follow the general style of pre-existing articles +- use the root user (i.e. no `sudo`) unless there is a specific need. +- do not preface commands with `$` or `#` or anything. +- use `.svg` files for icons/logos and for illustrative images, keep filesize low +- Use `example.org` +- custom command/file info should be highlighted with `<strong>` tags + +### On `<pre>` tags + + +In-line code should be in `<code>` tags, while codeblocks should be in a `<code>` tag *inside* of a `<pre>` tag. +`<pre>` allows formatting preserving whitespace. +That said, do *not* format `<pre>` tags as following: + +``` +<pre><code> + echo "Here is a command." + echo "Here is another." +</code></pre> +``` + +but do it like this: + +``` +<pre><code>echo "Here is a command." +echo "Here is another."</code></pre> +``` + +**All** whitespace, including tabbing in and initial and final newlines are displayed by `<pre>`. +To maintain consistency and avoid goofy-looking extra lines, add no extra whitespace. diff --git a/auth.html b/auth.html new file mode 100644 index 0000000..6c30d7f --- /dev/null +++ b/auth.html @@ -0,0 +1,122 @@ +<!DOCTYPE html> +<html lang=en> + <head> + <title>Requiring Passwords for Webpages (HTTP Authentication) – LandChad.net</title> + <meta charset="utf-8"/> + <link rel="shortcut icon" href="favicon.ico" type="image/x-icon" /> + <link rel='stylesheet' type='text/css' href='style.css'> + <meta name="viewport" content="width=device-width, initial-scale=1"> + <link rel='alternate' type='application/rss+xml' title='Land Chad RSS' href='/rss.xml'> + </head> +<body> + <header><h1>Requiring Passwords for Webpages</h1></header> + <nav></nav> + <main> + <img class=titleimg src="pix/auth.svg" alt="access control with nginx"/> + <p>HTTP basic authentication will allow you to secure parts (or all) of your website with a username and password without the trouble of PHP or Javascript. + This will work with any Nginx server. + </p> + + <h2>Installation</h2> + <p>We will be using the command <code>htpasswd</code> to make username and password pairs.</p> + <pre><code>apt install apache2-utils</code></pre> + <aside> + <p>The apache utils has a small username-password pair encryption tool.</p> + <p>Like the other on this site, this tutorial is for Nginx, <strong>not</strong> for Apache servers.</p> + </aside> + + <p> + Now think of a username and password and remember them. + </p> + + <pre><code>htpasswd -c /etc/nginx/<strong>myusers</strong> <strong>username</strong></code></pre> + <aside> + <p>The <code>-c</code> flag creates a file. You can make the path of this file anywhere outside of your webroot.</p> + <p>Obviously the username is up to you as well.</p> + </aside> + <p> + Type out your password twice to confirm. You can do this as many times as you'd like. + </p> + <p>Check out user name password pairs (the password will be securely hashed):</p> + <pre><code>cat /etc/nginx/<strong>myusers</strong></code></pre> + + <h2>Nginx Config and Auth Basic</h2> + <p> + From here, we are going to edit our websites config file in <code>/etc/nginx/sites-enabled</code>. + Have in mind which folder you'd like to secure. Add something like this: + </p> + + <pre><code>server { + #... + location /<strong>secret-folder </strong> { + auth_basic "What's the Password?" ; + auth_basic_user_file /etc/nginx/<strong>myusers</strong> ; + } + #... +}</code></pre> + <aside> + <h4>Huh?</h4> + <p>If you're stuck, try finding the line <code>location / {</code></p> + <p>Just below this block is where you should add the custom location block</p> + </aside> + + <p>If you'd like to do the opposite, such as making the entire site private except for a public section, do this:</p> + <pre><code>server { + #... + auth_basic "What's the Password?" ; + auth_basic_user_file /etc/nginx/<strong>myusers</strong> ; + location /<strong>public</strong>/ { + #... + auth_basic off ; + } + #... +}</code></pre> + <h3>IP Addresses</h3> + <p>If passwords aren't enough we can ban an ip or accept one.</p> + <pre><code>location /api { + #... + allow 192.168.1.23:8080 ; + deny 127.0.0.1 ; +}</code></pre> + <p>If you want to check both a username and password with an ip address, use the <code>satisfy</code> directive.</p> + <pre><code>location /api { + #... + satify all ; + + allow 192.168.1.23:8080 ; + deny 127.0.0.1 ; + + auth_basic "What's the Password?" ; + auth_basic_user_file /etc/nginx/<strong>myusers</strong> ; +}</code></pre> + <h3>Complete Example</h3> + <pre><code>http { + server { + listen 80; + root /var/www/website ; + + #... + location /<strong>secret-folder</strong> { + satisfy all ; + + allow 192.168.1.3/24; + deny 127.0.0.1 ; + + auth_basic "What's the Password?" ; + auth_basic_user_file /etc/nginx/<strong>myusers</strong> ; + } + } +}</code></pre> + + <p> + Now check your configuration with <code>nginx -t</code> + </p> + + <p>Reload nginx and you're good to go!</p> + + <strong>Contributor</strong> - <a href="https://tomfasano.xyz" target="_blank">tomfasano.xyz</a> + + </main> + <footer><a href="https://landchad.net">LandChad.net</a></br>Because Everyone should be an Internet LandChad.</br><li><a href="index.html"><img src="pix/chad.gif" alt="chad"></a></li><li><a href="rss.xml"><img src="pix/rss.svg" alt="RSS"></a></li><li><a href="pix/btc.png"><img src="pix/btc.svg" alt="BTC"></a></li><li><a href="pix/xmr.png"><img src="pix/xmr.svg" alt="XMR"></a></li><li><a href="https://github.com/lukesmithxyz/landchad"><img src="pix/git.svg" alt="Github"></a></footer> +</body> +</html> diff --git a/bitcoin.html b/bitcoin.html index ce3206b..ec41f23 100644 --- a/bitcoin.html +++ b/bitcoin.html @@ -46,10 +46,10 @@ <p> <strong>These words are your money.</strong> Once you are shown them, <strong>immediately</strong> write them down on physical paper, and you will be storing this somewhere it will not be lost or found. - You can memorize these tweleve words if you trust your memory. + You can memorize these twelve words if you trust your memory. </p> <p> - These tweleve words unlock all of the funds/addresses you will have on this wallet. + These twelve words unlock all of the funds/addresses you will have on this wallet. Whoever has your seed has the ability to spend your money. </p> <p>Note obviously that I have included a picture of a seed phrase above in this tutorial. diff --git a/certbot.html b/certbot.html index dded807..cabf6cd 100644 --- a/certbot.html +++ b/certbot.html @@ -97,7 +97,7 @@ ufw allow 443</code></pre> <p> Of course, you don't want to have to remember to log in to renew them every three months, so it's easy to tell the server to automatically run this command. - We will use a cronjob for this. Run the following command: + We will use a <a href="cron.html">cronjob</a> for this. Run the following command: </p> <pre><code>crontab -e</code></pre> @@ -110,7 +110,7 @@ ufw allow 443</code></pre> </aside> <p> - This <code>crontab</code> command will open up a file for editting. + This <code>crontab</code> command will open up a file for editing. A crontab is a list of commands that your operating system will run automatically at certain times. We are going to tell it to automatically try to renew our certificates every month so we never have to. </p> @@ -125,6 +125,10 @@ ufw allow 443</code></pre> Save the file and exit to activate this cronjob. </p> + <p> + For more on cron and crontabs please <a href="cron.html">click here!</a> + </p> + <span class=next><a href="html.html">Next: Use HTML to Make Simple Webpages</a></span> </main> <footer><a href="https://landchad.net">LandChad.net</a></br>Because Everyone should be an Internet LandChad.</br><li><a href="index.html"><img src="pix/chad.gif" alt="chad"></a></li><li><a href="rss.xml"><img src="pix/rss.svg" alt="RSS"></a></li><li><a href="pix/btc.png"><img src="pix/btc.svg" alt="BTC"></a></li><li><a href="pix/xmr.png"><img src="pix/xmr.svg" alt="XMR"></a></li><li><a href="https://github.com/lukesmithxyz/landchad"><img src="pix/git.svg" alt="Github"></a></footer> diff --git a/cron.html b/cron.html new file mode 100644 index 0000000..3f61f23 --- /dev/null +++ b/cron.html @@ -0,0 +1,174 @@ +<!DOCTYPE html> +<html lang=en> + <head> + <title>Cronjobs – LandChad.net</title> + <meta charset="utf-8"/> + <link rel="shortcut icon" href="favicon.ico" type="image/x-icon" /> + <link rel='stylesheet' type='text/css' href='style.css'> + <meta name="viewport" content="width=device-width, initial-scale=1"> + <link rel='alternate' type='application/rss+xml' title='Land Chad RSS' href='/rss.xml'> + </head> +<body> + <header><h1>Using Cronjobs to run scheduled tasks</h1></header> + <nav></nav> + <main> + <p> + Cron is a service that lets you run scheduled tasks. These tasks are called <strong> cronjobs. </strong> If you have already followed the initial course you will have already used cron when you set up certbot. + </p> + <h2> What tasks would I want to schedule? </h2> + <p> + You can schedule anything! Some examples of what you might have done already include: + <ul> + <li> <code> updatedb </code> to update your <code> locate </code> database </li> + <li> <code> certbot </code> to update renewing of your https certs </li> + </ul> + Some tasks that you might <em>want</em> to schedule may include: + <ul> + <li> Package updates - if you really just want to leave your server alone you can automated updating packages on your server </li> + <li> Backups - you may want to backup certain files every day and some every week, this is possible with cron </li> + </ul> + <p> + And many more, anything you can do can be turned into a cronjob. + </p> + + <h2>Basic Cronjobs</h2> + + <p> + This the preferred method for personal tasks and scripts, it's also the easiest to get started with. Run the command <code> crontab -e </code> to access your users crontab + </p> + + <p> + Once you have figured out the command you want to run you need to figure out how often you want to run it and when. I am going to schedule my system updates once a week on at 3:30 AM on a Monday. + </p> + <p> + We now have to convert this time (Every Monday at 3:30 AM) into a cron time. Cron uses a simple but effective way of scheduling when to run things. + </p> + <p> + Crontab expressions look like this <code> * * * * * command-to-run </code> + The five elements before the command tell when the command is supposed to be run automatically. + <p> + So for our Monday at 3:30AM job we would do the following: + <p> + <pre><code> .---------------- minute (0 - 59) + | .------------- hour (0 - 23) + | | .---------- day of month (1 - 31) + | | | .------- month (1 - 12 + | | | | .---- day of week (0 - 6) + | | | | | + * * * * * +30 3 * * 1 apt -y update && apt -y upgrade</code></pre> + + <h3>Some notes</h3> + <ul> + <li>On the day of the week option, Sunday is 0 and counting up from there, Saturday will be 6.</li> + <li><code>*</code> designates "everything". Our command above has a <code>*</code> in the day of month and month columns. This means it will run regardless of the day of the month or month.</li> + <li>The hour option uses 24 hour time. 3 = 3AM, while use 15 for 3PM.</li> + </ul> + + <h3>More examples</h3> + <p> + Let's add another job, our backup job (for the purposes of this our backup command is just called <code> backup</code>) We want to run <code> backup </code> Every evening at 11PM, once we work out the timings for this we can add the to the same file as the above by running <code> crontab -e </code> This would mean our full crontab would look like this: + <pre><code>0 23 * * * backup</code></pre> + + <h3>Consecutive times</h3> + + <p> + Suppose we want a command to run every weekday. + We know we can put <code>1</code> (Monday), but we can also use <code>1-5</code> + to signify from day 1 (Monday) to day 5 (Friday). + </p> + + <pre><code>0 6 * * 1-5 echo "Wakey, wakey, wagie!" >> /home/wagie/alarm</code></pre> + + <p>The above <code>echo</code> command runs every Monday through Friday at 6:00AM.</p> + + <h3>Non-consecutive times</h3> + + <p> + We can also randomly specify non-consecutive arguments with a comma. + Suppose you have a script you want to run at the midday of the 1st, 15th, and 20th day of every month. + You can specify that my putting <code>1,15,20</code> for the day of the month argument: + </p> + + <pre><code>0 12 1,15,20 * * /usr/bin/pay_bills_script</code></pre> + + <h3>"Every X minutes/days/months"</h3> + + <p>We can also easily run a command very several minutes or months, without specifying the specific times: + </p> + + <pre><code>*/15 * * * * updatedb</code></pre> + + <p> + This cronjob will run the <code>updatedb</code> command every 15 minutes. + </p> + + <h3>Beware of this Rookie Mistake Though...</h3> + + <p> + Suppose you want to run a script once every other month. + You might be <em>tempted</em> write this: + </p> + + <pre><code>* * * */2 *</code></pre> + + <p> + That might <em>feel right</em>, but this script <em>will be running once every minute during that every other month</em>. + You should specify the first two arguments, because with <code>*</code> it will be running every minute and hour! + </p> + + <pre><code>0 0 1 */2 *</code></pre> + + <p>This makes the command run <em>only</em> at 0:00 (12:00AM) on the first day of every two months, which is what we really want.</p> + + <p> + Consult the website <a href="https://crontab.guru">crontab.guru</a> for an intuitive and interactive tester of cronjobs. + </p> + + <h2>User vs. Root Cronjobs</h2> + + <p> + It is important to note that user accounts all have different cronjobs. + If you have a user account <code>chad</code> and edit his crontab with <code>crontab -e</code>, + the commands you add will be run as the <code>chad</code> user, not <code>root</code> or anyone else. + </p> + + <p> + Bear in mind that if you need root access to run a particular command, + you will usually want to add it as root. + </p> + + <h2>System-wide cron directories</h2> + + <p> + <code>crontab -e</code> is the typical interface for adding cronjobs, but it's important to at least know that system-wide jobs are often stored in the file directory. + Some programs which need cronjobs will automatically install them in the following way. + </p> + + <p> + Run the command <code> ls /etc/cron* </code> you should see a list of directories and there contents. The directories should be something like the below + <ul> + <li> /etc/cron.d <em> This is a crontab like the ones that you create with </em> <code> crontab -e </code> </li> + <li> /etc/cron.hourly </li> + <li> /etc/cron.daily </li> + <li> /etc/cron.weekly </li> + <li> /etc/cron.monthly </li> + </ul> + + <p> + The directories cron.{hourly,daily,weekly,monthly} are where you can put <strong> scripts </strong> to run at those times. You don't put normal cron entries here. I prefer to use these directories for system wide jobs that don't relate to an individual user. + </p> + + <h2>Contribution</h2> + + <ul> + <li>Mark McNally -- <a href="https://mark.mcnally.je">website</a>, <a href="https://www.youtube.com/channel/UCMiInY8BhSUtCarO6uu6i_g">Youtube</a></li> + <li>Edits and examples by Luke</li> + </ul> + + + + </main> + <footer><a href="https://landchad.net">LandChad.net</a></br>Because Everyone should be an Internet LandChad.</br><li><a href="index.html"><img src="pix/chad.gif" alt="chad"></a></li><li><a href="rss.xml"><img src="pix/rss.svg" alt="RSS"></a></li><li><a href="pix/btc.png"><img src="pix/btc.svg" alt="BTC"></a></li><li><a href="pix/xmr.png"><img src="pix/xmr.svg" alt="XMR"></a></li><li><a href="https://github.com/lukesmithxyz/landchad"><img src="pix/git.svg" alt="Github"></a></footer> +</body> +</html> @@ -115,7 +115,7 @@ <img src="pix/dns-ping.png" alt="Pinging landchad.net"> <p> - As you can see, our ping to <code>landchad.net</code> is now being directed to <code>104.238.126.105</code>. + As you can see, our ping to <code>landchad.net</code> is now being directed to <code>104.238.128.105</code>. That means we have successfully set up our DNS records! You can also run the command <code>host</code> if you have it, which will list both IPv4 and IPv6 addresses for a domain name. </p> diff --git a/gemini.html b/gemini.html new file mode 100644 index 0000000..aa6d83e --- /dev/null +++ b/gemini.html @@ -0,0 +1,103 @@ +<!DOCTYPE html> +<html lang=en> + <head> + <title>How to set up your own gemini server</title> + <meta charset="utf-8"/> + <link rel="shortcut icon" href="favicon.ico" type="image/x-icon" /> + <link rel='stylesheet' type='text/css' href='style.css'> + <meta name="viewport" content="width=device-width, initial-scale=1"> + <link rel='alternate' type='application/rss+xml' title='Land Chad RSS' href='/rss.xml'> + </head> +<body> + <header><h1> Creating and serving gemini capsules </h1></header> + <nav></nav> + <main> + <h2 id="whatis">What is Gemini?</h2> + <p><a href="https://gemini.circumlunar.space" target="_blank">Gemini</a> is a new internet protocol which is different from the HTTP and Gopher. It's much cleaner and has a growing community and audience of hackers.</p> + <h3>Why use gemini protocol?</h3> + <ul> + <li>Gemini capsules (webpages of gemini) are lightweight, minimal, and don't use many resources to operate.</li> + <li>It can run along with your websites. Gemini capsules use port 1965 by default. Your webserver can run at port 80 or 443 along with gemini server at port 1965. </li> + <li>By exploring an alternative protocol, you can check different ways to serve data and blogs.</li> + </ul> + <p>To access any gemini urls i.e. <code>gemini://example.org</code>, you can use any gemini client such as <a href="https://github.com/makeworld-the-better-one/amfora" target="_blank">amfora</a>, <a href="https://gmi.skyjake.fi/lagrange" target="_blank">lagrange</a>, <a href="https://thelambdalab.xyz/elpher/" target="_blank">elpher</a>, etc. + <h2 id="instructions">Instructions</h2> + <h3>Create a gemini user</h3> + <p> + It is most secure and clean to have a separate <code>gemini</code> user, so let's create one: + </p> + <pre><code>useradd -m -s /bin/bash gemini</code></pre> + <p>Now log in as <code>gemini</code> with the following command:</p> + <pre><code>su -l gemini</code></pre> + <p>To create and serve a gemini capsule, we need three basic steps:</p> + <ol> + <li>Content – the webpages in our capsule</li> + <li>TLS certificate – Gemini requires encrypted connection.</li> + <li>Gemini server – the program that makes our capsule available (similar to Nginx for HTTP)</li> + </ol> + <p>As the gemini user, we can create three different directories to simplify the process:</p> + <pre><code>mkdir -p ~/gemini/{content,certificate,server}</code></pre> + <h3>Content</h3> + <p>This will be the directory where you capsule files will be contained. Gemini uses text/gemini markup (in place of HTTP's equivalent HTML). It heavily borrows from Markdown. Similar to .html or .md, gemini uses .gmi as its extension.</p> + <p>To create one gemini file, go inside the <code>content</code> directory and create one <code>index.gmi</code> file.</p> + <pre><code>nano gemini/content/index.gmi</code></pre> + <p>We can add the content we want in our Gemini capsule here:</p> + <pre><code># This is Sample Gemini page +## With header 1 and header 2 +And a short paragraph like this. +=> /index.gmi Link to the same page</code></pre> + <h3>TLS certificate</h3> + <p>Go to the <code>certificate</code> directory which we created earlier and generate a TLS certificate using OpenSSL.</p> + <pre><code>cd ~/gemini/certificate/ +openssl req -new -subj "/CN=<strong>example.org</strong>" -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -days 3650 -nodes -out cert.pem -keyout key.pem</code></pre> + <h3>Gemini server</h3> + <h4>Download and prepare the server</h4> + <p>There are <a href="https://gemini.circumlunar.space/software">many gemini server software choices available</a>. + We will use <code>agate</code> server for now. This is a simple gemini server written in Rust.</p> + <p>It's a good idea to always get the most recent version, which you can see <a href="https://github.com/mbrubeck/agate/releases">on the agate releases page</a>. At the time of this writing, that is agate v3.1.0 which we will now download. We will download it to the <code>server</code> directory we made.</p> + <pre><code>cd ~/gemini/server +wget https://github.com/mbrubeck/agate/releases/download/v3.1.0/agate.x86_64-unknown-linux-gnu.gz</code></pre> + <p>Unzip the gz, then rename and make it executable:</p> + <pre><code>gunzip agate.x86_64-unknown-linux-gnu.gz +mv agate.x86_64-unknown-linux-gnu agate-server +chmod +x agate-server</code></pre> + <h4>Create a system service</h4> + <p>Now we need to create a systemd service to autostart and manage agate. + The gemini user does not have permission to do this, so press <code>ctrl-d</code> to log out of the gemini user and return to root. + As root, create the file below by opening it in your text editor (nano, vim, etc.):</p> + <pre><code>nano /etc/systemd/system/agate.service</code></pre> + <p>Add the following content to the file <strong>customizing highlighted text</strong> to your use.</p> + <pre><code>[Unit] +Description=agate +After=network.target + +[Service] +User=gemini +Type=simple +ExecStart=/home/gemini/gemini/server/agate-server --content /home/gemini/gemini/content --certs /home/gemini/gemini/certificate/ --hostname <strong>example.org</strong> --lang <strong>en-US</strong> + +[Install] +WantedBy=default.target</code></pre> + <p>Now we are ready to run server. Enable and run agate server.</p> + <pre><code>systemctl enable agate +systemctl start agate</code></pre> + <h4>Firewall</h4> + <p>Lastly, if you have a firewall running, remember to open port 1965, which is the port number used by gemini:</p> + <pre><code>ufw allow 1965</code></pre> + <h2>Finalization</h2> + <p>Now your server should be running. If everything went okay, you can access your gemini capsule via any gemini client with a url like this:</p> + <pre><code>gemini://<strong>example.org</strong></code></pre> + <p>Sample gemini site for reference:</p> + <pre><code>gemini://gemini.circumlunar.space</code></pre> + <p>Enjoy your first gemini capsule.</p> + <p> + For information about how to write in "gemtext" the markup language in Gemini, see this site: <a href="https://gemini.circumlunar.space/docs/gemtext.gmi">https://gemini.circumlunar.space/docs/gemtext.gmi</a>. + As you might guess it also has an analogous gemini capsule here: gemini://gemini.circumlunar.space/docs/gemtext.gmi + </p> + <hr> + <p><em>Written by <a href="https://nihar.page">nihar.page</a></em></p> + + </main> + <footer><a href="https://landchad.net">LandChad.net</a></br>Because Everyone should be an Internet LandChad.</br><li><a href="index.html"><img src="pix/chad.gif" alt="chad"></a></li><li><a href="rss.xml"><img src="pix/rss.svg" alt="RSS"></a></li><li><a href="pix/btc.png"><img src="pix/btc.svg" alt="BTC"></a></li><li><a href="pix/xmr.png"><img src="pix/xmr.svg" alt="XMR"></a></li><li><a href="https://github.com/lukesmithxyz/landchad"><img src="pix/git.svg" alt="Github"></a></footer> +</body> +</html> diff --git a/git.html b/git.html new file mode 100644 index 0000000..b5dd616 --- /dev/null +++ b/git.html @@ -0,0 +1,190 @@ +<!DOCTYPE html> +<html lang=en> + <head> + <title>Hosting Your Own Git Repositories – LandChad.net</title> + <meta charset="utf-8"/> + <link rel="shortcut icon" href="favicon.ico" type="image/x-icon" /> + <link rel='stylesheet' type='text/css' href='style.css'> + <meta name="viewport" content="width=device-width, initial-scale=1"> + <link rel='alternate' type='application/rss+xml' title='Land Chad RSS' href='/rss.xml'> + </head> +<body> + <header><h1>Hosting Your Own Git Repositories</h1></header> + <nav></nav> + <main> + <img class=titleimg src="pix/git.svg"> + <p> + Once you have your own VPS or other Internet-available server, you can + start hosting your own git repositories. The goal of this tutorial is + for you to go from</p> + + <pre><code>git clone github.com/...</code></pre> + + <p>to</p> + + <pre><code>git clone YourLandChadDomainName.xyz/...</code></pre> + + <p> + so you can cultivate your own homegrown, grass-fed code, rather than + relying on a centralized proprietary service like GitHub. + </p> + + <h2>Installing git</h2> + + <p> + You most likely already have it installed on your server, but if not, + run:</p> + + <pre><code>apt install git</code></pre> + + <p> + We don't need any additional software, <code>git</code> itself ships + with everything needed to host a remote repository! + </p> + + <h2>Creating bare repositories</h2> + + <p> + For each repository you want to host, you will need to manually create + what's called a "bare" repository on your server. These hold all the + commits and any other git data needed for your repository, but without + an expanded "index" in which you can just browse all the files of a + certain commit in the file system. + </p> + + <p> + These repositories need to be owned by the <code>git</code> user, and + you should probably pick a directory where you will store them all. One + sane choice is under <code>/srv/git/</code>, and we will use this as the + example directory for the rest of the tutorial, but any other path will + do as well. + </p> + + <h3>Become the git user and create the directory</h3> + + <p> + If you're logged in to your server as root and have <code>git</code> + installed, you can become the <code>git</code> user by executing + </p> + + <pre><code>su git</code></pre> + + <p> + Now navigate to/create your desired directory, for example + </p> + + <pre><code>cd /srv +mkdir git</code></pre> + + <h3>Create the repo</h3> + + <p> + Now you can create the bare repository with + </p> + + + <pre><code>git init --bare my-repo.git</code></pre> + + <p> + By convention, bare repository names end with ".git". + </p> + + <p> + Repeat the above command for any other repositories you want to host. + </p> + + <h2>Syncing local repositories with your server</h2> + + <h3>Set up SSH login for the git user</h3> + + <p> + You will need to be able to login remotely via <code>ssh</code> as the + <code>git</code> user we've used before. To do this, you will either + need to set up a password for the <code>git</code> user by running + <code>passwd git</code>, + or copy your public SSH key from your local machine to + <code>/home/git/.ssh/authorized_keys</code>. + See the <a href="sshkeys.html">SSH keys instructional</a> for details + (just log in as <code>git</code> instead of <code>root</code>). + </p> + + <h3>Syncing a new repository with your server</h3> + <p> + If you've just created a new repository on your local machine, you will + need to tell <code>git</code> where the remote repository is to be able + to sync with it (using commands like <code>git push</code> or + <code>git pull</code>). We do this by defining a "remote" for your + repository. + </p> + + <p> + A remote is just a named URL remembered in your repo's configuration. So + we need a name and a URL. By convention, the "main" remote is called + "origin". The URL has the format <code>user@host:path</code>, where: + </p> + + <ul> + <li> + <code>user</code> is <code>git</code>, the <code>git</code> user + we've already worked with before. + </li> + <li> + <code>host</code> is your domain name. + Alternatively you could even use your server's raw IP address. + </li> + <li> + <code>path</code> is the absolute path to the repository on the + server, in our example <code>/srv/git/my-repo.git</code> + </li> + </ul> + </p> + + <p> + So, to create a new remote, run: + </p> + + <pre><code>git remote add origin git@yourdomain.xyz:/srv/git/my-repo.git</code></pre> + + <p> + Now you'll be able to run <code>git push origin master</code> to push + your commits or <code>git pull origin</code> to pull from the remote. + </p> + + <h3>Syncing an existing repository</h3> + + <p> + If you've already set up your local repository to sync with a service + like GitHub it probably already has a remote called "origin". You can + see your repo's remotes with: + </p> + + <pre><code>git remote -v</code></pre> + + <p> + You can follow the above instructions, substituting an arbitrary other + name other than "origin" to create a differently named remote, e.g. + </p> + + <pre><code>git remote add vps git@...</code></pre> + + <p> + Now you'll be able to push/pull with <code>git push vps master</code> + and <code>git pull vps</code>, respectively. + </p> + + <p> + Or, to completely sever ties with your centralized git provider, first + remove the original origin with: + <code>git remote remove origin</code> + and then follow the instructions as above. + </p> + + <h2>Contribution</h2> + <ul> + <li>Martin Chrzanowski -- <a + href="https://m-chrzan.xyz">website</a>, <a href="https://m-chrzan.xyz/crypto.html">donate</a></li> + </ul> + </main> + <footer><a href="https://landchad.net">LandChad.net</a></br>Because Everyone should be an Internet LandChad.</br><li><a href="index.html"><img src="pix/chad.gif" alt="chad"></a></li><li><a href="rss.xml"><img src="pix/rss.svg" alt="RSS"></a></li><li><a href="pix/btc.png"><img src="pix/btc.svg" alt="BTC"></a></li><li><a href="pix/xmr.png"><img src="pix/xmr.svg" alt="XMR"></a></li><li><a href="https://github.com/lukesmithxyz/landchad"><img src="pix/git.svg" alt="Github"></a></footer> +</body> +</html> diff --git a/gitea.html b/gitea.html new file mode 100644 index 0000000..88738b2 --- /dev/null +++ b/gitea.html @@ -0,0 +1,109 @@ +<!DOCTYPE html> +<html lang=en> + <head> + <title>Setting up Gitea – LandChad.net</title> + <meta charset="utf-8"/> + <link rel="shortcut icon" href="favicon.ico" type="image/x-icon" /> + <link rel='stylesheet' type='text/css' href='style.css'> + <meta name="viewport" content="width=device-width, initial-scale=1"> + <link rel='alternate' type='application/rss+xml' title='Land Chad RSS' href='/rss.xml'> + </head> +<body> + <header><h1>Setting up Gitea</h1></header> + <nav></nav> + <main> + <img class=titleimg src="pix/gitea.svg"> + <p>Gitea allows you to self-host your git repositories similar to <a href="git.html">bare repositories</a>, but comes with additional features that you might know from GitHub, such as issues, pull requests or multiple users. Its advantage over GitLab—another Free Software GitHub clone—is that it is much more lightweight and easier to setup.</p> + <p>Head over to <a href="https://gitea.com">gitea.com</a> to see what it looks like in practice.</p> + <p>Although Gitea is lighter than Gitlab, if you have a VPS with only 512MB of RAM, you will probably have to upgrade. Gitea is more memory-intensive than having just a bare git repository.</p> + + <h2>Installing Gitea</h2> + <p>First install a few dependencies:</p> + <pre><code>apt install curl sqlite3</code></pre> + <p>Unfortunately, Gitea itself is not in the official Debian repos, so we will add a third-party repository for it.</p> + <p>Add the repo's gpg key to apt's trusted keys:</p> + + <pre><code>curl -sL -o /etc/apt/trusted.gpg.d/morph027-gitea.asc https://packaging.gitlab.io/gitea/gpg.key</code></pre> + + <p>Then add the actual repository to apt:</p> + + <pre><code>echo "deb [arch=amd64] https://packaging.gitlab.io/gitea gitea main" > /etc/apt/sources.list.d/morph027-gitea.list</code></pre> + + <p>Now we can install Gitea:<p> + + <pre><code>apt update +apt install gitea</code></pre> + + <p>Since apt automatically enables and starts the Gitea service, it should already be running on port <code>3000</code> on your server!</p> + + <h2>Setting up a Nginx reverse proxy</h2> + <p>You should know how to generate SSL certificates and use Nginx by now. Add this to your Nginx config to proxy requests made to your git subdomain to Gitea running on port 3000:</p> + + <pre><code> +server { + listen 443 ssl; + listen [::]:443 ssl; + ssl_certificate /etc/ssl/nginx/<strong>git.example.org</strong>.crt; + ssl_certificate_key /etc/ssl/nginx/<strong>git.example.org</strong>.key; + server_name <strong>git.example.org</strong>; + location / { + proxy_pass http://localhost:3000/; # The / is important! + proxy_redirect off; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} + </pre></code> + <p>And reload Nginx:</p> + <pre><code>systemctl reload nginx</code></pre> + + <h2>Setting up Gitea</h2> + + <p>If everything worked fine you should now see a setup screen when you go to your configured domain in the browser. The options should be pretty self-explanatory, it is only important to select SQLite3 and to replace the base url and SSH server domain with your own.</p> + + <dl> + <dt>Database Type:</dt> + <dd>SQLite3</dd> + <dt>SSH Server Domain:</dt> + <dd><strong>git.example.org</strong></dd> + <dt>Gitea Base URL:</dt> + <dd><strong>git.example.org</strong></dd> + </dl> + + <p>These and other settings can be changed in a configuration file later so don't worry about making wrong decisions right now.</p> + + <p>After clicking the install button you should now be able to log into your Gitea instance with the account you just created! Explore the settings for more things to do, such as setting up your SSH keys.</p> + + <p>If Gitea does not load fully and has random errors, it is possible that you need to increase your available memory on your VPS. This can usually be done on your VPS-provider's website without too much trouble.</p> + + <h2>A few extras</h2> + <h3>Automatically create a new repo on push</h3> + <p>This is an incredicly useful feature for me. Open up <code>/etc/gitea/app.ini</code> and add <code>DEFAULT_PUSH_CREATE_PRIVATE = true</code> to the <code>repository</code> section like so:</p> + <img src=pix/gitea-push-create.png> + <br> + <p>If you now add a remote to a repository like this</p> + <pre><code>git remote add origin 'ssh://gitea@git.<strong>example.org</strong>/<strong>username</strong>/<strong>coolproject</strong>.git'</code></pre> + <p>and push, Gitea will automatically create a private <code>coolproject</code> repository in your account!</p> + + <h3>Change tab-width</h3> + <p>By default Gitea displays tabs 8 spaces wide, however I prefer 4 spaces. We can change this!</p> + <pre><code>mkdir -p /var/lib/gitea/custom/templates/custom/</code></pre> + <p>And write this into <code>/var/lib/gitea/custom/templates/custom/header.tmpl</code>:</p> + <pre><code><style> +.tab-size-8 { + tab-size: 4 !important; + -moz-tab-size: 4 !important; +} +</style></code></pre> + + + <h2>Contribution</h2> + <ul> + <li><a href="https://phire.cc">phire</a></li> + </ul> + </main> + <footer><a href="https://landchad.net">LandChad.net</a></br>Because Everyone should be an Internet LandChad.</br><li><a href="index.html"><img src="pix/chad.gif" alt="chad"></a></li><li><a href="rss.xml"><img src="pix/rss.svg" alt="RSS"></a></li><li><a href="pix/btc.png"><img src="pix/btc.svg" alt="BTC"></a></li><li><a href="pix/xmr.png"><img src="pix/xmr.svg" alt="XMR"></a></li><li><a href="https://github.com/lukesmithxyz/landchad"><img src="pix/git.svg" alt="Github"></a></footer> +</body> +</html> @@ -45,6 +45,25 @@ <li><a href="certbot.html">Get a secure HTTPS connection with Certbot.</a></li> </ol> + <h3 id=other>Excellent Extras</h3> + <ul class=ll> + <li><a href="maintenance.html">How to maintain a server.</a></li> + <li><a href="sshkeys.html">Use your SSH keys to prevent hacking.</a></li> + <li><a href="cron.html">Schedule tasks with Crontabs/Cronjobs.</a></li> + <li><a href="tor.html">Mirror your site on <img src="pix/tor.svg">Tor.</a></li> + <li><a href="auth.html">Password-protecting Webpages (HTTP Authentication)</a></li> + <li><a href="ufw.html">Using ufw as a firewall.</a></li> + <li><a href="gemini.html">Create a Gemini Capsule.</a></li> + </ul> + + <h3 id=platform>"Build your own platform!"</h3> + <ul class=ll> + <li><a href="git.html">Host your own <img src="pix/git.svg"><code>git</code> repositories</a></li> + <li><a href="nextcloud.html">Setting up a <img src="pix/nextcloud.svg">Nextcloud Instance (file hosting and more)</a></li> + <li><a href="gitea.html">Setting up <img src="pix/gitea.svg">Gitea</a></li> + <li><a href="irc.html">Creating your own chat server with <img src="pix/irc.svg">IRC</a></li> + </ul> + <h3 id=crypto>Accepting Cryptocurrency Tips</h3> <ul class=ll> <li><a href="crypto.html">The Case for Crypto for Normal People</a></li> @@ -54,12 +73,6 @@ <li><a href="bat.html"><img src="pix/bat.svg">Basic Attention Token (BAT)</a></li> </ul> - <h3 ol=other>Excellent Extras</h3> - <ul class=ll> - <li><a href="maintenance.html">How to maintain a server.</a></li> - <li><a href="sshkeys.html">Use your SSH keys to prevent hacking.</a></li> - </ul> - <h2>In the Works...</h2> <p> @@ -91,16 +104,12 @@ </p> <ul> - <li>Cronjobs</li> - <li>IRC servers</li> <li>Email webclients</li> <li>Simple static site generators</li> - <li>NextCloud (file hosting)</li> <li>Calibre (library server)</li> <li>Nitter</li> <li>Pleroma (like Twitter)</li> <li>PeerTube (like YouTube)</li> - <li>Using ufw as a firewall.</li> <li>XMPP ejabberd</li> <li>Movim for XMPP</li> </ul> @@ -115,7 +124,7 @@ </p> <ul class=ll> - <li>When settings up a website, use our linked affiliate links, like <a href="https://www.vultr.com/?ref=8384069-6G">to Vultr</a>.</li> + <li>When setting up a website, use our linked affiliate links, like <a href="https://www.vultr.com/?ref=8384069-6G">to Vultr</a>.</li> <li>If you enjoy a guest article, the author's donation links may be included at the bottom of the page.</li> <li>Donate crypto to the long-term LandChad maintenance and expansion fund:</li> </ul> diff --git a/irc.html b/irc.html new file mode 100644 index 0000000..57c8c8f --- /dev/null +++ b/irc.html @@ -0,0 +1,801 @@ +<!DOCTYPE html> +<html lang=en> + <head> + <title>Creating Your Own Chat Server With IRC – LandChad.net</title> + <meta charset="utf-8"/> + <link rel="shortcut icon" href="favicon.ico" type="image/x-icon" /> + <link rel='stylesheet' type='text/css' href='style.css'> + <meta name="viewport" content="width=device-width, initial-scale=1"> + <link rel='alternate' type='application/rss+xml' title='Land Chad RSS' href='/rss.xml'> + </head> +<body> + <header><h1>Creating Your Own Chat Server With IRC</h1></header> + <nav></nav> + <main> + <img class=titleimg src="pix/irc.svg"> + <p> + Creating your own chat server for you and your friends is easy, and you don't have to rely on a complicated system to get started. + IRC is an old but gold protocol, and has clients for basically every operating system made since the 80s, with many powerful modern ones on Linux, Mac, and Windows. + </p> + + <p> + Having a chat server for you and your friends makes it impossible for a group of arbitrarily appointed moderators to deplatform you for wrong-think, and gives you greater freedom of communication. + </p> + + <h2 id="installing">Installing an IRCd</h2> + + <p> + An IRCd is short for "IRC daemon", which just means an IRC server. + The most easy IRCd to setup is <a href="https://ergo.chat/">Ergo</a>. + </p> + + <p> + The first thing you need to do is create a new user for the server to be run by. + This is good practice for installing software/servers manually, as it give you more fine-grained control over which permissions the application has. + </p> + +<pre><code>useradd -m ergo -s /bin/bash</code></pre> + + <p> + Next, we want to switch to our newly created <code>ergo</code> user and create the server directory. + </p> + +<pre><code>sudo -i -u ergo +mkdir server</code></pre> + + <p> + You can find the latest release of Ergo on its GitHub <a href="https://github.com/ergochat/ergo/releases/latest">latest release</a> page.<br> + There are several platforms available, but you want to choose Linux, most likely <code>linux-x86_64</code>.<br> + Once you have selected the correct package, copy its URL and replace <code><i><release url></i></code> with the package URL (still as the <code>ergo</code> user): + </p> + +<pre><code>wget https://github.com/ergochat/ergo/releases/download/v2.7.0/ergo-2.7.0-linux-x86_64.tar.gz +tar -xf ergo-2.7.0-linux-x86_64.tar.gz +mv ergo-2.7.0-linux-x86_64/* +rm -r ergo-2.7.0-linux-x86_64*</code></pre> + + <p>Executing <code>ls -l</code> should now yield something like this:</p> + +<pre><code>-rw-r--r-- 1 ergo ergo 118825 Jun 8 00:51 CHANGELOG.md +-rw-r--r-- 1 ergo ergo 1983 May 31 01:48 README +-rw-r--r-- 1 ergo ergo 41440 Jun 8 00:42 default.yaml +drwxr-xr-x 2 ergo ergo 4096 Jul 1 09:01 docs +-rwxr-xr-x 1 ergo ergo 9654272 Jun 8 00:53 ergo +-rw-r--r-- 1 ergo ergo 1753 May 31 01:48 ergo.motd +drwxr-xr-x 2 ergo ergo 12288 Jul 1 09:01 languages +-rw-r--r-- 1 ergo ergo 39722 Jun 8 00:42 traditional.yaml</code></pre> + + <p>If you see something similar to the above, that means Ergo is installed, although not quite ready to run yet.</p> + + <h2 id="configuring">Configuring Ergo</h2> + + <p> + Now that Ergo is installed, you want to configure it to fit the needs of your group.<br> + The configuration in this section is tailored towards a small group of people, and less for a possibly large network, + but it should work for any size of group. + </p> + + <p> + First thing, make sure you're still using the <code>ergo</code> user, and are in the <code>~/server</code> directory.<br> + If you aren't, you can run the following to get back there: + </p> + +<pre><code>sudo -i -u ergo +cd ~/server</code></pre> + + <p> + Next, generate certificate files for TLS: + </p> + + <pre><code>./ergo mkcerts</code></pre> + + <p> + Ergo comes with a default configuration file with detailed documentation that can be used to guide you through the configuration process. + This guide will help you setup the server for a typical use-case, but if you see any settings that you would like to change along the way, + go ahead and change them, as long as you know what you're doing. + </p> + + <p>To start configuring, we need to copy some files:</p> + +<pre><code>cp default.yaml ircd.yaml +cp ergo.motd ircd.motd</code></pre> + + <p> + The next steps involve editing the newly copied <code>ircd.yaml</code> file. If you do not know how to edit text files from the comment line, + you can use <code>nano</code>, which is very simple, using arrow keys to navigate, <code>CTRL+O</code> to save, and <code>CTRL+X</code> to exit.<br> + Another option is <code>vim</code>, which is a much more powerful text editor, but has a learning curve. It is only recommended for this guide if you already know it.<br> + Lastly, you can copy the <code>ircd.yaml</code> file to a text editor on your computer and edit it with a GUI text editor of your choice. + If that is what you choose to do, you may want to just download the file from <a href="https://raw.githubusercontent.com/ergochat/ergo/master/default.yaml">Ergo's GitHub</a>, + edit it on your computer, clear the <code>ircd.yaml</code> file on the server, and then paste the contents from your computer into the blank file.<br> + No matter how you do it, the next steps assume you can edit the configuration file. + </p> + + <p> + <b>Note</b>:<br> + The options highlighted in this section are not a complete overview of all options. + Instead, the options shown are the ones which are most relevant to a small network.<br> + You should read over the configuration file yourself if you are curious about everything you can change. + </p> + + <h3 id="configuring-names">Network and server names</h3> + <p> + One of the first properties in the config file is network name. + You can change this to whatever you like, as it will show up as the name when you connect to the server. + </p> + +<pre><code># network configuration +network: + # name of the network + name: "Land-Chat"</code></pre> + + <p>Change the server name to your server's domain name.</p> + +<pre><code># server configuration +server: + # server name + name: "example.org"</code></pre> + + <h3 id="configuring-password">Network password</h3> + <p> + The next step is optional, depending on if you want your network password protected or not. + The benefit of password protection is fairly obvious; nobody can connect to your network unless you gave them the password. + If you're wanting to run a public network which anyone can join and create a channel, you want to skip this, but for personal setups, + it is highly recommended. + </p> + + <p>Generate a password to use by executing the following:</p> + + <pre><code>./ergo genpasswd</code></pre> + + <p> + It will ask you to enter a password and confirm it, then you will be given a hashed password.<br> + Copy this password, and paste it into the following field (also removing the <code>#</code> before the <code>password:</code> line): + </p> + +<pre><code># password to login to the server, generated using `ergo genpasswd`: +password: "<i><your hashed password></i>"</code></pre> + + <h3 id="configuring-motd">Message of the day (MotD)</h3> + <p>Change the MotD (<b>M</b>essage <b>o</b>f <b>t</b>he <b>D</b>ay) file to the one you copied earlier:</p> + +<pre><code># motd filename +# if you change the motd, you should move it to ircd.motd +motd: ircd.motd</code></pre> + + <p>Feel free to edit <code>ircd.motd</code> to your heart's content. Its contents will be sent to clients when they connect to the network.</p> + + <h3 id="configuring-ip-limits">IP limits</h3> + <p> + For security purposes, you might want to limit the amount of client connections per IP. + For a private network, 4 is likely the maximum amount of connections you will have per IP, so that is a safe value.<br> + If your network is password protected, this is less of an issue, since the only people connecting will be people who have the password. + The following is the default, but you can change it to be whichever value you like: + </p> + +<pre><code># IP-based DoS protection +ip-limits: + # whether to limit the total number of concurrent connections per IP/CIDR + count: true + # maximum concurrent connections per IP/CIDR + max-concurrent-connections: 16</code></pre> + + <h3 id="configuring-ip-cloaking">IP cloaking</h3> + <p> + Traditionally, IRC networks expose users' IP addresses to everyone. This is not a good practice for privacy, however. + With Ergo, IP cloaking is enable by default. You can enable or disable it if you like, and change how it looks to users.<br> + In this case, <code>netname</code> was changed to <code>"chad"</code>. + </p> + +<pre><code># IP cloaking hides users' IP addresses from other users and from channel admins +# (but not from server admins), while still allowing channel admins to ban +# offending IP addresses or networks. In place of hostnames derived from reverse +# DNS, users see fake domain names like pwbs2ui4377257x8.irc. These names are +# generated deterministically from the underlying IP address, but if the underlying +# IP is not already known, it is infeasible to recover it from the cloaked name. +# If you disable this, you should probably enable lookup-hostnames in its place. +ip-cloaking: + # whether to enable IP cloaking + enabled: true + + # whether to use these cloak settings (specifically, `netname` and `num-bits`) + # to produce unique hostnames for always-on clients. you can enable this even if + # you disabled IP cloaking for normal clients above. if this is disabled, + # always-on clients will all have an identical hostname (the server name). + enabled-for-always-on: true + + # fake TLD at the end of the hostname, e.g., pwbs2ui4377257x8.irc + # you may want to use your network name here + netname: "chad"</code></pre> + + <h3 id="configuring-hexchat-password">Password enforcement adjustments for HexChat (and possibly other clients)</h3> + <p> + Ergo offers account registration to allow users to do things like use history and bouncer features, register channels, etc.<br> + In clients such as HexChat, server password may conflict with account passwords, so the following setting should be enable if you wish to use accounts with clients such as HexChat.<br> + Note that this could under some circumstances be considered a security hazard, as a user with an account does not need to know the server password to connect, + although that user would have needed to register an account before the server had a password, and then a password would need to have been set after the fact, so this can be considered a very small concern if your setup always has had a password.<br> + Also keep in mind that this setting has no effect if your network does not even have a password at all. + </p> + +<pre><code># some clients (notably Pidgin and Hexchat) offer only a single password field, +# which makes it impossible to specify a separate server password (for the PASS +# command) and SASL password. if this option is set to true, a client that +# successfully authenticates with SASL will not be required to send +# PASS as well, so it can be configured to authenticate with SASL only. +skip-server-password: true</code></pre> + + <h3 id="configuring-multiclient">Multiclient, always-on clients, history, etc</h3> + <p> + Traditionally, IRC servers have no message history, and once you close your client, you cannot receive messages, and are not shown to be online at all. + Ergo includes functionality to allow users to both receive history, and keep their clients "online" even after they have left. + It also allows multiple clients to connect to the same account.<br> + If you are running a private network for friends, you should set <code>always-on</code> and <code>auto-away</code> to <code>opt-out</code>, + to have all users with accounts to appear as if they are online at all times, and be able to receive messages when they are offline.<br> + For a public network, keep everything as their default values, since you probably do not want randoms having this by default.<br> + If for some reason you do not want any of these features at all, you can set <code>enabled</code> to <code>false</code>, but this is not recommended. + Below are the recommended values for a private network (e.g. for friends) where users with accounts will be able to receive messages and history while they are offline. + </p> + +<pre><code># multiclient controls whether Ergo allows multiple connections to +# attach to the same client/nickname identity; this is part of the +# functionality traditionally provided by a bouncer like ZNC +multiclient: + # when disabled, each connection must use a separate nickname (as is the + # typical behavior of IRC servers). when enabled, a new connection that + # has authenticated with SASL can associate itself with an existing + # client + enabled: true + + # if this is disabled, clients have to opt in to bouncer functionality + # using nickserv or the cap system. if it's enabled, they can opt out + # via nickserv + allowed-by-default: true + + # whether to allow clients that remain on the server even + # when they have no active connections. The possible values are: + # "disabled", "opt-in", "opt-out", or "mandatory". + always-on: "opt-out" + + # whether to mark always-on clients away when they have no active connections: + auto-away: "opt-out" + + # QUIT always-on clients from the server if they go this long without connecting + # (use 0 or omit for no expiration): + #always-on-expiration: 90d</code></pre> + + <h3 id="configuring-vhosts">VHosts</h3> + <p> + IP cloaking was mentioned previously, and somewhat related to that, Ergo includes "vhost" functionality, which allows users to set a custom IP/host string. + This is mostly for cosmetic value, and does not interfere with operators being able to see actual IP addresses for banning, but if you do not want it enable for some reason, you can disable it. + </p> + +<pre><code># vhosts controls the assignment of vhosts (strings displayed in place of the user's +# hostname/IP) by the HostServ service +vhosts: + # are vhosts enabled at all? + enabled: true</code></pre> + + <h3 id="configuring-channels">Channels</h3> + <p> + Channels are where everyone on an IRC network talk. By default, anyone can create a channel, and anyone with an account can register one. + The difference between a normal channel and a registered one is that the registered one will preserve the operator status of the person who created, + whereas a normal channel's owner will lose operator status if they leave the channel or disconnect from the network.<br> + There are various settings for channels available, but the defaults are suitable for a private network with trust among users, or where you just want anyone to have the ability to create a channel. + Below are the default values: + </p> + +<pre><code># channel options +channels: + # modes that are set when new channels are created + # +n is no-external-messages and +t is op-only-topic + # see /QUOTE HELP cmodes for more channel modes + default-modes: +nt + + # how many channels can a client be in at once? + max-channels-per-client: 100 + + # if this is true, new channels can only be created by operators with the + # `chanreg` operator capability + operator-only-creation: false + + # channel registration - requires an account + registration: + # can users register new channels? + enabled: true + + # restrict new channel registrations to operators only? + # (operators can then transfer channels to regular users using /CS TRANSFER) + operator-only: false + + # how many channels can each account register? + max-channels-per-account: 15</code></pre> + + <h3 id="configuring-operators">Operators (administrators, etc)</h3> + <p> + The IRC term for an administrator or another privileged user is "operator", or "oper" for short.<br> + Ergo's opers have different permissions that can be granted to them, and are defined in "classes", basically groups of permissions under a name. + For example, "chat-moderator" and "server-admin" are defined in the default configuration: + </p> + +<pre><code># operator classes +oper-classes: + # chat moderator: can ban/unban users from the server, join channels, + # fix mode issues and sort out vhosts. + "chat-moderator": + # title shown in WHOIS + title: Chat Moderator + + # capability names + capabilities: + - "kill" + - "ban" + - "nofakelag" + - "roleplay" + - "relaymsg" + - "vhosts" + - "sajoin" + - "samode" + - "snomasks" + + # server admin: has full control of the ircd, including nickname and + # channel registrations + "server-admin": + # title shown in WHOIS + title: Server Admin + + # oper class this extends from + extends: "chat-moderator" + + # capability names + capabilities: + - "rehash" + - "accreg" + - "chanreg" + - "history" + - "defcon" + - "massmessage"</code></pre> + + <p> + The above can be kept with their default values, but you are free to modify them or create any new classes that are appropriate for your setup.<br> + Next, let's actually create an operator account: + </p> + +<pre><code># ircd operators +opers: + # default operator named 'gigachad'; log in with /OPER gigachad <password> + "gigachad": + # which capabilities this oper has access to + class: "server-admin" + + # custom whois line + whois-line: is the server administrator + + # custom hostname + vhost: "gigachad" + + # normally, operator status is visible to unprivileged users in WHO and WHOIS + # responses. this can be disabled with 'hidden'. ('hidden' also causes the + # 'vhost' line above to be ignored.) + hidden: false + + # modes are modes to auto-set upon opering-up. uncomment this to automatically + # enable snomasks ("server notification masks" that alert you to server events; + # see `/quote help snomasks` while opered-up for more information): + #modes: +is acjknoqtuxv + + # operators can be authenticated either by password (with the /OPER command), + # or by certificate fingerprint, or both. if a password hash is set, then a + # password is required to oper up (e.g., /OPER dan mypassword). to generate + # the hash, use `ergo genpasswd`. + password: "<i><your oper password></i>"</code></pre> + + <p> + This is a modified version of the default oper entry. The account name is "gigachad", but you can change it to anything.<br> + Replace <code><i><your oper password></i></code> with a password generated by <code>./ergo genpasswd</code>, and you will have a new oper account to use.<br> + Note that to log into an oper account, clients have to enter <code>/OPER <i><oper name></i> <i><oper password></i></code> each time they log in. + This can be automated by most clients by setting the command to be executed when the client logs in. + In the case of HexChat, you can edit your network and add the command to the <code>Connect commands</code> tab of the menu.<br> + You can copy everything from <code>"gigachad"</code> to the end of the line, paste it again, and change the name to create another oper account. + Another, less privileged example of an oper is shown as a comment below the above configuration snippet. + </p> + + <h3 id="configuring-history">Chat history</h3> + <p> + Traditionally, IRC networks do not store, relay, or handle chat history in any way.<br> + On a privacy standpoint, this is a good thing, since chats are entirely ephemeral and handled by clients.<br> + On a practicality standpoint, this is a bad thing, since people have to keep a client connected 24/7 to see message history.<br> + For normalfriends, this can be a big problem, not only because having to stay online 24/7 is just annoying or infeasible, + but also because they are likely used to chat platforms that handle history for them.<br> + With this in mind, enabling history is a good idea if you want to move friends over to IRC, and will make things a lot more pleasant for private networks. + </p> + + <p> + Ergo's <code>history</code> configuration group is very long, so it is encouraged to read over it yourself. + This section will go over the most important pieces of that configuration group. + </p> + + <p> + History is not endless (unless you want it to be), and the amount that can be stored for channels is configurable: + </p> + +<pre><code># how many channel-specific events (messages, joins, parts) should be tracked per channel? +channel-length: 2048</code></pre> + + <p> + History is already enabled by default, but that just means it is being collected, not relayed by default. + To relay history to clients when they connect, change the following to the amount of messages that you think is appropriate: + </p> + +<pre><code># number of messages to automatically play back on channel join (0 to disable): +autoreplay-on-join: 250</code></pre> + + <p> + History older than a certain time can be configured to be deleted or be inaccessible. + The default cutoff time is 1 week, but this is configurable as well. + </p> + +<pre><code> +# options to delete old messages, or prevent them from being retrieved +restrictions: + # if this is set, messages older than this cannot be retrieved by anyone + # (and will eventually be deleted from persistent storage, if that's enabled) + expire-time: 1w +</code></pre> + + <p> + By default, Ergo only stores chat history in memory, so when the server restarts, all history is lost. + If you wish to have chat history persist beyond restarts, you must store it in a MySQL database: + </p> + +<pre><code># options to store history messages in a persistent database (currently only MySQL). +# in order to enable any of this functionality, you must configure a MySQL server +# in the `datastore.mysql` section. +persistent: + enabled: true + + # store unregistered channel messages in the persistent database? + unregistered-channels: true</code></pre> + +<br> + +<pre><code># connection information for MySQL (currently only used for persistent history): +mysql: + enabled: false + host: "localhost" + port: 3306 + # if socket-path is set, it will be used instead of host:port + #socket-path: "/var/run/mysqld/mysqld.sock" + user: "ergo" + password: "hunter2" + history-database: "ergo_history" + timeout: 3s + max-conns: 4 + # this may be necessary to prevent middleware from closing your connections: + #conn-max-lifetime: 180s</code></pre> + + <p> + For privacy reasons, you may want to allow users to delete their own messages in history, or export their messages to JSON: + </p> + +<pre><code># options to control how messages are stored and deleted: +retention: + # allow users to delete their own messages from history? + allow-individual-delete: true + + # if persistent history is enabled, create additional index tables, + # allowing deletion of JSON export of an account's messages. this + # may be needed for compliance with data privacy regulations. + enable-account-indexing: true</code></pre> + + <h3 id="configuring-spam">Spam reduction</h3> + <p> + Most IRC networks have measures in place to reduce chat spam. By default, "fakelag" is enabled in Ergo, and that can deal with most aggregious chat spam.<br> + If you are running a private network where user trust is high, you can disable it so that there are no limits on the speed that messages can be sent. + </p> + +<pre><code># fakelag: prevents clients from spamming commands too rapidly +fakelag: + # whether to enforce fakelag + enabled: true + + # time unit for counting command rates + window: 1s + + # clients can send this many commands without fakelag being imposed + burst-limit: 5 + + # once clients have exceeded their burst allowance, they can send only + # this many commands per `window`: + messages-per-window: 2 + + # client status resets to the default state if they go this long without + # sending any commands: + cooldown: 2s</code></pre> + + <h2 id="using">Starting and using your server</h3> + <p> + Now that Ergo is both installed and configured, you can actually start using it! + </p> + + <h3 id="using-starting">Starting the server</h3> + <p> + First thing, make sure you're still using the <code>ergo</code> user, and are in the <code>~/server</code> directory.<br> + If you aren't, you can run the following to get back there: + </p> + +<pre><code>sudo -i -u ergo +cd server</code></pre> + + <p> + Starting the server is done in one command: + </p> + + <pre><code>./ergo run</code></pre> + + <p> + It will stay online until you close the terminal, or press CTRL+C. Don't worry, the next section goes over how to make it run like a normal server with a SystemD service.<br> + If you have not already, make sure the port <code>6697</code> is not blocked on your server. If you are using UFW as your firewall, + you need to run <code>ufw enable 6697</code> (not as the <code>ergo</code> user, of course).<br> + If you make and configuration changes while the server is running, you can apply them without restarting by typing <code>/rehash</code> as an operator. + </p> + + <h3 id="using-connecting">Connecting to the server</h3> + <p> + To use IRC, you of course need an IRC client. There are many choices available, but the most widely used for Windows and Linux is <a href="https://hexchat.github.io/">HexChat</a>. + On Mac, you have a slightly nicer option with <a href="https://www.codeux.com/textual/">Textual</a>, although you have to <a href="https://github.com/Codeux-Software/Textual/#building-textual">compile it from source</a> if you want to use it for free.<br> + A more user-friendly and modern client choice is TheLounge, which is explained in the last section of this guide, if you want to look into it. + </p> + + <p> + Connecting with HexChat is very easy. When you start it, you will see something like this: + </p> + + <img src="pix/irc/hexchat-network-select.png" alt="HexChat network select"> + + <p> + From there, you should click <code>+ Add</code> and name the server whatever you like (so you can find it on the server list).<br> + Once you have created a new server and named it, select it and click <code>Edit...</code>. + A menu will show up like the one below. Change the domain to whatever domain your server is running on, + and make sure to put in your server password if you set one. + </p> + + <img src="pix/irc/hexchat-network-edit.png" alt="HexChat network edit menu"> + + <p> + Once you're done editing the network, click <code>(X) Close</code>, select your network from the network list, and click <code>Connect</code>.<br> + If all is well, you should be connected! + </p> + + <img src="pix/irc/hexchat-connection-complete.png" alt="HexChat connection complete"> + + <p> + The process is very similar on Textual.<br> + Create a new network and connect to it. Note that it will ask if you want to connect even though the certificate is unsigned. + This is due to the self-signed certificates generated for the server, and is not a problem or security vulnerability, it is just a little annoying. + </p> + + <img src="pix/irc/textual-network-edit.png" alt="Textual network edit menu"> + + <h2 id="service">Surviving restarts with a SystemD service</h3> + <p> + In the beginning of the last section, Ergo was started by simply running <code>./ergo run</code>, but this is only suitable for testing. + To have a proper server setup, you need to run it as a service. This can be achieved via a SystemD service. + </p> + + <p> + Before creating your service file, make sure you are in <code>~/server</code> as the <code>ergo</code> user.<br> + Once you have done that, create a file called <code>start.sh</code> with the following content: + </p> + +<pre><code>#!/bin/bash +./ergo run</code></pre> + + <p>Save the file, then mark it as executable:</p> + + <pre><code>chmod +x start.sh</code></pre> + + <p>Now, create a file called <code>ergo.service</code> with the following content:</p> + +<pre><code>[Unit] +Description=Ergo IRC server +After=network.target +# If you are using MySQL for history storage, comment out the above line +# and uncomment these two instead (you must independently install and configure +# MySQL for your system): +# Wants=mysql.service +# After=network.target mysql.service + +[Service] +Type=simple +User=ergo +WorkingDirectory=/home/ergo/server +ExecStart=/home/ergo/server/start.sh +ExecReload=/bin/kill -HUP $MAINPID +Restart=on-failure +LimitNOFILE=1048576 +# Uncomment this for a hidden service: +# PrivateNetwork=true + +[Install] +WantedBy=multi-user.target</code></pre> + + <p> + You now have your service file, but it is not installed yet. + To install it, switch to your normal user, and execute the following lines to install, enable, and start the SystemD service: + </p> + +<pre><code>ln -s /home/ergo/server/ergo.service /etc/systemd/system/ergo.service +systemctl enable ergo +systemctl start ergo</code></pre> + + <p>Ergo is now installed and running as a service, and will automatically start when the system boots.</p> + + <h2 id="registering">Registering accounts and channels</h2> + <p> + Account and channel registration were mentioned multiple times in this guide, and are indeed very important parts of the modern IRC ecosystem. + You can connect to most IRC networks and talk without creating an account, but you will not be able to reserve your nickname or register channels, so it is important to register an account. + </p> + + <h3 id="registering-accounts">Registering an account with NickServ</h3> + <p> + First, make sure you are connected to your IRC network. + Once you are, type <code>/nickserv help</code> to make sure NickServ (the registration system) is working propertly.<br> + If all is well, type the following, replacing <code><i><your password></i></code> with the password you want to use: + </p> + + <pre><code>/nickserv register <i><your password></i></code></pre> + + <p> + At this point, you are now registered!<br> + The final step is to configure authentication with your client. + </p> + + <p>In HexChat, all that needs to be done is changing <code>Login method</code> to <code>SASL (username + password)</code>, and entering your NickServ password that you used earlier into the password field:</p> + + <img src="pix/irc/hexchat-sasl.png" alt="HexChat SASL in network edit menu"> + + <p> + In Textual, open up your network in the menu, and click <code>Identity</code> under <code>Server Properties</code>. + Enter your password in <code>Personal Password</code>, and check <code>Wait for identification before joining channels</code>. + </p> + + <img src="pix/irc/textual-identity.png" alt="Textual identity menu"> + + <p>You will now be logged into your account when you connect to your network.</p> + + <h3 id="registering-channels">Registering channels with ChanServ</h3> + <p> + Once you have an account registered, you can register channels with ChanServ.<br> + To do so, join the channel you want to register, then type the following, replacing <code><i><your channel></i></code> with the name of the channel you want to register: + </p> + + <pre><code>/chanserv register #<i><your channel></i></code></pre> + + <p> + You are now the channel owner, and are free to appoint operators, administrators, etc for it. + When you go offline, you won't lose ownership, and you cannot be removed as the owner unless you unregister the channel later. + </p> + + <h2 id="moderation">Moderation</h2> + <p> + Like any chat, there will come a point where you need to use moderation tools to keep things under control. + Many IRC setup guides do not go over moderation, so it can be stressful when operators need to actually use moderation tools.<br> + The main difference between IRC and other chat systems in terms of moderation is the difference between channel bans and network bans. + Channel ban keeps a person out of channel a channel, whereas a network ban keeps a person out of the entire network. + </p> + + <h3 id="moderation-masks">Understanding masks</h3> + <p> + Bans are applied "masks", which are formatted pieces of text that contain a user's nick (username), their realname value, and their IP address or host.<br> + This is what a mask looks like: <code>nick!~nick-dude@127.0.0.1</code>.<br> + In bans, asterisks can be used as wildcards, which is useful for banning IP address ranges, patterns of nicknames, or whatever else you can think of.<br> + A ban on the nick <code>person</code>, for example, would look like this: <code>person!*@*</code>.<br> + A ban on anyone with the IP address <code>127.0.0.1</code> would look like this: <code>*!*@127.0.0.1</code> + </p> + + <h3 id="moderation-real-ips">Discovering real IPs</h3> + <p> + Even if IP cloaking is enabled on your network, you can still obtain real IP addresses/hosts if you are an operator. + See the <b>Operators</b> part of the configuration section of this guide on how to become an operator.<br> + To find out a user's real IP, simply type <code>/whois</code> along with the user's nick, and you will see information about the user, along with their real IP address/host.<br> + <code>/whois</code> is not a command that is exclusive to operators, but it does not reveal as much information to non-operators. + </p> + + <h3 id="moderation-network-ban">Banning someone from the network</h3> + <p> + Any netword-wide moderation action requires being an operator. See the <b>Operators</b> part of the configuration section of this guide on how to become an operator.<br> + Banning someone from the network is achieved with the <code>/kline</code> command. To see more info on the command, type <code>/helpop kline</code>.<br> + </p> + + <p>To ban a nick from the network:</p> + + <pre><code>/kline andkill <i><nick></i>!*@*</code></pre> + + <p>To ban an IP address or host from the network:</p> + + <pre><code>/kline andkill *!*@<i><IP or mask></i></code></pre> + + <p>To unban a mask, you can use the <code>/unkline</code> command with the mask you want to unban.</p> + + <h3 id="moderation-channel-ban">Banning someone from a channel</h3> + <p> + Channel owners, administrators, and operators can ban people from channels. + This is not the same as banning someone from the network, since it only has an effect on one channel. + Additionally, a channel operator is not the same as a network operator. + </p> + + <p>To ban someone in a channel, type the following in that channel, replacing <code><i><mask></i></code> with the user's mask:</p> + + <pre><code>/mode +b <i><mask></i></code></pre> + + <p> + Note that this will only ban the user, not kick them immediately. + You will want to run <code>/kick</code> along with the user's nick to also kick them.<br> + To unban a user, run the command above, but replace the <code>+</code> with a <code>-</code>.<br> + You can see who is banned in a channel by typing <code>/banlist</code>. + </p> + + <h3 id="moderation-muting">Muting people in a channel</h3> + <p> + By default, anyone can speak in an IRC channel. To change this, you must be a channel owner, administrator, or operator.<br> + Channels, along with users, have modes, which modify their behavior. There is a special mode for channels called <code>m</code> (moderated) which requires users to be privileged in some way to talk.<br> + To set a channel as moderated, type the following in the channel: + </p> + + <pre><code>/mode +m</code></pre> + + <p> + Now, users must be an owner, administrator, operator, or be voiced to talk in the channel + This be reversed by typing the command above, but changing the <code>+</code> to a <code>-</code>.<br> + To voice a user, run the following, replacing <i><nick></i> with the user's nick: + </p> + + <pre><code>/mode +v <i><nick></i></code></pre> + + <p>Unvoice the user by typing the above command, but replacing the <code>+</code> with a <code>-</code>.</p> + + <h3 id="moderation-appointing">Appointing channel administrators and operators</h3> + <p> + Assuming you a channel owner, you can appoint both administrators and operators. + If you are only an operator, you may only appoint operators.<br> + The difference between administrator and operator is mainly that administrators cannot have their privileges taken away by operators, only owners. + To appoint an administrator, type the following, replacing <i><nick></i> with the user's nick: + </p> + + <pre><code>/mode +a <i><nick></i></code></pre> + + <p>To appoint an operator, type the following, replacing <i><nick></i> with the user's nick:</p> + + <pre><code>/mode +o <i><nick></i></code></pre> + + <p> + You can also use <code>/op</code> and <code>/deop</code> on most clients to appoint and remove an operator.<br> + To remove administrator or operator status, run either of the above commands, but replace the <code>+</code> with a <code>-</code>. + </p> + + <h2 id="thelounge">Bringing modern-day features to IRC with TheLounge</h3> + <p> + A large downside to IRC as a protocol is just how old it is, and the limitations that exist because of it. + Other old protocols such as HTTP were built to be content-agnostic and versitile, but IRC was built with a very specific set of features, so it has not held up so well to contemporary chat systems.<br> + A notable thing that IRC as a protocol is missing is file uploads, and other fancy features that many other chats have.<br> + With that said, these problems can be fixed by clients, although many clients are still very primitive. + </p> + + <p> + <a href="https://thelounge.chat/">TheLounge</a> is a modern self-hosted IRC web client that tries to make IRC as user-friendly as possible. + It can be the answer to many of the complaints that normalfriends may have about IRC. It runs on anything with a web browser, can be "installed" since it is a PWA (Progressive Web App), + and is optimized for both desktops and mobile devices. It keeps you logged in even when you are gone, and even supports file uploads and embeds.<br> + Effectively, it brings IRC up to the standard of most other chat systems. + </p> + + <p> + If you would like to setup an instance of TheLounge for you and your friends, you can take a look at their <a href="https://thelounge.chat/docs/install-and-upgrade">installation guide</a>.<br> + It is a self-hosted web app, so you can run it for multiple people, not just yourself. + </p> + + <hr> + + <p><i>Written by <a href="https://termer.net/">Termer</a></i></p> + </main> + <footer><a href="https://landchad.net">LandChad.net</a></br>Because Everyone should be an Internet LandChad.</br><li><a href="index.html"><img src="pix/chad.gif" alt="chad"></a></li><li><a href="rss.xml"><img src="pix/rss.svg" alt="RSS"></a></li><li><a href="pix/btc.png"><img src="pix/btc.svg" alt="BTC"></a></li><li><a href="pix/xmr.png"><img src="pix/xmr.svg" alt="XMR"></a></li><li><a href="https://github.com/lukesmithxyz/landchad"><img src="pix/git.svg" alt="Github"></a></footer> +</body> +</html> diff --git a/maintenance.html b/maintenance.html index 5cdbb1a..264fe68 100644 --- a/maintenance.html +++ b/maintenance.html @@ -113,7 +113,7 @@ nginx: /usr/sbin/nginx /usr/lib/nginx /etc/nginx /usr/share/nginx /usr/share/man /usr/share/nginx/modules-available/mod-stream.conf</code></pre> <p> - <code>updatedb</code> is an ideal candidate for a cronjob so you don't have to worry about running each time. + <code>updatedb</code> is an ideal candidate for a <a href="cron.html">cronjob</a> so you don't have to worry about running each time. For example, adding the following to your crontab will run <code>updatedb</code> every 30 minutes: </p> <pre><code>*/30 * * * * /usr/bin/updatedb</code></pre> diff --git a/monero.html b/monero.html index 5827c85..67d27fd 100644 --- a/monero.html +++ b/monero.html @@ -96,7 +96,7 @@ Here is the address we use for this site (i.e. not the compromised wallet generated above): </p> - <p style=font-size:small>84RXmrsE7ffCe1ADprxLMHRpmyhZuWYScDR4YghE8pFRFSyLtiZFYwD6EPijVzD3aZiEpg57MfHEr1pGJNPXyJgENMnWrSh</p> + <p style="font-size:small; word-wrap: break-word; ">84RXmrsE7ffCe1ADprxLMHRpmyhZuWYScDR4YghE8pFRFSyLtiZFYwD6EPijVzD3aZiEpg57MfHEr1pGJNPXyJgENMnWrSh</p> <img style="max-height:200px" src="pix/xmr.png" alt="monero donation qr"> diff --git a/nextcloud.html b/nextcloud.html new file mode 100644 index 0000000..f0debc1 --- /dev/null +++ b/nextcloud.html @@ -0,0 +1,212 @@ +<!DOCTYPE html> +<html lang=en> + <head> + <title>Setting up a Nextcloud Instance – LandChad.net</title> + <meta charset="utf-8"/> + <link rel="shortcut icon" href="favicon.ico" type="image/x-icon" /> + <link rel='stylesheet' type='text/css' href='style.css'> + <meta name="viewport" content="width=device-width, initial-scale=1"> + <link rel='alternate' type='application/rss+xml' title='Land Chad RSS' href='/rss.xml'> + </head> +<body> + <header><h1> Setting up a Nextcloud Instance</h1></header> + <nav></nav> + <main> +<img class=titleimg src="pix/nextcloud.svg" alt="logo"> + <h2 id="whatis">What is Nextcloud?</h2> + <p><a href="https://nextcloud.com" target="_blank"><img src="pix/nextcloud.svg" alt="logo">Nextcloud</a> is a free and open source solution for cloud storage. However it can also do other things, such as manage your email, notes, calender, tasks, and can even connect to the Fediverse (think Mastodon and Pleroma). Pretty much every service that Google has to offer has a much better alternative as a Nextcloud app and this is a must-have for anyone wanting to get away from Google services but still wants a traditional cloud experience (in the likes of Google Services, anyways).</p> + + <h2 id="instructions">Instructions</h2> + <p>First, we need to obtain a shell prompt by ssh-ing (remote machines or local machines) or just logging in (local machines). A traditional ssh might look like this if the domain you wished to ssh into is <code>landchad.net</code>:</p> + <pre><code>ssh root@landchad.net</code></pre> + <p>We should upgrade the system and then install packages that we might need. Run the following command:</p> + <pre><code>apt-get full-upgrade -y && sudo apt-get install mariadb-server php-mysql php php-gd php-mbstring php-dom php-curl php-zip php-simplexml php-xml php-fpm -y</code></pre> + <p>Next, we need to set up our SQL database by running a Secure Installation and creating the tables that will store data that Nextcloud will need. Run the following command:</p> + <pre><code>mysql_secure_installation</code></pre> + <p>When it asks for root a password, say yes and input a new and secure password. The root password here is just for the SQL database, not for the GNU/Linux system.</p> + <p>Answer the rest of the questions as follows:</p> + <pre><code>Remove anonymous users? [Y/n]: Y +Disallow root login remotely? [Y/n]: Y +Remove test database and access to it? [Y/n]: Y +Reload privilege tables now? [Y/n]: Y</code> + </pre> + <p>Next, sign into the SQL database with the new and secure password you chose before. Run the following command:</p> + <pre><code>mysql -u root -p</code></pre> + <p>We need to create a database for Nextcloud. Follow the instructions below and change some of the placeholders as you wish:</p> + <pre><code>CREATE DATABASE nextcloud; +GRANT ALL ON nextcloud.* TO '<strong>username</strong>'@'localhost' IDENTIFIED BY '<strong>password</strong>'; +FLUSH PRIVILEGES; +EXIT;</code></pre> + <p>Now we need to configure PHP. Let's start my making sure that the PHP user is set to <code>www-data</code> and if that is not the case, add the <code>www-data</code> user if needed and set the correct variable in <code>nginx.conf</code>. Make sure this line is at the beginning of <code>/etc/nginx/nginx.conf</code>.</p> + <pre><code>user www-data;</code></pre> + <p>Check for the <code>www-data</code> user by running <code>id -u www-data</code>. If a number is output from that command, then the www-data user exists. If not. add the user simply by running <code>useradd www-data</code></p> + <p>Next, we need to ensure that we have SSL certificates generated for your website. If you have not already done this, refer to <a href="certbot.html">this guide</a>. Although having SSL for your site is not required, it is highly recommended that you have it or you will risk attackers being able to steal passwords and data.</p> + <p>In <code>/etc/nginx/sites-available/</code> we need to make a new configuration for Nextcloud (example: <code>/etc/nginx/sites-available/nextcloud</code>). Create it and open it, modify, and add the following lines:</p> + <pre><code>server { + listen 80; + listen [::]:80; + server_name <strong>yourwebsite.com</strong>; + + location /nextcloud { + return 301 https://$server_name$request_uri; + } +} + +server { + + <strong># If you have SSL ready for your website (DO NOT use Nextcloud without HTTPS, you will risk data leaks including passwords and files), use these lines:</strong> + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name <strong>yourwebsite.com</strong>; + ssl_certificate /etc/ssl/nginx/<strong>yourwebsite.com</strong>.crt; + ssl_certificate_key /etc/ssl/nginx/<strong>yourwebsite.com</strong>.key; + + root /var/www; + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + + location ^~ /.well-known { + location = /.well-known/carddav { return 301 /nextcloud/remote.php/dav/; } + location = /.well-known/caldav { return 301 /nextcloud/remote.php/dav/; } + + location /.well-known/acme-challenge { try_files $uri $uri/ =404; } + location /.well-known/pki-validation { try_files $uri $uri/ =404; } + + return 301 /nextcloud/index.php$request_uri; + } + + location ^~ /nextcloud { + client_max_body_size 512M; + fastcgi_buffers 64 4K; + + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + pagespeed off; + + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "none" always; + add_header X-XSS-Protection "1; mode=block" always; + + fastcgi_hide_header X-Powered-By; + + index index.php index.html /nextcloud/index.php$request_uri; + + location = /nextcloud { + if ( $http_user_agent ~ ^DavClnt ) { + return 302 /nextcloud/remote.php/webdav/$is_args$args; + } + } + + location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; } + location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; } + + location ~ \.php(?:$|/) { + fastcgi_split_path_info ^(.+?\.php)(/.*)$; + set $path_info $fastcgi_path_info; + + try_files $fastcgi_script_name =404; + + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $path_info; + fastcgi_param HTTPS on; + + fastcgi_param modHeadersAvailable true; + fastcgi_param front_controller_active true; + fastcgi_pass php-handler; + + fastcgi_intercept_errors on; + fastcgi_request_buffering off; + } + + location ~ \.(?:css|js|svg|gif)$ { + try_files $uri /nextcloud/index.php$request_uri; + expires 6M; + access_log off; + } + + location ~ \.woff2?$ { + try_files $uri /nextcloud/index.php$request_uri; + expires 7d; + access_log off; + } + + location /nextcloud/remote { + return 301 /nextcloud/remote.php$request_uri; + } + + location /nextcloud { + try_files $uri $uri/ /nextcloud/index.php$request_uri; + } + } +}</code></pre> + <p>Enable the site by running this command:</p> + <pre><code>ln -s /etc/nginx/sites-available/nextcloud /etc/nginx/sites-enabled/</code></pre> + <p>Next, we need to download the latest release tarball of Nextcloud. Go to <a>https://nextcloud.com/install/#instructions-server</a> and copy the URL of the the .tar.bz2 tarball from the More Downloads dropdown menu then go to your server's shell prompt and download the tarball with wget. Here is an example:</p> + <pre><code>wget https://download.nextcloud.com/server/releases/nextcloud-21.0.2.tar.bz2</code></pre> + <p>Now we need to extract the Nextcloud tarball. Run the following command:</p> + <pre><code>tar -xjf nextcloud*.tar.bz2 -C /var/www</code></pre> + <p>If you have multiple Nextcloud tarballs in the current working directory you might want to manually specify which one you wish to extract.</p> + <p>Let's correct the ownership and permissions of those files. Run the following commands:</p> + <pre><code>chown -R www-data:www-data /var/www/nextcloud +chmod -R 755 /var/www/nextcloud</code> + </pre> + <p>Start and enable the php-fpm and the mariadb services (the name of the php-fpm service may have a version number ahead of it, use bash's tab autocomplete to help you out with that):</p> + <pre><code>systemctl enable php-fpm +systemctl start php-fpm +systemctl enable mariadb +systemctl start mariadb</code></pre> + <p>Reload the nginx service:</p> + <pre><code>systemctl reload nginx</code></pre> + <p>Now we need to head to Nextcloud's web interface. Go to your web browser and go to your website, but go to the subdirectory "nextcloud" instead. For example, if your domain is landchad.net and you have set up HTTPS then go to <code>https://landchad.net/nextcloud</code>. This will launch the configuration wizard.</p> + + <ul> + <li>Choose an admin username and secure password. + <li>Leave Data folder at the default value unless it is incorrect. + <li>For Database user, enter the user you set for the SQL database. + <li>For Database password, enter the password you chose for the new user in MariaDB. + <li>For Database name, enter: nextcloud + <li>Leave "localhost" as "localhost". + <li>Click Finish + </ul> + + <p>Congratulations, you have set up your own Nextcloud instance.</p> + + <h2 id="whatsnext">What's Next?</h2> + <p>Now you may be wondering: What do I do now? Here are some suggestions:</p> + + <ul> + <li>Rice your Nextcloud instance by changing your themeing and installing new themes and plugins in Settings in the Nextcloud Web Interface. + <li>Install the Nextcloud Client on your personal computer and sync your files to your instance. + <li>Install the Nextcloud App on your mobile device and sync your files to your instance. + <li>Set up your email account on the Nextcloud Mail app on the web interface to view and sync your email there (just like Gmail). + <li>Schedule events with Nextcloud Calender. + <li>Write notes in Markdown inside the Nextcloud Notes web and mobile app. + <li>Set the Nextcloud Dashboard as your web browser's homepage (it is pretty nice). + </ul> + + <p>Enjoy your cloud services in freedom.</p> + + <hr> + + <p><em>Written by <a href="https://github.com/MattMadness">Matthew "Madness" Evan</a></em></p> + + <!--<span class=next><a href="<++>">Next:<++></a></span>--!> + + </main> + <footer><a href="https://landchad.net">LandChad.net</a></br>Because Everyone should be an Internet LandChad.</br><li><a href="index.html"><img src="pix/chad.gif" alt="chad"></a></li><li><a href="rss.xml"><img src="pix/rss.svg" alt="RSS"></a></li><li><a href="pix/btc.png"><img src="pix/btc.svg" alt="BTC"></a></li><li><a href="pix/xmr.png"><img src="pix/xmr.svg" alt="XMR"></a></li><li><a href="https://github.com/lukesmithxyz/landchad"><img src="pix/git.svg" alt="Github"></a></footer> +</body> +</html> @@ -172,7 +172,7 @@ This will appear on your website. <p>This is my website. Thanks for stopping by!</p> <p>Now my website is live!</p></code></pre> -<h3>Enable the site</h3> +<h3 id=enable>Enable the site</h3> <p> Once you save that file, we can enable it making a link to it in the <code>sites-enabled</code> directory: @@ -186,7 +186,7 @@ Now we can just <code>reload</code> or <code>restart</code> to make <code>nginx< <pre><code>systemctl reload nginx</code></pre> -<h2>The Firewall</h2> +<h2 id=firewall>The Firewall</h2> <p> Vultr and some other VPS automatically install and enable <code>ufw</code>, a firewall program. @@ -209,10 +209,11 @@ systemctl disable ufw</code></pre> This keeps the firewall otherwise active. </p> -<pre><code>ufw allow http,https</code></pre> +<pre><code>ufw allow 80 +ufw allow 443</code></pre> <p> -This will open port 80 and port 443. Port 80 is the canonical webserver port, while 443 is the port used for encrypted connections. +Port 80 is the canonical webserver port, while 443 is the port used for encrypted connections. We will certainly need that for the next page. </p> diff --git a/pix/auth.svg b/pix/auth.svg new file mode 100644 index 0000000..5b17192 --- /dev/null +++ b/pix/auth.svg @@ -0,0 +1,1461 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!-- Created with Inkscape (http://www.inkscape.org/) --> + +<svg + version="1.1" + id="svg187" + width="327.67999" + height="184.32001" + viewBox="0 0 327.67999 184.32001" + sodipodi:docname="auth.svg" + inkscape:version="1.1 (c4e8f9ed74, 2021-05-24)" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:xlink="http://www.w3.org/1999/xlink" + xmlns="http://www.w3.org/2000/svg" + xmlns:svg="http://www.w3.org/2000/svg"> + <defs + id="defs191" /> + <sodipodi:namedview + id="namedview189" + pagecolor="#505050" + bordercolor="#eeeeee" + borderopacity="1" + inkscape:pageshadow="0" + inkscape:pageopacity="0" + inkscape:pagecheckerboard="0" + showgrid="false" + inkscape:zoom="3.6468507" + inkscape:cx="163.84" + inkscape:cy="92.271395" + inkscape:window-width="1920" + inkscape:window-height="1024" + inkscape:window-x="2109" + inkscape:window-y="28" + inkscape:window-maximized="1" + inkscape:current-layer="g193" /> + <g + inkscape:groupmode="layer" + inkscape:label="Image" + id="g193"> + <image + width="327.67999" + height="184.32001" + preserveAspectRatio="none" + xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABAAAAAJACAYAAAATlRTVAAASxHpUWHRSYXcgcHJvZmlsZSB0eXBl +IGV4aWYAAHja1ZpZkiM5dkX/sQotAfOwnIfJTDvQ8nUuGJGdmVWl7jbVhxTMIBmkOxx4wx3g6c5/ +/ed1/8FP7im6XFqvo1bPTx55RONN958fe8/B5/f8/ZO/Pv3lc8f7+N5FPkq8ps8XvX5ew/fn3wN9 +vQbjXflpoL6+vpi/fjE+1/Wx/zbQ57I+aUZ6v78GGl8Dpfj5InwNYJ9l+Tp6+3kJ83xe9/dC++fX +6Smur8O+Dv7979yI3i5cJ8V4Ukie55jyZwJJv8El403lOabGgYGHpcJf+iR+DUZA/ixO/qdZuT/J +SvizrAz/I0a/JCXVzxGOD34NZv3x+qefh/Lb518Duhfin66cvuMTf/18nBB+X8737727u3vPZ3WW +KyGtX4v6XuJ7x4GTkKd3WuXR+C28b+8xeHRH9S5Svv3yk8cKI0TSckMOO1i44bzXFRZTzPFEUhJj +XCRKn3VSNOJK3pGlrEe4saWRdqJv0iK9iU/jj7mEd93xLrdC58I7cGQMDBaUX6env+PxlwPdq5In +wP2lPrz8hKjKYhrKnJ45ioSE+11H5QX4+/H7j/KayGB5Ye6Ma35+hpglfNWW6ii9RCcOLLx+gUTb +XwMQIq5dmAxVn4OvIZVQg28xthCIYyc/xkCdpomTFIRS4maWMadUSU6PujbntPCOjSV+PgazSESh +sRqpGcnIVQbYqJ+WOzVkJZVcSqmllV5GsZpqrqXW2qrAz1pquZVWW2u9jWY99dxLr7317vroNuJI +gGMZdbTRxxhmXNQY2TjbOMBsxplmnmXW2WafY9qifFZeZdXVVndrLNtxpw1O7Lrb7ntsO+FQSief +cuppp59x7FJqN918y6233X7HtR9ZC+6T1j88/vWshe+sxZcpHdh+ZI1TW/seIghOinJGxmIOZLwp +AxR0VM58DzlHp9QpZ35EuqJEZlmUnB2UMTKYT4jlhh+5+0fmfsmby/l/lbf4nTmn1P0dmXNK3V9k +7o95+5OsbbHN8sm9DKkNFVSfaD8OON1iN5Hav/zq/t0T/t8NZLsSukaojYSEbWUskcFYBK1Rrztf +81Y3md6rWgFllBCrd1ipvHEpdbt1Xr+QN3XPlUZNh5zHPAfQCHTvfufizIYAKUB1W2maXbJttgso +dmrJbocGoMNFY9baZ2P4UE5ZI3D2iKXsldJBksBaxrxuz3XmdJlgLv0y4X17uVdNay2rtGJZGZpo +FFJIo68T+qqa1KXg2521TOoisHSd3o5NphOs0FIzJtcLFbq5BExqGy7k2FC5YjuhXYjrL+egKaQf +47t3AYbv9+xR9bX5ug8le82Yx7zRX6Lyzy7k/tmV/scLpdvayeHc3hyDpgI13w0Tr3YPH+jwXvjM +9w0g35t9n/oTPOPfCbndumbjnKS2O3cXFyDluHUQAmDyZt6S22G8nvaNcTDwML9XzjvMOko1C70m +qB9O6tcg7d1GcrcbVH9bOmHNDcDtWEbu+1JFVCZXZUGEet0L/qAo6q02atvp3FCyp0Soux4dJbX2 +pABnMCUHCO2DUm2Zxd98lkClgnU9R+OPvdfshWuFM1lu2qR/7hNdp6aLqpqIAbaNupzx5AX72+XI +HOP0da4+clnlRkKT5gaTS8shM0pkGjNvB2CmQHDmqjuuHVPdgG9YA0ieffVd8oTNoYURxQfnlt1P +B7gu1L1zt7WN5nJgY7+pV3VEpRIONXAPnTGphbQCfWi+zJh3Mp5gV7/mkryLVFkkh+mlymU7VHk4 +GQkXbKYEpTCBQAznBrV7LPUQ3tuYZYGSbn1sUm4nCWOj6Dw4Xx0sA+WiiIAHZoNQYKKzHT9YJkRS +24252F7jDNRGCiOdkyg8gJxVZv7tyriO+FjPBCdrgjedXVcO9VU4kbd4N8R1s7VVEDGgyRg37zHP +TmK61q/STB29EygL8Cqr2ibjV6oH5FldMHcrtMnxvu3WCBpH9FzGKX2uC2fvCKNVR01dlt1KIcRM +todyMzyMbvIkLZXTyknlepZDmZakqGwj4Iu5Q4+RvlyWHCxG54y0oCvflk36oVXyxeq35QaSvnJZ +voGFeos4+JNXpzdBc06NmrmrUBiIf1rJnzVHADlgu4HeO6sUVbvfYEqurJ+SJRenznKmuzwdr6K5 +wDeq+4ZBX3vGKORwN6nEGk7zh6Ve243MD6qA2K77SdE8uVDZs8HgtCR2AxhT4bZbjMwYBB0Ck6xE +MF4AjXf9wAZzViT+0CBkKAckvpZGb+QOZGdkEOrhY0KPIQSIGOhzF+03C6nJs+8Q+YjOm/RMoQc7 +8DEH3U+IyqDkaYh0YiCfzWQNMuR0W4VDAEQaFYMhGIu0ZWLu24AMZFIYJ+ZRo7txnNR8QNAwR1wn +XBlVEASqkrUEqTUkXmGkIA6oxHA03CotMufunvyD5lQ2wNQ6E50lj0AbQbEJ6EEMNoiXyUZID9G+ +6vHndBHAAuUzIRa3JIACsEX65TUZ2yg2Y8o0U0fSCjgzmF2NWKcCja0ph6WOB53AvaVQD1+2RFKL +TgVNBSTM81W53PLqo3AZ4bjqh/xRLqvHA/IeAqtvInmdPgAXNBsU7hLl3Kap1SbFf3yk6xP1gaeM +zyXK1hG9xCLIF/0SWV+YsKsBDoUmIVXe9XQG3dV2iSwPX0JCxqjA2RRpGNPt1F310MmZmQDid2i1 +MdJMEVaB2FCreFq/N4ojog9KH8wH/Ug4oiJIwDo9QZBWabagVLGgR9BSGWujgmEimBhB2h0A6u9B +aAow4JuBOqZIoyFA8hPty6NsYVVJo9TgkW7oI21NTAuKQqi7HrgfpUGh1Cu3av4CsCDoJAXEnDKC +kAtoeWwTEvolLogZwQU8UK190BUA83EF2AfsOhem1joLAd+X0Gl+pRhV/OjaEO+kCtFQI/h3PBQl +4w8XxRAdsDc4NAV6SVVviwsfdBZO8DQu2+AvJFwebS16GLgTmHlgZCKbIlOliaAjWotUSlXQ2u20 +DYuAMFuNB4ZiEFYX7oyOLaK456C226aVN76LWCc7nBecnAGQFpEJIrVOR6QEBca5TqMUaaspTsLH +bGATgoqNFtM+Q6UGIIE1Df2P8UOYUFsbUGoT8r7zcGUUEXk+szSwghSDQgPY6Kf2mBdLr7GCyzUh +nGigEdwiGPDiDdRWFh2srQjSwmKwCWxSvdTkawumiVoq9NtHuQGXmzRRCcWpaihSwImiYCo0JIZr +n81B4zQwBqndSJMEK3PtxBTWX0ssTGi/4nRdanYtnoNKkA7B6cr5EQsUE4EiTkb8Z2alODFyhJ7H +qtG6NHp/LFKQQht39N77P7w2FOdPhKF6+kEZ93c6QUT8+vUfCUWqUcdH2ucJVvzs3aoPorDmCQ9h +8nXliRI7CGBRDWp93I6wYeZGRkBUcAib18BTSjki2ba0xcXygj1BvY9kvHQ/CqesD2X1yrjoVYwp +b6nHpd0iRpPLzbSlxZBp2Yy6Q8EaSvusQEMu5DEzHLdIEyMNez8bKOZq9jhy55FYRwx2sDs4W5D1 +HPln6ApIwnd2jCmrdQApKlBYi8ipELZOzp9d4EW7DGQeA9A3LMTw3gDOlXAYA/s7QRV03laM0HU/ +/sody0yMnw8gIkgY9DGYNuQP1NyVJiT0odVnbXBRKBChHjpbcj9nxDt6cO762Hz7LBWOOXoV7edE +ednJ89IXiFZfF1NcGXqi6uHq5ACdeSJCDeqkrYBAFn20YwiQkz0MHFlD4+BkWA5ggQcAIxnVl6Tx +INGdokNkqCxYBeA/JPPQahnK98AXCIMLy2cYkm9mrFBmCqQWFKNJwJVBBxP9mx0Vmj5DWZPTBLN7 +0kYFkD7pbIOVcB9+5NYGkp02aUgKSvVAbRfcrgrjcFpEYFHN5FWzSDLaB1oP3EqTk2rcBmywaU6i +S+etmWpDCFSQKqNKakYeA5+f6oZUSB7iB3LEldDYjXLMROycDYLMjoESbR88RFt7bboZXY5kabE6 +j5hHN4OWWx1YLyuix8gsUmpny3eIVNBQSdOD/A1UhrUmSpP4BotKT3A714WgryEZYnZw4FMLSeGl +ZrFeoBlmhnUcjx7zFFGQnjwcypUCS6YDu4OvWhz6KieP5egrZCoCHQyHiaUpeHgckIZNqrbgvRGj +DMwyjvZjmpZQn2A/0k9PfQhMLkwNKW0ifnTX5B0h2f7sapIcxAIUymHi/bCdfcKgLlbVPZQ+WGPX +x4J+FJZVIOAMAKdn8h17o7sxfAPdvrTRlSTVvNSGh07V/cANOcc0ch6tgKAnXm9+7/lQj1dofnqH +YejxuuLhgUQxiLRS3FD2EoYC9uogifa7ngeYO3+2YvByZ3p7f/jfX5GoEHiQLHZDSrZTIxP516E3 +3CCVobsd8sSvsylc2Dv5jcXlekdSu1ZUJAIqLzOpSjexqkiXhu0MMoNwIkoPWMMzr4JNFkcSoeoV +GS4NHIOtY8WYAVJUHn1X93YZ44b7RP1tQMMyfENBII+RccwZeROwBhvhI3GNyvba3UhiGG0gtM+m +wxWLALQzQ5aInplodr5C9Kw+h/iAdiMI9owgYAMga6/P++fhqSlrUZIkOc6k328jYRTgCZxOfnUh +Wn/0Qg1G4nMIG/PC0QxtjdI4sLBAA8t2J4LeAfrjPopbLFa2A5cBa+FjOzBK87JCIEPaUpYxTizO +usBQS4uuKyhOBPB2NDEcn5h8wv9sBMtMAJvhtFIyfPNmYJU1fhZNK55HHDdZHZY0oZUzcBXZyXFq +S+4pJjQ3BSelgf1Vz1TTHhEwLR2JrgUwMqhxQkMCDWAbrMVZwsyuSocvuZfVQkFCxrIf0BIBA6nQ +75W0gGO49iPRj7T3QPl6mY81lOcE3Iq6gIluzvd2FPoe3/4jXS9Z3r90sayLpEXIXSw2mZeGgqoN +MYrMZLaJFKBydzuR7kZaBSlDvjUP74EyNBTGr4I4IVSJICAZHY7ivmIt/NqHtITRH9pCTZ+FE+BK +SFN9w4KvPFnDPiokCKkht6tSKOhMw1s6yYfphQaxs9qKLQSOUH1KF0RfDVzIb4eSWvPa6A5ZG1aS +wEHnMleeqWzUMQCF8GQJDR3ECJiU3iE4wFddfmX6STeWS3tOSc2rYgvCEtFSofu5GN4TG8jVwm0I +EfoV6byeNsZNDO1xxIFyMnxVl+9Fs5pUCCIYosOLN6OOBnHO2D5lHSxkgIGe6HFN9EWnZxB4TZsp +eMHda3sbNUg/xKUtAkMx6rYbsoblDi+mBZoQrwG6mgN074t5Q42jdkzTiZ26AoRAlq1NRnwvXC36 +IgkIrVSG/EPQTtlGTwyE2khJZQKmXPSatqBIG54mHQxIR1Wa7q7oBgKuZEaBXIAgl66FJZfLz7JK +4YAx2bQ9KBmABgSb38xNGJZJW5KDYXSIOKGh4Tc30TMIPpRO3BK3wLfnSixlFH+wHGBaZsbYSDRU +IrQFwlmtkhzKbBEGLGEOECRtB4wLYnVs2OiVSbeGeij5EBt2Yg1/aEBYAFWEGBgZZcrCvUn1DkgM +v8ZZGT427RE3yf0mY48M0hZHQ3mhH6Fg9Ko8Ma42C5TRm8BBpatoVtRtdWlOpsO6adH9WuV5yVRQ +1GUv8DLJeUxOS0hUdJPhmrovRdQIj6ByEJTdTcEa3FR0IyZVNWFBV2pTUkgwfW+KDZamqOMnRaPa +kUHcEqJIVXxKbs4P1sToF+TfSCwEKwwmW4MdZDjdcxqYmqvtvD5J2EXJIURP0i22KzxEhJlDtMjF +xsI/7bDik7PuaI3PBprulP7FzprutaWFcgIS03LxMELfFIwC6pEfBs3lxNLCmbAIbzIWvQmHAdLN +ggKF3gUx2F1qDDU1s6vHTseeq70QMxQN6BMKBpKYUduHLqFZxaMA+Kb09P9DqCxKKvjFYbg9LKgL +Xv+XoYmNrm49k1WiPDDMXSQgEYvkfhv0kpq0SttjLNigUmbam0Fo+ANCQhhTNPM2efLbVPrHLQTI +uWrDDnIu3zt8XzcfsNbpACNfI7ofQwrev8f8ZcSfx5O5eCP+Pl6ShsTRNm3nFZrvr5aVdVoVPIpv +sFhvj/djzgTpYpFBAgqMucALmmA32dIsQzjOS8V4uy5IMyQ1XGraLYm/r8D9tAQY5IDX9HekT4Fn +TIy2OahK5B0IB1glikZbyjaL/DpfM/gANZz8PWQrvRz42mT4WAAIfM7TjentZ+qu5NTeEz6GUqJt +0Vmrf+QhwtocssFPbVhZxccgrXDfCb+KTfKchc1HxyXN97kbNA7MSaskoH1qFwVQxk0PB21h3Cgq +iQTcAU7Gy+I0zCgSUn0EVN2Q4jLalYVl2OrAQOLmhcvFwqFcHC5zC9UONlpOetVdgFH4bL07OHAm +YnAd7DKisg1ZtYhKanLhmAACvXWzwWmNp8jmMgfd4rP4Eb9wzL9zT9P9TTdF/68PRG8O99/i0SwR +BaCXfAAAAYRpQ0NQSUNDIHByb2ZpbGUAAHicfZE9SMNAHMVfU7UilQ52EHXIUJ0s+IU4ahWKUKHU +Cq06mFz6BU0akhQXR8G14ODHYtXBxVlXB1dBEPwAcXNzUnSREv+XFFrEeHDcj3f3HnfvAKFeZqrZ +MQaommWk4jExk10VA6/owiBCGEdQYqY+l0wm4Dm+7uHj612UZ3mf+3P0KjmTAT6ReJbphkW8QTy9 +aemc94nDrCgpxOfEowZdkPiR67LLb5wLDgs8M2ykU/PEYWKx0MZyG7OioRJPEUcUVaN8IeOywnmL +s1qusuY9+QuDOW1lmes0hxDHIpaQhAgZVZRQhoUorRopJlK0H/PwDzj+JLlkcpXAyLGAClRIjh/8 +D353a+YnJ9ykYAzofLHtj2EgsAs0arb9fWzbjRPA/wxcaS1/pQ7MfJJea2mRIyC0DVxctzR5D7jc +AfqfdMmQHMlPU8jngfcz+qYs0HcL9Ky5vTX3cfoApKmrxA1wcAiMFCh73ePd3e29/Xum2d8PfU9y +q543VLoAAA3naVRYdFhNTDpjb20uYWRvYmUueG1wAAAAAAA8P3hwYWNrZXQgYmVnaW49Iu+7vyIg +aWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/Pgo8eDp4bXBtZXRhIHhtbG5zOng9ImFkb2Jl +Om5zOm1ldGEvIiB4OnhtcHRrPSJYTVAgQ29yZSA0LjQuMC1FeGl2MiI+CiA8cmRmOlJERiB4bWxu +czpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPgogIDxy +ZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiCiAgICB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFk +b2JlLmNvbS94YXAvMS4wL21tLyIKICAgIHhtbG5zOnN0RXZ0PSJodHRwOi8vbnMuYWRvYmUuY29t +L3hhcC8xLjAvc1R5cGUvUmVzb3VyY2VFdmVudCMiCiAgICB4bWxuczpzdFJlZj0iaHR0cDovL25z +LmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlUmVmIyIKICAgIHhtbG5zOmRjPSJodHRw +Oi8vcHVybC5vcmcvZGMvZWxlbWVudHMvMS4xLyIKICAgIHhtbG5zOkdJTVA9Imh0dHA6Ly93d3cu +Z2ltcC5vcmcveG1wLyIKICAgIHhtbG5zOnRpZmY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vdGlmZi8x +LjAvIgogICAgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIgogICB4bXBN +TTpEb2N1bWVudElEPSJ4bXAuZGlkOjUzNjJCMUJDNDE2NDExRTlBMzVERjdBRTQ5RkY2NEE3Igog +ICB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjM4Y2ExNWM4LWFkYWMtNGMwZC04MWQzLWQ2NGJi +OGQwMjU5MyIKICAgeG1wTU06T3JpZ2luYWxEb2N1bWVudElEPSJ4bXAuZGlkOjdjNjRlNWEwLWU2 +NDctNGJjZC1hMmE3LWQ4MTRhNzMxODk5YiIKICAgZGM6Rm9ybWF0PSJpbWFnZS9wbmciCiAgIEdJ +TVA6QVBJPSIyLjAiCiAgIEdJTVA6UGxhdGZvcm09IkxpbnV4IgogICBHSU1QOlRpbWVTdGFtcD0i +MTYyNDgwOTE0NDA1OTY1OSIKICAgR0lNUDpWZXJzaW9uPSIyLjEwLjI0IgogICB0aWZmOk9yaWVu +dGF0aW9uPSIxIgogICB4bXA6Q3JlYXRvclRvb2w9IkdJTVAgMi4xMCI+CiAgIDx4bXBNTTpIaXN0 +b3J5PgogICAgPHJkZjpTZXE+CiAgICAgPHJkZjpsaQogICAgICBzdEV2dDphY3Rpb249InNhdmVk +IgogICAgICBzdEV2dDpjaGFuZ2VkPSIvIgogICAgICBzdEV2dDppbnN0YW5jZUlEPSJ4bXAuaWlk +OmExZGRlYWExLWQyNTYtNGMxNS04OTRiLTFiYWI2ZjA2NjFhZSIKICAgICAgc3RFdnQ6c29mdHdh +cmVBZ2VudD0iR2ltcCAyLjEwIChMaW51eCkiCiAgICAgIHN0RXZ0OndoZW49IjIwMjEtMDYtMjdU +MTE6NTI6MjQtMDQ6MDAiLz4KICAgIDwvcmRmOlNlcT4KICAgPC94bXBNTTpIaXN0b3J5PgogICA8 +eG1wTU06RGVyaXZlZEZyb20KICAgIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6NTM2MkIxQkE0 +MTY0MTFFOUEzNURGN0FFNDlGRjY0QTciCiAgICBzdFJlZjppbnN0YW5jZUlEPSJ4bXAuaWlkOjUz +NjJCMUI5NDE2NDExRTlBMzVERjdBRTQ5RkY2NEE3Ii8+CiAgPC9yZGY6RGVzY3JpcHRpb24+CiA8 +L3JkZjpSREY+CjwveDp4bXBtZXRhPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +IAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAog +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg +ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAg +ICAgICAgICAgICAgICAgICAgCjw/eHBhY2tldCBlbmQ9InciPz53BIxFAAAABmJLR0QA/wD/AP+g +vaeTAAAACXBIWXMAAC4jAAAuIwF4pT92AAAAB3RJTUUH5QYbDzQXsaA0ogAAIABJREFUeNrs3emz +Zdd53/dnredZ+5xzhx7R3RgaU2OeSBAaSU2UKcuUrJJsJ7ZTeeHETiWVVMVVqbzOi/wPdiVVrqQq +KdkllezYGijKFCVxFgmCE4iBBBpjAyDQaPTc996z95ry4nY3Ly7OePv2/P1UnboHB7fvcLr32s/z +22utLQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHC5Od4CAAAAYHv8y3/9wsz19b/6 +nx+rvGMACAAAAACAG6zhJwwAQAAAAAAA3IRNP2EAAAIAgCIBwHWCIh3gnM4YA4AAAKAoAEAwAIBz +PGMKAAIAgIIAAGEAAM7zjCcACAAACgIABAEAOM8zngAgAAAoCAAQBADgPM94AoAAAKAoAEDRDuAm +OsczpgAgAAAoDABQsAO4ic7vjCsACAAACgMAFOsAbqJzPGMLAAIAgOIAAIU6wLn9Jjq3M74AIAAA +KBAAUKQDnNcZXwAQAACg+QdAkQ5wTmeMAUAAAFAoAAAFOsD5/FLq7Kt6nDPOAAQAAGj+ARACAJzP +r249fUWPfcYagAAAoFgAAAIAgHP5tVE/X/axgPEGIAAAKBgAgBAA4Dx+bdXMl3VMYMwBCAAAigaO +PwBXqPimIAdumMZ/Kz9Pvcyfz7gDgAYEuAyFA8cTgG0t0CnGgavS+Ltt/rzLNX4QBACgYQGuUPHA +sQPgioQCFOLAFWv+3TZ8znbPAKiX+OcJAgDQxABbLB44XgBclTCAIhy4qo2/2+Y/N+14rtv85wgC +ANDQgALiMh8jHFsATf22/hkKcHDeviYaf3eJX2feq/1bCQMuy1jBGAQQAAA3chHhOH4AXOFwYKbi +miIcnLOveOM/739Pe33Wpr7O8OcIAgAQAACXUEi4bTpeOLYAmvytfB4hADhfX53Gf5Yr+26G5/PU +AJMa/Hn+H0EAAJoUYM5iYivr+9hHAKDRv9Q/s9W1vhTfoPHfnvPvtMZ/2nM3x9eb5Xgf9XzWYIAg +AADNCLDF5n+eNX7sEwDQ+G9H4z/vVT0Kb9D4X9q5dpYr/JNem3VGwKxjRJ3ycdbnBAEAaEBAUbHF +Jt9t4c9wvAGEAfM09ZdyRY+iGzT/l7fxn/fjVgOArX4kCABAAABs4ar/Vtf5TTqOOL4AAoF5mvst +BwEU3KDxvyKN/6yvzfKzzNLgz/rapQQB3DoQIAAAbuiiYtbGf571f/McUxxzwI3b7F9K03/JV/Mo +tkHjv+2N/6TnlxICbD7GxzX6k/573J8dN65MG7uYDQAQAAA3VfO/nWv9uIUgcHM2/pfS7G9LEECx +DRr/y9L4T3pt1iBg1gCgTnmtTvhzs4wlBAEAAQBwUzf/04oBN8fnTzuuON6AGz8MmHU370td50sI +ABr/K9f4z/KYNQSYtfmf9pAZQgGCAAA0JLjpm/+tNPyXsvEPswGAG7fZn6Wo3q71vXNN6aXIxg3c +/F/txt/PEQaM+3m32vQXmW2WwLSxgyAAIAAAbqrmf94iQGTr6/3YEwC4uQKAac3/rFfuZl3jSwgA +Gv/Jzf/mc/K8jb+f0PxPCwM2/yyjrv5feK1Mafin/f/rLghgjAIIAICr1fzPs7bvUjf+4ZgDbsxA +YJbGf9Y1vbNO6SUEwM3Q+E87d8571f9Smn4/5eO0AEBk+tX/MubjuNdG/bcQBAAgAMDNVmxsRwEw +71o/QgDg5gwA6oTiflpjP+uVPEIA3IzN/7XQ+PsJzze/NikEkAnjxOYmv8zwfJYZAtNmFY0bS654 +EMA4BRAAAJe7+R/1317mX/M37mtOK044FoHrs9mfFgLMctV/XKE+7vVL2eSL4ho3e+M/remfdHXf +j/lvPyEMmLQfwKSAb1LTv/kxLhCYNo5sZQypWxwjCQIAAgDgmmr+503/J4UBs4YABADAjRkA1BmK ++1mm+k6b2jsuWCAEwI3S/F/Oxl9k9mn9W31s/prjfqdRY8G0pj/PEQRcjjCR2QAAAQBwwzT/fosf +59n9113hY49jGzTrl/97TNvhf5YNvSYV79OKeEIA3CjN/6U2/iKzb/A3aZr/pIdufL4iyTtXfXDO +e+e8L+qlBu+k56SqH8hZl4uXtjpXxURExLssPVdFfalD16+1xlpqLM6nKr6W4nypRUqpWkKteUoA +kCcEB7OOH9f0/gCMVwBNArDdzf+kdXzjpvjNGgJsVwDAMQpcW+HBVq/8lzGN/7irflu5mkcIgBup +8Z+1+Z9nnf/m5n/UOV5HPP/IxxAGPsZWc2m9SPWmzntnvhTnUywu+6FTVWdmzqwREZGUOokx1pxz +1dpUM19D46uIlJxzyUmKk5C9t1Ikbmzyp32cdfyYd0bRVQ8CGK8AAgBQdGxH8z+uAJhnit9WZgNc +ShDA+AAa8Gvr59tq8z/vY/MsgVmn9E58TymqcY03/5dzg79JV/1HNfybn6uIeIuq3jutPvviks85 +anHFey9OVX3s7Xa1dE7impPUrv901hMJg+p8U5u4UlNKNadUaq3FJBTzoYhYdkVKtLSxyc+bmv5Z +g4BZ9wiQOcaSKx4EMF4B28t4C3ADFR3zNP+jCgCd8N8qW9/451JmAdCEA9dOADHPbv+jdvWetq43 +jxhHyqbvWab8bG7Mc+Baaf6v9gZ/06b464TG/+KjlqhFvIqqiut5Z6beFe+8OJHqV04X11fnFry5 +4IpzzkmqTV0dqgyLqxq0irMioRaptZQqJVdXvKQs/kNN/+aHbnjuN33cPLb488/dhjHJTQgBxo0t +k8aVSeOM244g4F/+6xccIQCwfWgucL0XHeOKg0lFwMYGftpUP50SBsx6H+DLuRcAxzFwaY39vF9n +lqv/s27oNe3K3rgrepOm8477eT+EghpXuPm/1jb423xeH9Xw24jm30REe+a0S1lTMRVVr9aok+Jz +1/kUWx+kc3cd2O0euHO3O7BnSbz3cuzUqrz6zun61vun6smzufYXFmuzsFiqdznGtuS4mr1PJWjN +NYaNTX8aEQSkEWPHVpcGXBcbBTJmAQQAoOiY1PyLjJ/uP6nxH/fYXCBMWxrAXQGAGy8wmGXTv0lX +/vOY5n/cY9ZCfp51vBTUuNLN/5Xc4G+eXf2nnfttxPOLH2Na1aa3oC4saOyKDtdWvC9Jdy6Y37HY +c598zPxt+3e7O2/f7Qbn59tGEXnnvZV69IPT9dvPpXpqdViOn10rbfHFN6E0Pc1VhrnmNoe8sLnx +TyPCgLSFseO63iiQMQsgAMDNXXTMclVgXCEwS9NvMwQCswQAWw0BOFaBq9vwy4RCd9zV/0lX/ic1 ++2mGMGDSbIBJBTshAK7X5v9S1vlP29xvcx0wruG3Ua+tra7qwuKyNr2Bpthq6U7r3iXnH7xrj95z +cK//+H0LLgTnnBSX6lCcc06lV0VUSvXl9Z/E+tqRY+X5V98v75wYlugXsm96udaacxxmc83mpj+N +CQJmGTtmuYXguD0C5FoLAhizAAIA3NzNv8jsVwL8iJO/yoSEf8Rrk0KAScsB5g0AODaBaysMmOfq +/6zN/7xF/bhbfxEC4Fpr/q/0Ov95N/ibVgNsfv6R1wa2qMNhZ123pgsLXu+5fVGfuH+Pf/TeZd2z +5L1lceLEZRG30kYnIrLYC1XXj8QqulZW2lBeebctz792prz85ul8/FSbqwu5aZqca7e5+U8jAoFZ +w4B5NgqcZUyZNL7UOcZWQgCAAADY1uZ/czGwuWm3GKP2ej313lvO2Uop5pyzWqullEzNqaqaqlqt +1XIRLaWoc6qiXiWnaZsDXsm9ADjWQcN+eb/+XFf/ay6l1pprddk5V7z3SfXiut5ULaVSSqqpJhFJ +qiF5cSnnnFJK2cxvLuqnXcnb8lIACmpsU/N/Jdb5e5ntqv/EpX7e9bRKsVI6LTWqiJj3alK9iXir +ctqasGRSg7VtNefUen2zktdsOFzTprnNUj1h+/d2+gsP7tFfuHe/7l7qq5jz0TsfhuJOhXP+L977 +lnz+x19xa10rf+f+T8pvHfyleq/fv37MllxEXYnel++/+kH+0neP5CPHfQ7LtyddO5ZjjClXn4L1 +knMu1ZyTiCQzn4Z5mLz3yTmXitRca01OfKpes3OaXUppQggwbRy5LvYHYMwCaApw8xQd09YFznzl +3zlnImKllIvNv6oG55yVUkxcCTlnyzmb997MTFXVRNaDgFrrqH0BtrohIMckcO0GC7Nu/HehcM6N +hYtX/kspuRTJOedUsuRaaxKT6JxLZpZUNeacU44pOedSCCGmlDbPEhi3JGBSwT6tKKegxuVu/rd7 +nb+X2Xb3H7exr4qIpSSq6kzVqfPl/BV+Z1LNRLw1zmyYVkL2Q/M9sZyLxVat75dteeEWk+ZNe2Lf +LfrJB+6wg3eLDp3omqzpQi5+QXr+L84+7774/Nf9X7z8dffKyjuSSpY7evvlN+//ZP31Rz9Vf23/ +4+UWW64LIlnWSimuyaeL5GdeGeav/eDFdOpUP+3YtZyrz+n4qeNpOBzGpd5S6tlCql1NJeQkriTn +XBLnkoikWl0qpaRSSlbnJy0NmPfWgdfs/gCMWQABAG6+5l9kth3/R671MzOLMVrOOXjvzXsfRCSc +DwaCeBecq+adC86JlRwttZ2tra1o7Drr9fsT9wOotU66LeA8BROAq9/8i4y+Ajbq6lluUyyqmlVD +VtXkvc/BeqnX66UQQjy30qVSSlR1FwKAGFMbVTX1+/3YDuOoqb+TlgOMuzPAuMKcghrb0fxfyXX+ +4zb2nbTOf+R0/1KKee/Vq9iF0D+naiI+eG8Wire2tEH61WzgLMY2pJXWFm1gt+zcZ5/9ZGOHDu7T +nUEsrqxqsxR0KJ1/ce1t/Ytvf9X//nt/444cf9evpXNOdvZFvBc5syaSQ92zsKv+kwc/W37t4afK +39n/RNkv/SIxZKk+n42Sjq6czV97di0dfuPtdPT0auov7029wWJqV9dSXluLvUZTcSGVUqKIJO99 +UueTczWVUpLUnKr4WfYIKGPCgKu5PwAhAEAAAIqOicXDLFf/x230Y865kHM2EQlmFkQk5JxDrTU4 +50KRHJxzIacYVs6dsdMnjodzp05a261pzdnaGDfvCfChEGBTADBqFsC8xROAK9f4y4Sidtrmf1m8 +z977bGZZNaR+v5927NiRdu/em5aWlmLT3xNLKSnmrss5R3ElqmoUL7HWGl3RJOsbh88SAmzbLACK +as7D21BHXovr/D+0p48Fd37pXzURCbVWq8WZcxpU1bruhPUHu4Jzi7a2GoMvK3botsZ+9mP7wyP3 +7bGdTafqzVTEXM36wYm39T+/8i3/7976un7lzKte/DmXc3HdWnLSJSdmYgu9KlYk5Vh7Z/vl4Vvu +Lr/9wC+X3330V8uTy4dyX3yWIklKzavWpJdeH6bvPH8svfzWalqJIWrfkvfDVPLZqG5HyqnGUkrS +9aUAUUpOzufkvUspz7xHwNXcH2DbZgMwXgEEALg5mn+R+db9bywCfnrCrzV478P5q/9NKSWISOO9 +Dym3zbmzp8P7778XTrx/NJw9fdJKSsHUWQhBi1SbEgBc6maAHLvAlWv0J33uPJv/ZREpuZQsIrnW +9XX9zrnU7w/S8vJyXFhYiHfe/VhcWlqK2mjXtm3MtXRN08QqEttu2DXajyMCgFEhwKSpuyJbmAVA +Uc15+Co1/iLbuM5fJmzuZ8FZ13WhlGpmZupDqLWauBK891YkhdI5c0nC3kHfHj+0Nzz16C675w4x +kTM2lAWzkm1lZUW/f+I1/YOX/0b/v5e+pMfX3vayw7xk8dKJ6/lFt6O3LM45Odudk7W6UiXUKuqq +DH1ZrrvLU7c9kX/3iU/n33rw5/MDfk+2LElEszifjp+T9OwrJ+P3Xn4vvf1Bm7rSjy4spJ6uxpIl +ilhSb7GWnGJsk7gUvXepio7bPDBPCROvpf0BCAEAAgDc5EXHVq/+j2r+LwQAwXsfaq2hlNI45xpV +bWR9JkDzwftvNCc+ON68//57Ybi6Gsz70PTM1PlQSrKc66g7A1x8zDAD4FraB4DxANdro365v/c8 +6/8vFtAafHZuvQg/v/Y/iUhU1ahqcWnnvnjw4F3d/lsPdNW5rkup895HcdqllDrzeiEA2BwEbN4Y +8ML33PZZABTVnIu3ofm/Guv8bcR5/0MXALyKpZSsFhdCCOacCym3VkoKXiVYXrYdgxzuu61vTz68 +Nzxy77IFX4JItrW1c+b6ffv+0df0D57/sv37l76q7+V3vew0DS76dPqkr4u7vbTJSXTOXE9KKVLy +mkgjVRZ6tfFt7aoWGboiKy7vCfvLZ+59Kv+jJ34l/eK9j+U7hvuS0zZZiCmJpLdPdOmZ58/GH70q +6cy55djWwzEnl9T3Y+gtJudcjLmLpXbJe5ek6qjwcNZlAdfS/gCEAAAFPyg45l77P7L5F5FQSglm +1pRSQkqpMbOeqjYrKyvNqVOnmjdeeqZp27bpuq5xzoVerxdUNaSUQtu21l/fA8DmDAAux50AOJaB +7Q0QJoUA06f/i+TYdvnCLt3rj4tT+jupLhbnu73793UHD97V7dl7oPMWupRrW53vqtNOa1r/3PEh +wKxLAWTTc4pqbOVcvF1X/a/YOv9Rjf+F5+vn8rIeBnhvpXYhpTY0PW8Li71we78JTzxwwH7mkR1h +uZdMZBhWSmsrvrFOGvujp/+t/eVbz+lfHf+RZVtV8c7LWqdSivdN8CWJ8/2ed85J7jonpYioioir +ElOV3BbxUqUXioReltVUFtuQH9p7Z3r0zvvz//Kz/yLdvbw3L0tMktairwup2HI6/LbE775wJL19 +/Fw8c3YtrqyW5LUffTOIRXLKEqNXF110F8aKSwkCZt0foMhsMwEuZVkAS5cAAgDcRM3/PAHAuCsD +H2n+RSTEGEPTNI2I9HLOTQihqbX23nvvvd6bb77ZtCdebZxpT31oaq0hldrknINzzrz363cK+HAA +oDL73QBELm0ZAMc2sL1N/7ivNWoTwHFX/y8GAOY1n9+RO4msr9F1zkWprqu1dlWlE3Hd3n0HunsP +Pdju3ru/S9m1XcydM2u1xm5EABBl9CyAURsCbtssAAprmv9taPwnNf2XZZ3/qMb/wnPvLeS8vv7f +uRpK7cxCDXtv2RH2H9gTfutnenbLoB8WkpjEYZCB2Rkp9oXDT9vnv/kl+3/8l0zOrah2nao6jcG0 +VvUSzffrwIsMfZTkslUnwYlUEZdEQnK150IdhkHNZa1UNyzOp1JKypJrFmfZaT//fXsw/cbHPpN/ +54nfSYea3clFiaKShnY2rcjZ+PUf7I/vvP1+euudD+JqK7Fqk7KXWCRH0RpD9Jub/zghBEhy6bMB +trI/wGWZDcBYBdAk4MZt/kUmTxGcePVfRBrntDGzZti1vZJis2vncu/c6Q96Lzz7vd7ZMyd7XcyN +qvZiapuUusaa0Jj5UMp6AVGLTQoARoUAkwojjlPg2gsO5tkAcGPBnF1eDwDMfHK+xBjbKL5GM9+V +mjtz/XZt2HXLO3e2i8u72yc/8XOthqZdG3adN22l1E5EWrkwa2D8UoBxV+m2NQCgsKb5n6H5n2ed +/6Sp/pMC/ZnW+a+mav2eWSMl1NialGSqIRSvIeZi/TQMXTMIbdOzaBp2Njk8tq8ffvW+W+yBgwuh +qgRps7meC2Jr9o3jL9q/+e6f2n96+zt21p8zt1YmzgDc8HtsfB9G3UFk85X29b1Dmi71ynL6ewee +yP/ssd9Mv37Xz6Y9tjtKsSTeRynD9P6pFL/z2rn4nVfOpndPpqjSi00psaytJlm2KKXEmmOSmqPz +TarWxOwsdUVSv3TXw/4AW54NwFgF0Fjg+m3+JwUA464cjNv4L2z42Kw/fKOqvTZ2Tc2pN+g3/Q+O +vt07/KPne2urZ3tVfK9K7l3YG6DW2sSUGhEJqmpe0sZgYdQtAWdZAkAAAFybzf88AcBHZgCoWYpx +ffO/lFLs9QYx59w557rY5a7XWDtsYztYXGxDb7F9/ImPt0s7drcp19abtjWX9nzjvzkEmGdDwElT +cAkBOBdvV+M/T9M/7xV/v6nJnrrBn4hYz0uoTqwWsS6XUMWb8xZEfahVbDhYCG71TNhT2/DIgUX7 +ucfvCA/fPwhiEob5jC3KUmi12IvxJ+GPfvBF+8ILX7c3z75rnW+t+qyrkm3Ez+XHnP83H3Ojxo8P +BQDLank47JJ0Pt2168709x79pfR7j/1q+oWd96cdtZfOpC4uhoWkWeIH70v8xrNvx2++/GY6KiE2 +e2+J/RWJpZTkpawHhyUnqTnWWpNzLp6/TeCsGwWWCePM5dgfYFtmAzBWATQWuD6b/1kDgEmb/22+ ++t+c/9gTkUY19LoUe66WXsld/8jrh3tvvX64X0vqabBe27a9JvR7TdM0McYmxtSoavDeh1JWNgcA +02YATGv+Hcc5sG3N+3Z93XEhQJkUAIiVVIok9SGurrZx147dcW2167y3rpTSBattTKXVEIZFfPvA +g48Ob7vjzlatN6zOt1Jye7757zY8Ju0FMGoZQBnR/NdLfQ8prG/65v9S1/lP2tl/3Dp/LzNu8Cci +tpBXrCsutK4x6S0E0Z6VmkKOXZCSQxNquHNP3566f3d46r6dYe8OF6SsmXgXxKkdTu+FLx/+gf3R +C1+zrx59IXRuTcWq9bpkttbq6lLPpjT/s8wAGDsLYGm1TauN5txvslRJ0jXpycU70z9+9FfSZx/9 +ufTU8uNRpCQpMXa5ppU8iO+ccvHbL74Tf/DiG7GLy6l4jaEZROs1seaY8tq5qKWLfZU09INL3R8g +zxgCTNsf4FJmAxACAFtgvAW4jpr/aQ3tLGsLP1RcOOdUpKhz1ZrQ2JnT5+zUqRMhpRSC+WDmm65z +TSmlSSk3OUsTtGlUXUgpBWf9IB9dAjBtH4BJAcCVbNgJBkCzP9v3GTd1tYwp4LOI5BSTNzPfhL4f +uuqcmEtpVZrGS9NYLTkV732pteS2a/Op0x+EfQduyxb6VmrNbr0AH3ub0SmNVt3wOgUwLqX5v5Tp +/rM2//Os8x/X+H9orX8nFopa8GHBkveha88Fl1bD3qXG9u1aCj9/nwv33XV7uG1XEySvWRUJnZod +Tavh5Tffsn/15h+E5155yd44/hNzO/oWFoPFtXPaaja3b1llrZv16v8sMwDq5gDg7I6gUksWk+w0 +aO3W9AfvPqfvDt/XL7z/Xf1fD/1DfeDQvengYL82XtNiiPrwrY0eXLjDfvXuA/aF7x+J7508q8fO +ntAuDiz0FqL1FtVn0yIlSZV4/ueOI97fdP73yBueb3zkDR83jn3+/HO34fdyE0KASWNU3RScuBFj +9NTx7V/+6xccIQBAAIDrl5vQ9E8LAkYWGFWy1uq01qpqzmJqbXV11ZxzpupCrsXMLJRcQ4y5Ueeb +Rn2TSwqxXQ3iFsOmImTWQmDc7ZFo5oFrIzCYtFv11On/IpKtLPnaFZ+rOHVBcs7OTKua1OK6UooU +530WV4O4mtfWVnKVrM45KzkndRPXFvtNxfao8aTOOHbM/V5RVN+Uzf+k2Xgi02/PO2ln/1l395/a ++F94nno7g3gXqkhwcdUG+XTYt+TCJx7cHx69/2C48/ah9aoE6UqQOrBSU/j6sR/ZH7z8lfClN75v +r5150US9NbuDuRQtn15V8WLSqA5Lp2762v9R5/w6IQQo57/e+XEkZVHLru2ytENtQlC9bZcdLefS +0de/mV567830ySNPpH/yyN/Vz979i2l3aVSK2M5+icv3mf7TWw7Z8y8ftWd+dMTePX02xly12kCT +NtaVEq3GC43+hY/zBgF5Q3O/8fnmILJMCAGqzLYMa1Ko6aaN+YxXAAEArs2iYysNrxvT9M8cBJRS +vNOspSSttdGu67TrOvMqVmu1GLsQbGC1lFBzDU3jQ6kxlDwMS0sWYu2CfHQJwLU6A4CQADT4W/u6 +W5oBsKDet23rJDm32DMZtufEgpXqUl3r2tLUfnauBOclq1avAJuoAAAgAElEQVTtulZrzSYiSapX +cWXalf9x4aIbUTTLhNfBeXjWKf+Xclu/rV71H7ez/+bmf+PHMCzF0upqaGQ13La7CQ/feWt4+O49 +du+tu8KORQlSQijF2bkg4c32uH3h+a+FP/ref7Rnjn/fZLBiIvvNSbUutyY5qjQ9G/QHmmLUeOKM +yuLyLM3/uBkAIpOXEnlZq+obl1WbXBZq7nJW6VaTqFdZXNSja0f0j587pj945XX95sOvpH/w8U/r +U/vvSTslaW3P2i07bo2f/MQBPXj7sr74xnH90Zsn7Z0PTtpaCbH6nprKxgBg0myAWYKAUbMBNo43 +o0KAMiGMrCPGq0uaDUAIABAA4Ma2uSCZuLOwc05LKVpr0Zyz1ZrVzKzk1ko5f69gKSZSzHkJ7dpK +WF6y8NjjD4XlXtzuAMBtw+8OEAxs79eYZw+Ai+NLcNV1sUh2Jqla/dZ3n6vZuZKKL+JCdtVbrSU7 +caqqlnJnOWddnwWgo66KzhoCXLGmkoL6hmz+t3LVf6vN/6Td/Wdt/Dfe3efi815ZDbcsFbtj93J4 +7J7d4WMP3hr2LPsgTizGNoj48KactD9985nw/37/z+2HR5836Xe2tH8x1DNFh12x4qtJY+qWBlZr +0bW1NfXF6eLSbr9a06zH5ub3cdxMog/NBNi5vDufPndWS0xZFxdyCE2Oq2sqwy5ZaHSp2avdguob +5X39V4f/UP/krb/R37n/F+N//fFf15/ZeSittCd0qbes996xYPv2Ltj+nb344yNn9e0TnZ5eqdYm +sU0N/7TZAJuDgLzpvzeGAG7D7+LGhACb34N5lgVMmg1ACAAQAOA6b+Tn/by51h2qqlfVDxUd3ns1 +U23TUL335pyzUopJrVZrtpiGtrS8L3ziyUfDzz+4NCoA2FjMjLsN4LSp/+46+zsArnbTfrl+js1L +ASbdBSBvbASKDcVrT7rak6Mnuvry64fLsZOp1BpyEwbZddGqSKq1mvNVc16fjSQX9yeZupzITRkD +65jGAzT/8zT/W7ml3yxX/GfZ4G9U4z/2qv/G57fu0PD4/XeFn3loVzi4S0xqDTUNQycSYhX7/Ilv +hT/79uftC4e/bMcWzgbZ2TdZEzt3olF1d5obrFmoorUUrWtZqyuanddioivSeSd+K1f/x40lfnOY +eHr1lJfBoDTF+Xym9TFnb/2edwt9H0vOq7Xx3cpxFRuqLJr+ZO2k/uF33tXD77yVPvXIL8X/8fHP +qJOhDqRLO/s9/YXH9uuDh/bbs4dbe/alI/G1Y3Fz2LJ5FkCU0cscLgQBm8OAjSGAk4/OBpg2I2Da +soBRswIIAQACAFyHxce8jeikzYgm7QWw+V7D60sAqvNdm/xif9GntVYbp96LaNuuqaqa81mH56L2 +fGMpnLVVSdZbPGBrZ6PtGXSmmn9akJwv2GutKt55773PMV1rmwBu69dev0iJm7Zrz+VGDAtmXQJQ +glk9r4hzpdbqi9QsIs659QX8Fnui/nTdYank4UKpORbnzmXfuVR9tlqr+uzVO1WvwavoesHtkpc6 +dnqxl8lTsYFLaf5HBUrjnk86zzrZ+gZ/Gm3RcokmKZoXsca8qbpQc7GcswVtQowxOJ+tFyzktBpS +bsOeXUvhwIF94b94qrEdi4PQ75UgvoShZDujJfztuz+0b/zwO+H/ePePLedseTkESTtMTtb17x3E +qj+npVbLIir+ws/lvBPR9ePSqYy+i8E8AYCMCBIv7OtRnG+KxFyiiJee9068ZilZUpedSI6yos76 +SaSvsiqaRfTkIOtfnXpa/+qbT+sz73wr/ZPHPq3/6K5fSiEN1BWxHQsSn/x40Nsf2qHPP9vT1468 +bT85dtKK60W1gXZtVVdMB80gnSvn1FdJ3vvovddSSupyic5pUjPvU9ocBIzaKHDzbIBJMwJGLQ2Y +ZbnSqCUBE/cFIAQAAQBwY5m2LnbqxoDzPMxMa63rSwh+erXCS6m+lHxhdsGF7yVzhABXMhTYeqdE +u3FT86rXfYYxx//fXLD7nPN68y/ixbninMtenIh34pyTWi5+fjl/vr1wNexCk5Nk/B1ExjUV064y +XrGNACmkr9vm/1Kv+m91Z/9pzf+Hrvi77pw13psGZ66K1VpC7orVWkOt1aQ3DDGXkLKFWC3sHCzb +A3t3hZ97ZF94/L4doVQJvlYTkVAlhVdPv2Gfe+Vvw+de/qY9d/wtS/0USinrM/wufF/n1DlnY36+ +zb/DrM3/pD0APjSmbA4B5MNLi8qERvsj7+nTb3xXf3zsdf3KQz9O/9XH/57+ysIDaXC26u6iunvx +gN39lNiRg4P4nR8f1+deP6Vn1rw2g4FJWbMzK0djr7dTU04p5ahBLZp69d5pKSlKTCrOknx4RsAs ++wNkGT1LqcjkWwSOa/q3PBuAsQsEAMD11+RPK2LGff4sBcqsgYCt7x1QrZRycfnAhiUFPqWpMwBm ++bmv2+4JN8eBeIOoM4YAFx+N2noQILW4dSLOuVKKK7mIuI/sDzCpmZh0tX+Wq4uTGg7Q/G+1+Z8U +pG/liv+0Tf4uPoJ0JkXMVQ1FnIn44Jwz731woqFrhxZCCL2BD7uWJDx56Nbwyw/vCPv6YhJXQx0s +hOhceCefsi+98I3wJ8990b763rP2vh4PsujNtYsm67P2bEPzrxuW30wK5ibt8zPLsThyVtGmpnZc +ELDxfd089f7iz3zcndbja6f1te+/rX/zyrf1Xzz+2/F/ePJ39da8W2VFUr93Th+8dUnvPHC73n/v +7fb0Cz+x144ci12purS8W6UGleJSzl5LqepKTk5yDFLUex/b0fsCjNoocPMdAjb/Tk6m7w0w69KA +uUMAERGCABAAANdf7zHrrQAnXbWYtC5xXBjgU87rn1Oreu+11+tpv9/3wavWWp33ftqU3XmK9Wuu +qM9EADc1vb77zDrn53y0MC21VvfTArY4kZyztG1bh8Oh1tH7A+iEMWaeNcXTphmPK3q5AwDNv0w5 +F81y1X/Usjon42/pN26Dv3Fr/M3MrBQJsVYTZ8F7H6qIlVxCKTH03VLYvVDCQ/f17cmHd4eDe5rQ +y22QbEHCgp2Ts+Hpt39kf/TCV8Ln3vimvdsdNVlOQWxgmjrN61f+P3LVv9Y6yzHqZOt3+hk3prgR +z0cFARtf23y1/afjTKraW1jQfmP61spb+r9/7d/on730t+mff+L39B889Ol0e11SqVUHZWg/c5fG +B/bdqj86sku/8+JxPfzWGataTLyLGhr13mutOeUc1UmJTr1K/shmgbMEAZNmA8x6t4BZxm32BQAI +AHANFiKXq9kdNx124+t+ShEzSxjgRURV19fruvXlAH5psOCXl5e1seBLKd6bXmt7AGzr13ecLm9q +V2kJSL0KX3vkbQBLysV775xz5cL7EWOUs2fPSkqpxtxN2uxs1qZ/Uog4y3FNEMA5d97mf1zQNOsV +/0lX/ac2/ucfIRY1byF4r1ZKCV3qgsspBC02aHz4+L0L4aG7dodHbg9heTkGkbOW1MK72oZXjh23 +P3vpD8PfHn7evnXsVavLzmTvgknbmZxtbVAaO6ei4pxtvOJ/sfmvVd16gK9zNP7zBACjprDXMQFA +HfG+j5oR8KEwYGHpDr/6wfvaylltdi9ot6Pqd45/X49886j+yZtfiv/T4/+dPn7rPr03hKR5TXf3 +BvqpQwu2e3Fgt+7/ID776nFtu6JtyppdY95CFG+actZcShLJ424dOCoIuBAGzLtR4LQZAZPeT0IA +gAAAN5lpV8pGzQAYNd12UmHz080ES/GllPVbf6n5RtWnKj7n4rdQHLjL+J5s7xfkVEkAcJW+9RX+ +2iPX7PoqouKqd16qP3+AW6je++pK3TxNd9ZlR+MaC5Hpt/+7KhsBUjjfkM3/Vm7pN/MGf9OafxEJ +sXqz6kLJOcRu1SSvhj3LIRy6Y184eGBv+MQD0fYv94JmCZJDWHF9e8OdDH92+Kv2x9/+Ynj69HdN +qjPZ1bfGGktnWiurrYmapv7AXGlHT/X/6QyAeaf8z3P1340JFzcuBxg3E2DUpnof2aV/9fhJL7uX +s/R2+K5d0eZM1MY7fX/tJ/qXr7yhr7/+evrtJ39N//ETn0mfWDikC6UxMYkP3+P03nv26R2379Mj +7xy1l988au+fPhWHsVGvPXXOm6su2vRbB24MAjbfMWCrGwWWGcfwzXdBqYQAAAEAbtymf9rrW1kW +MDYoKFKdlOpLzt5X8SVlL7n47IrPKXkL4VL2ALicYcD2vOGsNL6p+WvvWN+Oht+NKSZlU4EuqURf +nauprNek3nsptdSaSy0pe9GRweK4JmrWzf446rDdzf88O/v7MQ3ntH1zZm38LwYAwYnV1Abvctg1 +qOHAnp3hoYO77JG7bwl3HGhC350JWc7aqjbhfW3DX7/6tP3hM58Lzxz9ga30hyaDvokP5ofJupNn +zLSxhV07tPNeh6vn1Hu1WuvFn/nic+fmme4/S/PvJow542YB6IaGd9xMgLKpQfYbXvfNLpc732VJ +zos0War3qY0aFlTLjgV99fQr+n9+9U398rNPx9/7xG/p7z31G/F+3auLkjW0K/apB/bYfftuibfu +cvryO2f07Q9aPXWus1J8VA0q5UMBQJwzCNi8dOHC7zBuWcCosKTMGAKITN4jgBAABADADdD0T1oC +MM/VDSeTZwWcX+NfXS3FOee8c857752pdyV7d35WwKybA7nL+J5cHpVz5M199F2bN6fYhuNl0rTR +i4V6CKF670spxaWcnazf/s+dXxbgZmz+p40/IvNv+DdqbOFgpfmfdbr/pKn+TmZb4z+u8ddNzf7m +xv+nAYDkUGq0xYGGe+/cHz724IHw0O0adjTFpKwEWVsOdSHbs2d+HP7we5+zP3/pa+Ht7qS1C2pS +GxuseGtzsmpmuqPR5LKea0+b1KoSVCXr5ubfXziPi4i/8NoMjf88zf+049FtChq9fHRpwOYwYPOS +gCwi3rtzfnHN+TI0P7R+7gYDL7aQpW29vrembsdAu12iPyyv6dvP/n78wdHn9L988DPptw5+Sm/x +e5K0R/XWnTt0z5P79e6799v3Xj5tL7zyXjx9utUqSbM4k4/uATBuWcB2BQGbf9dpGwTKVkIAgAAA +uH4DgVnvgTzrFNuPXqkr1dVavZn5krIT75yod8O282bma62bi6h5ioRrp9Efo+2ypJQk5yzryyVF +6vlQwDl38fn129+6KfnHjV0/1Fovvgf1/D3tVFV6vSAhhGv195/W0M/zNTYXix8qGpNU0VKc1Oq9 +c+JEqivV51pK9lN375+1kZgWBIx6fVp4AZr/eW/pN2/jr05XTWpjtTRak1qtas5Vc1qC12pNVhPJ +IUlnRVJwpiG4JpRsllINze7T4e5beuETh/aEj9+zw/phGKRakGEviC3atxZeCl989uv2Jz/8Snj+ +7BFrrTMJxSSLDbSxoUYTFRWpVlJWJ6IiPRUnKkl8lZ9u9uc2XPU/3/hfylX/ecP9cWvXxz02NsPj +NgksbVxwouJlUbxI9q6seukkixNfFi1rEi+uajWvx8s5/fyrX0s/fudwfPZjL+pvPPUr8bOr96// +XfaK3bbbx9/++Z36C4eW9bsvvWY/fO1VO33s4egsqQtFi3WWUhdTKqo+xKYZaDvsxyqdepfU+aze +VxXvtBafanW+1ryVIKBseM+mLQuYtgSAWwSCAAC4gRp/kdlmAcxTDE2bGjnpdS9bu0pwzQcApRQp +pUitVUop4pyTsmE69PXeIF/4XbYaENxIQcDGv8vN/83Ys+UxZCuhwKSG/1Kaf8IBmv9p6/xnmep/ +8Wp/yT2V6s05MR+KiRQTl0J11XLNIatZG0soEoK3BcupC8N8NuzaYeH2PYvhEw8esqce3B12Vgn5 +bAqtWzHZZeEn+n749usv2P/99H+w10++G46sHLNuUExCMEnZZK2ztdipW+jZmJ9v1ttvzrLR31bP +525MozrqmJwWAhQZfbV840Z8H2myGwtaUkylVC/e+2RVXzv9nv67b3w+fvEH39RvfOYfp79/z5P6 +i3IwSRs0D7Pu3R3sV3/u/vjkofv1yy//RN9866Qe/WDVfN0ZQ3OLet9pNxxaymsx9LLWmpPUEkvN +WopXV72XCw+XL/xsacz7P0sQUDYEIIQAAAEAbuLmf1LhIyOK6HlnAkz7PJHpmyxNCy0ux3tx2RrD +UsrFhv9CY3ghGLjRG+Mb+sDaEHBc+F2vk+a/bsNxUecs5OcdP7bSUExr/NkjgOZ/u5r/WXf13zzN +/2IA4GXRqksmkqz6881/rVZKCbXWsCZrZv2dwfxi6LoSTKrdfuti+Pgju8MDh/aG+5dCiOeKleKD +7rCwqjvtK8e/E/7t9/6TffXlp8N7NVqt0WRQTfpm66vvTCWIeRHt1q/wz9r8j9uPw084tkUu/5K+ +SWHAxuZ/1v0BLj5SXt+/SEpVaVRtsZ9qX/zROPTvxXf0h1/8v/Qvb39Q/9nHPp3+6X2/rLfoLl1o +a1oQpztvE/3sbbvt5de8ffeHx+OrbyU9d26og/6i9hdCKnlFcz23Pu3fea3VRZGqLot676P3Xkv9 +yC0C04b3e2PDn0e8tvF92bhHQJkxBJgp/CQEAAEAcG03+vN+HTfhtWkbb83y+iwBw6TfyV0v7+fG +xnDjtP8b4eo4SwDq2NBn4/KAq9DQX65/23XM1xi1q/Tm12XG8WKWsHCWwPCaavgplK+J5l+22PyP +aoC3usbffhoAqBUpVpyEXJM5ccE5M3UhiPjQ9LOtrKyFGlfCbXt3hMfuvT08cWhnuPuAWN9KyO1q +CEtNOCfZfnDycPjj7/+1/cXhr4ZXu3ctLYlVU5MaTGIy6VotK9mKmHrvtXi9lKv+lxrUzTIWjRpr +ps0EGBUEbJwKP21/gI1/xxpdzT5YrrWm2nY+dVGlF1QGprKoGk6v6LfffEZfOPaSfvHVZ/S/feI3 +9bO3/Wzq175KV2x/WY0HDt2qj95+qz7/SrHvvPiOvfXeMWtLjU3TqPM9deJT9U6d91qrS87VKLVo +rWncRoGbP25eFpA3vfcbG/5JswEmLuciBAABAHBjBwiTGvZxnzPLn99qELDVhuWa6a6dcx953CwB +wI1u87T/q3zsXokQwW2haJylyReZfmV/lmYCNP+z/vvdavM/yy39TKbv7B9yGZr4Gpxz5l0IIhY0 +qXnpBS0a0srJsNNcuO/uXeFnHr3dHjy4EJacBMkxSHW22mvCsyd/HP7shb+y//zaN+yVc2+HoXkr +jZqczSZ62kQbdeJMkmgVM6eq1TstUtSJ8zLbVf95Nvmb5Vh1Wxxr5gkCRoUHo/YHGHX7QC8iudbW +19DzA2e+iM+pG6a8OvTSOhVfNPqeDgZBvbT656/9rX75ref1lw4+nv7F47+pv3PHU6nX7VVJorc0 +Yr/0qI+3771Nn32p6kuvH9cTZ8+o6V7LzsVavBbv1LkSnUtaaxtL6dT7hTjm72VjCDDq7yJPeJ83 +3kZx3Hlg3HhOwAkCAOAaa9yv9PeYdQdumbOxn7VQcNfD+zuq4b+RmmbWuV8TYUi9gv/OJxXXbkxh +Xqd8v0l7jswbDLirMD7g5mv+t9r4f3g3f9cF74M5DaEWCTWmUFIXGhet5y3s2Wvh448eCp94aBD2 +LEgQWTGRGlZyF46ePG1/+MYz4W9e+Kp96/3vhZW9nckeZ3JizWS1ZwuDfRpLZ16cetdYDarinBZ1 +WiRrkuQlXrZ1/pcjsHNzBAEbw4Aqo+8UsDEE2DgjYMMO+iVLzj6J940z3/SWvbiSc+1yLNmHpqer +Z06rSFVZXtIz8ZT+5Y++pm8eO6L/8d5H4v/2wD/XA7uXdKeGpCXqA7cP9OCBu+yBu/fbC4d/Yi+/ +1sZhLLqSRJN4leC0MZdUnYr3sZSR/9b8puZ/3iDgQsCxlRCA2wOCAAC4zMXKlWhoZ23gp70uM3yd +eWcAzBMGXEtBydgm+cM7xtcbIgiYFgDc6DMExv1+V/j33ur6/Uv9XpPu1T1pbJg2bX+esepyjhe4 +MZv/Wf5tTmv+55nqP+52fsGpD+Kd1eKC5By868LuHTXcursX9u4I4aknD4Y7dpsNnIQ0XAlr/S4c +k6F95f0fhr/+/tP2xTe/ZWfiahj2q0lrJsWbNANtGm/qsrrUt5irtiJaclapRaXNXlxV0eLFNTpj +0z/vOv9ZGn+3xbFqliBg0pKAafsDXHw0Tc/FrpaYOxer8+Kcd6X4KtmLFJ/bNtuePT41onJmRe3c +UBeagR5efUdfeOmIHv7xG+n3PvXr+ruPfCod8rt1UFpd8CE9dk9fD+w9qDuWP9Bjp1b1raMr+sFK +sVzNRCyKM3XOqZQP3S4wyujZGmnC39O4MXLjcgdCAIAAAJjpRD3LrbXcNnztrRby10zhP675v9Eb +4Jvq4HA//Se78e/5Gn9v3DaEA7NOD91cPMqU8cTNOVbM8rux+d/N2/xP+/c26d/htKv+k6b4f/SK +//nG/8KjZDEpLtSag7gcdiz4cPedg/Cxh/aGe+/cGZbdatCSgkjfrL8YXnz3J/b7P/xc+JMjX7O3 +03sm/kSQpZ0Wyg6TVdOymqxaZ11Y0c6tqeRlFedVLKgEU6nVSztUrcn3fPBrdcvr/Lfa+F/q3Xym +7QswaSbSqDBg1P4AFxtj36bicy3FGi/a5FqLryV7cd77xnzxwZezK97FmMNC4/MtjZ6OnUqMOkiN +PrPwPX3uK4f1+y8+G//7p/6hfvrup7QXY1IX9dadTj/9qdvt7eOdDX78rrkjZ+OJs6Ile825aklV +VS/+O4syfY8Gf/7zRgU1ecx7uHlPgG25JSohAAgAgGu3yJ/lc2YtxmeZGbDVItxtw+941ZvDzUsB +bpQQ4ExxsrNxsmxFjr1/XHbtv0feOrYqz//oNTl69KiUZlHe+8nrcvD2fXLPwTvkrltvlVv37ZIc +T0jTJJGyKCvnVmVxeUm8qaytrYmqivdOcs6yfuvp68Pmv9PreJaHmyMUGHdlyG0hTBg39twwjTuF +8VVp/mfZZ2KW9f4faf5zzqaq5pyzUoo550xVrdYaUkqhDLLltgYtIfRsELxzoY1robhh0J4LurYY +ikroNSXcu6sffv6B/eFjDy+aDdrQyvHQrNwSZLGEH9cj9kfPfSH8xx9+0V4+9bYNrQTfN6vDvSat +aJJVkyAmYf1nc9KoSKNyoYEsnUrbrf8OTrQ4vdD8uzmbf5GtzdZz2zw2zbNB4LSG1m8KBC4GCK1T +JyZOpDjJQ+cuNMxVfG2jdxK9mFOxJsUqXtZKdmJenOhQiroTXtNi1D89/g392688n37j/l/Q/+bJ +306/tvSYWtvTpncqPbJ7QR955G598xbRrx/5QL995C1dWcu6c2FJhytndNAsqq99zW1R51y0gfkk +Q7/WrnjvBt656sUVV2txIuKcWPS+ESdeSm1ned/LmL/HSfu7TA0HGOtAAABcX4HApYYJbkrhNWvw +cDl/lyvxft0UdlmRmoocO9uJLN0u/+7PvyH/4XN/I2fXopQssjKsMlgwceU5WR705eAte+R3PvPL +8lu/8ZScOvGOLC958eYl5yzVyYZZErz98+YPV+hYmOUWUbMWirMEgkzvx3Y1/+P+/U277d+4tf7m +nDPvvYnIxtv3XbzS332gYXlHP+gghrXh+yHmFHrNztC4XU0aWtCdMdyhOXz8juXw+MduDUt7NbQi +wUrPFoa9cHjxRHj68Pfs889+KXzjne/ZUTllue+Dc07LMJkTvTDTYPOMhFG3JJxlZ38/Y9O/Hef5 +qxUEbByXpi0N2HzLwFF3C7i4aeD5x4Xnvr+0rMPcai2tvjv8QP/iB1/T9468G3/40K/oJx98Sn/R +P5yKiQ73FD2wx+s/OHSLPv7Koj790vv646MndXFwj7bpjIpfU9uRNKes51azV7/kFwa3+pTXvHPV +iUtOpHoRcbV4yTm5nKszG7kfS930vlX58CaIo84thAAgAABu4jBgu/7MvOt/L3dBQTOxRb00lNrb +ISeHPfn9f//X8vkvPyPZlqQtnaipdLWVQbNDjn3w/7P33kGWXfd95+d3wr0vdJ6AwXCQAQ4wAIlh +JggwigGSKFEUg0mlLQfZWtsqu1y7Vfbuusr+Q9qVd//YqvWGsi0rWXmtVaREMYoiIUAAiUAiE2EG +wOTU4b13wwn7x5se9PR093s90z3T3XM+Vbf69Qv3nXfvueee7/f8zu8cY6aEM905XvzlP+SV1w7z +E5/+KKgak1lccGgPSqn5fgxywQpGiYuow3Edvide5OfWakQ/rQSQxP+l3ItWWuZ2mNH/15fxU+q8 +0P4Yo40xWqWUFRF77dSE7VQdWxR1pk3LmixaXzlL7GSjpmX37qrs2/fvtbddo2xObWM9a50Re9QF +81p3zv7SI79un375WfPs0ReNzyujRjMTYzSx6wxVMDT1YtG/3JJ+GoYa8VeszTx/ucR2a9j2azkj +YKnR65VeX8kECMuYQwuF/+K64gHVK53H1Ypcaz3R1ieKSn/p8GP6e3OH61uOflv/g1s/Xd936xv1 +zZJrqUodVUPfeUfb7Nx1g77xcdFf//6MLt2crlWtJct1zLWKtVPeOe1coXzwKkavRKJSGqWUElFR +JERRamGuv2WP52Lxv1IEwEVfq8kESCQDIJHY/MbAMDf61Yb6D/t+uYy/MzGMAaAtB091+frjr/DH +X3mYXgXNRkXszbDnhj1s2z2J5JYzO5q8/MoxHJpuzPjiA48xec01fPS+W2jmGaEsCc6RZTneR2IU +/Nlea2JN63lco33Gi3htmHZj0LUpm/16Th3iyyb8VxP6P+zo/wXz+xeKfqVUJiJWRCyQzbijtqhU +ptSYNaqVqbpnR7Npe/tNI9mb7tht77jO2p6rbF1om1trRY/Yl+cO2F9+8gvm95/7hj3QOWq8Kwzt +aGhqE2Jt6FYG1dQTU2NmujerlxH/67ms31ov7zfse5DWUVIAACAASURBVOMqjICLyQ+w2BCA4SIC +Fr5+3vG2jaZ3XlQMzvuiq1BKMYY+HI6qw68c1w+/9pj+3IF73T+94+P67dfcrSXmem6u4ybbRn/0 +fXv03rco/dTzx/UjTxzRB447pRtjanSsqX2cVZ3OYdVU21WMqBCCIEiMkRgjSgnWKLw779gt/l1L +/c7ljttiM2VV5kBq8xLJAEgktpaokHXa75UyNxKrpOMMR870+JXf/QInz3TZs3OCvW8Y48c+9iPs +f/M+RlTN0VOn8a02f/Po8/zxn3+Lw8cqTvQcv/pHX2TfLZ/llptvQHQAV6GU4JwjEmETzf/fhNdu +XIP9DJswalASwERircX/oLo7jPBXg0wAEbFnw/6zeQMAsCGELMaY1dZmppXbWFSZlIW98dp29rY7 +b7P7bmllEy1nY3R2XDKLxb7YO2J/+/t/Zf/g+183T518xhZ+xlhjTVSYQDRUtSFEjVgjEV0UxaBR +/4sV/xcj/Ie5ttcy8icO2b6tNj/Awv0uzg2wUkTAktEAta9Upo2KIr7uzSmi1+TakWWK6LWTGf1r +j/6x/trTj6uf3P8j+mfe+kN678iuWiLKhUrdMO71rru26T2jY/rbz5xSz706rWdmChWzKHljVOkQ +RUVEyERExIca55zEKP1ouguP10oGwDwrTQVIJJIBkEhsYXGwFcuWhMc68NqpDt9++gBneo6dO3Yw +ZQs+/7F38/Y376Guj9FuGG7YAcHU7P7w3YReh//wm39CEQx2dIynnnuJPXuuJ1eGQIWSSMSBGGI6 +Y5vBCFjra1uuhms7jYitu/AfNPq/lCGwWCgvJ/4188v4nR3pB7KzkQDZvPgXkUyHsaxty2zH7mhv +vtZkd982ld24q2U1WO9UZpyxp+jZvzjy1/ZXn/pj8+VXvmNjqAy2bY1sM6o6ZazWJkSlHWKMybTk +Wlel00VnTksrHyT+F/+u1czzH1b8X4lEvYPar4s1AhabAcMsG7gwImChGaCoeqpSSmVKqdFGS0kM +vnK1cp1Ke6L2oa3t1Kg+KMf1//zkf6r/6NBX9efv+GH9mZs/ovc2d+qqM6PzVtBv2pur667fpb77 +vFKPP3tCvXYiqm7ZUrXMSPCI1lasaaDEIASJMbAgJ+1Sv2W+viz8Py5RJ+IyxyZFASSSAZBIJNbl +Ji8btFyJBUzuvJavf/N3qD00veOOW6/nnXffgUiPxtQEx49Nc83OUU6eOExzNPKx+97KwQNH+cK3 +HufUyRmefPIF7nnHu2lMtogRYvTE6NFaEwgkF+CyXLfxCnz2Yq7dLVUZUod43cT/oDq1mgiA5cS/ +oT/Sf84IEJHMe5/HGLMsy7JGo5FJcSy7fc+27O13viF743WtzNCzjl52JmBrZe3jxx61/+/TX7V/ +cuhb9pg5aW0rmOp0bSg6xo03DC43UZQJMWhX19rVpdaNXOvcatPIdFWUg5aFW89l/TbCCj3DGAGr +yQ8wyAxYatnAxcL5nBnQHG+pXqerqqpQlbLKaqNEWWXEegOqyBvK97q6oZ0qWqinus/qf/vICfXE +K8/rT910n77/zg/rikpZptVEU+n3vnmHeuP116gnnpuWp188KoeqXHrdSuqqFhDRKqefk5JIlAhh +uUSH85vmwhUQZIVjE1Obl0gGQCJx9Qj19RTjssF+a2IVHDx4kJOnz2CzJrUrufeed+EFlG1woow0 +r9nF4TMzjLbHyZWhLXDdzh0YH7FKc/DVw3RLdzbxH0iMED2I6y8B6FMTvAE60Ru1XUok4T+oLsmA +e88w4f9LJgCkvwygVUplWussxnhu5L/ZbObj4+PZJ+6dzN4wOZaNKjJ6MSPPs6C8ffnMgezhZx63 +/+rMf7bl4VnjT5a2IbmJzZb11hhMz9jiqC6k3TcdrDUqy3UIQXnvtO91NRKUSKZZecT/Sszzlw3W +hq0mP8BK5sE8y00NuGDrzZ0OOmuqmLdVqJyqY9QY4zRK+dopFU6roLWvpKlMz2rxTvswo/7g0Bf0 +n8x+Uf2Ll55RH3jLPeo9b7hL5WhFJXLNGOq+t4+rvXtz+cIThRw/dlpOnZzF1fNL0fbvpTGeJ/TD +IuG/8H+1hMmxLlEAyQRIJAMgkUimwnqbBElQDIFqGaZPTjM+OokvAkqB8z2yRqAsuyhlKXoVk5M7 +qEpHXTuazQa162GM4tTJGlcJKgQmRwzXXdtGVado5mPUHkxxgpHcEaPjdK+gNbmb3TddQ7tlqOdq +TvUch04e58Ybx6jLHqWzNBttulWBzoSRoCmlphNKJsZ30JupkVoRjAfrIKRVAtb42oubvE3ZVNd9 +6gyvqfAftm4sJX6XMgK0kqYOsacjlTYm064WE6IytmlsUc7acauyjhjbkWZmxGRjeSe7aVuZ799b +ZbfdWufGbs90HbNYV5k0Q3bEHcu+9Mqj9ne/9/XsWwe+a6el6EcTjBrbdzt931yQhilBC2hiMLig +IyiZNyKUUYAyREUQFQLKa6XIlCCicEEonahGVMFHgSgoI4gRFYUQghCCYFrgSiE6QQtYg0iU6Gtw +NdiG4Fy/WTAWpZRQe5QLGFGUKm60a+880boogOwCI0BmKhqtVow6k8LVQMRkCnTAu4LomyARIYqo +EGP0MQpRKaIYHX3tIh4BE9BKiEHQopoxBDq9UDRaITgCBBGUQvB4JwGUKFQkUyL4iFMep9AotFbR +a1WeQf3i6d9Sf1r8rfrsG+9Tn7zlPrWvfYMiNJWNSnaON/iZ9xp59oWuPPOi5/EXZ+llY/QqF1tK +RdedDWhino3GolsExMdmUwK4EKIN3qkAQS0wAAIXTgVY8yiA1O4lkgGQSFw9ov5ydxKS+B+SqlNi +jYHgaLUzukWPqDWOnJGJKUIAT4+gRgjKEVRNFTWVj3hRnJ6ZJYRACAGbj+AlRxptuk5xpuMYabZR +ePJMoXBUzoBkjIyM0asrjPYUvUjlDSabwAehV2sKJ1hjOV0HzEiLuvQcPnGMPGimRieJRjFdFGSS +pZO4dU2Aq0b0Xu2d4TVO8Dfs6wNH/0NwCumL7hCCAW201kbFYDTRnpp1tjmi7Igq7M5Rk921Z3t2 +963XZNfvIgdyHBnWZ7OE7G+OPpH9wRNfzb70/YfsAX/a+hFjpdfPJcCiyAIuzOy/ZIb/WkSUoLRC +ISI+oJD+MnBWkLorymiDMn1xWvtSQnSCAmWU6LlZTNYQk1kCIkWvxLsAxojNRvBlcVYpK4l1IAQH +MRC0Rqymbw5syPvtcElJr9tOb2ZOCD1G260YfC2d6dMRgtBqIaYgek/0EB0oNAISo8QQXcybJvrg +otZaouhQ1YVQh1BlWrJ2U/rmwAWJAofeWo2m+u6r31cHjxyTvz74ffnhfe+VD+/eL3c0rsUUio4X +2X/zbvbdRLxm6lR89PnX4gtnpkM2ujPE5mjoVdOR6IMxxiMSQnQ6+BBicD5Eo5U6V6alxL+s8n6w +qntHavcSyQBIJLaWQXC5w/yT+L8EfBmYmhhndm4aV3cJyjI6OcVzLx3j5Zdf4JXDx+nM9dDaEs6O +tiulcK4iyw2vHjxJ4SIqy+mWni985WEeaWtK76lUTnSe4CvyTKiqCpM3OXyix+mZHqWHk6dKvvKN +Rzlw4AChLnGlJ4pFtEJlGqVhx84JbrtlD7ddt4OpzDJ98gRzdRc71gaXzmEyATZ/e3C1doYv44j/ +Uq/JICMgxqiVEi1itA9RxyjaEI13lSF6Mzm5zU60XLZ7rMze95Ybspt3j2QEMgJZqMmkOZN/4+B3 +s9974hvZlw49kT1fHrOoIsNES1FZUGaRAaCXMQCWTvJnjOC8Ui4KoVYBJBKFiIgSiaohTkWBIGdV +rCBekEggioxG6tCT0vf6wQfRiLEZgoFayIwVIwqtVN/oVZGSgIuOuuqKqGwzXPvLTguI09MRq6Es +mD1xTMhtbO/cLl5birlOjFKIauRYZYi1UFdeIjrqRoaxOXHmhITKR5Pp2LAZaBsrX4uPMfSUFiEs +ThLoWX6qyeLnxc3NqaiinJEz8sVXH1GPHPm+/NWOffLZN76HD918t2xrvQGJxNyF+KH9U/Hd+6bi +Vx95NT57tBe//+qJYIwKzlVe6cyL6BCCCz6GQBCtlQrx9QiA+TKuNFVkqVwKl3SvSCZAIhkAiUQi +if8rQGZyjNYEXyJKIabB8y8f5wtfeZi/fuBxTs1VVFWN9x4RwRgNgPMVeZ5jYqTnwDYNp2YL/uBL +D6DrAucj+egkzoGve2QWXFlg8gzbHGWuDIjOKYPmge88y8OPlWfNAo3oHJ0p6lATcHS609x23S5+ ++ANv5xM/8C7GR3JyE8lbY/iZXjqJV9YEWG4e6EZaZWBTieGt3iFeR9E/KJnbYkGznPi/QKCJVtrX +lRaMAYyrKpvZaCdaM+bj773b3r4Tmxky/GxW6JjVqpUdnDmR/ce//ZXs8UMvZQ8efSErmM0Ya2Ri +WzbvlFbPlbbbVkuN/BuGW9pPCKIIIhGnokSJWgSJEhFxaCGUQgR8FETTNKP9yICyouoV+HEviIDW +aJtJZi1ERa9XQq8nNbZ/BbuARMHkGSbPcIhQh83Uli3ZFo3WmTjviM0sqsntFM5LZ+Y01HnENMW4 +gCtrSl9CnpGPjRBzTVXO4U8dFjsyGUOMFOIIoVICMdM2VhKFug6IWipHwEIjYMWcDdoa1TRavCip +ylJOzr7KH8+e5MnuAX792Df559f/SNx3021xKstjI2axZfP44bfuCbd3CN/87gv+uZe7Ya5TedAe +rXyMUSsxOopoY4yvfbW4ToVlrpHFUwFSu55IBkAikUjif9M2cMYwPT2NVpaxqQkOnezw27//p3zz +4e9zci7QGN2GHdGEstdPMJQZ6rrGYxGx1LFH1rTEWJPlhrqXoVtN6l6P4EDIIbNIphBVUOORoDC5 +IsRAszVCZ7YiBEWjNYKKORGDo6aoPaOjkwTaHD0lfPnrTzKW5/zY/ffSbGQcO3qGyWaeTuKVNwHW ++5qVq+ma36qjYus82n8xdW+5KIBzYkyIKoSgjSgdRBkrSiuF1hLNtvFR8+Mfu8HeNInNSiwq2hll +7EFOZ994+UvZH/3ln2VfKZ/NglFZHNUZqp3hahvnZrIYsVlmTPf10f+VRv7nTYALxKLUXvBegkJF +owQTBB/Aa/GIZJWXUdNk0o7IDjvOrvYO2T2xi4nmuGQ646m5g/TKrhw5eZQDxw9yvHua0ETMZBM7 +OU6vop9IvqyJtaMOTlwNWimizog+bOr2zMRItyrwvhJKFalhwo9zx9gNsnf7jXH76A6aI22JEF89 +dViePfQ8B88cYtYgfmQi9sRAUwQVYuXKSBVirm3MdBYr8QvF/1Kj60u9dp4B0MMJtZdctIwajR/R +dGPNM9PP88zMC5x59qn4oXd/NN570zvi/tF94Rqdh0aOv6WFb757l53tnvYvHjhmfHRegvEh4q2x +2nmnJIg+a0QsXiJycVnjet4zUhRAIhkAiUQS4Re7zyT+L5IgNXXwZCanKoRXXjnJY999njMdR2N0 +J65zku27duKsIkZPngtlGRHRaK2pK8FawbkCm2e4TNNqtagrQwie4EEpg1LgvaXfX6yJMRAiKPGY +liPLDdYY6ioQQ4XSkfGGUBZz5LpJXVtePdbhwUef5b73vIWd28ZoqiT+t4AJkEzAFcTyZu8YX0HR +fzHh/xeM/ouI9iFowWillDbaGC0Ya8Ts3rXd3DCFycUbmtqekMr+6SsPZb/16J/abx94xHbdGZtv +22F7nW7GTC9DKauNyWJmbamwpYgRF1aa97949H9xGcVEEbSWoBGvolA6oYySxQbbzZh8ZMeNcuct ++7jnjrfK3tFbaNOSDIvBUpa15JkGiZwM0zw3fUAePfYsD732FA++/ATPvfgijI8g1qDzXKTZxNU1 +sSjxTrDGbMYZWOdFA8yOBnydQc9yrZqUD+17G5+884PxXTtuZXtoCbqNiERRShyRDt345Jmn5Yvf +/nJ84IkH5YH6JCEDxi3kGlxNdE5iHSLEiNLz37XSagGeZUPvvWCMlFqoYiB6h9SeDEWmJT4cng+P +fu1I+MKTj4Wfetsnw8eve1e4tTnlQ9n121vB79wxZV597ZipnHhHdDGKjoLyPmqP96gL6nxg+akx +w6wGkEzPRDIAEolESvi30aliRdZsECqh04VXD57Ce0Oj1cIbzX/7uQ+zb9/taAMhVuS5pa5rjDEo +ZeiWntGGJrgSpQydska0xhAxBEI0KJtRFEV/CoG1+FCjFGRZRq/Xw2b9ZYvqKuArg1KK3Hq0dRw9 +VfJHX/wO33j4RYLVHJ/tUrgKV/VoZ4JPkYipjdjChshmNAKukOiXIV5bKrR5RRPAalGVCyoIKqJU +ELT3Xqvo9dT4uNHOG7JoZ5mz//eX/ov91af+0h4a6diiWWRN28q6p+esErFZo2mttZkXbOlrS/Rn +R/5lGPG/bJh4NEqiRPEqCN4JteZaMynv3nkH77x2r3zu7h+WqZEJRlWOOIQigFJglOQqh+kIWtim +J+Se8XHeMrmP+/d+iCcOPcfTB7/Pb3z7dzk+PSOn6eHaGeS2v1KAi2hRuOg3c7sTXTkDc4Z7tt/F +z7zzx7h/731cK6OSuYhoGxEFUQkFZD7GViOX9068g73vvZHP3vVxfuGvf43vnHiJl7onoS3kDSvS +K2IdA6gI6GGXDFxsAgBI3p6QsiyhLPsReNrGrJFhqxBj6ULVaodKSfj26WfCq3/27/2BW75r/82P +/hM3njeNRpnRpjOCNxCciNaeqDOUjjEqEVmcf2C5uf9LmScpWWwiGQCJROKKdfST+L9EoorzUzyZ +GMvpdhyduYpu8LSaI9yy3XL3TRMY018e0FhFWZZYkxOjUNGgqT2hB8oa6thElCHTHnEFlTfYPKPX +BWUz8kaDbreL8xVZZnEh0GhkhBCoy0CmR8itxrsOwc9y/bXX8p3H2rSamqgNx6dPcnrmDJN5zVRz +hLmg0knc2KI3dRSvAiNgg4X3D7pXyJCb0lovDMHXIUQdyp5BapNZbTJjTSSYWWbNweKAeSW8Zuo8 +s0xXpqibRnJrg2BLLbaM3lA5Q+2N0cY0TWbmKJcyAJbLCn9BmLjzDvTZJf2iyKhp8dadt8l/87b7 ++cGb3i0SJzAgcjaLvTSRqKEm0KNEJppigAyD1IEGlptpcvO1u/joxNvl1tsn+dpjf8ufP/kwB6sZ +glH9iRESqPpzAS7X/TuuS50oa37wznviz77px7l/1700XRsi9HLoCeKZiW1a5Nqga5HoiFosO7Ld +MnbN7vg//riR//Or/5XffOLLFL5DnRsMAdFKaNhIcU78xwW/IS5TDxe7KVIeP0OWZVjbxBNjFWIs +JcQyl0A7D7qXB2+LwEgIx08d9YfdK75LYdu0nXYYid742ulI1CKiAS0iqh/NopUL9UomwOIyxvVs +01MUQCIZAIlEMgTS77xcDVxoYCUiqmSuauDySGmgoRpYV+Nsk5hlFNU01hiqSqEkx+Px4lD1HI6M +WudY20SJ0O3OUQVN3hjHh0jtIlFltPI2szOzjE2MUrmKTtEjN21c3S+LNuDxdJ0HLOgpYhWIKuLE +EYPQkBGaaoJGY5RZX9AfxNj8PswWMwGS6L8KjIBNIPqHravLrgLQ9bMq0yNKeqjclLqKtcoaY9o4 +dPSnNUyZCqV312PmpehMtNbQ6RlsZlUlNmhnpB8M1Rf6giXTxhPNXCxXGv1fKjv8BWVVDS1h9iSM +NiWr2/LB7G5+5UP/k0yNTjFLV0bnz5AG0f17kUA/hJzm+efPnteWSqvV4sPNH+HT993P79v/j3/9 +xO/yXOMYBI/MOK7NxnmNGdAZIjnROXA15DltEVSnx1xu1+peeFEJ6FpVTTdvgFjaIVKGDi5zkGVw +suYHmu/hH+39jHxiz3sipQUDToOJgakYQMZeH/W2IGfLYSAakLfE2/i37/x7ka6WXz7wRYLu0XJQ +1BpncqBeXKSFS+2FAeYU0sqpgTq6voEgRIGIjxEfAtF7gvPMOa+kYU6Yhrm2bpjSYoyKJoQ5DS0d +zYiuwozOtahYGG2UUT1mlfRP+kom2HrfKxKJZAAkEolVdRRkA5ft6jlRyiCiEAlURRelFI3MopSi +Lnoom2G14INQFF0gcPr0abQ1TIxP0ut00kFcfZ2KG7D8MV1vW98I2KCif7lQ5UFL0g4bFbBQjC8M +z1+YvG/YbblkfyuN/i+VIA5AxAUxoxO4blfu2HYd//D+n5aJqW3gkCb5oOMz8FiOiaEnFR+59378 +7hF+8cu/zvfcEfI9k7z22lFs3kCCguAIyuAblhgDvdr1S7s+1/DwK4yos3o7emofUfMRC4VnsjnO +J+67nzfdvA8wgigixACo6EFkpTau/782bB/bIZ9+3w/Gh/78OXl6+jm6vqTRalC8/rPnP7tUNMBy +RsDi9n7hFs7WIb9oM6uoW8uaSlwYAbBSO5/EfmLLkuJLE4mruwO/Fo74liViqWqPUZrcWgRPjJ4Q +HM71NzEaaw3GarZtn6LdblPWNadPn04HcHPVSVmDMifWWJBfDlF+ub7nMtXf5UKclxP9agkTQC96 +rBeZAXoJsT/IBFAMjgQ43wxwXrTKJe/m8qm975P3Tu0TQaT0DoOWSxH/ANpD1IZRxvj8jR/hF97+ +07yldRPF6RkYN2gXkLrGlwWqdjTR/RkJMRIajfW+5gfv3ygIfTFf1zVKKYgKunDX9hv5yN572MV2 +iBZXB5xCIpx938DvkxojOQ3unbhLfvTW98honVOFKB1XgA8Dp5gMMJjUMkJ+KeNpufcsVbcUS+eW +WE78ywBTbc36eVskqiixRUgRAInE1WkqpBvRECiTU3ZKMquxmSJWut/5Q9NsTzDb66JdpC5LJAZ6 +RcHI2BijahTv+yMziTWrq2kk5io2AuYfr1VUwFXQGV9ulHOYCIDlxNlyQm0Ysb9cxv9lR2eVUlJ1 +Pfu33crn998vY9HgBaLVglf9PQ53P1v6dV/T0BlVt8aoJj/65h/itdjl3zzwaxyzMxS+h9iMKAof +Hco7xId+pLzR4P0Vbf/8uTz10jemJYOomZQG9928nz1qGy0s1OBF+pbJ/P5ijCt8XwSoEWwlMio2 +fmrfB/jCY1+Rx8oevuyhjSIoWenzgdenBCyFXvC75t8/vw2qe2qZeisDhL+scG0kEskASCQSyVxI +gLWWSmu8d1SdGmMtWWOUYyfnmOmc5sTMHKOtnO0To9zwhm0cPnQE6fUIIaC1TQd78xkBaxHymU77 +ZTADLtYI2GLCf1CkzDCRAEtl4V9u1HY5UT/sKP+Sy/2xzGhs0J68yuSjb30fN+lr4OScqG2T/RFs +N9T1tvK5zjQ6QDO3lA5ysfyD/R8Hqfl3D/weL3OEaA00FNReauf6Q+gI1O6Kt38uhn7yAwVRpP+C +V+xu7ODeG/czEhv946Qht3r+4VntH1dq64R+LEFfjned3DV1A3fv3hsfe+kVaDdFd30MyixcKm9x ++6kWGQELWRjyv7CeDWsADJNXYljxL8vcA1L4fyIZAInEVSCCZR32L1e4HEmYXCJF2cFmgjGK3twc +ttFmthS++sATPPr4Mzz0+FPkOvC2u/fy+c98nOt2TWGMoaoKjFEEF9JB3JxGwEZok9K1vAohv5wh +cJWF3S5lCAwyAVaaFrBceLUeYAgMM9d/RfEP4GMhOxjjnhvvJlRR9Pg44NCos/PfL0H8Az4GdOhH +EhQ51CEyEpr85L6P0e1U/NJ3f4fj3Q7kXtAKH2tyUaANzl8wj/5ynuMIEAKgFdEHtDHUBHCRXdu2 +c8fkDf2Z8wuOso4QY0ApAzowQOT2U9BmRFSDjJLbr7lJeNLHbGoEPzsjWBO5MIGhDGFCqUUGgF5g +FKxUDy+mbg27BOC6rwSQSCQDIJFIbHSBkQDqukduDdootM3xYnju5SP8xde/zRNPv8SO3bcyffoI +jz3zGuN/+df8vZ/6BFFARPpzMxOXpSOcSGxRob9WeSlWmgaw0uj/pWzLfcdKI7Pnl9M4JrG8wU5I +5cFmIDh01BJFrXRwhjpurvLozBAFGoBWAkrRZIy//87P8HL9mvzZUw/x0twxGMsgOBwKm+U4V4PX +V7Re6EAMWhEqh9YaLw5qz1RzgvHYJErAB4dohY6C1B7R/ZULPGo+Bn/ZdjSra4KxoizRE9jeHKeB +kaLXwxqJ4XwzVpYxARQXRgHEBSaAWkL8L2UoDYooGST+V7o+Ltu9Jy0HmNgopCSAicTWFuApOdkl +0Gjm+FBSVQUAvcrx0oFDvHbsDBPbr2emtNjmdora8Mij36NXeioXEAUhuHQAN+d1la6XxFa9Vla7 +MsBamQKyjDhbzqzoP24baSkrWS3YZosONc5VQoQgl3795janFPAE8tJhnGMGoTBNJvS4/P33fJx3 +7riZUWlgTQYEvK8JUoO68tFdIiJKBLxHa90P2veRXBliGQg6EAxEiSDx7JGJEKHr6sHHTEEpnlKQ +iCLXhsmxCTh9hrzVXCnKZJj6tVLkiayiXg271N8wyf4SiWQAJBKJxKbv8Yrgz3aOYoxn5+ZrQggo +pYgxnsuFtNRjXzmMtDCxTUs3sTEQXAdDJHpQ9VGUVECGoYmuShqxQgcI0k4nYPOaAMlESGy2uj5o +CcBhhP9KQk0YbrR/2A0GLct2RvFyo8bkkDmPIRcjI0Rl0Wtx3SnIAYOC3IAxjCGMgqBhf3wb//yD +/4i7du2lLmchq1ENiysyKCaueGWoVRNTd4SGk56PmEqg5TmjZ2ioETSGjAyDBUw/hEIrEBg1duCx +q7TQdLqf6TFqMTqX476ExgQd55arcyuF2K9yGor0QzJQ0k9yoObnfiiiXGzIv6S2OpFIBkAisZE6 +97JJynnVYEx/lpRzjsrVNFs5N910AxNTYwQ8WgveO4wx3Lr3VhrtFsYolFIElyIAkuBOJDbMdTEo +Edpy86iHGXEd1ghgSGG2nIBc7zbg/O+xcOeOpwFFTgAAIABJREFUW/iXH/5J3lhso6nGCEYTXJdc +uY18rtdzHzKE8TTsuR+0XJ9aZf2SAXVbBvzWdB9JJAMgkUhsanGSbmRrQIwREUEk4r0jqsjOXTto +tixIjTbgfY3Hc+0bdmMyjY8BpQORlAMgXcsX/VnZgGVKbK56OMzKAINE26DQ7WGiBgaFXssq/79s +4rfUMBoyfnTb2/nXH/xZ2qdzMA1QFYbOVu1rrJUJAIOnBLDO9WxQfUvtXyIZAIlEYt1vtLKBy5ZY +grKuiTFirUVrTVEUdLpzdDqz/UR/BLQRyrri9Mw0LkQqV/Yb19S6bsbObyKx2a+BlUbPhxH9w5gB +wyb0G2bqwUqC7YqJf+gn0afroRzhk3d+hH/4/p/AngE7OkZHelu5HbxUE2AlI4Ah69jFRJMMW7cu +JsIkkUgGQCKRSFwNGGPwIRCIaGsIIXD40BGmZ3sgGu8qsiwDFN9/4SXK2p9rVk1qXbeSCZA6h4mt +cm2sJIiGFVjDCrjlzIBhrq0rKv4BtHfQysEF2nqCf/zOz/MTt3+Q5mwEJZvhXF9uE2CY51eTqE8u +sZ4NExGQSCQDIJFIJAGUeJ28kRHxVFWFiEKbBoePnKCuA0KGdxElBps1OHL0JLNzPUzW6jetMTWv +V8l1JKkNSWzS8zBMdMCwj2H4edbLjQhvKJGbo/AKilFDBLYHw3/3/p/k3RN3IEXraqg/l3pOBpk/ +g4Q/A+rkoO9N7WEikQyARCKRWB0+BFCKiCJ4CF44eOAwvjYQc4zJKEsHylJUnldeO4ooTfAQY+o3 +JFKHMrGp6uCwQutiRnJXU/dlQ1yHojg9M4MAVc+R14bbs2v4+Q/+FD8wtv9qaWvWKvnisAYSDM4f +sVLdGjT1ILXbiUQyABKJ1Kgnlqcou2itybIMj1AUFYcOHaOqIwFDw+YURYFzgYjh1dcO42rwPqSD +l67pRGIj1/lh1khfrYhfTWZ/uPjQbLlcR3Xb2BiuW5BbAyhMbPCe3W/i777jR1N7uPJ5Xk0CvrUw +nFLbn0gkAyCRSJ3ABDhXoRSEEFC6n82/rktEIiE4lAalA+izqw2riKiIUoLSgTHdJPZKVIRGPsKh +I3McPHwKlWuKcIpeASOtNioWOF/x9POHKWkxMjqJieXZFQSW37KsAYAxihBLYqzRJhBijUpZBNM1 +eGV/h6zifeu1XanffaV/x1qPWg5ao32l8z/MWu8X9TujLLnJ/ON1PDYy7LsEaLcaYIBcgbZMMcFP +3PWD/NK7f5KdYYRYdBlrNRmrI7Eqic2cKHHLCARZcLwkns0AGdelzVzt0nzC8CtLbJh8AD//759M +fbXEFcekQ5BIJLasGpPX77MxRmKM554XkbNh/YrohKAV0UMUBTESRFFFh7KasuxRdrr05k7yhu0j +jDlLxykaBLz3gCHGJu08cObEcXRbaGcQ3coivld1qesaJGCMQeuIiKZfzNRHSKyr0I1Dvm+jGipx +HfZ5JX7HRjq+soKBMMgoGOb5Sz0WspHOxSf2f4zTcwW/+eRXODh7HKTCmJy8jnTQQNhs1/t67WPx +ZweJ8GHq1VosH5lIJAMgkUikG8ZWNABELhT/5xpA0WjRIBolAkojKBBBJFD7itGREXztaJuMO2/d +zc/93U+iG2MUtTDWNHR7JWI00de0MsWeXeOEcpZ2I2OmXNkAyHOLtRoRwTlHfXb6gGCxVvrmQOJK +dXjTsUjt9VY6NrIG+xo00r/aZQgv9zld0/3fJtfzL975eVy34H998g9h0qC9pjx1Bt1uEjbWSgHr +3Q4s3P9Sjxf/HVbwL/X6ao2D1Zz/dO9IJAMgkUikzuxmNwAW38tFBM6aACHWr29BE4JHxEL0BCp6 +tSMPnqI3R7vVwGrHm27bjbINnBcklJS1pdFqE2OkLgtC1aXozqGiJcjKmaKVMsQY8d7jXeyP/J9d +PSCGVCUSm7I9Wa/vjpuszHGdy7iWCfVWm6hv2CkAa7mU34ZrEKVr2Z5fw+ff9kM8Xx/nT159iDIW +qNGMuDXTwKylOB42cmS9l4NMN9rEVUmaZJpIpJvDFjcAzv//vOd0QHRAmYgyETER0R7REXQgb7WI +KJyP+ADOVxBryrkzVN2T6NjF0EP5Dr7soCWgNIyMTdAemUBpv+JWljV17QkejDFkWYYxhhACZVmm +E5jYyG3cxcx3v5T58qudb3+pc/QvdW7/lc5psNFF0WY6HktjoPRwx/a9/Mt7PscHuBG6gmwbJ2ap +P7OB61Hq1yWuelIEQCKRjIotS4zx3JEREZRSiAiRfmJAHxQuKHyEGPuj7rE/Z4AYFVrnVC6CaSCm +SdZQ2LyBjwWZ0tS+QJQlRk1dlxhj6dU1Wltmel2yXK9YvlZzlEY+gjEZVR0IIRCiQ8QiKqbTmths +bczlmqMd16AM613WOMT742U6XhfzuYuJBLi67m8GKqXIaPKuqf389+/7GTqP/A4PHnoC2hrItmo7 +EC/Ddwyb3C/1ixKJZAAkEonE+QZAPNtXUUq9bgCczQkQ1SioBlH1k+8FAaUygjiiVASvCSGANOlV +Gucy6gLKUlA6ommgtUbrHNtokDUyfLfEZDmu1wO1sgFw+lSHbqckeDmb/K8mBA/isZngUgqAxOUV +93GNRPR6TwPY6Gt7L+fexSG+f9B7ZA3Kfylrt29GEb8u390tp8mb4/g6ADkf3fdhjtUdjn/lVV5y +0xt1IvmVnOO+VskI16KNSiSSAZBIJBJbXuEsWH6P2DcHvvSlbzI7M4d3MxitCbVGlCEq11+STwLB +g7aG2nmCQJ7nOOf6hkJU/WUFiVRVRavVYq7bYWR8DO89Uq/c97De88ILB+h2C8Ymxmm3M7LMEKOn +rj1CI524q1eMr3cnXIYUpINev5iluwYJ/I1yrOUiyrmS+B8mAkC2QP1cy7DsDXs8Wk0NwVF7Q0dD +Oxp+7NZ7Odw9wC8+9nvMbO02Kq6RwL9ckUWJRCIZAIlE4mpABUHnGc4XuN4cd92yhztv3MPXHnyW +HXv28sCLh3ngxcPLGgbzKwesF7Nlk23jI1gqwvTLvO2+92PzjKzRpNeZwdp0DhMbTuxdbGjuajv6 +ayUw1kNwrlTOpcoYl/nMoN97uYWQbNB9XTTee9G6H4kVQkAiiOov9YoSYu0QBIzGC4QYsFGBBwa0 +v54RvHNkOVgJ9MouWXsbn33z52gcGuGfHfrfabUmKDoOY5tU3vdXjOnMkI+0qUK8ktd13KDty9X0 +/YlEMgASiURi7W/vGu89SKCZN9izZydvvft2Xnr1BMdOvULWnjy/lx6XWDFgHRnPAsXsETIpePMd +t/KOt7yJ7dsmiL4gzwwhLUaUuLQOrawgPhe+f1Bo/WrC0AeFqA+6qAaJ49WK5ksR/cNEACwn7FdT +tmGiAy71uF71IijG2Bf//cadKkQybc5NcIhAFEUUkCGz+If5e0YErRQK2Nnexoff9yE+9ej3+OLj +DxFGNJWqaORNilPTjF9zDdO9uc1+4DfacnlJzCcSyQBIJBIJyLKzo//OoVTB+MgY77/nTYgITz37 +Mo8+/ep5wn+hARBjRKn1XShFVTPsGGtx60138P773sGbbr8VqoqZ2VNkVmGzZjqJidV2dGWIDrqs +IGJXK+xlyNeHFdayCnG8lqJ3teVcqexLPY5D/Oa4ivN8JYTQ5U66dkn7iyBLrQRz7vWzCWElQPAR +Mf3/CyKZjughFsrS5vX9WRTeOzJtuGXHDfyzt3yO6pTnT157BKY0RTlLo2XpdrvgPYi60u1I3ITt +WiKRSAZAIpFILE8422XQWuNchRRzXL97nB/56Dt5x5tv5UMnj5wn/hcbAettAOQ+Y+f2bWzfNsHE +WIs8E6qipNVoMD42wkynl07i1ungXu4O88Ucn2FE/0rPDTIDhi13XOX/yz1/MRENl1rG5cS/sLoI +gTig7LIOdWKjGA1rT3xd/HugqitqKwiaLArKR9BCAGL0oIbrHhttCM6jtCA6w4Saqq7JbMZ7d7yD +E++uOPi1MzxevgSxJow2qY/PQdYCnUK8Ut1MJJIBkEgkEmtKURRo8eSNBkRPWZZYYKrdoHXdJLfd +NHpFDQDxLYwxeF9TVbMUdQT65TgzM43SWTqJifU0RgaJyOUE/SDhf7FGwEpCf1gTYLXiYLXRCsOU +caW/w5R72DVAV5sRfaOJqXUXanFBbVf0R/jr4Jgtujx48HH2X7+X6+02iBbKiLWCVWb4MzB/v/CA +FtCWzKt+RAGWD+x5K7Pv+Sz/y9f+M0+b41SdGezUFO1OZJrqamln1rp+JIGfSCQDIJFIJJZp4Ew/ +0jIEUEojoqmqqp+hPyq0z8/vxC16vN45AGq6dIoapRStVgtrLSEE6rrGOZdOYGI9BP9SIecyQFjK +APE/6PVLNQDWwghY7ZSG1RoAK4n9yIVRAEs9xxDHZBjTYr0FuFymentJn/fEJXdSB0+vKvm1B/4r +p+sP8cnbf4AxA9QAFiIEV6MyO6CAEUHQ9mwUwPyUAd1/5DxMqjE+u/cDnDhzjF/81m9xkjl0W1PW +c5CrjdQ2XCmRn0gkkgGQSCQSa9jAWQ0SKWuHApSyaMXZTNCCj2rJ7ublMgBGRtoURd+QKKqSmbk5 +RIQsy1Bar/sqBInL1sneKGVYKhR9OVE5jNAf9P8wRsBKgjeu0gxYzbm4mNwFw5RrKeG/1P+yChNg +reqVXIY6Lhul/ssShzUAKMFJ5MHuc8x9pyBXho+/8f208yYyfzaGiP5SC36aGI0Lvv+8aJRA1P0v +bIQWf+etP8j3DrzA1848ycunD4OuEEZTm7iB608ikQyARCKR2IS4skCMRUQIUWNMhopQ1zUET7Bz +F/ZMFiaJWmcB3p2OWGux1uArhzKGdnsUEWF6eppmntYBTAzdoV5O3A671vywgn+554Y1BFbq1A8r +/i/GBBgmdwGrLOdy4n+p/we9tvB8LTYHFn/vsOW+HFME1kMQrt2OZT69/+vVRCmNUopyd85XHnmI +ba7F/j37uLl1Pb4ssHkDMXqIvQeqyqGMRlR/mz9JHrACMThEa3bbHfz8/T/F9J//PxzoHSFONWB2 +y7ZFyblOJJIBkEgkEst0n0IghIDW/Q6Zc+7c46qqmF+/+WLplbB9dIwzZ6ZRqp8ToNVq0ZntMTIy +gkb1zQA4913e90dxrLVwdkRnoREwbxCICN57lFIopYgxEkLoLzUlgtaayvVfF5ELXhcR2rnBOUdd +VP39aE3RnUMpxUirccnTABaXe3FZ1jvCIbEhOuLCcOvQDyP8L2Zbap8rVttFj4cV/4OS5g0rkocp +57Cj/hezLZcsMK5g3AyTc2HdxfZGQweISqgErAgSQUdPJiASac1lnNw9zm8f+yvKvxJ+4Z6f5vbW +HVDDrIVR7/uJAb1HvENU3l8uUAm1CBmKLFs+T0uoaiSz/fQAMWf/2F5+7t7PMf2g8JVD30YEooro +3OKooSpB57RChsxVdEdS+5xIJJIBkEgkthhZlp1dok+dE83zglprfckGQCvX9ObmsEqwti+2XVnQ +yjM0EQ8YY84JcuCcmJ9/vFhILy6/9x7nHCJybl8hBLz3537PvOheaB7Mv2/efFhoQMwL9Ev9/fO/ +ZakEh0n8b1jRvh77WM4MWCnsf6lNXeRrw5oAw4r/1UQCXIzoX6mcK5VxqS2s8vm1TpwmV6AOborr +KC9r6PRQOyb56vOP8h+Y4H/42G4ma02ryvCZ7p8M3b8fnTs7rsbawQlalbU4oKoDmfOYXHjPnrv5 +O/tPMjc3x8OzzxGJuKqHMhabj1B2S7qxoLF9DIrO5TpWacQ+kUgGQCKRSFw+vPf9pHwi58yA/rJ9 +7txo/MXSzHNmZ2dpNpsQHURHXdc0m02cK6lCOCfQz+vhzwvwJbqRC8W01vq8Uf2FIjuEACqeZy7M +f/bcc0t8dn5/838vqYE35lyUxULhP2+yJLa8gbBSAsDlBO8gYa+GeDxMRMBqDYBhTAC49MSGq50C +EAeIf7WE6A+cH+Z/KWbAsJEV673OuqxjPV4XbO0Za7WZqXqc8V1+44UH2PH4jfzsmz/O9jBJsWCW +f0D1k/yfbcNVP7PsivuPRCJCZhUGgcLRbmZ86tb7aMwF/tXD/5EjxTReOWJwxKKioQxlI6fw3c3i +xCQDIZFIBkAikUgMT1EUdLvd8wyA+ZH0+ecuhdnpabz39Hq9cyLYGEOv16MoCsTmF4T+L/xfy9Kj +5fNCPoSAMeac0K7r+rznKheW/Pz8c0axpNCfF+mXaoAopc4zKOZ/X57nZFmWogCuvEBfLyEkLJ3x +fyVRPEj8q1X+Xfg5ljABFv++YUbWlzMDYPgIgEtZvWCpMg4a+Q+LzICFfxeaAWHA/pYqw1rN8V/v +5IAbsqEJTQ3TDnpzsG2CE51Z/tPf/CG78lF+et+HsYz13Ztw9iQocApED2eeSogoFYmiwEj/w7Uw +lY3xqTd/mO8VL/K7j3yZA/VJYttSFXNYUTQyQ2+2A1tzGVgZ8lpNJBLJAEgkEluRuq4piuKc8F8o +wtdijrr3nna7TVlV1HWNiNDUml6v1w+196+Pvi/87nMj8sGdF7a/1P7nw/fnw/5jjK9HMYSl8wec +E+j9nNTnTIXF71kLgT4/zWDxNAtrbTIANr9xIKvoNK80f3wl8b/w70qPBxkBwxoAw8yrh8GRALC6 +aIdBRsBKZVxqJD8sEvmLHyvOjwSQJQyDYYSTLHM+t4oJtm4UbcvMq2fIxkeoag8mcmD2CP/Hl/8L +rckGn9z1ITQG8f2uclRQI4hW6HOncCUUGujVjqANWVNDgLIsaeZt/um7P03vVI/feP7rnAkVTLSp +Z3v42Q55Pkrlyq0s+tPNJ5FIBkAikbgqVc2C0Pj5sPi1zLzvouXE6Q7NZhNlM0IIHDs5S6PRoNUa +I4bq3Aj5/Mj/fFmUUuD1kqPz83+t6ZsW3gVEFNlZUT1vBtjMnjdlYPFUgLAg6eFi0T5vLlwqC0f/ +582AlABwS5sEK4WwxxUE47Cif7ltJTNg2GkAq8mmP0j8swrxv9LqBcOUcalR/7DM/wu3+e9aGAXA +AONjWCPoUoyAq6JxmK0qmtu248sC5grykVHqrOKxmQP8b9/4HW784LXs234Do2oUvEUiRIGIOhvc +P7D1BQRDpKhLyHNQUEvEoLgu7ubn3vc5zviC33zmS4QpDe2ccKagrRtUqU1LJBLJAEgkEluNhcJ3 +/vG8SF04d/5imZ4reeihh9i/fz87duxgbq7Ht771IPv37+faa5tYiVRVjVKKRqMB9KclhBDIsgx7 +NoR+4Tz6+XLNC/350f4YI8658wyEGIUQIiHMGwCvC/wQArk158L0F0YgzEchrNUxni/PwukGC5Md +Jrac+F84BQDOH2UeZr6/GnLTQ5gBi/e9nFmx2oz6sHJ4PKw+yeHFRAAMGvWf3/wKRsBShgCL9sui +cznI/EkMIO96stY4RzpzkFkiniCBbEeLR179Lv/XI3/Ip+/+IPe/4e1YBKJBhH5mgBgGHu1e8DS1 +wRqLIVLjEIRWZvvRX6Vl38jN/JO3f4LpM8f5i9NPUI0JjDaYnZ6BdiOdpEQikQyARCKxtZhPALhQ +ZM8bAAtHri+WEBWPPf49brl1L7uuzandLN978hn23n4niGF6+jhlWZ6bww8wNzeHc448z2k3ckII +5xISLg6n73a7jI2N0Wq1qKqKmZkZqqqi1WoxNjZGpzt7gXkwbwB479m5fQLnHEVR0Ov1AGg2mzQa +jXOC/VIJCxIdLoywWIscA4krKvRlFe+PrDwKPozw10M8Xik6YCWRvZq59cMkBhxkjFyMEQCDR/9X +2tQSZoBn5UiEhZ8dFAmwUiLDtYwOWIv6uyG+Y4du88TBF2HXGISKqtul0WpT9LownvPrj/45O7Zt +466dN3OT2UXwHqU0GpAoA79JrKFTl7RNjhDRoZ/XRqGg9niToSvFu67Zxz9+/yd58s8O8sL0K8jO +HbjCX+7zktzgRCIZAIlEIrH+zI92zwvRhRnq1yJMfVqfpNF6K1KPo+IzNFVO21xHrSZ4+Pnv8a2v +v8j4iGakEfn0j32Cxx59kr/99vfIR9tEI3zs3vdyqDzFN7/5TcZdzg033IDa0eI73/kOu/Mpjp6Y +5bprd/KZz76Zx797iG88+By6Ieiqzed+4h4OvVrxtScfZNS3OPnKMcx1k1w7tYuXHn2e5g3b+MwH +9zEycQ1/8BffYq4X6BVd7nvnXbz/XfuoOicQyf5/9t40TLLsrO/8vefcJdbcq7LWrq2r91Zr6W6B +RCMhhFiEJMCAGCMzwvYAY/AAYwYP/jCPbfzAAzzYZvXwWB6EMUiMxAASFgjtktHSi5beqqpr6arq +2rsq94zl3nvOOx8iIzsrO5fIyqyt6/zquRWRkZE37j1x4sT9/8/7vmdD2rhrtnRTHYwx83UXAjeN +6L8Sk2C13y8X8m8Bo6oGsCKyUOjb7uNKbIwR6703zufWGEwcWysG45wzBWrmZJKxiIiK4FW896Kq +tDKk2l8md22MidVnEdZHKj7TWJzmkazFDFitTV4m+nOfSl/ZStYck7YvpFQZlHaG2NxJ4r3k5RhA +VD1eC/CusypcJGqM0cxPqjWRGpN49db73Kh6461NnZHIFzrmRcQZY7wiXQPAeTEGcFJ4WWQEzPt2 +i45/qZoAC897o1YCuFaC/oYYeGakSame0Gq3O0dkS/gcIOkU7Lut4Lc+8Qf0W8tPP/geai4hdgmS +WNQY/GVvSSeCrdtjDVAyQJzO/95K+tLTE5gEhtpAo8p3bn8bv/D6Br/25f/K6dkXydMGuAp4Syop +Xi25FBAJER7fbqBRGkbHQCAQDIBAIBBYiGu3abcaSBST1jZxcaxJM8sx4hi7cB6TFLzlbW8mosl0 +c4zHvvZl7r7/1Yzu3M7ffurvmJ68wHPHTzAxNs33veNNjIyM8HdPfJWZqSaPfN+DfPXZFzh74gRn +L1xi977b2bLrNTx3/CCf/8RjHDz0HPt238XBD5/gPd/7dsp37ecP//vHuX/ffdz3vTv5fz/9ORrN +jANHv87UTItvf+t38/yxwzx34CBbBxPu3DtK1g6TMoE1Cf6F93UZwbVU2P9KM/62u4mIEZH5n/Os +ZeO4ZKI0tnmOzbKWyZq5FWsMqElsbFTVqIpRjKh0dmEiKx6kLwHxLabHz9NsNrXZcLSaTnfv261J +raqa5ysV2aNHE2DZ2X41SOZUCp+LtZGAl1ZzUs4cPSgD5UjSkR1EUSRJqUSSJJgkRVU0905z5zWW +uvrCa+G8N8b7yIrHOu/ctG/nhStVyt4554rCOee9EbHeGGOMUSciopfn/7tFtywyBMwyJsByxk+v +SxquV6S/cl3EyRbl0RH+6NGPM1DaxI/f93YS1zndNmDzHBtHCILzHYM1tlHPLTI4ZwQQQdsX/NBr +v5MxJvjlv/5d/LYaLomw3tCezcArkiZonlP4glJaphUCuAKBQDAAAoFA4HK2jwwh/lleHJ+AZBcz +7YLZdsZQX410726ee+4kH/zAx7n/nj089NrX8cKpBia+yNeePkWpuoU8u8jmgS1crI0xPBSRJi3K +tsro4Fa2jJbZ1d7JM08+Rb1/iKefPMZTh04TV4VWnqFimZm8wKa+HezYNork09TTYbZv20KlGKNk +y4xPNZmZzTl9+iyPPvooF188x45NVXbt2EnebszprMArSKSvRzitVORvLftfTfzPC/+FYp/OzP9C +M8DWSqnN88zOzM5YVTFpmtqonFj1YvI8t1KIMSIGEVHFOFUpXC6Fz8R7L2NjZ2jMniebPsfwUJ8O +9W3i+dkprdQTHWtMai2pLSX811IMcMXif0Zy40GMicTYVNR5EW1IY/qkvObuu+TAkWdFbEyclEmr +fZSqAyRpVdXGKmJUW6kaox6LgvPeFx7jnU3wccm6PBenaq0Y65LIOIM6wDjnxLlCjLVdwd9Ln1iY +CuBXeF9X208oDNgjia0xbRzT7dP8/pc+xI76IO/c9S2IL6MCkbXIXLNYFRaWVCmcEtmVm0wyaMdK +ywqJTRhWw0/c/12cOv8C7z/4KZqlWbRSh9RAK8PIXGdRj7P28p5zc4yBwdEOBIIBEAgEAleX5tg4 +m0fqTDcnuTjR5uSZSZJKgpU2W/oH+fF/cjdHjz7NJ//uo2zeqmzebtm5p8QbHnkLL46dZ2uaM3ss +osgc9bqQJErWysELlYqn0Zwky1q4Qnj62QOMjO7mNd90D6ePfQTvPZY2mhmqqaFSS8gbBYkx9NUd +RauNjct4P8Gm4UG+7c2PUEks0xdPkcYJLmuHq6VgElzpfhYXAFzq96vO+htjrKp2t6hrAIhIBNjJ +RmHjOLZJqWbB2MI7mzWK+WgBp2qsERNbbygykzenZWbqosxMTki71ZCR4RLf8cb9PPLwO9i2eUAf +/dpJfuP3PqhZ2ytRXVWXFP8rRQGwzHkvmeOv4kQ1EjGp8S6WosglMSKbBhP5/rc/Ij85uEmOHHuB +J772NE8dep5Tp1rYpK79g5u0Wh/Qcm2nFqree+9V1COR93jnCu+99y5WdXMpAEZUDWIM6kRATKfq +6eJjWk3SdYW/WYOYCnk+V3qBHFXJsikYrnDwwjH+4HMfYPi7B3hw5AEqPgFj5t8FMabT0NrN6VCi +1ZpePbkv8DbpWL0TbUbqw/zCd/8vXJht8+cnP473TaI0gUqKFjlGBB+XyLMcSG+WcS18lQUCwQAI +BAKBa8Ptu/dw3z0xf/2pj/L1A5+hkuzkkTc+SJo4Dj79LJ/8yqcplaG/vIu797wBNz3MF774FU4d +/zhpyfADb70N17Ik4rC+jXGemIKSVRqTFxnqj6hXYmKB/mqVb3z9Ucanj5BGBS5rYomoJJbGzCSl +Wka1JOStSQomqVcspcjy8GtfxeT4OH/5oT+hr1bh/rv2ovtGcc4j1oQ3MXClJoIsI4iXWp5vsQmw +cMY/6or+uYiAaO73UXVgxGZ5y86225HxO7JdAAAgAElEQVRRbBxHNk4jqziLV6PizNils/bF08+b +9vSLMlwz5v47d8nD3/5auX3PLvburv9w5wA6S6qN1NI/qyRlLZcGdKYpijR7iQC4YgNAxIgvMDGx +OI3FO2+MQ0pRJLu3bZJNZX5419BO3vLgTiaafOiFM5M8eeCofv2pQ3ry+FE9nD3t6/2DOjwy6qv1 +YS9SckLiIxM7oshFbtYBhffO5IUz6gsREYnjWOI4lizPlxPoK61ssFwtgOWKGAYT4ApptBtESRmm +GyS1mC+cf5rf+twH+JV3beFOsx0FiiKHwhEnZTAvNXPUy9ideMqSIHlOYmOoVsFlbIs28UtvfS9T +n5vkK0e+wVSrQTpUJc8deEhKVbJ2q1t2IBAIBIIBEAgEAl0uXbrEI4+8mpGtMRrntGaq3L5nC2k6 +yd69e/mf9+/jxYtn2LN3By4/yWteM8z9r/ounj9+hC1bh6kkEQ8/tIedOwaolhOcc3zLGx+g3W7T +Xy8YdrO8593fTyUSHnn9Q7zpzW9kqn2a2G1m59YK0p7iH73nHkZrLSI/zY/9o3ewf/dmps9M8u4f +ehuRb7Bz5yjRW97A+OQEtUqZeiWh3ZgFddhgAATWLv4XRgAsJQJ7rfhvvfeRiCwW//MGwNTsZGTA +prGJ4gjrilk7Mz5mJ8fHbKMxY1utMXPb9i32bd96p3ngru+U23cMmR3Dpe/vVAZUfGehTLyf/Iih +/52uyNIia2tjalKNqfkkkeUMgKWiAJYSyytW+1cbiy8KE0ed7Pw4SaQx4aXIChm/OCWbdtQUAUEY +LMsPDuzt5949r+U73nj/X7bzQh87cloPHjriv/7Us/744bar1Uft8OZdrlQeNF6NwWYmiiKT2Lgg +joxqLIVz4rzHZcVyNTiVl3J/Fp/jUtX7ldULPq7UZ9aymsStRRIhuSPOBTVKs6x8+szXed/nP8hP +vf5d7Kjdjo1jxJi5T5ziPUgkPU15ZwIJnqqJcTMZtpagJqFoTPO6gb383Lf8CL876fjUqSfI2wW+ +k2mCOg9xfLOlAAQCgWAABAKBwNXHRAloi327hogTQ9aoY5MmmZtmx237mBhvsuOureR5C2c9SVxn +fHqS1939EDbymPYMUzLD1tEK2va0m22SuEmlFBH5lK1DjqhvEM0vsXPzELO+SbmasqVvOxcvHGGo +1kd/mmOdoxRXGRkx5O0JBvo2YWJLH3V8c5wtgyn91QHK5TLWCnm7RRqXyMMyfYErF2fLmQBLFQEU +Lp/9X6oIYARE3vvuZsuxiQQXFa1pe+7i6Wji4mmbWmdv37PD7tt7h339A3ttX61mBgfqZrDMu2SR +Ru8EUAvW9L9TMZg4ipMUzZsXtdzndXp6crHY77UWAL2ctzGILwop4pJpFSJxmprZxphUKmUxWFH1 +gGhHqSsinVCI0cH4+5SI7SP74Jtv59zEt//FwcMn7WNfO+ieO3rQXDzrTBSXTWVwmzE2FpukkpYq +EpXKWBNRFI4syyhH0WIh3xX/S52fWXDr1ynoAz1gbUzemiWp1mi0pqGUMN3O+G+PfwTqnp991U8w +VOonsbbT7EVnmcCe493V4ZzHmgSNhawoiJOISqmK5gXfM/xaJh6eYDzKeHTsAIgnii1aOEwU48Nb +FAgEggEQCAQCiwa4JGW2MUGtmtOemaUSV3CS0XRtJqdmKEVtjPfE1hFbg5FOfn5iGzQaY5Tpp9Ap ++vv7kYmC2CTU6xZjhNkLDYrKJMZVsOSIdfRVEzJNmLx0js0D/eQtJa60oKFYSsRJg+ZsRi3uQ2hA +LjRbTYY3jWJmC1qtaer1Os5A7jJCEcBbTrSv5Tm9hHgvNgFWEv+LjQAzN/tvRcSqqvXe2zzPbVEU +1jkXTZ44GbVaU1HJarTvthH7jm99W3T3/h126+Z+O1KTH7TzEkU7/+ncPem8vPjOfVWvGKHS1x+X +a4mePXdQ83NWY+xC0b+cEQAvTwNY3C5LRgAYY4xXJ2lSMhMzTUmrFaOtKblrW5/s3l59K6Z74Au8 +BfVzUQHQqfGmsn0g/v7tD+/jLQ/v48yY+/DBI8fM8ZOnzBeenJaZ6Qlp5U5MXKbaP0S1f5A4KRGX +K5BnrCL2l3rc8/IaD3qVjIBb2kxwU1OkQ0PMzk5BuQzG4Ipppuop/+UbH+Mt6SPcu/9ORiuDWMCr +Yuf6RuH8qhFcCRYiw0yrSblcJgFajSalShlnIuys4bvu+laecKd54rOH8b5NuVaj1XD4LIcoDiNp +IBAIBkAgELi5yPOcOI5RVZxziAjGGHSunPJ616k33lAugXMpUSklpwFqqCZbgRwwOMz8UOi0IEos +mXNEST85UKeCn83JYiCOsBmAx/aVsJQg8jiqQBNysPRRrkLLKyRQKSJIoIWj6lIopbRQyj6lsJBU +E6YbLZCIUikizz3GdC7sVNdfO8kYg4jgnMN7P9+mqrru9g3ccAbC4irwS4n/+ftRjqiNjESR8YIp +1BucM14zI3iDrRicN6i3Pmva2akX7dTUOQstWylZ++b7+uzO7XfZO+/YZ+/aveW9Zj7yWfUlvbpA +nMqiA5/TRyKdz/zdO9O3/v6//tHPNhoNn2WZepteTQPA4FWstR0jwHvx3pskSaRWq8nLFbR0D3bx +Q/NCXIDtQ/YHtz+8X3h4P+/6Dv7k7Llxnjx4RJ868Ly+cOGojl0sq00HNUpq2j+aeDQxQsmgsRER +Y4w3YgojxqvPo04IgjpR6R63F4yIiAheF7/H9NAGgV4/ZKWUrDGLiIXcd7pdWqYJNIuC/+3RX+Pf +b/oZ3p48BNEADRsRtwpKsZBGBasW6ZPO906tVJ5/qFTp3LcYpquGoWYfv7HnH1B5cZpfeeLDTLeb +kKaQ5aCWVuwRk6K5oZA2iGNQLaneMPEBoQBgIBAMgEAgEHiJarVKkiQURYH3fl6squr8z+u6gLvJ +Be56DYDl2jRJkvl2D7xijICFQq+nXHhNEecLca4QjxGLGGuQxERiFHNx4rRpzk6b1sy0sb5lRvpL +5oFX77Kvuf92u3f3NnvbkPlnIpeH4auqysvF8Yr9W0QQEay1DA8Pv3loaOjlYnt18+OKPl7dl1B9 +yRS7wmFDFxsvI/3+R0f6B+S+Ox8SfddD8tyZyd97+tDz+o0nj/jjJw6ZQ183tq9vyA8NbTHl6qAR +E5vCiVHBiDU+kkK6zTPXrNI9cFUVgygvjwZYT/G/YBCsgbP5JL/ysfez5Ue28tpSibqUyEsRDQpS +Few6W7PmwUVKEZX4oTd8L4dmL/Chpz+N2VIF7xCN8Vhi54iMoZGUIWvSyHJmxDN4g32dhR4TCAQD +IBAIBLDWzl/4d2f/F4rVMEO9PrptuHDWvyu4vA8ZpLewQSCAuMiT547CFWIRcd5Je3ZaJscvSmNy +UpLKjLlt21Zz74N3yr37d5m9O0bMaD+/KKCoepXLZ94V9KXPbG/u1VKf8VU+97pOsaovvc7C1wQV +ecnKkCXbUHvYtyxsjs4NKsCdW+s/fee2B8w/ePOrZbLR/tXHn52UY8+fME8+e1BOHXpavC1L3/A2 +6R/aJomti9PG3FS/FWNEVEG9iFMvqqJzi9AHYXWdmDUzfDk7wb/+2Pv4/e/6WXbFWzHlErpBl9Yy +3aboTykocW+ym3/xLf+QczMTfOH0VylVY6RQMnG4rMCaMqU0puUh90oRp+ENCgQCwQAIBAI3pkB9 +adZNNlzwb0QI/XVVb+tNgZiLoFjYxt12d85hbagxcCuTNXIRVIrmDJfGzkt7ZozhWiSv2rdd9u66 +Q1577xb66zXZMlT7VemE3fs5Ya/aHv+/SQd/ck4iz0WoL/hs62Wroi1pTCzs33OfVb28//csttck +/Fc+qPmcf1linTXpdV8dbGdHsshEEGSgkv6rtz602fDQZnNh8r7/48TZC/LUwRfkyYNneP7wE0xM +5rJl7y6J45hSqUKSlomiRIzEGDF0/DvlCs2Q4KxuBBUD3vPJk4/xm5/7E/7Pt/04m9hEhQTJgfWm +6Je6VWBitOF4ff89/OKb3sPFvzrHwZkXkLiET4FYyYsc4y14RTCIWdOLBxMpEAgGQCAQCFxbkbtY +/G+UcL/VIwistfMmi6rOGwIL6ywEbl0mL0wzduk8jdlLbBop8cjD9/EtD9/D3fuHGI75gznB39l0 +rorfnJqV0uBPLRYOujDdf42fvaWff2366NLrJcpqAlpX293iFIM57b9g151dbO4v/ebm/l32wbt2 +mWPj/OOnD12QY8fO8RefeZRSqST1ej/1PqVSMUTWghGkGyp1cwp+vYrHpNfsfNseWk3o6+N9Rz5J +fftm/sVrfoChdh3sBszAp4Z8cpJyvR+XlNB2ztu3vI7zb/pR/t3n/5jjzVmwBuKUIo9ACwRIRKAo +IAoGbyAQCAZAIBC4geley3bF6kLBGlhfmy78eaHhEkyAW5vRTaP099WYnuxnZvosjz3+DV44fog7 +9o6yY+vITz68f09c66tGg0O1X+/o1gUJ/wqCsiDff/73PaivpZ6mV1m3Lina58edtRkX2pPYFt9t +Ibrp+vMmichl5REPn3nxZw4cOVM8deA4B4+c1RcvTjI0ejdJkmilXKNcrhDHCYLprAe/NndEr/B5 +YYBYiYZjKK0xVbTIavAf/sefcldtM+/e/a0k1rDeEIAWnnKtDg40BiXCFPADd72N80XB7332zzkz +Ow2lAmwZvMOKkloDRQ5RSAMIBALBAAgEAjcYi6vSLxap681Tv9WLAC61v41aYSFw8+OigjQpa9q3 +ncF8s7ab00zPTOgXvzGu+WNn9G+rz+mW0WG95+5dv3TPXXvi27ZUo4ESvwRIp+K/vExcy4K+1mMu +/7L9fYW/v9LO+zITYIXX0CVeT9f6Yh3prwuiATq5/C/OZr9y/HQrP3L0ePHVbxzMj504p+3CamVg +SAcG97J/R0VNNKjGmI4RKt36fzoXTuB7MVXWawhstBFw7Wbnr8UFdNpPJhDFhiKboRkpv/zJ/4fN +797MQ337GDKj6/t+zAuIYxwOi0Ws4HOo089P3PVOJs5f4sMHP8bzs6egDmhB4dtYqyh5GOACgUAw +AAKBwI3HUnn/C4sBhir16xf88wKCl2ouBG6dLrBI+HZvFdDcttQTIURqkprG6aAmtdu0lhXqndNm +Pu2fPndOnzj8Je3728/63aMVf+/erb/+wJ23R3tu2xbVh6o/PTcXrXPh7Z39C50Q9TUIx6UMg6sU +EvCSmNeX1xnQBRP0VyCAL88kUDN3p7Oq4Jlz7d87evx08eRTz+WHj57whybQUlr3lfpmHdm1X5Ny +v9rYqDeFegqNvFX1qoVz6uePzKtY0ym2qLrRAn09feyWw5mYmWIG0YLBch/jrSaH/Yv8279+H//+ +u/9XXr95fQZAxZY53xinvzJIyXtcXtBOE2IPI1kfP/HIuzg1fogXXxgjMzGZb4LLyX1BjrsRx6HQ +bwKBYAAEAoHA5QKgKwIW3l+vwbDaa97oBslGGCzd9uwaACG14hUn8BfeX+5iWxY9RxNfXrCEX6aQ +ecCQdB4z5Zr2D9zufbHLN2an/NHJS/7AVybdXz3+hKTp0+aRu7f+pz27dkR37d9hb9ss7+3sx829 +zuRHVYfeQaea3pLS3anDiuCdQzBgLKfOtT7TjrzPJNeyz7tT3X7uOP1CA2PRttS5L1wWr3vfdG+L +aEBMkZmKEZlttgw2kSg2pmIL2TRUe/OCvIC5Yv7dk+lg8FwWBTEfmd/54L7Ykj+5eGm2OHTkdPHk +syeKw8+fcxONwiXlqi/Xd/m9W7c5EfGAN8Z4kZYXEW8VH4moJ9e5PAs18+fZvaeLz32x4bPRIiuI +uMWdyzdREdSkjBeAJojzHClO8U+/8Jv8zXf+NqmJGKr0Yb2ZC9owOC0gjlg1Q98YRivD3c6GTRMq +c/epwO3N3fzLR/53Xvz0f+STM1+GeJo6NUrtKq1SdDOMWaE/BQLBAAgEAreq8F8seDdKmN/qs92L +z78r/DcqxSJww11EXybwlxH/skg4+0XiuCu4HeJFxEqSJBLZPqmUEsmzlnhfiMHLJ774FP4Lj9NX +jbhj3473P/yau6O779xptw4mPwKD77CXVdPrdsYFh64GFcHYjqo5frL5if/wn/9YL0w3tKmFll11 +sfD3i457qfNdbAAsFP+XmQCTrQkTq5NatWLExJIrppIauXPnkPmp9/7Qp/qq9tulW8JfdIGboPM6 +X70XpRO1pAKTTfnwc8fOuhMnz7jHDhwtxsZm3MRky2lcdQNDW92+XZudN9a182xe/HdvAa+qXkRU +VVcyO5YzPqTHPnG9+65swHOuP36uSVWRKOrUwPA5060Gesnzy//9D/g37/55mtkMNSqQJBRAlikV +zxKLTKyRFPaN7uHn3vYPOfmBQ5yoGqajjLF8lqFr13xBtAcCwQAIBAKBtQvUxbP9IUx9Y1gcTbHQ +YFlYfyFwwwj4tTxH12gILPWYX2QIdH92gBjFe184ESPGJlKuJlIu1aTIM3HOyY773oDgaM5O8viR +k/rJR/9C+2upv3v/3j+9fd8u+833bbbVStn01yumv2zfJYu0qDHRfMV9BU5eHM+/fuic7rjrQd22 +abvPpwu9mgbAlj41easthTemrUjebJrp2QvyzNHzMtVA+utLpjHIfJOpIMYyMctfHnz+rHvsG0f8 +08+dchcmGq5QKeK07Gr1rW7TvqHC2LQoHMV0IUVSLrlqbdDlU5Nurq0Xbl5V3QIjxrN05MNK7/2N +JPavh6C/Jq9nRfBFpytKBBJZfOFo5TlFUfDh9hfo/2If//INP4ZttTEkNIFaEkNbIV3fITYNxAjf +MfwAv/aWf8Y//7vf5VStoJUa+n3eq8EQvmwDgWAABAKBwDUcgKJoPix9cbh6EKcbcIE6twygc+5l +xkto41e8mbDU7LAuIZr9EgJZAGetiPdKnucCSGTiuRodKQavs86qOtTEQ7pz/4jfI+qbs9P+8Jkz +/rGnvuI/8tGLbueOreaB++4w99255893bx+S0b74B0ynnh0yt7Sg4kAsSTnKagPDOjy6VyfaRqv9 +rZWE/3KCeCkTYKnNtHMVk1aMVytqElPvN5K6QRl77qJxzol0grSlY0jOrXmgMNVwf5VlhX/s2eN6 ++Mhx/+QzR/zZS7Pelgfc4Kbb/OjuO1wUl10URYXY2FlrC1V1kXNF7orCF87NTk0XqUixkvhfEBmg +PZoBi42PXvqOrrFfBbrfX8bijcd53ynYZw1izdxSj8JYeYr3fe4D7CgP8d7X/DCu1aReKhMpEK9/ +7E0omG5nDERlvu+ut3G8OcUvfu6PqG3vo9GepVoeuZHGo0AgEAyAQCAQYD4M3TmHtRYRmRerG5Gn +vlokwa0ggL33LzNZuoUWA69YQ0CXMQGYE5DdUP+uWFwyF8SYjlQXC84phXdqTARi1ESRliOjqpHH +d0JKCu98FNf96LZ9bsuWvVZtYaYmxs1HPnPYfOivv2QGa4nce8fuP3vwNffK7ft2y/7N/DCAEYMC +jeZ0NjM7pkKhaVLycWJWigBYLf9/VQNAvZO0HBlLLJqrtLJZ41qTkhdNiSIR9V4Qg4jBKRw+0/rQ +k88e1SeeOqTPHz+l066s1XrdD47c5fffVvdGEufUeGMiZyRyYhLXbDRdu90qIiuuXE5dNUmKwjmX +t7NCosSp6mUmgIj4ufD/1SIAepnl12vc79bztzfdYOyZM1HFdDJcXGeBRokMYiw0Jmj0VfmNT/03 +KuV+3nPXdxHN1bV1EavXAFgF65RKWqHVyClJmZ963Q/yzMWz+EabVmSp3thjVCAQCAZAIBC4FWk2 +m7RaLfI8n6/83zUArLUhFWCjrrYWLP0XRRFJkhBFUTABXrnCf7mfWcIY8EuIZQDydoYxRjufTUVV +VNXPVaRXJcu9+g4GsVEU2ShNrZWSAex4S01taNAMbtptXN6U1uyYOfDCmDx+4NMUWUvecM/IH2/f +3s8Dr7qdXXv2qSfVSrmm+LbWKiXNZqJexH+vEQDd+90igBLFuWnMToiNSqaaliW1Rhotb8qVmkw3 +c1FJ5OlD5/74y088xVefPsKpiw1cVNXqwGaqW+7XUlz3URSpjWMvkfXWWBeLepx3qHN5nrtqKXF9 +tdS5rO3aWcvNtmZdGidFrVR2jbxwwOIoACci8xEB9J4KsJIJFAbSq0B77nura14X3sGc4ZqJI/Up +rhRxyk3x2598P3dv2sobB+4GqZBj1m0A4AQsuDQGByWf8H995z/l8098BRMN3Gxj13LmQOi7gUAw +AAKBwCuJLMtoNpu02+2XGQDd9IDA+oT/wiUAAZIkAbhsecDADXcRvNFGwGIWRwEseSzdPiMiqKBK +MZc8gnqPt4hPk8gbk/iiKHyeZ67VblgxxlhrTWrLFpw4541iTFIZlKTcJwO6C1B58oVjPH74eT72 ++WfZtnWrilQ116o2207zYlwH0qGlwv49y8/+6yLhv9gEuCwCQEqxtNrjYgtnjC0kNlayNubShJcP +/tXn5clnj/7nOE4lLldJKjvYdnsfUamqNkoRE2lkS945p87nvsicd+I9eO+9d957V05jXxSFy4vc +ieCiJHER4rwzbrblndiX5f9fJv4XRQKsZnzIBvazjV49QK7h323U3/eAx4tgBFDFIPhupo33xLaP +dt6AquFEfpF/+5e/w6+/55fYF99GTavrPzpraExOU+uvM9toUI0TttHPD7/ue9BMILnq73MQ54FA +MAACgUBgbcRxjLV2XvzPX8nOhaivNwLgZl8GcL0sDPXvFv7rijprbeiAN5e4X62g33JGgC6rXlaR +IGmaoqrqtVDVuVXwDN5LR5wab32WOw/OiYg1cWSSOLJz5oKJaRlVNV5EMBiwosQyl5Iim/a9gUha +zI6f4fzkJW3MttUkw5pW+jSK0CKfXi3vf7UUAFnBAJB2uyaRrZpyGkmeO/FiTBz3iy1vlqcPX5Lq +bQ8TRZGUkogoirBiELyKCMajks/4WEQja7yLjC8U74m9xNZH1rp2s+XFqOss8adOxDpVcSrGqVgn +tPwi8d/9+aWVGF4eAeF7OOdrvWSfXuHr3JSh/y9dQXfGUO8caGe87Y6rqspMPpcegGfKT/DlyUP8 +3ic/wL97+y9Qy+hFoK9I2ygDfXXytietV2iTERWeOI9vhFbVq7iPYDwEAsEACAQCNzPOufmZ6u6t +MYaiKFYV8G081XJC1pgGb4mkhLExmWuQVMBldZQMGxW02tOoKmlSo8gtQkJammKm6UHKlOMSVQtT +U1NkxmIrdaQ5jpqYOE6J8DRnxohLKfHACKfHG+zwnixyeOvwzuCbSppUITXMFjPUihiNc+I0Ynos +o780CkaYNpNM+PPsyPuYLpRS/zBePM3JS5TiiEq9n4npNpGMkcZlXCHkuRLZGLEGp26ubVa/yls4 +ixtm/F9xpsBiE+BKLpiXjQJwzilgwah0xadi7YKidHMz1hZweDVz4t8CJqebIL0w9F5lrg6FoJOo +QqV/WCv9wy+dg3qNchSSxUJ/udn/1VIAljQBSj4zWKRV5NKp3JaZer0s9TvvXfw3802loN01+rC2 +czyKgnoD3uA8znkc3tg5Aa84VLziO0If58XkboHIXzjjv9wKACtFPsgSonqpdtEN6n9BgAGi8rJe +dlnUWpKRJmVc1qSQlKmy5aNHvsKmv/sD/tXb3ku1tQkSaLdbpKkFEXyu+CQmAyqrvH4qHbMhTs3c +BX3SuarfoCt7hxIt7jTSWf1Q5IbuBaF/BgLBAAgEAq9UUvVkjVmqlX6mZwu8qTIz26BaSWjPThBh +MLElyw2eOmIEr5bYeorWLC2f0dc3ytiUY7oJLd9iZHCIqZkpWrMTjA5v4sKlaRptR7Uck1YGcUWb +xsQkQ2mJLINmLlhTB58RJ23UzxBToWRLeI0Yn2oRRcJQfRAtGoyPjTO0cxMu38RMUyn31ZluNLDk +9NeqGIXxsWni2hCzzYLCJKQRxNahrrN0nxFLURRhFj8YBcs9f7UZcl0khpf7u+5m527NAjFqFty6 +udultsvy7hcJ8pVMjNVm/XspALiiAcASSwMuc4yyRPvC0jPzC4W7W+Znt8JzehH/Kwl7WWef0hus +79/gaQArkDuc5viigEgggvPtaT576imGH/8IP//gP2FyYoKBgT4UQyvPSJIEnxVUoqjXZfyul0jW +a3w8QdQHAsEACAQCATDtjFK9nxNnJnj+9CQHnj3G3fv3su+2AUY31ZA8p3AxTx44ybHTl4iiiDt2 +jXL//m3EpomJ+zl89DyHX5jgyNETvPbuvdy1e4Qd24eQiYtMTLR44qkjnL44Q7lc5t59W7l9+zCS +z1AuwZPnxnjqmVOoltm5pY/XvWoEcVPkhTAzHXPo1Bme+NrT3H3H3ezdkbF9xLJpa5mL49OcODPD +M4efJ4osW4drvP6BOxCXgYk4e2maEwfP8cLpcUZH6tx713a2baqjbhaXFyRJGSRGyUInuDXNgF4L +u/Uqkv0yInfhZhaJfrvg/nKi3ywjtlcyAFYzI66WAdDLcS53jCuZAH4VU6AX4e9XOV9h+Zn/XlcL +WGv0yLVOM7gJv6AsVkEUvAVSi2Ztvjz+HBe/NsMdldt4yz1vADx55jFJQg5Yik5pyOT6XqLLXNef +73Q3dspc6HuBQDAAAoHArUCtOsCJFyd59vkL/H8f+zJZZnnm6Dne9bYH6evfRTWJOHl6jE/8/dMc +ODFOkiScPjfO8GCN7cMxkzPCV585yce+8BQ2qXL0ha/wI9/zTZTKMQO1Cp959Hk+8+iznJnIKYqC +C2NTbBp+I/U4ZfLSGJ954lm+9rXzZK2UHZsjBkZexd7tZdoZPPnMcT762FNMjuccfP6rvPkNt9P3 +xu1QOBpZiY997AmeuXgRl81w355R9uzaQX+iiLU8e+w8n3rsAONjnuH+iMK1qT98B9VYkbmLsLBA +QqAHAb3UxXEvkQBmGbHtlzACVjjBI84AACAASURBVBP+q83+r2RurEX8r1YDoFcTgB6Pdbn20SVE +fK9ifyXh30u9g6s9461X6blX+7NxXaIAjLUvNUPuIPVQMniX8VzzNL/++fczcsc2Hoz2EuUWSaAF +REkERXE1L9Gv+L3ZYBNAb5BxMxC45QgJoYFA4KbFJ1XaPuLRJ5/DJTXGW8pMbnnsyQPMZJCp5cS5 +Fzl2doyGL9HwJY6dHePEuRfJiRifyXj2yCl82sf5qTYNjXny8EkyEzM22+bs+AxnLs4wlRkmWsKx +MxO8ONUi05hzlyY5cPwsDU1oknLo+DkOnzhPblKcKXHs1AXOT2W8cHGaLCpx8PgLnB+fxZT7ePrQ +CS7NZky7GBf38/y5cQ4fP4O3ZWYKeO74Gc6NzaCmzKWxKU6fOU+z0SCZK0bmvSfL89ABAiuZAKsJ +aL/MY4tD1btbseh+d8uX2LK5beH9DGgv+vlKt4Wvky96LF/l92t9rfYazmGlYykWbW6JbaUIgbXW +Qbhay/9drVUEXnEF37w6cvU4MZArzLaRwiNxjETK3xfH+Dcf/h2enX4eUxZkNqcM5Bhakdwwo0pX +8y8Q/3oN3vcg1AOBYAAEAoHAy5lptYgrJe69ez9Zc4qhgTKRZOzYPkqcWJzCwMAA27eNkEY5sWmz +dcsQfX19OIVKNWH7ts249gxD/SVce5Z9e2/DxhFqE3ZsH6VaScE1GexLGR2pkyQRcblEUq0xOjhI +JSlI7Qw7dvQzNDCElQoiltEtg1Qiy/bRPlqN84wO97Nt9DaaM8rIyBDDm0rUYiWSguHBPvr6+0nS +lDROGBkeoK8cgZ9ioC9ly3A/feUqsUQUWU6et4nSOHSAwFovtHUF0b9cqLpbRvivZgLkKwjkXgT+ +cqJ/KZG90jGs9He9vHbegxGRryD+i2XEf9GD+F/NsFnJ8OlFROkaf77axsHVNseu8as6vBVMEiNx +guRKnEFJDbEYfM3zieOP8/uf/zOez09DFchz8jwnJ73h2kK7i4Be3/dB17ivYB4EAksQUgACtzIS +muDmpt2cYuvICPfsGWHm9Xdw7Ohp7r3zXl5193YGq+Ay2Lt9hG97+A7q6QGMMTz86t3cNjpAhGfL +YMpr79yK9zlnzl7gNfe+mr1b++krW7LMsH/nEG987T6OnjjH4OAgD9y5k819hjRyDI8M8tbX3c/X +kmdotlrce8de7t91GyUXgyt49b3babSU508cZvv2rdy5a5ShuEwpSZnun+WbHtxOOTU0W7Pcd88+ +7ti9hVTa2Fh5w6v2Yik4cfoi+3Zt4f479lBPUzRrd1ZNMJCmgg8lAG4l8b6SqF/p8V5z5RenA3RD +ys2i33Xvd1MAlgv17zWnfqWLe+3hXHq5wF8uFQDWHv4PK6crrCTcfY/P6zXsX1l76P+ViPxe+tnV +7v833fd1pOC8w8cJGIOq4BDURDj10GphN1f5w2c+QW1ogJ//5v+JoXZKOe6juOFGoMtn/0Xkar7x +vZpYoXBgIBAMgEAgcKsx0JcyduEkt22us+2tDzPzUEYaCyPDJVoz50jTQSpWeejeHdy1dzMA9XJC +QkYiQmPyNK9/9V62btlEu12wc8sQES0unTvJ0Mgw/annnd/2MOfHpogjw5bBKi6bpjHpiMplHr5j +F/u2VcnJ6K/UKGOIM481jmQw5p3f+jDnxzYxOFyinpYpJiaZKJR9O0Yo15vct3MvEkcYA7aYIY4U +zVrs2VRh79vfzImJaTbVa5TEkc/OIpFQLZVpq9Joz1KSMIS/QoT8tXi9XoTkUmaALhL4C3/nF/zO +c+U59SsZACsZGiuJAlnBBOjlfq8GAKxeq8Cv8fG1mjcrmQC97uNa99VrLeqvuYkQFUrhik5D2ggE +nBicNeCV/rZhUhowHPPHT32KndEwP/vQuyGzxDNA7cYYf5ZIAbiRxrsg8gOBYAAEAusmRAVcy8YW +IYoisixDVTHG4JzDe08URatecLQLqNYGAYgTKG9KAMicw6SbOhWVYygD5fjy4S4H4uoIrVaLzQMx +EIM2KYD+gU24AtSA0GbLUCccM3cZ2BTbWfUcZxoM9FXortjs5v51iDHJBFu3dI4v90BVEWBqZpqa +HcAMLszCimkClBI6i/s12TMY0SkLBVTj+VkhI1Bh9SUAVRXvO0sHWmvx3s+HccZxTFEUoRO+sgyD +1WbOegn5XlwQUJYQ/ou3KxH/0qNR0ettr+P6esU/PZgT69mWE+3aw/fVanUB6OF3vbRprysNaA8i +vFdhvhEC/pqaAO3YIti5hA4HMhdMM1e/ZbLUD0UL65UXm+f5rSc+iB0s8eO3v52qS5jC0acRzDoo +pTQiaOLpxxA1CqhEV3nwERAwc/aeiKgxBhVF1cHy30FXmtevXN00lJXGm0AgGACBQCBwLXDOdULa +54QqMC9SuwL2emKtvar7v9oCXETmDYBu24oIqopzLnTAW8M8uBLB3Ivwp8fH1yKq1yr4VxIL0qMJ +0KtJsZqA0B7NANYh/HUF80Q2yDjSVc5Ve9zP4sdkhePtVaDflKkAy5JnYASHR2LLxeYUH/3iJ9ji ++njHnW+iTkTRbhNVquCUCkIZw8zsDPVq7UrHg6s93vT6eaaHftXLSibQ+/KoQewHAsEACAQC15vu +zHQURYgIxph5sWqMue4GwNUWyVF0dYfgbkSFiFzWvsaE+q+3mPhf7fHVBJf2KPJ7nVGXNYjqXh5j +FUG8kvBfzRzoRUysJOJ7MQhWEuG95v5v1Az5aufUq3DTG/izcWOYCM4TxRGFz9FImXYFnz7yOKnE +DO0a5S3JfZBEFAZwQpSBCOCVWTzV3ut4b2TxvY3427X2q15SYnQD+0cgEAyAQOBW1qehCa4uSZLM +h6N3hWlX9HeNgOttUFzVK9GrbHAsTAFY2LZJksybA4FXjODvdWa21yW8FotM7VHkr1X492IE9GJq +rGU8X4vwX6tZsdpsfi+z/asZAGst/LfSvvUK34O1RAZspEC/6VIBlu+RijWGIndgFfoqFK7gf1x6 +huJT72fn6/85O0d2YSmIsZ1D9kqtXqeNv1nE/3pfR69g3NMrGEeuGb/zM/cGkyEQDIBAIHALD0Bz +M+BdA2BxyP31jgC42Q2ArsA3xswbAAvTAAK3jDmwkRe/S80+r2Vm/UqPuRdhfCUmwGrHKVdwfL3c +9vJ3vbwHi00B7fFYlxNMa5l51R5+Xkl0X8kqBq8YE0CskLdboPalUprDNcZnWvzNs5/j3ngXP/bI +u7i/fBuIoAZmcZSJKOUOYnOtx4/1jjEr9Y1e+p+u0sdD+H8gEAyAQCBwo7Nwdrq7LRSn13uG+mrn +6F/tGgMLQ/4Xmhnee4qiCKkAgYUXxrLKhbssITyvJJS+l7z6XsTreg2AKxH+G2UErPbYSufYa8j/ +avtdrVjkSoK/F+G/eF9rSVnoRZzf9PUA1BRoI8eWSoixFFMNiARKMTjhj579OFEq/Ks3/WPqtkou +EYaIwhVYLGvsn9fTIFipb/Ui+Ffqw6t9xkJqQCAQDIBAIHCjGQDz366LZqcX/u56EcfxVd3/1TY4 +Fhb/6/7c3W6E9g1cV8G/mtgUVl8ycCVjQNcgpHu54F5reDA9nM9qEQobYVZoj7/v9ZxWWu5PVnmP +WcEI6HVpw7UaASzRV1ihD11LgX99TQTjIRIiBMkNRQY4jxFPXCrz4uw5Pnzg0+wf3c277nwzQwyS +AF6ll6v36xH6v5pI77UfrsUYWOl1A4FAMAACgcCNSFeQLjYCvPdXfYb8RhHoV3P/3WX/usssGmOw +1t4QRRYD190E6PU50uNFPCsYASuJa13DceoGnLOs8FgvBsBaTYArEf3rmf1f6XivJNR6I5Y0FDZe +cN/cqQBGicolpC2oKyiV+nDG4bImhSswmyocOXGM//KFv2D/8F4eGemHqQJTT2hITmX5IoB6HcaI +Xh9XVjeQ1tPP1rIM6tUwQQKBm4IQ/xm4JTRmaIIbV/x3Rf/Cbal6ANfTnLha21VXeQsKKnbD/bvm +ShD/QfT3cNHNMhfXC3/2K/zsF2y6xPP8Mn+/0uO6yr78Kq+ra9h/r/v1S5z3Sm20lln19Roiq6Um +rHXzbJBQE0VFYYlbRAGJtFzAjC2gUCzQ8gYpPJ7Wquc/ZkBySNrgnaMtHhWhnbXJI6FAEWPAebXG +aiwGX7hr9t0jWYzLPW3jyGJPm1ZnRQAb4ZMSfsZg923ni5Nf41c/89scnnkKKg48OGJwHm23ce0W +aAHOQzvT3BUvtc46xoo097SibgMLRZaDMSgtNrl4tTz8XvL2lY0T/at9lkLEQCAQDIBAIBAI3KKC +91Y5742ooL+Wi+vVRKLvcdto0enX+LvVjmWtz1sttHk94uNKagusVfz7K2xHZW2RDi87boPg8kLj +OFasRYB4TpsXl1fBX7L9EoA5ozPzDk9nNiBCiLRjwC4yoW+oMSN1BvfCGeLNI3ztwnH+46f+jDMy +BhGU2+BQfJpCWsKLgKiSRMTWYLxb/7gpnbfQzj1aKaUYr5CWdCZrsYqgXovReCWfX8/KS2n2YpgF +0R8IBkAg8AonRAEEAoFggqzv4rfXsN31XPBf6WzgWoyMtYiPtRgV653lX4uI7iUaoNdK62sVYZ6X +Rz5cqXmz7HHHAi5vY2MDpiPORbuXrnbV/px0v/nFI3GMYEANiUkQ1zEQvACmkyrlFpoAN8AVQ5yB +JDXydptzMsOfHv8Sv//4R5hgksjmtAQc4EALrOYiIJ3L+uTKarxc3obSeeusAq5ARFTzTElLtHyx +mqBey5iwUpSQsj6jrde6AYFAMAACgUAgEAjcUqbAWkX21cjlXWu474283ysR/Osxa3pZYm2tgn8l +82Mp8X+lBsmSwi1SweFoaAbG4Tzqnc492azaTjEFGIXI4LuK3oMx0C5yigWz5Iqi3jMXGHBDiMOW +VQb6+mGmASlM1B1/+NhH+JOv/iVFNE3JWGJFIw8xIGLIu4e+9jSGl52zt5YIA4VCIjrVnETzHLyi +nQK5qy0ZudbPVy/9ba39bi1GaDAFAsEACAQCgUAgcF25VvOQVzKLvhEmwnr/dr2RAuuJKtgI02Sj +36P1HKuuIrjWmsKxnFnQSySAAuTeaRGJnp8ZpxCPMWARRcH3UABP1YMqznVmq7168ApGmXCzOOc6 +tVDMoo+ZkW4BlesqCIuyZXxminKpCs0crOesH+N3P/sBPvjCZ4FchQLjQOa8DodQwNzs/fr6lqMT +Z6E4zfCcnrnUqSXTzpA4Wk389xpRspZ+tZIJsJa+FYR+IBgAoQkCgUAgEAhskKC8UhG6kX+zEce8 +3tSDjTjejTBsoLfQ/15EmVtw65Z4bL3pEpcda+Yy8ggOnDqqbTwOkM7Etvoe+oyIAWPxneB/bO7B +ONo4TrYu0C5ynM4JZREQlirQev3EohYQW0QhcgLNDFOKOJM29Fc++V/1i2e/zqROgslBwecOQ8cc +ybJi3X1JkU6hxtgwScGRibMQi5IXOicf1hJVs5qY96v0O0dv0Si9pppcFyPgd37m3mA+BIIBEAgE +rukFYSAQCFztseNa5/ffiMes1/G9XGkNdVhbqP9KJsCViLW1CTUr2rKqX3n261zIx1Txncc9MF+a +bnlyIkXAiiUCUhsByjhTPHbiafI8x/uFBoB08gNWNlOuHW1PrVShkbcxpQQRUecyNcNVDpw/wu88 ++uf8zYnHaNommIJIzHx1hFjMej/7auYCkArgqxef4xtnjmkuDrEx6nwvVf89Vz7j77jyqBO/xs/n +lRRHDQSCARAIvMIIBQMDgUDgxjUsblaBvpbz6FV49PL81Wb7Fwsot45tPas9XL7FkXpxHDh2SM9e +ukBLs06yvlz2Jb3s+bc7of+qfmHJQM/p8fM8+tw3XkoBmP/mn5v976QAXHcjoOZjZiensPUKmXGq +VhAbM3H2DHbbKB968hN87OCXODxxCqxCJBSFw6giJuql760ocC0CzpNT6NePHtAj50+heaZpnKhZ +WfSvlqe/lMhfqh+ttc+tJcJkJYMsiPzAK54oNEEgCPAb5qL2ljvvc/1lbv/7w9gtES8UU6RFhLUJ +qYeJulJqXd31mItIaBWzbJtRXFpiIo2JohKlsQn8SIqbaNIYSElyIRLDRdekRMQmKXFJMmL1lNWQ +G4haBdMlYfhSRmtLnXymQVkMY1WLqrK1GWMzx1hJkUqKnWrho6t7fgmCzaBAyU3BoEA+0UD37ubs +aD/DE+0w2gR6GZuuxzit12H/cgOdQy/fCQufs/j5q1Zed041LbW11cy8aMlHkno0c8ZkPnI13zDe +Vwrrsljd5lbmTNJwmMwJA4UrSlFUyosia1tEHWlksJGRPDemXYhVJLfxam0qrDARJQ0vtm70UPWi +/PqX3qe/9fafZcDskvasKkmJDMR7j4gSiVUDIurAdRb8q0cNZohpJWUdAIkcTEeOvz75KJ+7+DjS +l3Zkrge8B5FOSkDeTRpY9X29qp+B2cgBVn3bIcQvtUuphp9twbaYDx3+BK49wc+9+Ud4aOBuSpRo +NCxRNSZp5Z3WjQTM3JuuXu1cdIDi5pWzxWAQJRdwBlSQZk425PVDZz/H+575EI1KQ225gpvJNSGh +ZfJeqvsry0WJePWq6qy1zlrrnHPOZW2HiCOJi1IUu1bRcM40XSHeDTbUZXHsUodv2cInVD00PEQu +tnVf5C0vOu2rtbKfmC58GsVrWZIzEAgGQCAQCFwLdn76afR9H+VS+yKNfJpyVEOdpd1s0SgXGE2v +6utbH2FTjy86yyc1KYhNTKnwvKgzjGqZXDLiHFoGbjc1WjHMzswyW4vIpGBrHpO3MyRX2DvMxbEZ +pktCNNNG2oqrR/z/7L1ZkFzndSb4nX+5NzMra8MOkARIgAB3iBQ3SZS1WrZkyS1bbVteOsbuDs9M +TIR7xg/zODMP0xHzMBMTMRHTPTPhsB/cPRO223K3ZVmybMnWvi/cF5AgQQAktirUmtu9/1nmoQCo +WMzMygJRIADer+JGZt3cbt6897//951zviOqWO55ZEZINYJEh1qHwX5zOVQvI0SNEO/R0g5aKnDk +cdOnPo4DH3oEC1sb7zTSWuHK7UOrjpursj10Ga8ZyZHdkVdTUjOoM4iAxSSpkYkSpAbHAKQFJ7MK +LkswssC5i0HNOIp67wOzqZNCCFI6A8hCJJ/nlHrlKALAxdu1C0gJzgXAF/jB60fw509/nf7rB3/d +pqYmSToKn7kVBz8CoAIYGZwH3MrA2kMTTTg0ewAIlkKJP/n+5+g/PPmfgG0BKK/Y8UJvy7HoMhTW +xZee+z7mzi/hX/zcp/HLhz6GsRBg3YR2PV7YOEWEQwDMG4CegcsSIY/wwcF7QAhWAuAISAQMsFod ++MqJH+PPvvMFO7lwDogwCh4CstTrgVYaBK5XWmLo7x8heZ5LURQiRcHinbgYxTfqDICVIO3lLodm +zi4GxhKJqrHCiTnwvJYiIDETMTMlgjiQqEFVyBzFYQaBwGDjwk0bF6r6/wqVAFChQoUKALLdGRaL +GcyePAq2Ej6bhiQDtbuI4w5ON7dKqVZGzLkO2DmMM8BRYQVDG2MIlFAKwFogicdMJtjZbWJpDGjN +LSDfMYXxrqBWa2A5MOz0EojnkE7OoNms46bmNJaKNsY6EUkTpMtIIUAjoEmBBLhsczMAWmUbdcqB +Wg1AQo8LdPMc41jG5M58pbizQoVKQLlefyMasm4Q8b8UiXUuU1VTUlLnnLKaqqkYQeBMnJlAVFoo +uL51F0NvZrTOMZclB+d80e35EILLnXMK55IRqyNS56grsnbj+hEvt4pAv2mwj/WaFe0OwRnOpGX8 +8RN/D4an3zv8CbupthVcKoVaboCDekfJVsr4dcUkkNQc0L6wstHDX7z2dfzl3HfshJ0lLC0Cte1X ++nyhq3reLXWQNcfQnfD4RvcYXvvOX+C5s8fxa3d/CPdvPYCghowiSJ1dsvR3ANcJUs8vRP5XRAGv +gCfAEyxBsJxa+MLi4/j33/xL+9brT0KmowEKlmQuqxks4EKdxMYj/xcWSYmJiC0GgXfsgmdzxJIS +oyzZuRpDwBpJUMu4W/cyq8t8s07K9tBgo7YYQRQqzkydc2rJVMTUUXah5cNIIsCgfV+NgxUqAaBC +hQrX5YTwmsZJWURZLq6Qf1KUqYNOKah5g2QRZa+7qZ/faOSo3bQH2fQYWt9/Dr4eME2GFreQokdL +EsbzHPlywuyWgNNL53HO17A1d5hKitfmZrDtkx9A8+dux9znvgl/ZhG7pibgsohTyzOQzINSgoOi +gxLORzCAlArkoYZ0BUJQw7ClloEKBQmjHgkUIubJQ0SwoAwPX501FZmucH2N66OWBgDrtGIzCspc +KgDx5AQQITKx4CQZWKRgHwJP+Mj5UsF4bYmRG8epPHWt51A4p0bkVJ1XR3kIhBDRlQQrCiC8YYrp +12zbasLfNxNAQyC0W3D1OtxEDUfnjuP/+v5foSjb+Of3foAONW83QiIHBzMzSkoxq+GCrZ85AtAU +miln8P8+91X8L9//c8wuHkMYn7Cb3U68brrZJR+0meNDIIeiLIC6AxqEZ+aP4NR3X8MLx1/Azx16 +F37jrl/CtvEtlrkIGAE9gYUAy1auQzlgzgArDaQ9oO4tocDR2ZN4+dRx+58f/1O8cva46WREfaJu +vNADkpjLyDQ4Awuw8S4SFxdORcE+zznLck5QZhWGggEwvOdgzCFkzEkS2m3u7lRuuMhg5bBYCkJk +BC/CIkZJMjhV8qJGao50pa7jivuAVON5hUoAqFChQoW3gpwJDTSQxSmwFnDJIXMBMRCIDBk2twSg +S8C+9zyC2l0H8MpPjyNzgu0xw/NLi6B8EqezBRzIxtFcmMPBxhhamcfYlknkgXH29Hns2bYXs6/M +gO67FdNzDnzesAQAmQPftAup6IEWW2g6D1CEkkONIiIIjdokuuXmChzeeXRTD1x04B0wbgG1LCD2 +HLQM1RWgQoUbS2SiVQLBIHO2N0RozUyISIlohaD5ICDhdsHcDRk3BTwF4s/c+RD3tJW+9+pP/OzC +osNW5+AaTsWcFuxYBU6Uwkr1PMkbTehWb4fvs86tur0oALhUdhGyBsbFGZdCy80cp3gef/TUF/GN +l3+M//beX8PNO3bhlh03YUuYoJg5I3Th4ajXLfASvY6fHH/W/uOPvkzfPf8ilrd4YGoLeL6HhVgH +YrnZovmmkkXyEVAG2l2AFGhkWB4zfGXhGXz1W0/Z//fkt/Hu2+/CBw7ej3dt349bxrahiRwBhcEE +wXLAGaQmtoguXuydxrdPPmVffPzb+M5zjyNNm2EiGDyjvbBojgnBZyZFYVA1kF8v7b9v6v9FASBk +GYOIk3AylQSzBOdTJJ9CjKk7VqbyzFzK/AQfvu3+9Jk7HkzjKBlMjOg5GYnzuSiTKLPkMYr3F45j +cwoaajoJDO+acUVRpf9XqASAChWu0LWv2gU3wABEGSwB0kvoWQLgUWY5PAX0ija8bW4JQE8SXB6w +bec0EiKK1MHZmR56t+7Cofd+BDc/uhvZTAsLn/sOll84jtajt2HXu+7E9l07MV53mHx5AS9864eY +XFBMtTPY/Ydx7vBO9Exw4J478frXfozlHz0LdAuo8yiUQUpIAiyrgjd5StCJHmmiBgSPYIKsAJLP +wI0GbLwJ1+3eiIdVNdGq8E4j/2uNAIf1ZP8Z+ScooOodxEEFouLzyGIc5hc73EKTs15KWe78r97z +AX/XXXf5v/3h19Lnj3zD/WTpFaep60BECI4QIxRKJZfwMOTOr3j2DyZdfh0RACCiEAJxpyAVQn2q +gS73cHbpLM52z+Pxz/+v2LtrDw7dvI9unt5pU1kTJKD2csuWWsv4wdnHaQ5dzGvXOBfUW0qdUmBZ +Ha3JOqhdrhVPriskImShBh/qYC4hxkhOkBrOUBP8uHgJTzx3HH/1zD9iGjXcPL4Nt26/ybZNbkEW +IjQpkiabXZ7HsdnX8WrrrJ1HgXauhlsckNRcHkw7PaBkyxvj5lSs7PWMat5gl03+VwSAELhIKRk0 +IfjkyCVKkrTspcSasKOebp3an371tsfSp+//UHp42z6OZWB24PlaxvOLiyzm2PsomlScqWClJEDN +QWHrkv9+IlV1DalQCQAVKlTE/7qeDF7zqJNDUZQIJaMeAAUhKjBtBhKCp80VAKbyDF4IvV6JnX4M +y66HPCTc+/MfQu3BxzD71PfBt+3Ajt/5Rbg//Uds/d1fxtYzPSyUXdCDB/DU03+PLXftx00fex9e +/dpz2PboHbjtdz6EI1//PhYkYf/734MTR09jvDsLJYdlFkyQQyEeXAK1TfY46M12EUIANQPIFLFX +IndAaPdQLi+vTdGtcO2KCNW4Vx2P/coARvEBGNiqzYzVORNSFTMRVeWAzJcJPHN+yT9zZJLfuzdP +GUXPqfS3xT3uD9/zu+6Dtz/i/uxHf+e+df5JOre8QHNli8Q7IHooFSYs5kgNFvuJEH4N6fcDRACD +966XSioikQuBUJYEZkI9p7xRx/IWw7NyBs++9jpwTFYkDSKD8wQi5GRW9NqEsTqIDcXcnMXxCaLJ +HGXrDED1fuf8dXOuxVBD2W0DmuCzACMYih7gHFBrwKOAaIHzVGDOdezVsoVvv/4q+FUBUjLkASFG +eO9NRMAoDMqgFCzGiLJom8IZQmYINajzxswGb+qjMykHtv4b1t5PsOI+w0kkGYwphBRjTJakJLHU +zOppenq83D9xW/rdD/1K+tS+D5axlNQokeDyJDWkp8+00umz81wm46xW41J6oivHsYK8ENxFAWBt +9suo5QBXTAyoov8VKgGgQoUKFVZhriHo1Rn1psEaEUWPUXAHXgOSS+hscok6dRexfSrHUg6I9nCO +W7hlRwPjDx3At8+9jFv+778D/6sPYuunP4rT8cuY2DuJ2ldfwKmTJ3D3/Yew5fmziFNNFE2P+Ziw +q0wof3wE83/0Rdx5+33Au5wDvwAAIABJREFU738U52JCN7VBTtBFgSwGFHWHdi6ISTb1+23TGrqk +aEsBlg5yAK5eR2wGcN0DqSLuV+B97Sp8fiUWVNjo8bpej3YFqRDBkzNRVRERMSJJrLy03PXf+/7R +5M5v9/cdHEsT2yddDrjQhXv/+GG6/xcO0R+f/jy+88xP6VsvPoGz3SXAebuY4C9mqyPEYcD2+D5C +wCURwJdiEslZMydhJrR7LmQ56i6gNbNgcSwjZUFQQ3QeGgklEtgZ4Ancyik2piwZwyKR27cbqds2 +LJxBrZZTISOJLdcsUhK4rAajaAKBM0IMAd4cXAcoahlgahdbADIXQBKL5FHLcyQrrNftrmSixWjI +vMFyQJ2BHfKQWwFn8MGgsKLXNTgYZVFZSiPUBpn9DYr+86rbRETsvE/O+6Qsibvd1KBYHtx3W3n/ +XfeW/8O+3yh3YVcZJKTlGFKbUFIH6dlnz6RnXzrBs/MZJzbOQ8bOlWxgUWOBBV3pB/km4q94az4A +Gx7fK/JfoRIAKlSocDUnf9cHCVCFE4NzbmW2oAo2u9CG2F24Xm8eGm4ci902mvUMHZ/h9uWtmHGE +Se8x3Z5HCoTi/CLEGJPk0frBsxj71EPYsbwf+OYz2H1iEU/vjNjNgmkXUI556HSGOLuEsw8CW0jB +ZDAzRCNkcMicR7o0j9jc70ekMGcwclAEqClMAVOGaQlsssdChQoVrsq43s98bj0RQDybA7wwvIOB +67XgkHq+luUuKdzZNrsvPHPG/fT0hLvvYHT3HsjczjFQQIuaskR/uOOz+PX3fQRfvOl7+NxLX7Mf +nHvWlnjRQGoqorEIlmqZIcsMAvNF0hr3gsVCy8gqNnHBiP4N5P/iYuq8I4GhnVbKAkIOUVBLmdAY +IzYAPqL0sPLSvomgi/JGDlNNIICgZtbqgeAJcRKFDI34XxfZAORKGFZklpUf3CERkMgAZ4CsPEKX +LjPBEAMYQAtqoAgKq7I0Lu0TtQQ1OGdkMKS0cuwEt3L8KIzghzn9KwAxbkmDxsRrlJaaWN0z6o5d +6rFbXmKu1RKCTyrd5DlPD2y7q/zVAx8pP73/g+W9W24rHZZLBC1LoExAefQUpyeeP5uOvrqYWq1G +CsGlPIJTe5kdIAIv8A2BQjyknygxrOb/rZoDVqhQCQAVKlwr18d3MDG/LkSAXWUNnZQjLAFll1Gn +DJxlmDSPBe6ippv7FSTzuCVOolurYe5T70bNDPnLx7H47Ku4593vAX5Tce6B7Th/6gyaLUOc3ILl +42cxf+QVdI7NotUU1MwDSwnMgnRuAVOLCbsmpuFmFxHnGHvDBOrZElhLBAFiCeQ9BTkPz5s7BC9I +CaKIGHPUXEAjMTrsgILgU+jTeOu6J0gVKrzTBIFhZQBrif/FdntrCZvDG6O0DoCvxaZLZc+dOr3o +ynaL5s5M0MG9TTp4yxQmxppgOYNdE+P47H2fwLvvfsS+9NS37AtPfdleWDpiZb2nMplbXC7VLXTV +YqblWAxtXzNI1CCqFzIELm6Hx5tLAt5cFvBGo8DVy7B5QD+fhI0IK3SdjXc25H8bcruWBCuGt/ez +NaR/dcRf62Pj3Om0BD6IH5/kRgJ3zy4yR2XdMpli4dm3Nd02ti/94r3vLz9+72Ppnsl95Rbkpehy +6Wi86DHK0wtWvvDqufKJF14vj59eLl0+mbZu25MWF2bTheN19SJrtmeU9P9B++stXVOq6H+FSgCo +UOGdR/ZvWNJ+JdGBgbOIFAg9FYAIyQxmirNUYMrXNvXzl1tz2PX4UcTpJqbvuRVTYzm2LXfx5Je+ +g4k5wZmHt2HLQg+9f/81hBdOYtv0NtTygObe3fj2oRz3fOUIFn/4PBZ+/Ay6TjG5sIz5Z19EKQXi +0iLmf/Q4lpYWUTpGT0qkzJCcovCMLNqmmwAWdQdJDCRCNAER0HUOLouweg15ccPUANgN9jkVKryV +47Mf6V0rBAwj/w6AUwaZBleUSq/PFLSweJbOzrZxZk5xy55tOHjrVuQgmyxgD2GH3fXAL+tH77jP +/vzJv9e/ffyf9NXuKyq+ps0aabJSYarwYwoOnpeLQGOq+Fl5gOLNmQD+wvpRRYD1xIDV+wZr9g/W +EQLoOhjrRiH+QH9Txn4igA4h/4Na/F28z8YkfnJSREuWpRleFs/jE5PczWNiTjyxGNLH7/tA+q3D +H0/v3XZnucVPJIiW5lPZcb1yZhHF80cXy6eeP1GcneuVpauXtcaeklXS7OxsupDMkAaQf0H/zheX +WwKwobG/Iv8VKgGgQoUKb9fk4ZoXFJL0QNEQ8wiowrNDp0iIjjBez1Djzd38+pYxLHzt++h+70mc +n1ActwL7l4DpVhfHF/4J7htAWDTEhR7sPftwKrZQ/qevY+uc4OEP3g9/cxPlj1/CwuMvgpbnofNL +mH88QY6dwkSnhZmledDsAkgVAYIsCwiOoCVhjAiF39zvt83nKDsFuCgRCWgiYIkIY6owWWm4XJH/ +GxbvCDFx1In2v/63z97oIrH1IbQ2gPzTGuJGFwgUrSbXqehQ8BnFsQaZ1ambChybKTHTPoenX120 +w/M7cc/NTbt1GgYtdExKfbRxs2195Lf1gzd9WP/dU3+iT599Rc/3ziqaXmOpkk6fVbiGH9+xS1ud +mbCK+K8VAtaS/qEtAy/j+rdRIeDtzgawDT6+XtR/0DEySmu/QXX+ukpIkl6Pmdql1KNjHWtyYYmX +u+1Ux3a+a+pA+u8e+3R6eN+d6e7azSmUscQyEjJXnue8PLFclN/9wdFyfr5bzC1pKZgsfWiUziM5 +6ZaKIgFxLflffb9fBkC/MoC34glQkf8KlQBQocLbNLGlDTz3HTMpvl5EgJ5XFK4HRQvOKyaRwwoB +GSHLcnBZburnL1BCLRq2MGG75FheWsKsc9i6dwdOz59HozC0fAOtLYr22ePY8eIJ7PwvfxEtYSy9 +eBbHvv5POHR+HpMTTUju0FucQ1738LdsAUuCvHYaMQ/QSDAWmDl0tIdkPWSFgWlzXQ473R4cK2LM +YEHRsoQ5Z2DrgmQZdTQq8n/tCwr0Fp5DN6JAcjkT7NWvuUHEgNXjuw0gsWuJ/5t8ANaQaLdKCKDg +lQwFsQqRD7DMo2ADF7A2J/vKt4/bKzdN6IN3btM799Z1uh4tiOqdrql33rJdH9n7b/Rvnv+m/umT +X9CfnHtGUhAd3zmlSSwst15Xctlq8r/aD2BQNoCt+c6uz/1hmQC05vVA/zKKa0kIuNLEfz3SP2rE +f63Bn+KNUXiO403mXoe7khi9xN43+I6pvelXDryfP3HgPen929+VAJTgIsFzagdfvniyWz710mJ6 +9Uy7nF0+t0L66xOF06zsprKUslvmUVOzGVKvg4T+GQAbKQMYtD8vy9y1Iv8VKgGgQoVrb8K80fU3 +ChG/ZkWAnRhD249jDhlYC2S+BhcUWZFQFgQvmztEbe8YbKyBtCgoRLAlm8QpXsK2RLglTGNuPKF7 +YgnjE+PIEmD/7is4lf8TSgD3dGp4ZmoOaoRCFJ3gEMmh7nOUjYjlhWXssBo45EhOEJjg1MEi4EIT +dQsg2VwTwB4BtSyHr+foWgGWEilzqNfraNbH0e7I9XyeVxOtdxiu1OT6OhcDLicLAPiZ4+jqDABa +IwK8YcmyQF0uiZkBBJB3CMGtvCeRaSjt6VdP2fMnz9qBW3bpo/fcrO+61cl4gCIty97uhPzBwU/J +P7/jffJHT/xN/JOnvygnl49HOBY4d5GkXST/YQDJXJsN4PDGrADCaKUB/fbdIEFg1H29mfOHzST+ +wPrp/qNG/fu1+BMAnLpdRi0yLEvbbIL/2Z4H+ffv+3h6783vSmCfsISEBlIR8/KlmcX0kyOn0otH +2+X8bF5KGiubWydTmbTs9dqlUVGG4Mvc+RImZbfdSURjaz0A1pJ/WYf4X9Hof0X+K1QCQIUK1wbh +v5Kvud7N+65JM6PydImxuAWySzGTllDSGEg8Uq9Ary5oTGSb+vmTRUI3z8FSorM1x7ZkmMJWFAuM +1JxCfZywfdsWwDucbQh8UtwSJ6GqeKXBuGPiAErfxbKWSA2PHAHGhh4Yfts0qAA6TY9CGBM1B2eA +1R1ijNCuwGhzBQANDioepQd62kY0QcPnyFJAOr4AbB+vyP/1NY7RNTBGXbfEf9h7X2dCQD9Tu2FZ +AMCbswFWHzfShyxDlADz8B4gcgA5MxGDmanB2Ho2ObXdlBp67Eyps3NH9eTrE/rQXVt1385xyQIE +HZbdVpP//t2flUcPvTv++ZN/r9848j1ZaJ2XxchriWUYIAR4DDYKXJ0B8Hb5A1zJ888u43FbRwRY +L/Lfj/yP2tqvX4u/laVT8oTW+eG996ffuu/n+dO3PJK2YTKhZ0mEE8ZCOt9BevL5xfTD546Vx04v +JXLNcmJyPGWhVi4tdkofY6rVqBRYaVwkYSs9uZS5sZTsTeSf0d8DYNOj/xX5r1AJABUqXPuT6WvJ +zIfeAZ85EKc//gBuq9WwZbtDl5dAmiFQhlwMnTFG1t3cz+8QoyyArW4cSzuA1rGz2LZrK8rzHczs +mcD204tY3tqEb5fYmjkkFXTVYbwELBdMnCug28fhvCE4oCkOza5izATjjTGUvWVYneCgaJY5vBi4 +DiCP0PkOsmxzbfhzZAiFAKSoe8ZUcOgudcG3H8CJ3Vtx83z3ejuv7Tp//7cyhvUrfaINvNd1N0G9 +mpPqtZ91HZcJ9BMCgOFGgOhDkomTgyGutJQDTBObqSLCWRajqm2zzlJP4boa86Ctsis/eO6cvjZ3 +Xg7su1ne9UApWye2SBMNHWubfDzeI+999Gb5q113xD976h/lH8/8eDWZDGuEAL9GDBhUGrA6G+Ct ++APQAOFko0LA5c4x7DKeczXq/DdO/C8s795/B//6nR9Mv7X/I7zP3ZygWeIMqR2QWirplROvpaef +OZOOHO2mpNvLifquxNpLnc5s2fHt1Ih7SwEnSWVS4pKIkqeYvIakTAmh7JcBMMgAcL1uANfFOFWh +QiUAVKjQf5J7uZH9USbbNwrsWvluO+fa6BzeCwCYXLU+AZi4StsQAfQA7ACAw3tQYOWf3QAwuWfl +SduBHCsLAHQubF/vlpX/HYCLsfT2hdtlAMCuS9/rYrHipb4G267uj00AFletv87I/zs14r9RYeCG +wLUwoe63DdeYKDAsC8AGkNuLZGjttY9WCQGXoF7s0hdWmIM3OG8KaE9UATUfnQJQZRNCTZRqevKs +ycmzJ+X11yCHD+Zy+EBTpsYokkHqGJNf3/8J+eS+j8f/5+jn5bvP/yD84NWfxsWwIBjPBKYBXVGI +86jl6pz3VEqQghXeed+oqZAqip4n+CvpDzBMCBjVH2Aj19i34kC/WXX+b2jrZ7lXFCwwU/ggIC9g +E2ckeYzcpVlBYezcBNfjOBfdgq3o8V27d/H9t+/n//G2P0i7t21N4z4wQMkEqdNDeun1lF545Vz6 +4YtLCWgkxEYK0MQ6VwJIMTQS0EgJ3RJAIqLkERMMyWCJKTHCpdr/hP7p/8NIP/oQ/8uK/lfkv0Il +AFSocG1NkkcRBjZ7Mne50farGaW/ZsSAChXeoaT/csemtyIgXJP79lqfTF/J7dsEMcEGENbV59Lq +lnq6AUFpPRLZ1xzu5GwpS51X5dXXMrnzlmm56/btMpZ7aQAiZUv+4PZfCh/ddXf8m+P75XPPfyUe +O/eSwGfi47SM+bHQKs6qStcjBo1TY56ZvSwtevK5Tk9t0fn24tvtDzDKeWhXcAy80nX+wyP+57sy +vmVKLQvS6rQEqeCQ1cSzSvf8LE/WtzE3TNq+ze10IoXxbfypez7Ev3/wl9JHdj3ItYwSszBrSGo+ +nVmw9MzRmfTsK7PpzHxnhfz/TBsfZeE+t2szEVaLAKO0/6sIfIVKAKhQ4Rom/JczSSZsLFp2ORkE +7xTCVYkDFW50kn81t2XUjKPLSfVfT/C0a00QeCdG0a5QhsEoJnX91usGP6MfoeznBP+GZaYd5Hyr +lHPzXZlZTDKzxHL3vi1y045cpupNATg8NnVI7pi6Kb5v6h75/DPfjP90/HE50Z2XpXxZsvGalEUR +0Cs0LYnP81qoTUxo0Us6d/aMUrP+Vv0B3Aj7sd95cjlCwJUm/qOS/lFN/mTtbzoxNSmthSUxiDTH +xsRCkHZngTkGbty6VRbLjHFuhuuJ02MHHuRfe+8n+Rf2fjjdatuYWkiImjKfpcUC/MwrS+knz59K +r5xaTB3OksvGUwYZheyvJfxrl1Gc/9dL/a+i/xUqAaBChRtAOFhvAkwYnuJ/LWQGXGvO/dWFrsI7 +VYjYzGN/lLGn37hF64xpax+rIv7XmSiwATFgI6UAa8mODhGa+pGiYe7wbxIE8pCL9w1RDzkx15XT +MyfkyMun5ME79vC9h3bz1skyUhllO6bkV/Z8MDy642H5wslvhD977m/jt45/X0oRQW1Mas1JsW4R +tFdqN6pPAR5j/kr4A/Q7d9a79m6WEGAbEAKuSp3/kvXENWtSTyLUKRmknNVrUtaMO2mJ0ery3bfc +l37/tl/gz9z6gbRv4lZG6ZJ6cDmO1Gu5dOJsLz3+0un0wom5NN+l5OI012KWRCThzQIAD7kdZPjH +6O/8P6oBYEX+K1QCQIUK1xnJxzoXcmxg/Sivu9oZAtds+74KFSpsaNzaaEr/MJGShpC2YWTlSj1W +kf+rJAZcZpnAsK4AF0m8wxvLAWQd0rmeW/xq8hUv3m+6JKwqQkES1bmr4PZMmxd7Z+Pzr/XkY/dM +y85dDWmOQ4QQJmOUXzv0/njP1q3y1I4Hwv9x4qvx9fMz0i6WBWO5oJELet0Ag681mlp0y9VGgR5v +bh24nj/A6nNtveyZfuUAw4SAUcSAUYXHUer8gf7R7kF1/tqHNL8xml4m1kYUadS4KJNIt8cojXPL +uRaz9Ht3fpo/evdj/HO7H0pTaLIxkgakTok0e36Wf/SCSy+88lo6eXYxUX0q1RuTiVORqOyk8ei4 +o0OJ/6ClX7r/qM7/o+77auyqUAkAFSq8TQR/VFI+bMI9iMDTiGJChQoVbnzYJj//rYyDNISoDCIv +g7IBrolJazV53vi+GkEIGCQWD3KyX+0JgAuEWNYh/6PW/l8SAryWUrKJcBRfq4fQGBdJmZztFjJz +fElen2W55w7j+++s856tRZzwLA1EfmzrQ/E9jz4S9x+8S/7huR/Gv3zhe3KyOCOIENQb4jplcOdb +ika2OvLvB4gAG8kI2Kg/wDAh4EqMLZtZ5699yPMb6umnfc7zi8tSRDAaY4xY5+08xr9w8+H0sXse +4d/Y+89S7sGwIvWoSGXIeV6Rnn72XHr6p0fTyXYjqVGKEzvZx1qSVCYpuilC2cdslPT+fqn+gyL+ +/cj/FU/9r8avCpUAUKHC2ycMDCLu6xF+WmdyPUyIeLsEgSoLoEKFa4f8X8nxbL3U/mEp/4PGxUHj +n61DTq6KQFBNni9/v21QBFjPuX5tRgAwPP3fNkAqL5HJHoWIYBIJYlwEKEsAxMeaUEb8Urfg13/y +Ujx2zMljd++SBw7u5okJH0uDFAL5xe0PhXsfOyiP7n8wfPHF78bvvva0nGnPSAkRrucC2Orof+iz +HWtLAvya77L63BjUOtDWmYPYgHOI3sI4ZCMKABtx9u9b57/m/hsi7O3U5Vq9waDAzdTk+7YfSp+6 +4738if0P84H6ztTuaKrXHUPzhIT0xEun03eeO80nZ5AK3ZLyYCmPMTFzKpbnOY8hTU1NJE6JZ5aW +Uq1e5wECgAwh/orRUv4r8l+hQiUAVLiOSf6ok+hhhH2UiNmw523kszeD4FciQIUKN+Z4N4iwrycG +jDqOrUfwr1oZQDV5fttEABvht1xdFrD2/awPcR5GMC8tHYqSB4oBIo7LqGVPjCCgwEY+HmpACpmW +E4vGJ3/Y4x+/PhPfe9ekPLDPy3jeYvCWeJPbJr9x86PhY7sOypdf/F7406f/IX5t6UUp6yzUkouf +NYoQ0C8bYPW6YaUB612LaR2RZaNCgPX5DdYj/qNG/IcZN76BfJdTnrFc8ENje/g37/1Y+tQ9H+J9 +9ZtSQM4QSmONViq1zide66UfPXUmPXuylZZ1PGV+LGUEFjufrEip5inV656LxOn8/BxTrKdsejuj +19pItL8f+deK/FeoUAkAFa4RXKH2RsMmwaNMhC93AYabaY0aibvSuCZFAFWFc+7S/Us7hOgNtxWu +T1z8TYkIRA5mK4chUYD3AapyPX+9qz2hW8+LZDPHtX4kcL3/ryh5rc6mK7cf17nGvhURgPoQz2Gp +5heXfnX4WjdRMFQBAaIgxABAaOX5sliKiBYcvI8OKq+9Niv/ML8gL53YwbfdsiU+dOcZaWBcwGNh +WnfLb971mfDQ7R+W//zU34Qv/ehL8dvxdRHpCTQJeRIiH1S8QPPgqOZVWgHOKRwp4DxgSmreQZ2J +eot+9fcZJAaMUhIw7JzayDh0JYj/pd/GlNX5KHCkqlCICMwE0UnwQZrLmXQyljIvGSgkY2FicBEc +I0a+6/xW/sT9H02/cf8v8f0Th1KeHKNAQjTu+l565UwzHXllKT338uk0u5ySIGeDJpTzyUETBc8g +pLRS68/kHNfzmADrR/4H1fb3c/gflu5/OaZ/1fhVoRIAKlR4G0BX4DWjTIIdrpwogLdBCLjmRAAz +hZlduNU3/RwrhLHC9SwAOOdw8Wdc/VurXte/7WZt/KjdSEaJ9l+pMQzoXwZgIxD/a7aDwDtdCLiM +LgGDRIDVKfAXhYB+17O1hMphuCfAMCIXAQgRCZEFIhLACyvz3GKbmU/G8/NzMndugg/tq/GBmxDz +vCtAL+zOSX7z4U/Hj93/Cfk/f/An4dkTL8UXZk/IsitFa16QioBeV1W6PuYNFRHvAe+dD0nFibKK +cz5r1i0V5dpsgFFFgFFNPW2D49Gotf4j1fn7el2lTIIiKTkveZ6Lc04kFVJ0O7JgiwzkUpeMu5Zz +yczON/muxi4+2NjF//KTn0l379rPN2EiUeomQ4MRKc10KT1/fDk9d+Qkzy600uxySkx58iEmco4J +PkUfUqmyNr0/YTQ3//XM/S436m8bvR5U5L9CJQBUqHD1BYH1XHpHmSy7DawfVQRYr/Z2MwWBa0oE +WCGHK9dHohXCvzr6XwkA1/mJSHRpufhbOueu98wO26TnDhvPRk35HzZWuTXr+j22Hvm3dUjKFSf8 +1QT6bREB+ok962UC6KpjaXU2wCBS5TA83dyvIwQEMxNTDXAm3jtW5DGJyHyrlFav5NdONuKxU+fl +zttNDt0KvnlbFscQZAxN2SoI/+b9/0383sln5HNPfiN+9ZWfyPnWWcEYBM1McpKgpamJ+FRwSOhp +yHIf8qgM0jIlpZ+VBvQrcRjkDzAsw+atjkmXY/LXTwAQACqcBAT10YsTE+21JcHYAIEDhz1jwksl +d7uJgQZntJUPj+/j3zn84fTr93+Qd2Jr8gATOFl06Xwp/NOfnE1PH1tMs0uaeq2lVCqSuRqHvJaM +fDIR9qSJyF0LxH8Q+R8p9b8auypUAkCFCptP9jdCmkeJkLk+k2jXZ/2w163Xeutqkf5rVgSIMV6I +Cq9cJ1eLARVuHBHg4m9rZnDOwXsP5wiqNzT5v9JiwKCxY5RIv1tnfFs9zilGz2SqsgAqEWDt76sD +jpm3KgQMEgOiqoqSBngvPm+IQ8ZwiOKTvHhmno/P9PjIsfF4+NBOuXtvU3ZNgccyxDEZk1+55dFw +957b5aEj94bPP/W1+PiZZ6RdzktRNwGboJaHkEXlTtuzppD7TA2k0u4qYly9fR6Xnw2wXmnARgSA +YWn/fVP9MajOv1Rxwav3js2SlCwCU0aeC7LIMrvEiDX2tXE+lO/lz9z+/vTZwx/mQxO7maApJCQ4 +8GInpOdPnEnPHj+fTsyUab4duJNcGs8nUyRK5LJk5JmZk6oykSZztJb8C0ZL979SxL9fzX9F/itU +qASACpuBK1T/32+yPCxa5obc9ouU9ft/o+m11wKRedu3I4SfmSX3i/ZXQsD1jdUZHquFnhXbh+tu +fvR2bvB6GQCDBMpRxq5+r1sdzV2vLzxhY7XiGyKo1Vl0XYgAg6B4cybJ5QoBq836BIA45wQgMXVB +VSNURWCi3ofgnBDNsqM8FjwhL50Ocvr8LL94bJ4fvGd7vPv2MRlTk6AU7vZb5ba7fzG8Z/d++cLz +3wpfeunb8cj5E5KiCCwIci/OU9BuV4tu27tQC1mtqUmKtSLFoIwAGiACrD6/aMC5tBHyP0xoGUb+ ++7n7S+4zEWUppRA4YtQygfMMdYxSeZK2su9Gft9tD/B/9divpo9tO8x5T5L1iqS1nHsB6cSpIj31 +0mx64cQyz7aQ2DUSgqVa0KQa2MySiiWAGaLJkTERDTP3G5X4CwZ3NLAhIgAq8l+hQiUAVLi2QRv8 +Hxgt8j9o8es8Pkqd7SCB4u0g82+7CLCa4Pcj+5UAcGMIAGvLPIA3mj5WxL/vGNXv/rAxjEYYw0ZZ +FIP7nes6pHCtKDDo/wo3lgiwnjfA2qyAtcTU9TnO1hUCEos4F8R7EoBEVYOZipkFERMULvgICXUn +bMrzRTsun0hyeqEtP3xugn/hPZO8qzkRxyOkDhfeP31IDr7vlviu/ffKN174afz6icfl5LmT0i3n +BJOZUL0m1iuDpVKzLPj0xq4Bq0WAQd0C1pYEGNY33aQRxqZRUv5Hi/qvWqxkcZHYxSCqzOiVDImc +0xg3fJ3ffdM9/NkHP5w+vffdvK3Mk/WUrdZMAqTZcx3+9vGX00svz6Yz5yi5fGdysZGKzjyLLKWx +BlIqmxci/MrOueQdGPBsylyKMn4mBKxn8Leeud/lpvsPMvyryH+FSgCodkGFa1wY2IzJsl9HEBhW +EjCKMeDbQW7elm0ZlPJf1f7fGBCRgaLOar+HivyPNI4B69f4Dxuz/ID7MoCsaB9SNkiwHKUUoMKN +KQL0E3lWP18x2FdKSIhXAAAgAElEQVTC8ObMgLXH4Gpyt5pwCxtCNBPAxIPFE8Q7iECjqUk9nw6d +oi297hy7zMdarSa5b3CndHzs9RT/9MsvyQceuEceOVjjKe8jCpOdeVN+Zdf7wmNb75UHtt0afnj0 +ifjN4z+V19KcpBrE1XLRLku32w3I3WrS7/HGcgW/5vzbqDfAKFkWw6L/w2r9Beu39uMkpfhaxpQF +RmEM8Xxr3MEP7ryH79p1IH3ygZ/n28e28DbLE5xPFgPPJKRnX+qll557LT03u5iyfIIp+rS4uJiI +ltLkZDPFfAt3e8sp0IUUf1J2Dpci/wywiHAIYS3xZ7y5ld9GW/rpEMEEFfmvUKESACpcPyQf2FiU +rF/UntaZOPs+E+dRswJGEQHe7tKAt0cIIL3ICvtuTnU1vf6xWuS52PLxwgOAXbMCgF3F91ivfn7U +MW3YGNZPvPSrSJWsIi/9apcN/euV+32PUdsGVrj+RACgf726beCY1jUkd203gLViQD8vAA/Ah5gr +qXhVVjMVBxI4ElMVVgkdkuh9lIlsS1BVka5wYUUkMvHkZElu4r/++vP8xLOIH334Vrl//7T4ZNxI +Evf5LfL7934ifODQYdn/wt745898RZ6dOybISHwWRThdbEeoa4QJ7SMCWB+BbT0hYJAIuB7xHxT9 +HxTx1zUE+9L9bKzOBTGj12VQ5APb9/DHbnmYP3PnR9KjO+7liV4tgTl1nTCTT+dOttOTz55PT7ze +4bOSpTrfktq9TnKuTNOTkclZKsrF1OkpO4qckyUAbKZsLCsRfx/YOcdEXgBdu01ryf+gVP/10vxH +jfhX5L9ChUoAqLDZeAv1/2819X+jxH/YujcQ/8C5Sx5keaSiV6d6JJJyDr6WIekEwRUwVSoTIzoP +WA+EHtVqAWWvDRf8RsjGlWBTG+1BfEVVnEvrq8z/G1OqszWrr63f+apP4EgVcA524Y9cgCdDREk+ +daBWB8baIAeicoyUlwlFRuZzco2ekzKOMoYNGs98H/Lv0b9N21oRoN+vZxsUNypcfyJAP+K/9r4N +ec16nSb6lQWszgZYLQKoF1lZR16NvJcLhJCcl+jiSho7NLAWK20DPQJAYiBhgKmzFAM15PWZJP/5 +66f4uVc7/MAdW+Ptu3Opha4EqYe74365/fBu+dRND4a/fvof41+98G15pjwjmM6lOVdKy6tYjgDv +FYV4VyCQD+rrYwrpaFkUHqoa8txnWeZY1ZWcHMwcObdWCFjPL2jt/h0a+Y95pmVRKFjU+aDOOYWq +iJk650Tciru/NxMOJpYTw5lQJ3HsFFxMTzJaxjttmj+8737+tcMfSx++7RHeYlMJXTDqC0m0ns7O +xfTkS0v89Isz6fRMJ3lXS9MNnzo0xz4iAUiJV6L9hIwzv2LsJxdr+8kzADaAYXaB4NvalP9+wsWw +dP+NRPzXq/evyH+FCpUAUOEaoxSD1m809X+UiXIY8lj/8gBS4qTOx0BkSoCnPKtTzHJabnWptB3k +AKgTiPdImKBOaiAqwJLBuw0R/itd028b2PcVKlxPsGvh/c0AZ4AqoApyBjIDCjWIM0rmKZUd6olh +aZmpOb6FSnXU5Y4DdL2sJTdkHBP0T1tW9E9bvigCXIQOGQuGEcFKELgxRQBgY+aA/cSkYWUBq7MB +PAZ3C5BVx/eb2gYCiKv/Z+oKhUyci7zQK+Ljz78mZ06fk/tu3ykH9u3gg3uKqCUkuLrcvfVdYduH +Dsnth94dvvDM38WfnPipvLynJqHFMtbqSdIk3boPOhUUTJ6Ktvd58LFW86rqRVU7nY6HmUMMLstz +l1Jy6J9hM0q54Lo1/2VZKtQU3it5pyASBSmBxACZdF4WiyVRSQw0ZLLwXBRd7o15Lm/ZymOnlvmB +PYf5M/d9In3q4Ed4r59OnpUTuinUkU7NNvmVU+fTMy+dTSdmy9TjPGXNBqtqWi6Xkvf+ooP/2tu3 +avA3KN3/StX5V+S/QoVKAKhwNXAFov+DTLM2ki47igiwVggIGFwe4JyDUysJqDnniZiVjJSWW116 +4qkXcOToCyAiIlvJha5lOZr1BrxzxMwg50Yh/pspAlxt4lShwo0oLFh/AcAuGSWq6kVPBOr1euh0 +Ooi1GgxdlCio6EWanW9RpwjEWpCWhctCY/VYNoj4h1ULr1k/bCK9NgsA6F8KsPb7Van/7zwRoJ/w +s142wFoxaVhZwChGgau7BHgMbht4USAIlKkkKZi0FuHrUpZBjp7r8Xx3kV84afE9d7Tl7gOHZKIO +9h3EHXldPr3nsfjAtpvke099L/5vR74qZ3ozsshtQeYlkBMrRcQkcITnXhkQozrvFM4pYArAkcFz +mRxooJHwKF2DhkX/V/aJmjrv1QgqKgJVgaOV/WLGi9yVxnhToovc7Ra8yMxZo8mTLuc4A/7D9/1L +/rlDj6SHJ+/jeidLABKi47avp58eP5meeiam2flWOrsAbpch+TymLFAyVVbtJY+x1YQ/XQbx32jE +X/HWU/1HcvqvyH+FSgCoUOHqgjb4vFEMs4YR/X6LX3N/UDaAE6gzEwcoZT5QSolUQUvdgp58+gXq +qtIlp3QWckQIYeW00sQwR+uRDVqHbFQR+woV3h7Sv+5rRATer5T5XBQAvPdQVTAzeZcRqCAKQoSM +ypSTmVEIwYGy9TIAwoDxbO3E+uJjo/TE7lcKYAPEgLecBfCv/+2zVE2yr0sRYK0gsNHSgNXHyahG +gaszBPwIQkCMFIRFgplIVmtIbEywlCnOd9oys3he5s4rP//qMT5855Z4x94xaXqTDOB7wsF494MH +5efueCT8xTPfjP/hxW/I0fKssBWCbkfgIX6sEUREYeZVxcMsUPAanHeSWLUsPeXZKJ5BGHKdH1T3 +v1IiQStRf4MpTAUEgXMCIoEqxyyTztISw+eMsTEGRR5LNf7t2x7j/+LBn0/3bnmU6w6JtGBkKVnh +06tnkH50dJafe3U5zSxq8jFLlI2nRu5ZjZOkMjkoZz5PpptC/Ecx+MMQEWAU4l+R/woVKgGgwnUg +BozaHmuUqP8wsr/e8iYhQNVWhABNzlFwzoGyWCcNgVq9LqFWgzlHDiAjj6QKtgvGaeRGKYYftU3Q +5QopFSpUuHyiP3SSqQ4QciAi6IVT0pODi4FczKAcYRYJqqSqlOc1EhEH58gQnMm6mUthDfEPAybY +NmByvbYUYO13WK8UYMOkv8INIQKM8psPEg9WZwGslxGwXmnA6rKAN7e5a1MYi7Wo5KToLkvqLYcQ +guQ1JzGLfIqb8dTRWTl6/qw8NL9DDu/fzjvHx2Izh5BA7qjfHv6n994mHz/4aPjjp78c//q1H8lM +Ni+uYAmzbQnTTVFYSMIeKmqqPnnzwTn1eS4MG9ZJaJAI0I/E9jX7U1UFSIwg8F7gvXjnBKKiZuy6 +yqg3GCAOKeNP7nmAf+/ej6YP77ufJ10jYRmMGpLEPL3eTfzMK6fT00cW06lTSN1unuqTBYukpEWR +AJc8OY7kkrfAZJZKty7xv9w6/1FS/dcj/RX5r1ChEgAqvJ3YQPo/bfCxtcLARlL/h5H/iOEZAJcu +6uSCi7HulM0pEpmZU+/Jx0BiOYkIqSr0QhYAiFauPESAJ7j+E6ZhUZfNIDOVWFChIvZX/n3Ne3+p +FSIRXSoFuNAikZxzBIsrDzumJIlUmWDqTMn5lbYKDqNlLwl+VgO90XZZ/cwB1+sKMIwEVoLAjScC +ABvLBhjUNnCtuNRPBCC8ORtgmD+Aop8/gHhxMYoDhzIVYkjBUS4UAhM0uolSgk3LmeU2/+03zvFT +z7fje991s9x5+5Q0G8JbJES0II9M3xvu+fDt8pn5p8Mff/Ov47dOPC29yaYsLZ4RBC8uiwExE1UJ +YPZC3ucxehZWvLlTx3pZAGsJbD9iLAA0OCcMUzgS8p5hJtItBIkZYlyOT/OEZPzwzoP82fs/xp/c +/560E5PsLSQUSMiF53suPXG0lb575Fw6dqqVDDk3allq5kgGTeYSkyGZWfII7DQwWUhmxnAyKvHf +aMT/Sjn720bH7Yr8V6hQEYMKb68AMEr0f2197LDa2IukPrtwP1uz5H2WmhFqUMtjCDUpi9r52bP5 +00/9qAYrc++Qm2WZcy5PKUXRlAEajRBijEFVgycXzMwTkSMiB8AZ4eJ9MtFR2wJV52eFCteukNDX +uZuIDIDZSq9EMzMFoGamRKRmJqZeyHuOMUivWEoxhgTvk6lPYCnNrPDkSiMUzme9dz/83qI5ta0n +ioIMPQA9AMWq29VL2WdJq5ZBE/i1k/VRJuWjTL6rSff1f62mEf9/K/49/dr59mt5ufq6/ybvHrIQ +zCSAOJDT4L2PRBQ4WShLjn4sRU4xeDcVo6tHLlrR43y4fd9YvOeuPfHR3dMxjiM6IGirFbNosZdr ++I+vfj/80fe+FF/tHglLnXboGAdXywJ558uiCEjiQwheqK+J8LC2gGvHFBtE/gFI9EFLTgJPTN6L +JRb0Sq6HnKfGxnkKu/m33/VB/heHPphure1gQZ4kBgaQpIN0dKlIjz99PD13dJm7OpksNFOvaCeg +lcabjjtLmrLoOcaQyBmLSBIGm3om8mzEq8eNUQz+ZETSryOQ/sup76/If4UKI6LKAKhwtcj/RoWp +9er+h9XMDov4D1u3dpLher3kG42ac8455yM5Byo5kZISPCiIvxTxUzK6GAUUqAEgt3Ld7+eyvHb9 +RglJJRxUqHDlzplR3++Nk1K6UO6DlQwARxcygcwAA2JUSixE5ih4QuIe+ZA5k+iEleKKS6gfMJYx +3uh8HjHcRVuxflrtoNaAlfP/OwAjZAIAw0sCgNE7Bax+7qDSgLXlAP38AVZnBbzBH0AiVDgJyCQP +XlRJUoFAiLFenxTqnJXcI5jvihGzhsRS1uMrJ0lmZufl5YMn+PCu3fzuPTtiljcFQVnRjb98y8Px +Uzc9IH947I/D00eeD8+/+nIsuj3x9dyTc2KkXlUDvFsrUgiGlwEMEwDWZjuIma0Y/wFizjGBpJbX +ee+O3bz/5r3pf9//r3jLlq08HbYkaGSfkP7/9u4sxtL8vOv48/yX9z2nlu7qHs9Mj2ff7fE2WLaz +L0Akk0SJIiDCCBGuuAFxlxvEPYIr7oKEuAAJgiKEomAUpCREKNg4OHYcx541nu7Ze8a9dy3nvO9/ +46K7yqdPn+U9tU1V9fcjHVV1TXV1u33e932e33+zmxJevXw9vnL5g/An32mCySZorIJtt4K1IS73 +XBhqFdY3B7HvPhZSamKITTA2R+MkSuViLiWmFKLPehDr/Pc63b/Lr2n+ARoFHJEAYNYoQpe1/hPX ++RtV513tNzY2vHPOV1VVNU2ojDGViFTFpmmj/7WI1CVXvVJSrZLqXm17F995q37p+9+u27aplvp1 +HUIYnVHgZfqeAfPS/93MAOA6nVddFp7pM984yltnnwKDMjUEmFzIl7ECeXQUbXtjrZCbFPory20T +hq2xvrG+137uxS80p9bua0Jbhup1dLR/fAZAK5IbLaYtOTdOXVv5XjsMbUglt3W/CqEZTpsJMGsf +gS4F+sKBCwX4sXtu64LP8Wkfu+zrMynsn3Y877SlftNmBY5+7kc/TzH6+9Zq/9wTa/4zz3zMPf2Q +9csmey1DJ83QSzrrvnX9gv/t83/ofu/8H7sLG287qcUVV5y0wUo7tLJ6yorpW1mPVjazWfHWSK+Y +LdOaksy0Z38RkdL3sQyHuWSps+0t55Qly/BGFpNStexTu2GTeI1GNZWc45pZjT/z4IvxH73w5fhL +z/xE7BUNoiFmk8Km2HDxhsZXzw/DK68PwvsXm1D8YOdeI3ce5Tdvd//xxj9OuJ9lmT6TqGvzL7LY +kX5lN/dw7j3A3Sz/BDiE5n9a4zutSJg06j9xrX6I2RlrXM7R+cp5Y9WnHLxzxjsnPpdUqZRKpfjb +H7dftUqpjNrKmFKVHCvJ0d+4cclfvvShT7H1pSSnarqcFjCvwJEFm3+6NhAAHL1QYFoIMK2gnf/K +UsSU3IY2q5pirC0PPPjxvLK0ml3lS86xqJSpLylZnNFiRUX11tSDVGIJMUpMsVije11jO+2evbBv +/v5v8c46Ir75+78lP/ZL/3QvAfSiQXaX5TVlD9fWpOnlc4+bWz11tty4cTO/9857+fLlqyW1rvR6 +K3m574tx/bJZDfMjp06VLz7yVH7m9CN5EEt+/9q13A6bfMr1SmNy1psh96+1uWdcllO+DPolt2kr +l0GT1FV3jeqPvoK0qVibRCWWto2+pND3PkopIWwOwtp9NgzjIJTWtF849cnwm5//SvjNn/oH7Wcf ++ES7qdouGdMmrZrNpm5fv5Dar/+/t5u/+P577fXNYbu01mtDG6ctFQoyfclQmBIMpBkh4rRZSLnD +/49dGn+af2C/60P+CXAIzf+sAGD080nrA2ft8u9FjK+qyucUvLVaDYeDanP9RuWcqdWUyho/dfRf +ROosvrbW1LEd1qKxvnr5UvX+u29VMTR1Kck3Tdoe+Z83+j/vLOCuRRPXJHB8QoDxgnbibt4yeRZA +9LYKpaS2jSFUVdU632sff/LZZu3M/a01rlETx9f737EHQMip6fmqKaW0KeTGWttWS8utca5NWdoU +YpDJewKkGUX8rDW684p0ivGT+RxfZDbApMBot/sDTKoFZh39O37E76QZATsfN5voer7ylTXepca5 +MvQP3d/3L37qCf/88yvuvnrDSxFnS+XFOPfO8Ir76sv/2//XV//Iffvy63ajiq6X1C7nbJMke900 +VowYcT2z5JfMYDCYVAfsXEfFu2KMZptDTs0wl5SzdVVSW6dSNMX2anzu9JPpK899OX7lM78cP7Hy +WCxNCWpKVC/hurj4g/Nb4aWXroV33mvjzUZDqzEE3QjRbMVa1ro09otu8LfIiH9eoOlfZJZR4X4D +EADg6AcAe5n+P74J0B0P9JSKd85VOTU+pVh9ePGd+oOL71TGap1zrHMoM5cAtLnUVVXVKbSVdaaO +zbDa2LxZWZUqhOB7vZVK5p8cMK/5ZwNA4Hg3/l0DgGkhQJoUAmgxIcY2FJXgnGtz0bC8vNK6aqnJ +ybQlb05t/kWkCSU33rpWS26apm3q/nL7yKNPNmcfeLAtom3te9sjfZOK/1mjeCwD4Fne9Zm022UB +0iEEmLUcsOsJQFamLAsYaOtqu+S96TsJ6mOz7p02/sxZ7+67r+9/+ukl/8TT59yyF++a4sREJ751 +/3fzvP9v3/+6/e1v/U+3XrVuU9ethHUrsZhT2rdRrNmK2Whtt//+4/9ORUTK6aYq63ErpzpmWa2y +SEmyGZO0VVqqVtOvPPe34q994kvpVx59MS7HKoraUKyJWyHEyxc/DF97r4SL727Ed98dhuFwKfj+ +cnQ9DcncDKGsBx9Xxq/5rqP6Xdf57+exfjT/AAEATlDzP63xnTf9f/xBP/og/1GSb2xlRL2UULVh +UJ//wavV22+dr62mKsa2rv3SzBkAbQh1XddVjLH2la2MaJVzrLz3PoTgU1I/ofl30n3n390uA+Aa +Bg6vsV/098+brjxrL4CdotsZH9t2GKw3QVVDztKmWFpR14aQ2n5f2xkBQJuLNsZIIyU1TROa/tJK +89wLn24fefzZtohtQtOOT/Gdth9A170A9hQAUJifiGf6fswGEDkC+wNUp9QNtpJvG3VWau+9d0Yb +n/OGz6Vxq0un/Zee/Lj/8SfX3Mc+Fn1eDi6JOCfOmTa5/3HjO+6/fPP33Vff+LodLrXWV9aGa+tG +orErp87oZtwyEwKPnetodVDlpldKs5STlDbL+jCt5LX8N578UvzZT3wx/ZNzvxbtaR+DhJjTIPZT +PzbRx2+8sR7++KXXwuZVG1OWoGqjGh9EJMQiUbUEtSaakLuO+u9lnf9ej/Vb5J5C8w/sE04BwFEO +pMYLhbumBaqqkZKtc85arY23zlbW2crXLhnnUiqTztPeaeaNFisl2ZyCSaGYJGJSSkbEmLaNxlo/ +7yxfkdlrZ7e/rlM+32tjz4MOOLygoOtmgPPuCSoiaqxVMarOOZNSMM45I5Jtr+7ZEJLNabjduNx9 +BrpIMkaspGSNFWdNTiXHFGNMMSYTYrJW79qZfN4SpVknAsw7LQDHVMfTASY9z8avhUkn3JSOP2/S +a/zkitHTA7bfz+MnBYy+7Mi1Mx7Cuc2Nm95olXp17UouqQ2bLpeYqtrHXq/vt26eSX/wZxfi99/K +/se/9Eh8/qmzbqUUv5a8s9a7X7n/8+5v/vIL9g8v/Iz7t9/4Xfu/fvh9K2unjVpvN66sG63NzCUA +N5dyFmuKNJpcXsmfue+F9Lef+cn065/8+fT8qYeTDCRKaKPxEq/Zlfhnb10L3/jWh/Hd930s9ulQ +2Sshl0EUbYK3IVprg8kmxtaHHCQaO3PUf9J0/0nN/7yd/eet8x//XHYRJjLLCCAAwAlt+CeNCojM +WSLQtq2JsTU974yRZNs22tAEa0VtjGKNM5PWBe68KmutMWKNqLVqbCnFxKKas6iq1SmFzrw1bZMK +pUU3AOQh1uUNxCZ3sytrTkk4zBCgy/TXOwwGA21Do6pF22ag3nuTYjG1r0xO0eqPjhkbH9lMIpK8 +uBRLSU4lSVVZNcZqMVay2hSztV4nNf6jIWqe0XjR6BMCzLsGFg0CdML1o3OCgElHVo4eH2hGvmfW +8Zh3BQG+LKcUo8vSeudK8rVxKduUk7hmM6dTponx3Dn/vmzE3/2Tt9ynvnPJ/9ynnor95yonPXFL +xbpTw8r9nUd+xn7+1z9lf+f1r9n/+Gdfta9++Ibpr/bMMLdmVgAg0mTddPkp/2D+8tM/kb/yxV9M +X7zvudRLNoVL12O+/3Q0rY0fXBjGb7z+dvzTizfildaGlX4/rsUQr4VhcM5GX62EUlJsB21IIUbv +bVxeWg6DZuuw1vnPC0APfNQfwO4bMGCuXUz/79Loz1r/P2Xzv1tH87nKV23bVrWztZZcvfK9v6zf +evMHda+qe7EZ1tnlWUsAKpNDpapVCKmqej2van3bRl/VtS+luJSDlzunEY6vPTQyffq/yPTds5Xr +lQCAAOBIN/pdm/95AcB4E7L9MRpjUowxLi1VcbC1FZxzMbQprPRX2q2tYSjurt2771gO4MU1TTNo +fKWNqg7F1c1Tz366eeLpF5o2aiulHd0BfNJSgHmbAU4q8OcV8p2aTd5+J+YZv+jeACJHY38Aa5Jz +osmJzc7Y4lIsLsbkjfac95Vbd5e826rcUjjta7vkgt1yveWb7oWn+v7F5+53jz/Qt7XvO1vESZts +0i373cF58x9e+wP7n7/3R+ZauzH6dx2/j5T7vC8/8dBn89/75JfzLz3+U+lMWUtlGFNbmVQqE9+7 +ktLLF67E775yLV69VGJVqlBXMQ781XhDroZlfSTGIEGij9b0ojEmFAmxSBtFQ0ziD3udv8ghT/fn +vgLsDjMAcFQDqfHPJ75izCpZTYxRtUQjNpuiycYyNOKSUTWT1gbuFAvFVqaIGFt7TUVUSlLjVGNq +t//cWWt8Z4Ua05p/jv9bQGyyVH0jWZIU9ZKSlxiCLPeNiAwltl5yiVJSlKp2Ulkrg8FQYszS7/el +Melk38CTkxij5Bylt1RLCEmaJsjS8qrkXKR2RlIWGbateO9FVSW2rdROJMcg2VW8yXYXECwyC2Da +5nqScxZjjAyHUdRUmrKIcUa3QmPEq+r05ubWDKgcjF/qmZKyEWtsCNmoMaYJQyNqx3//rL1J5jVy +FNaYdy3s17KAeUsMJi0NGJ0RMDobYNLSgO2v2Wzjrca3aMpRk4gk62wSyS7moVsKp1JxxTVmKzay +5YwxPoa++/M3XPyLCzfcz3+ydc890bdPnBNnq2KtGvu56hn7zz/zsPmNh37V/IuX/o156e039b3N +G6pry6Kqkq9fk9O+V5568KHym0/+w/L5Z17Iz55+NNvokjQlad+lzUbSmx9cSb/3tTY2TROHwxJT +lWKQQRwYEyWfDlVejVE1ikoUX0KSQUx3TPX3x3WdP80/QACAezQEmDQaMC8MGC90J/160kjCrKJ4 +2g7f0wrkvQYAhABjqqoSkSghBFFrxBovVc/J1vp16dVJPr62JI8/8bScOrUk7XBLSklSuVpUreQs +UqV4ov99Bmqk3+9LiI2EHMSoE+O8rN/ckpdfflVuDoKEVKS3tCxqjDRNI8YUyaJinJ34ZkanArTr +XgCLrJmddK+YdSzaXcePquqtfVGmN/2z7qPj9ywK6nvQgksB5jXuewkCZOy5Or5cZT/3B5g4Mq6q +SUScMcaVUpyIxJyzSym5nLP7xsvvugsfXLcvPHW/e+Gp++zZVWdzaeypqjKrj5wz/+7cvzT//eU/ +1v/08lf1m1dflpJaeeH0s/L3X/jF8quf/oXy5PLjxcgwq6QsLqfW9PLr72ykP/3LD+LL5y8l7X8s +ppRijDHKrRlDUVVjKWV8Q79FjvU77HX+izT/ZbfvWa5cgAAAR6+h36+fMXP5wCiZvpPwrBGwaUV8 +GSk+ZhUoXaf/H3Sjf2JCBGOMFLVSShGnRSS20u/V0pRWnnnycflnv/HX5dlnn5Yzp5dlfWNdSimy +vLQkUow0TSv9Ex6nbKYsy6tL0rZB2nYo1ldSV7VcvXpDvvWtc/Lvf+c78vZ774uzRZJESSlI1e9L +yVGSmJPY4pVD/vm7PRZw1pF7s67nife+UopKKWb7NiizR/m7hJAU1IQAuofrYz+CgIPcHyDJj2YE +joYBoyPlO8sOVXXn81KKizE6VXU/DEv20rsDd+GHb9rX3r1mv/DCw/aFJ/t22dZGpDErsdZ//Lm/ +a37us1/Q//NXX5OmaeQLj70onz396bI0qIvLUtT0chLJr713Pb30xjv5jQ9CurTh46Z/MPlmK5ZS +0mjzLyKxlBJLKdu/TjJ7d/8u6/xzx8BS5GDW+dP8AwQAOKp2WRDsd1M7cdqqqoqKbq8J1wWK3WnN +/mjBMOv7Z76EOTYAABdESURBVO2mLQQAexNzEZUslfNSeScbg4Fkb2RtpS+/8LM/LT/5uU+K91ZE +gvRXtqezJ5GSZWXJSdKTXRssFSciQZZcFqm2//dHWblvVc785BfkL8+rXLt+RdrYSBYrYo24upKt +rShGshixBAB7//nzTgOYFwRMGmGbd13vhJ6jX9/OP1V19Idox3sSsB8hwHjzPu+/TWr0uywRGA8B +VCbPBhifEZAnBAKjYcDOrICc8/YsgDgaAIiIzTm7IpUzVd8OJNnvv7lhL1561V5466x58ZkH7KMP +9k3dy9orRj9bntBPPfmYhhDEGJFKbJF+KG02+ep1KS+f38x//vL19M6VnIPzydSSTLUZTWN3mnlV +HQ0A0sgsgHmb+3VZ5991jf+Rafxp/gECABztgqAcZLE5Z5Oz0rHhL1MKc739wBz/fWakiOg68t/l +34CifIKUkqgW8d6LyEBCCHJ6pScPP/ywePEiUSRHI+Z2iVeCSA4itne7pDvJbr9TSxZRf+vdmrKI +9SKr/VW5//77xXsvg61G1DkxRiXGKDFG6ddeSuL9tYfCtMwIAkYL5UmjadPW3k7dL2BagV1KkVLK +diKw82L/RxyBEGDac63LbACV2SfrjAcGRiYvDRidDdDlxICdpQHbjfbtGQBJRKKqulKKVVW3ZLMd +Dgc2eWd974z9cHPdXvrzd+yF92+aTz39mPnpT1SqarVXV+q9UWtrkSIlNFlUS/n2W4P88usXy+tv +buWhnE7aO5NLu5Hi5s1UVTFZeyrdHu3fbvi3/w7RGDNtff+sqf6L7O5/5Nb50/wDBAC4d4vxiQ+Y +0RkAqlpu1cVFRCeOwE1r+MenCI7+GXasmBjf3XfeKFvXIooQYPQGZVSGIUuWKKmI+KonKScZhCyv +vHFBfuz5Ws6cOS3GiSTJYqSIOBXbNyIiYvMJX+Xub9WxKuXWheBEjKhEsfLhh5fk/IW3ZdhmyWKl +8pXYFKTZGoimKN72pT3heyQcYPMvM4rfWTMBxgvvrmtyJxbnd9zrfvS1RcIK4CBDgP0IAqb9zPHn +7egeAWXCx1kzAsaXBVgRSduNfillewTejYQAsWeyDWVo28ZaVbVVvWKS9fbta625+O23zPfeV/1r +zz2qn3u00jM5i/dGB0bKd99v5FuvXChvXqhym5uSjWRb3cxFNpLVnCuznPpSp/W0meRHI/7bf4ek +qskYE3PO00b7Fx3xzws0/Xtd50/zDxAAALtq/kvH17QH3ujDfvtzI3ef1TtpxH/SZoIik2cAzGro +afS7/B9fijhnJCSVYRslGydZRJpY5Ot/+m353PNOHn/iMblv7bS0YSgpBXHGizFOjDFi23Ci/31a +yeK9lzYMJWsWo05Urdy4uSGvvPKafPel16SJKqJeSraimkVKlMp5UZr//QwGuuwFMH5fKhMCgGmF +/KzRu52vqerO63YmNG0Gwax7LMU19jsEGG3au4QEu90ocNYeAZNmAxiZvOwvi0gyxoxuFGhvN+H2 +dghgr2xu2FOnTtkV5+3m5qYdrG+YXm/JWN83TYrmlSui733jTf3ed7I+fqqn3lu5uBHLm5tZriZb +XHHF10u5lI083LqZnbF5tbeWUmvy5Wubya/uLEEYXYowr+GfNbto0u7+05YgHanp/jT/AAEATnZx +XeYUo1M32lLVrKrzRvXTSMOfZPru/9MKhlmbCXLs3z4LIUhvuRKTVZoQpJRapFgRK3L+7ffkX/+r +P5IHzz0gp06tiLFZtNxaMpCzSGUrGZ7wYwCXspGiWZp2KFVViVorKYlsrG/JhQtvyboasa4nbYwS +QhRVI97VUjuRZrAlUvV4k+29+Z9WEE+6V00aeZsUAnTd0GuhGQPSbU3vvAIfhAB7vYYW2R9gNAjQ +Ce/NRTYKNFPe/+MzApKIWGNMLqXk2xvx2dshgL0dAth67X67Plg3srlhe97ZteXapBRN0wQjavRc +40xjl/WvgpGXt0SNqPSLk7oJ5eywLVtnr5TYStHs86p7KJdS8uZWSMa1+fQ5nwZbbTLG5O0QYHsm +wPZrQtPfZRbRsVrnT/MPHAwaECxsF0XApIZ4vHGedMTV6HQ8N/Lyt1+Vs1q1MVTW2lpVq4vvv1Of +f/2VevPmlXqpV9dNW2pjTGWMqUtOVc65Esneqamstb4tafvnuZE/Z/vPHD93e5Hmn5H/Q5AzB9nN +YozhH+HwwoBZIcC0/QCmBZS31vqKjSIS5NY04JBzbkspwRjTGmNajaVRb9pUYlNEmjP3P9A8/uRz +zdn7zzVGfRvb0IhIe/sVxl5xTqgwbQfwPQUEFPH33PN/tzWodqwjZtUVk04DmlZvjNce43XIvM/v +OpZT7p4lOO3eMGvAYtpSoXmj/YtM9T+S6/y5bwAHhxkA+KiLaJ3wuUx4QE6cSptz3knorbV5ZWUl +r62tpTjcSm3bJmNNLCXalCVaa03tvRERTW3QpmlEvB39s8Z3BB59sE9r/vey8R9hwF5vYI5b2Cwp +scvfATf9XQOASQV/mVDwb3+MIpJiDNEYE621wRgTjDE7R4DlnKN1JhljYgg5RdFUVXU6dWote1fl +9fVBrpydNfVXOhb/B1bU4/jZbsT2KQg4yP0Bpv2sLksD8sjzf3TJYJrS9FuZPVOwSwAw7X6QZf4R +frOWB5UOzf9+N/40/8ARRwOCXdnnWQDTUvnRB62TCbMAVHIVc6qs8VVVu6odDusP3n+7eufNH9RX +L1+ullZ9lbPUOaaqlOKNaGWM255B4Ive8TPt2Osgpv5zze3nDUz555xZgbEV/GEHAV1CgO6zAIrZ +Od9bVYOqhpxzyDm3KaWwvNRrm9A2IcZ29fTZ9qmnn28eeeypVk3dXL+x3vZ7btbo/6Rdw+ctIZjX +FFDIUwccVE26lxkBs17jdcekmQF2zq8njf5PqhXG7xXzjgidN7qfZjT985p/kSO4wR/3DOBwMHyG +o1ZYq8zf1O+Oh51Vl0opKaaSrPdx5fSaWT19xm5sbJgYh8ZaZ3zttCSREIKmEMR7X7z3JaQ4bQfg +7Ye8dnioa4cCZS+FD6ZgCcBsLAE40GZ/3vfueRaAtS7lnGNKKd6e+h9vzwQI1tqQNIXBcBh7yyvx +4Ucfix978FyKscSYBqnfX0pS2kUbe4ptLNSc7XMIcBQ2ClS5e2bA+AyBNKPxnzX9f1oA0CUEmDW9 +f95U/yyzZ/1M+kjjD5xgNB3YtQUf/PPS+lnr8ibtA+BExJucfDHWF5GqqKmMER+bYXX18ofVlcs/ +rN5957XKWls557y1tpJcfM7iU0qupOzUmsMc/ee62+8bGDMAZle9zAA47EBgXgjQdS+ALCJRitk5 +/1tVgzFmZyaAiIRBHLbGuPahc4+0Tz/zibB6+mw7GDRtLtouLa20bbsV5EczAKIsNvq/r+v/Keip +B/a5Pl10RsC8WQGz9gjQKTWBmfK9s2qFaaca5RlBQNll439sNvjjXgEQAODeCQEmPZAX2QzQaYpe +rPNFjC8qlTHGGylV22xVw60N/4O/eqna2Njwm+s3q5SS7/UqV3nvc44uhOCs9eMBQNeN/xj9B2j4 +Fw0AxsOAPCMESCmWdHvUP4lIzDmH7dkAIhL88lJ46KGH24c//nhYXl1rjXG3mn3VVkRCzrnL1P8D +n/5PQU89cEB1apcQYFq9IQsGAbOCgUm/T+YEACLTZzqWjo3+Io2/yBHd4I/7BEAAgJP90O+yD4DO +CQDuCAFMTq4Y60WtL2Ju7QtgSiUl+JKS37xx01++/MPqwx9e9Bs3rrsi0TtnnLPqSkkuZzOr+Z+V +6LPu/yh0Z4xwz77gmCHxUYYEs0baZi1t2lkGULImY0xS1ZhzjjnnqKrRex+rqgpnP/5oeOD+j4e1 +tTNtjDnkJKGqXRBT2rZtglE/beQ/Ltj87zoAoKinJjgiQcCs/QFkRggwLxTQBesE6XA/mPV51439 +jk3jz30CIADAvRMCzHoYz5sFsBMCOCkuq/FFjCtifJLitSQvOXmV7GtT+TYM/c2bN9y1Kx/6a9cv +uc3Nm67k6FSLFXHjAUCXtf8id2/so4d4bXHd0uASkOx/w34QP3ta8y/SYUPA2zMAkqqmUkq01sbV +1dV49uzZePr06bh05qHgnA+qNuR0a8Tf2BxESsiljSK90ca/y+j/pKZi/O9N84+PKgQ47CBgWnNv +OnzPpDqhSwAwKxDYS9NfZtyXaPwBAgDgQB/4XWcBzDoRYDsAGJ0N4Kd9LKW4UorPObsYo0spuRij +LaW4lEOXqf9mRrFwEM0/1yVwfMOBriHAtJkAOy8Vm+TW+v9krU3W2ui9j865aMzOCQGjo/yTRvy7 +Nv/7OvpPYY9jHAR0XSIwb9R/Wp3Q9Z6w6EuEdf4AaDRwxEOARWcBTNoPYNLmgDsBgKre8fXbYYDN +OTsRsc6baVP/d7P2X7kGAYKBXYQAk9b0phRLLqXsNOyqmowx0VqbVDXGGOOUhn/WlP+uG//tevSf +4h7HNAhYZNPAeYGBdAgARKbvDzKvwT+WjT/3B4AAAPfug363ewHMWg4wMQgopVhV3QkCVPWO33t7 +BsC843zY+R/AbgrkadNup+0AfsdMAO/qXEpJpdwRBERVTaoaU0pJJo/0jzf+Ue48YnDSGeL7MvpP +cY97JAgQmT3qrx3+XrOCQekQAND4AyAAwLEMAeZNw5u2H8C02QCjQYAtpeyEA6pqSynjR/3ZXTT/ +H9XafwDHMxSYtxfAxFkAqnprM8BS7mjcVTXe3hcgTWn2J434LzLyv6vRfwp8fMQhwG6DgL0GArJA +jSAzmvN5p4Z0bfhp/AEQAOBIPuRnzQIQmbzLrukQBNwRBhhjdkKA283/6PcbY0zX5n/RhzvXF0Dj +37XQn7gcIOc8fjRgVtWd5QA559HGflbTPz7qP+8Ysa7NBEU+jlsQsMjRgV0CgWlf61oDdGnmywLf +S+MPgAAAxzYE6DITYFIIMCkQuKP5V1WrqkZETEplL+v+OfYPQJdieldLAZwzWUTK6AyAkc9Hm/qu +TX/XTf9o/nESgoC9LguYFwRIh8ZfO94n9tLk0/gDIADAsQwB5i0FmBUCjAcBZqTxN9vN//ZHVR15 +2S7N/7zGX7n+gHuysV/093Xd/Ot2c553RuhvN/47AUApJRtjJq3r79r4Z+m2oRjNP+7VIGBegz/v +a7sJAHbb7H/kjT/3A4AAAOj6YO+y9q5rCDAeBhhr7XYIsPPa/m+qakpRI4uf5cvO/wBBwG6/v/N+ +AKpley+A0T0BdoKA23sA3LVMQKZP9+/a/M9rLij2ca8GAbv5fDf3h918TuMPgEYExz4EmHU84GgI +MC8QmLfL/6Ij/8q1BGAXQUHXpQDTjggc/7zrq9D8gyBgV0HAvMa+64i/dmjEu4YBizb+B9b8cx8A +CACAwwoBdEYTP63RX7Txp/kHcBBBwF5DgDIjCCh7aPxp/kEQ0D0IOIh6YDdNPo0/AAIA3FMhwKQZ +ATqn2V90yv8iO/tyPQGYV3h3PRVApjTueezz3CEkmLfRH80/7tUQoMuzW/fwtb3eM8qC9xcafwAE +ADh2D/LdhAA6p7mf1/R3CQAO6oEP4N4LA3ZzBnjpGAjMa/pp/kEQsH9BwEHUAbtt+mn8ARAA4Fg+ +xGftwNslBJgVCuym8WfkH8B+F/O72RiwdAwEJn1dZI9r/mkCQBBwIN9TDvF7aPwB0LjgWIYAewkD +ZjX9izT+XDcA9jsMKHPCgK6BwKIj/jT/IAjYW418WDMADqXp55oHCACAoxwCyJyGft5/mxYqzAsA +uHYA7HcA0CUEkDmN/ayvC80/CAIOtV7erxkANP4ACABwTz24tWMIIDJ/ZF87/ox5IQTXFoC9FuaL +7gswLQgQWWykn+YfBAHHr24+8OuQax0gAACOegjQJQCQBZv+4z7qz/UMHGLBvM9/vy77AkiHJn/R +hp/mH4QAR/OZeyjXH9c5QAAAHIcQYF7T3nV6/343/lxPABYt3vcjCOja8Jeuf0eaAhAEHHpNfajX +HNc4QAAAHOcQoGsQ0LXpZ80/gI8qJFhkaUDXxr9z809TAIKAk41rHAA3RdwLQcC0xn9eEMB1AuCw +A4CuIcBuPp/1Z9IYgCCA5h8AAQBwbEKArkFAl1/v17XB9QXQzB9WGDDvv9H8A/doEMD1DYAGBSfp +Qd2led9rw891AuCjCA0WXSKwcONPcwBqCxp/AAQAwEkIARZp9NnkD8BRa/5nfU/Zw9doEIATHgRw +XQOgocG98pDezRp+mn8ARzkEWDQI6PSzaRCAkxcEcF0DoKkBQcDu3/dcGwCOUxjQ+WfQJAAnLwjg +ugZAAAAe0DT7AO6NYKBz4U+TAJysIIBrGgABAHg47+97nWsEwFFo8mn8AYIArmkABADg4cz7HsA9 +ZOGin0YBODlBANczAAIA8GDe+4OZ6wDAiWn4aRaAkxcEcC0DIAAADu6hzHUB4Ng1+zQMwMkLAriO +ARAAAEfggcz1A+CjbO5pGoCTW3dw/QKggQGObggAAEcKzQNw/OoPrlsABAAAIQAA0EQAJ7AW4VoF +QAAAEAIAAM0/AAAgAAAIAQCA5h8AABAAAIQAAGj+AQAAZjD8EwAAAAAAcPIxOooTj1kAAE4qRv8B +AAABAEAIAIDmHwAAgAAAhAAAQPMPAAAIAABCAACg+QcAAAQAACEAAND8AwAAAgCAIAAAaPwBAAAB +AEAQAAA0/gAAgAAAIAwAQNNP0w8AAAgAgI8CoQAAmn0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwN79fzWOelPGLIibAAAAAElF +TkSuQmCC +" + id="image195" /> + </g> +</svg> diff --git a/pix/gitea-push-create.png b/pix/gitea-push-create.png Binary files differnew file mode 100644 index 0000000..ca79c71 --- /dev/null +++ b/pix/gitea-push-create.png diff --git a/pix/gitea.svg b/pix/gitea.svg new file mode 100644 index 0000000..9df6b83 --- /dev/null +++ b/pix/gitea.svg @@ -0,0 +1,31 @@ +<?xml version="1.0" encoding="utf-8"?> +<svg version="1.1" id="main_outline" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" + y="0px" viewBox="0 0 640 640" style="enable-background:new 0 0 640 640;" xml:space="preserve"> +<g> + <path id="teabag" style="fill:#FFFFFF" d="M395.9,484.2l-126.9-61c-12.5-6-17.9-21.2-11.8-33.8l61-126.9c6-12.5,21.2-17.9,33.8-11.8 + c17.2,8.3,27.1,13,27.1,13l-0.1-109.2l16.7-0.1l0.1,117.1c0,0,57.4,24.2,83.1,40.1c3.7,2.3,10.2,6.8,12.9,14.4 + c2.1,6.1,2,13.1-1,19.3l-61,126.9C423.6,484.9,408.4,490.3,395.9,484.2z"/> + <g> + <g> + <path style="fill:#609926" d="M622.7,149.8c-4.1-4.1-9.6-4-9.6-4s-117.2,6.6-177.9,8c-13.3,0.3-26.5,0.6-39.6,0.7c0,39.1,0,78.2,0,117.2 + c-5.5-2.6-11.1-5.3-16.6-7.9c0-36.4-0.1-109.2-0.1-109.2c-29,0.4-89.2-2.2-89.2-2.2s-141.4-7.1-156.8-8.5 + c-9.8-0.6-22.5-2.1-39,1.5c-8.7,1.8-33.5,7.4-53.8,26.9C-4.9,212.4,6.6,276.2,8,285.8c1.7,11.7,6.9,44.2,31.7,72.5 + c45.8,56.1,144.4,54.8,144.4,54.8s12.1,28.9,30.6,55.5c25,33.1,50.7,58.9,75.7,62c63,0,188.9-0.1,188.9-0.1s12,0.1,28.3-10.3 + c14-8.5,26.5-23.4,26.5-23.4s12.9-13.8,30.9-45.3c5.5-9.7,10.1-19.1,14.1-28c0,0,55.2-117.1,55.2-231.1 + C633.2,157.9,624.7,151.8,622.7,149.8z M125.6,353.9c-25.9-8.5-36.9-18.7-36.9-18.7S69.6,321.8,60,295.4 + c-16.5-44.2-1.4-71.2-1.4-71.2s8.4-22.5,38.5-30c13.8-3.7,31-3.1,31-3.1s7.1,59.4,15.7,94.2c7.2,29.2,24.8,77.7,24.8,77.7 + S142.5,359.9,125.6,353.9z M425.9,461.5c0,0-6.1,14.5-19.6,15.4c-5.8,0.4-10.3-1.2-10.3-1.2s-0.3-0.1-5.3-2.1l-112.9-55 + c0,0-10.9-5.7-12.8-15.6c-2.2-8.1,2.7-18.1,2.7-18.1L322,273c0,0,4.8-9.7,12.2-13c0.6-0.3,2.3-1,4.5-1.5c8.1-2.1,18,2.8,18,2.8 + l110.7,53.7c0,0,12.6,5.7,15.3,16.2c1.9,7.4-0.5,14-1.8,17.2C474.6,363.8,425.9,461.5,425.9,461.5z"/> + <path style="fill:#609926" d="M326.8,380.1c-8.2,0.1-15.4,5.8-17.3,13.8c-1.9,8,2,16.3,9.1,20c7.7,4,17.5,1.8,22.7-5.4 + c5.1-7.1,4.3-16.9-1.8-23.1l24-49.1c1.5,0.1,3.7,0.2,6.2-0.5c4.1-0.9,7.1-3.6,7.1-3.6c4.2,1.8,8.6,3.8,13.2,6.1 + c4.8,2.4,9.3,4.9,13.4,7.3c0.9,0.5,1.8,1.1,2.8,1.9c1.6,1.3,3.4,3.1,4.7,5.5c1.9,5.5-1.9,14.9-1.9,14.9 + c-2.3,7.6-18.4,40.6-18.4,40.6c-8.1-0.2-15.3,5-17.7,12.5c-2.6,8.1,1.1,17.3,8.9,21.3c7.8,4,17.4,1.7,22.5-5.3 + c5-6.8,4.6-16.3-1.1-22.6c1.9-3.7,3.7-7.4,5.6-11.3c5-10.4,13.5-30.4,13.5-30.4c0.9-1.7,5.7-10.3,2.7-21.3 + c-2.5-11.4-12.6-16.7-12.6-16.7c-12.2-7.9-29.2-15.2-29.2-15.2s0-4.1-1.1-7.1c-1.1-3.1-2.8-5.1-3.9-6.3c4.7-9.7,9.4-19.3,14.1-29 + c-4.1-2-8.1-4-12.2-6.1c-4.8,9.8-9.7,19.7-14.5,29.5c-6.7-0.1-12.9,3.5-16.1,9.4c-3.4,6.3-2.7,14.1,1.9,19.8 + C343.2,346.5,335,363.3,326.8,380.1z"/> + </g> + </g> +</g> +</svg> diff --git a/pix/irc.svg b/pix/irc.svg new file mode 100644 index 0000000..0f48379 --- /dev/null +++ b/pix/irc.svg @@ -0,0 +1,57 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 20010904//EN" +"http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd"> +<!-- Created with Inkscape (http://www.inkscape.org/) --><svg height="60.0000000" id="svg1" inkscape:version="0.38.1" sodipodi:docbase="/home/danny/flat/scalable/apps" sodipodi:docname="irc_protocol.svg" sodipodi:version="0.32" version="1.0" width="60.0000000" x="0" xmlns="http://www.w3.org/2000/svg" xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xml="http://www.w3.org/XML/1998/namespace" y="0"> + <metadata> + <rdf:RDF xmlns:cc="http://web.resource.org/cc/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> + <cc:Work rdf:about=""> + <dc:title>Part of the Flat Icon Collection (Wed Aug 25 23:23:49 2004)</dc:title> + <dc:description></dc:description> + <dc:subject> + <rdf:Bag> + <rdf:li>hash</rdf:li> + <rdf:li></rdf:li> + <rdf:li>application</rdf:li> + <rdf:li>computer</rdf:li> + <rdf:li>icons</rdf:li> + <rdf:li>theme</rdf:li> + </rdf:Bag> + </dc:subject> + <dc:publisher> + <cc:Agent rdf:about="http://www.openclipart.org"> + <dc:title>Danny Allen</dc:title> + </cc:Agent> + </dc:publisher> + <dc:creator> + <cc:Agent> + <dc:title>Danny Allen</dc:title> + </cc:Agent> + </dc:creator> + <dc:rights> + <cc:Agent> + <dc:title>Danny Allen</dc:title> + </cc:Agent> + </dc:rights> + <dc:date></dc:date> + <dc:format>image/svg+xml</dc:format> + <dc:type rdf:resource="http://purl.org/dc/dcmitype/StillImage"/> + <cc:license rdf:resource="http://web.resource.org/cc/PublicDomain"/> + <dc:language>en</dc:language> + </cc:Work> + <cc:License rdf:about="http://web.resource.org/cc/PublicDomain"> + <cc:permits rdf:resource="http://web.resource.org/cc/Reproduction"/> + <cc:permits rdf:resource="http://web.resource.org/cc/Distribution"/> + <cc:permits rdf:resource="http://web.resource.org/cc/DerivativeWorks"/> + </cc:License> + </rdf:RDF> + </metadata> + <sodipodi:namedview bordercolor="#ffffff" borderopacity="1.0" id="base" inkscape:cx="37.697545" inkscape:cy="22.126475" inkscape:pageopacity="0.0" inkscape:pageshadow="2" inkscape:window-height="685" inkscape:window-width="1016" inkscape:window-x="0" inkscape:window-y="0" inkscape:zoom="6.9465337" pagecolor="#ffffff" showguides="true" snaptoguides="true"/> + <defs id="defs3"> + <linearGradient id="linearGradient772"> + <stop id="stop773" offset="0" style="stop-color:#fff;stop-opacity:1;"/> + <stop id="stop774" offset="1" style="stop-color:#fff;stop-opacity:1;"/> + </linearGradient> + <linearGradient id="linearGradient775" xlink:href="#linearGradient772"/> + </defs> + <path d="M 11.934141,39.676628 C 11.934141,39.055534 12.066954,38.483269 12.332579,37.959831 C 12.598204,37.432487 12.969298,37.018425 13.445860,36.717644 C 13.926329,36.416862 14.473204,36.266472 15.086485,36.266472 C 15.410704,36.266472 15.744688,36.305534 16.088438,36.383659 C 16.432188,36.457878 16.721251,36.586784 16.955626,36.770378 C 17.190001,36.953972 17.307188,37.202019 17.307188,37.514519 C 17.307188,37.764519 17.232970,37.973503 17.084532,38.141472 C 16.940001,38.309441 16.758360,38.393425 16.539610,38.393425 C 16.434141,38.393425 16.330626,38.375847 16.229063,38.340691 C 16.131407,38.305534 16.031798,38.268425 15.930235,38.229362 C 15.832579,38.186394 15.727110,38.151237 15.613829,38.123894 C 15.504454,38.096550 15.365782,38.082878 15.197813,38.082878 C 14.893126,38.082878 14.635313,38.155144 14.424376,38.299675 C 14.217345,38.440300 14.061095,38.631706 13.955626,38.873894 C 13.854063,39.112175 13.803282,39.379753 13.803282,39.676628 C 13.803282,39.965691 13.854063,40.235222 13.955626,40.485222 C 14.057188,40.731316 14.203673,40.926628 14.395079,41.071159 C 14.590391,41.215691 14.820860,41.287956 15.086485,41.287956 C 15.387266,41.287956 15.690001,41.231316 15.994688,41.118034 C 16.299376,41.004753 16.481016,40.948112 16.539610,40.948112 C 16.680235,40.948112 16.809141,40.989128 16.926329,41.071159 C 17.043516,41.153191 17.135313,41.260612 17.201720,41.393425 C 17.272032,41.522331 17.307188,41.655144 17.307188,41.791862 C 17.307188,42.080925 17.180235,42.325066 16.926329,42.524284 C 16.676329,42.723503 16.377501,42.868034 16.029845,42.957878 C 15.682188,43.051628 15.367735,43.098503 15.086485,43.098503 C 14.621641,43.098503 14.195860,43.012566 13.809141,42.840691 C 13.426329,42.668816 13.092345,42.424675 12.807188,42.108269 C 12.522032,41.787956 12.305235,41.420769 12.156798,41.006706 C 12.008360,40.588737 11.934141,40.145378 11.934141,39.676628 z M 7.9614851,41.991081 L 7.9614851,37.362175 C 7.9614851,37.084831 8.0474226,36.854362 8.2192976,36.670769 C 8.3950789,36.483269 8.6196883,36.389519 8.8931258,36.389519 C 9.1196883,36.389519 9.3150008,36.450066 9.4790633,36.571159 C 9.6470320,36.688347 9.7642195,36.827019 9.8306258,36.987175 C 10.232970,36.506706 10.664610,36.266472 11.125548,36.266472 C 11.379454,36.266472 11.602110,36.358269 11.793516,36.541862 C 11.988829,36.721550 12.086485,36.953972 12.086485,37.239128 C 12.086485,37.532097 11.994688,37.744987 11.811095,37.877800 C 11.631407,38.010612 11.332579,38.137566 10.914610,38.258659 C 10.488829,38.379753 10.201720,38.532097 10.053282,38.715691 C 9.9048445,38.895378 9.8306258,39.219597 9.8306258,39.688347 L 9.8306258,41.991081 C 9.8306258,42.268425 9.7427351,42.502800 9.5669539,42.694206 C 9.3950789,42.881706 9.1704695,42.975456 8.8931258,42.975456 C 8.6196883,42.975456 8.3950789,42.881706 8.2192976,42.694206 C 8.0474226,42.502800 7.9614851,42.268425 7.9614851,41.991081 z M 5.2603133,41.991081 L 5.2603133,37.362175 C 5.2603133,37.084831 5.3462508,36.854362 5.5181258,36.670769 C 5.6939070,36.483269 5.9185164,36.389519 6.1919539,36.389519 C 6.4692976,36.389519 6.6939070,36.483269 6.8657820,36.670769 C 7.0415633,36.854362 7.1294539,37.084831 7.1294539,37.362175 L 7.1294539,41.991081 C 7.1294539,42.268425 7.0415633,42.502800 6.8657820,42.694206 C 6.6939070,42.881706 6.4692976,42.975456 6.1919539,42.975456 C 5.9185164,42.975456 5.6939070,42.881706 5.5181258,42.694206 C 5.3462508,42.502800 5.2603133,42.268425 5.2603133,41.991081 z M 5.0786726,34.696159 C 5.0786726,34.391472 5.1880476,34.127800 5.4067976,33.905144 C 5.6255476,33.682487 5.8872664,33.571159 6.1919539,33.571159 C 6.5005476,33.571159 6.7642195,33.680534 6.9829695,33.899284 C 7.2017195,34.118034 7.3110945,34.383659 7.3110945,34.696159 C 7.3110945,35.020378 7.2017195,35.289909 6.9829695,35.504753 C 6.7642195,35.719597 6.5005476,35.827019 6.1919539,35.827019 C 5.8872664,35.827019 5.6255476,35.717644 5.4067976,35.498894 C 5.1880476,35.280144 5.0786726,35.012566 5.0786726,34.696159 z M -0.95648360,42.055534 L -0.74554610,40.479362 L -1.1967180,40.479362 C -1.3959367,40.479362 -1.5424211,40.422722 -1.6361711,40.309441 C -1.7299211,40.192253 -1.7767961,40.053581 -1.7767961,39.893425 C -1.7767961,39.733269 -1.7299211,39.598503 -1.6361711,39.489128 C -1.5424211,39.375847 -1.3959367,39.319206 -1.1967180,39.319206 L -0.58734298,39.319206 L -0.39398360,37.877800 L -0.85101485,37.877800 C -1.0463274,37.877800 -1.1908586,37.821159 -1.2846086,37.707878 C -1.3783586,37.590691 -1.4252336,37.452019 -1.4252336,37.291862 C -1.4252336,37.127800 -1.3783586,36.991081 -1.2846086,36.881706 C -1.1908586,36.768425 -1.0463274,36.711784 -0.85101485,36.711784 L -0.21820235,36.711784 L 0.039610147,34.830925 C 0.066953897,34.631706 0.12945390,34.477409 0.22711015,34.368034 C 0.32867265,34.258659 0.48882890,34.203972 0.70757890,34.203972 C 0.86382890,34.203972 0.99273515,34.248894 1.0942976,34.338737 C 1.1958601,34.424675 1.2466414,34.543816 1.2466414,34.696159 C 1.2466414,34.762566 1.2310164,34.907097 1.1997664,35.129753 L 0.98296952,36.711784 L 2.0669539,36.711784 L 2.3189070,34.830925 C 2.3462508,34.631706 2.4087508,34.477409 2.5064070,34.368034 C 2.6079695,34.258659 2.7681258,34.203972 2.9868758,34.203972 C 3.1431258,34.203972 3.2720320,34.248894 3.3735945,34.338737 C 3.4751570,34.428581 3.5259383,34.547722 3.5259383,34.696159 C 3.5259383,34.762566 3.5103133,34.907097 3.4790633,35.129753 L 3.2622664,36.711784 L 3.7192976,36.711784 C 3.9224226,36.711784 4.0689070,36.768425 4.1587508,36.881706 C 4.2525008,36.991081 4.2993758,37.127800 4.2993758,37.291862 C 4.2993758,37.452019 4.2525008,37.590691 4.1587508,37.707878 C 4.0650008,37.821159 3.9185164,37.877800 3.7192976,37.877800 L 3.1099226,37.877800 L 2.9165633,39.319206 L 3.3735945,39.319206 C 3.5767195,39.319206 3.7232039,39.373894 3.8130476,39.483269 C 3.9028914,39.592644 3.9478133,39.729362 3.9478133,39.893425 C 3.9478133,40.057487 3.9009383,40.196159 3.8071883,40.309441 C 3.7173445,40.422722 3.5728133,40.479362 3.3735945,40.479362 L 2.7349226,40.479362 L 2.4829695,42.354362 C 2.4556258,42.549675 2.3931258,42.702019 2.2954695,42.811394 C 2.1978133,42.920769 2.0376570,42.975456 1.8150008,42.975456 C 1.6587508,42.975456 1.5278914,42.932487 1.4224226,42.846550 C 1.3208601,42.756706 1.2700789,42.635612 1.2700789,42.483269 C 1.2700789,42.405144 1.2876570,42.262566 1.3228133,42.055534 L 1.5396101,40.479362 L 0.45562577,40.479362 L 0.20367265,42.354362 C 0.17632890,42.553581 0.11187577,42.707878 0.010313272,42.817253 C -0.087342978,42.922722 -0.24749923,42.975456 -0.47015548,42.975456 C -0.62249923,42.975456 -0.75140548,42.932487 -0.85687423,42.846550 C -0.95843673,42.756706 -1.0092180,42.635612 -1.0092180,42.483269 C -1.0092180,42.405144 -0.99163985,42.262566 -0.95648360,42.055534 z M 1.7153914,39.319206 L 1.9087508,37.877800 L 0.81890702,37.877800 L 0.62554765,39.319206 L 1.7153914,39.319206 z " id="path832" style="font-size:12.000000;font-weight:900;fill:#ffffff;stroke-width:1.0000000pt;font-family:VAG Rounded Black SSi;" transform="matrix(2.687231,-1.389012e-16,1.389012e-16,2.687231,8.790176,-72.34898)"/> +</svg> diff --git a/pix/irc/hexchat-connection-complete.png b/pix/irc/hexchat-connection-complete.png Binary files differnew file mode 100644 index 0000000..096ae01 --- /dev/null +++ b/pix/irc/hexchat-connection-complete.png diff --git a/pix/irc/hexchat-network-edit.png b/pix/irc/hexchat-network-edit.png Binary files differnew file mode 100644 index 0000000..4a0fb6f --- /dev/null +++ b/pix/irc/hexchat-network-edit.png diff --git a/pix/irc/hexchat-network-select.png b/pix/irc/hexchat-network-select.png Binary files differnew file mode 100644 index 0000000..9f4ffe3 --- /dev/null +++ b/pix/irc/hexchat-network-select.png diff --git a/pix/irc/hexchat-sasl.png b/pix/irc/hexchat-sasl.png Binary files differnew file mode 100644 index 0000000..ce77149 --- /dev/null +++ b/pix/irc/hexchat-sasl.png diff --git a/pix/irc/textual-identity.png b/pix/irc/textual-identity.png Binary files differnew file mode 100644 index 0000000..a2fce22 --- /dev/null +++ b/pix/irc/textual-identity.png diff --git a/pix/irc/textual-network-edit.png b/pix/irc/textual-network-edit.png Binary files differnew file mode 100644 index 0000000..1eb4dc7 --- /dev/null +++ b/pix/irc/textual-network-edit.png diff --git a/pix/nextcloud.svg b/pix/nextcloud.svg new file mode 100644 index 0000000..6f2e1a3 --- /dev/null +++ b/pix/nextcloud.svg @@ -0,0 +1 @@ +<svg height="64" viewBox="0 0 64.000005 64.000001" width="64" xmlns="http://www.w3.org/2000/svg"><path d="m32.028095 17.446884c-6.630378 0-12.249342 4.49517-13.99122 10.563651-1.517121-3.258998-4.77612-5.506585-8.597016-5.506585-5.169446 0-9.439859 4.270413-9.439859 9.496049 0 5.225637 4.270413 9.49605 9.496049 9.49605 3.764706 0 7.079895-2.247586 8.597015-5.506585 1.685689 6.068481 7.304653 10.563652 13.935031 10.563652 6.574188 0 12.193152-4.438981 13.99122-10.451272 1.517121 3.146619 4.77612 5.338015 8.484636 5.338015 5.225637 0 9.496049-4.270412 9.496049-9.496049s-4.270412-9.43986-9.496049-9.43986c-3.708516 0-6.967515 2.191396-8.484636 5.338016-1.798068-5.956101-7.360843-10.395082-13.99122-10.395082zm0 5.562773c5.000878 0 8.990343 3.989465 8.990343 8.990342 0 5.000879-3.989465 8.990343-8.990343 8.990343s-8.990343-3.989464-8.990343-8.990343c0-5.000875 3.989465-8.99034 8.990343-8.990342zm-22.532046 5.057067c2.191397 0 3.933275 1.74188 3.933275 3.933275 0 2.191396-1.741878 3.933276-3.933275 3.933276-2.191396 0-3.933275-1.74188-3.933275-3.933276 0-2.191395 1.741879-3.933275 3.933275-3.933275zm45.007902 0c2.191396 0 3.933275 1.74188 3.933275 3.933275 0 2.191396-1.741879 3.933276-3.933275 3.933276s-3.933275-1.74188-3.933275-3.933276c.05619-2.191395 1.741879-3.933275 3.933275-3.933275z" fill="#0082c9" stroke-width=".561896"/></svg>
\ No newline at end of file diff --git a/pix/tor.svg b/pix/tor.svg new file mode 100644 index 0000000..4d7eefd --- /dev/null +++ b/pix/tor.svg @@ -0,0 +1,41 @@ +<?xml version="1.0" encoding="UTF-8"?> +<svg width="66px" height="104px" viewBox="0 0 66 104" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + <!-- Generator: Sketch 47.1 (45422) - http://www.bohemiancoding.com/sketch --> + <title>onion-bg</title> + <desc>Created with Sketch.</desc> + <defs></defs> + <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> + <g id="styleguide-portal" transform="translate(-2.000000, -23.000000)" fill-rule="nonzero"> + <g id="onion-bg" transform="translate(2.000000, 23.000000)"> + <g id="layer5_17_"> + <g id="path2554_28_" transform="translate(30.297143, 0.000000)" fill="#68B044"> + <path d="M8.13239105,7.75250545 L5.42159403,18.7352215 C9.24860159,10.982716 15.4674889,5.16833696 22.4836694,-7.10542736e-15 C17.3809926,6.13740015 12.5972332,12.1132898 9.72697753,18.2506899 C14.6701956,11.3057371 21.2080002,7.42948439 28.543098,5.00682643 C18.6566618,13.8899056 11.0026467,23.4190269 4.94321809,32.9481481 L0.159458648,30.8485113 C1.11621054,23.0960058 3.9864662,15.3435004 8.13239105,7.75250545 L8.13239105,7.75250545 Z" id="Shape"></path> + </g> + <g id="path2534_7_" transform="translate(0.000000, 28.227160)" fill="#F5F8DE"> + <path d="M25.832301,0.521713871 L34.7619853,4.23645606 C34.7619853,6.49760349 34.6025266,13.6040668 36.0376545,15.7037037 C51.0267674,35.2464779 48.475429,74.1705156 33.0079401,75.1395788 C9.56751888,75.1395788 0.478375944,58.9885258 0.478375944,44.129557 C0.478375944,30.5626725 16.5836994,21.5180828 26.1512183,13.6040668 C28.7025566,11.5044299 28.2241807,6.65911402 25.832301,0.521713871 L25.832301,0.521713871 Z" id="Shape"></path> + </g> + <g id="path2536_18_" transform="translate(34.819291, 32.302106)" fill="#623676"> + <path d="M0.102153196,0 L3.29132616,1.6151053 C2.97240886,3.71474219 3.4507848,8.5600581 5.52374723,9.85214234 C14.9318075,15.828032 23.8614918,22.2884532 27.369582,28.7488744 C39.8073566,51.5218591 18.5993564,72.6797386 0.261611844,70.5801017 C10.148048,63.1506173 13.1777623,47.8071169 9.35075478,31.0100218 C7.7561683,24.3880901 5.52374723,18.573711 1.21836373,11.7902687 C-0.376222748,8.72156863 0.261611844,4.68380537 0.102153196,0 L0.102153196,0 Z" id="Shape"></path> + </g> + </g> + <g id="layer4_17_" transform="translate(9.000000, 32.000000)" fill="#010101"> + <g id="path2540_18_" transform="translate(0.000000, 10.329661)"> + <path d="M22.9646678,0.502650405 C22.3354989,4.00722163 21.5490376,10.3791693 18.560485,12.609351 C17.302147,13.5651431 16.043809,14.3616366 14.6281788,15.3174288 C9.28024249,18.9812987 3.77501389,22.4858699 1.41563021,31.5658953 C0.943753473,33.4774796 1.41563021,35.5483626 1.7302147,37.4599469 C3.14584491,42.8761025 6.9208588,48.9294527 9.90941147,52.2747253 C9.90941147,52.434024 10.5385804,52.7526214 10.5385804,52.91192 C13.0552564,55.9385952 13.8417176,56.7350886 23.1219601,58.8059716 L22.9646678,59.9210625 C17.302147,58.3280756 12.7406719,57.053686 9.75211922,53.5491148 C9.75211922,53.5491148 9.28024249,52.91192 9.28024249,52.91192 C6.13439758,49.2480501 2.35938368,43.1946998 0.943753473,37.4599469 C0.471876737,35.2297652 -8.8817842e-14,33.4774796 0.629168982,31.0879993 C3.14584491,21.8486751 8.80836575,18.1848052 14.3135943,14.3616366 C15.5719323,13.5651431 17.1448548,12.7686497 18.2459005,11.8128575 C20.4479919,10.0605719 21.7063299,4.80371509 22.9646678,0.502650405 L22.9646678,0.502650405 Z" id="Shape"></path> + </g> + <g id="path2542_18_" transform="translate(6.291690, 25.222293)"> + <path d="M19.0323617,0.106199128 C19.0323617,4.08866643 18.7177772,6.00025073 19.6615307,8.86762718 C20.2906997,10.4606141 22.3354989,12.8500945 22.9646678,15.0802762 C23.7511291,18.1069513 24.6948825,21.2929252 24.5375903,23.3638081 C24.5375903,25.5939898 24.3802981,29.8950545 23.4365446,34.5147166 C22.6500834,38.3378852 20.9198687,41.523859 18.0886082,43.2761446 C15.1000556,42.6389499 11.6396262,41.6831577 9.59482698,39.7715734 C5.66252084,36.2670022 2.04479919,30.3729506 1.57292246,25.2753924 C1.25833796,21.1336265 5.03335186,14.9209775 10.3812882,11.8943023 C14.9427633,9.18622457 15.8865168,6.15954942 16.8302703,1.38058866 C15.4146401,5.68165334 14.1563021,9.18622457 9.90941147,11.4164063 C3.61772165,14.7616788 0.314584491,20.337133 0.629168982,25.7532885 C1.10104572,32.6031323 3.77501389,37.2227943 9.12295024,40.8866643 C11.3250417,42.4796512 15.5719323,44.2319368 18.2459005,44.5505342 L18.2459005,44.2319368 C20.2906997,43.9133394 22.8073756,40.5680669 24.0657136,36.1077035 C25.1667593,32.1252362 25.638636,26.8683794 25.4813438,23.6824055 C25.4813438,21.7708212 24.5375903,17.6290552 23.1219601,13.9651853 C22.3354989,11.8943023 21.0771609,9.82341933 20.1334074,8.38973111 C19.5042384,6.95604288 19.5042384,3.77006904 19.0323617,0.106199128 Z" id="Shape"></path> + </g> + <g id="path2544_18_" transform="translate(17.302147, 40.596412)"> + <path d="M7.39273554,0.343351713 C7.39273554,3.05142948 8.49378126,6.39670201 8.96565799,9.90127323 C9.28024249,12.4500523 9.12295024,15.1581301 9.12295024,17.3883117 C9.12295024,20.0963895 8.17919677,24.7160516 6.9208588,27.105532 C5.81981308,26.6276359 5.34793635,25.9904411 4.56147512,25.034649 C3.61772165,23.7602594 2.98855266,22.4858699 2.51667593,20.892883 C2.04479919,19.7777921 1.57292246,18.5034026 1.25833796,16.9104157 C0.943753473,14.680234 1.10104572,11.0163641 3.61772165,7.35249416 C5.50522859,4.4851177 5.97710533,4.16652032 6.76356656,0.980546481 C5.81981308,4.00722163 5.1906441,4.16652032 3.14584491,6.71529939 C0.786461228,9.42337715 0.471876737,13.4058444 0.471876737,16.751117 C0.471876737,18.1848052 0.943753473,19.6184934 1.57292246,21.0521817 C2.20209144,22.6451686 2.67396817,24.0788568 3.4604294,25.1939477 C4.71876737,27.105532 6.29168982,28.0613241 7.07815105,28.2206228 C7.07815105,28.2206228 7.07815105,28.2206228 7.07815105,28.2206228 C7.07815105,28.2206228 7.07815105,28.2206228 7.07815105,28.2206228 L7.07815105,28.0613241 C8.49378126,26.4683372 9.43753473,24.7160516 9.75211922,23.1230647 C10.0667037,21.2114804 10.223996,19.1405974 10.3812882,16.751117 C10.5385804,14.8395327 10.3812882,12.1314549 9.90941147,9.42337715 C9.12295024,6.23740331 7.86461228,2.73283209 7.39273554,0.343351713 L7.39273554,0.343351713 Z" id="Shape"></path> + </g> + <g id="path2550_18_" transform="translate(24.373837, 7.143687)"> + <path d="M0.792922455,0.343351713 C0.792922455,4.32581901 1.10750695,11.6535588 2.20855266,14.5209353 C2.52313716,15.4767274 5.35439758,19.7777921 7.24190452,25.034649 C8.65753473,28.6985189 8.81482698,32.0437914 9.12941147,32.9995836 C10.0731649,37.3006482 8.97211922,44.6283881 7.39919677,51.4782318 C6.61273554,55.1421017 4.09605961,59.7617638 1.10750695,61.6733481 L0.478337964,62.7884389 C2.05126042,62.7884389 6.1408588,58.646673 7.55648901,53.7084135 C9.9158727,45.2655828 10.8596262,41.2831155 9.75858045,31.8844927 C9.6012882,30.9287006 9.28670371,27.9020254 7.8710735,24.5567529 C5.82627431,19.4591947 2.83772165,14.680234 2.36584491,13.5651431 C1.89396817,11.9721562 0.950214701,5.12231247 0.792922455,0.343351713 L0.792922455,0.343351713 Z" id="Shape"></path> + </g> + <g id="path2552_18_" transform="translate(24.373837, 0.000000)"> + <path d="M2.20855266,0.477896076 C2.05126042,4.46036337 1.89396817,7.8056359 2.6804294,10.6730124 C3.46689063,14.0182849 7.71378126,18.637947 9.44399596,24.0541025 C12.7471331,34.4085175 11.9606719,47.9489063 9.44399596,58.4626199 C8.50024249,62.1264898 4.25335186,67.5426454 0.00646122758,69.294931 L3.15230614,70.0914244 C4.88252084,70.0914244 9.28670371,65.7903598 11.0169184,61.011399 C13.8481788,53.5243605 14.3200556,44.6036337 13.2190099,35.0457122 C13.2190099,34.0899201 11.6460874,25.9656868 10.2304572,22.6204143 C8.18565799,17.5228561 5.03981308,14.0182849 3.78147512,10.832311 C2.83772165,8.44283067 2.52313716,2.23018169 3.15230614,0.79649346 L2.20855266,0.477896076 Z" id="Shape"></path> + </g> + </g> + </g> + </g> + </g> +</svg>
\ No newline at end of file @@ -13,6 +13,1323 @@ <link>https://landchad.net/rss.xml</link> </image> +<!-- LB --> + +<item> +<title>Using UFW as a Firewall</title> +<guid>https://landchad.net/ufw.html</guid> +<link>https://landchad.net/ufw.html</link> +<pubDate>Thu, 01 Jul 2021 16:58:11 -0400</pubDate> +<description><![CDATA[ + <header><h1>Using UFW as a Firewall</h1></header> + + <main> + <p> + <strong>Uncomplicated Firewall</strong> (UFW) is a front-facing program for the more involved <code>iptables</code> firewall program installed in most GNU/Linux distributions. + We can use <code>ufw</code> to restrict machines on the internet to only access the services (SSH, websites etc) you want them to, but it can also be used to prevent programs on the computer itself from accesing parts of the internet it shouldn't. + </p> + <h2 id="how-to-get-it">How to Get It</h2> + <p>Log into your server by pulling up a terminal and typing:</p> + <pre><code>ssh root@<strong>example.org</strong></code></pre> + <p> + This command will attempt to log into your server and run a remote shell. + If you leave the settings default, it should prompt you for your password, and you can just copy or type in the password from Vultr's site. + </p> + <p> + Some VPS providers automatically install <code>ufw</code>, but if you do not have it installed already, install it in the typical way: + </p> + <pre><code>apt install ufw</code></pre> + <h2 id="first-time-setup">First-Time Setup</h2> + <p>You can check the status of <code>ufw</code> right now by running:</p> + <pre><code>ufw status</code></pre> + <p>Without any changes, it should report back <code>Status: inactive</code>. Let's set it up so that only connections to SSH (standardized at port 22) are allowed in, and then enable the firewall:</p> + <aside> + <strong>Careful!</strong> Enabling <code>ufw</code> without allowing SSH will block you from remoting to your server. + Double-check that you have allowed SSH, and if you have changed the default SSH port, put in <em>that</em> number instead. + </aside> + <pre><code>ufw default deny incoming # block all incoming connections by default +ufw allow in ssh # or: ufw allow in 22 +ufw enable</code></pre> + <aside> + <code>ufw</code> has an internal list of protocols applications, and the ports used by them. + In this case, it knwos SSH is on port 22. + We'll go more in detail how to view all protocols <code>ufw</code> knows about. + By default, when you allow an incoming port, it allows that port both on IPv4 and IPv6. + </aside> + <p> + With the firewall enabled and allowing only SSH in, all other ports are prortected from incoming requests. + To view all your rules, run: + </p> + <pre><code>ufw status verbose</code></pre> + <p>A firewall that allows to connect to SSH and their website may look like:</p> + <pre><code>Status: active +Logging: on (low) +Default: deny (incoming), allow (outgoing), deny (routed) +New profiles: skip +To Action From +-- ------ ---- +22 (SSH) ALLOW IN Anywhere +80,443/tcp (WWW Full) ALLOW IN Anywhere +22 (SSH (v6)) ALLOW IN Anywhere (v6) +80,443/tcp (WWW Full (v6)) ALLOW IN Anywhere (v6)</code></pre> + <p>If you want to delete e.g. the 'WWW Full' rule, run:</p> + <pre><code>ufw delete allow in 'WWW Full' +ufw reload</pre></code> + <h2 id="enabling-common-services">Enabling Common Services</h2> + <p> + You have blocked all incoming ports but SSH, which means no outsiders would be able to access other services, like an email server or your website. + You should look at the ports your services are open on and enable them individually. + Here is a list of a few common services: + </p> + <h3>Opening Port Numbers</h3> + <p>Suppose you install <a href="gemini.html">a Gemini server</a>, which must broadcast on port 1965. By default <code>ufw</code> blocks all incoming connections on all ports, so whenever you install a new service like this you will have to tell <code>ufw</code> to enable the desired port:</p> + <pre><code>ufw allow 1985</code></pre> + <h3>Websites: HTTP and HTTPS</h3> + <p>HTTP uses port 80 and HTTPS uses port 443. We can enable them like this:</p> + <pre><code>ufw allow 80 +ufw allow 443</code></pre> + <p>But <code>ufw</code> additionally knows the typical ports of common serives, so you can also run this:</p> + <pre><code>ufw allow http +ufw allow https</code></pre> + <p>And that will do the same thing. There are also other abbreviations for common port lists:</p> + <pre><code>ufw allow in 'WWW Full'</code></pre> + <p>To see these other "apps" that <code>ufw</code> knows by default, run <code>ufw app list</code></p> + <h3>Email: IMAP, POP3, and SMTP</h3> + <pre><code>ufw allow in IMAPS +ufw allow in POP3 +ufw allow in SMTP +ufw allow in 'Postfix SMTPS' +ufw allow in 'Mail Submission'</pre></code> + <h2 id="fine-tuning-rules">Fine-Tuning Rules</h2> + <p>Instead of denying all ports by default, you may want to deny (ignores incoming requests) or reject (explicitly tells requests they're not allowed):</p> + <pre><code>ufw default allow in +ufw deny in <strong>PORT</strong> +ufw reject in <strong>PORT</strong> +ufw reload</code></pre> + <p>You can add rules to comments to remember what they are there for:</p> + <pre><code>ufw allow in <strong>PORT</strong> comment 'Secret SSH' +ufw reload +ufw status verbose</code></pre> + <p>Output:</p> + <pre><code>To Action From +-- ------ ---- +<strong>PORT</strong> ALLOW IN Anywhere # Secret SSH +<strong>PORT</strong> (v6) ALLOW IN Anywhere (v6) # Secret SSH</pre></code> + <p>To deny outgoing ports:</p> + <pre><code>ufw deny out <strong>PORT</strong></code></pre> + <p>Ratelimiting is useful to protect against brute-force login attacks, like in SSH. Only IPv4 is supported for now. Enable it by running:</p> + <pre><code>ufw limit <strong>PORT</strong>/tcp</code></pre> + <p>To blocklist IP addresses:</p> + <pre><code>ufw deny from <strong>IP_ADDRESS</strong></code></pre> + <p>To read more what you can do with <code>ufw</code>, run:</p> + <pre><code>man ufw</code></pre> + <h2 id="recovering-from-losing-ssh">Recovering SSH</h2> + <p> + If you have accidentally firewalled yourself from logging on your computer, you can recover access by using your VPS's virtual console. + On Vultr, this is on your VPS's menu. To the right of the server name, It is the leftmost icon that looks like a monitor. + </p> + <a href="pix/ssh-01.png"><img src="pix/ssh-01.png" alt="View Console"></a> + <p>Log in through there, and disable ufw by typing:</p> + <pre><code>ufw disable</code></pre> + <h2 id="further-reading">Further Reading</h2> + <ul> + <li><a href="https://wiki.ubuntu.com/UncomplicatedFirewall">Ubuntu Wiki: UncomplicatedFirewall</a></li> + <li><a href="https://help.ubuntu.com/community/Gufw">Gufw (Graphical UFW)</a></li> + <li><code>man ufw</code></li> + </ul> + <strong>Contributor</strong> - <a href="https://shunter.xyz">shunter.xyz</a> + </main> + +]]></description> +</item> + + +<item> +<title>Creating Your Own Chat Server With IRC</title> +<guid>https://landchad.net/irc.html</guid> +<link>https://landchad.net/irc.html</link> +<pubDate>Thu, 01 Jul 2021 16:28:32 -0400</pubDate> +<description><![CDATA[ + <header><h1>Creating Your Own Chat Server With IRC</h1></header> + + <main> + <img class=titleimg src="pix/irc.svg"> + <p> + Creating your own chat server for you and your friends is easy, and you don't have to rely on a complicated system to get started. + IRC is an old but gold protocol, and has clients for basically every operating system made since the 80s, with many powerful modern ones on Linux, Mac, and Windows. + </p> + <p> + Having a chat server for you and your friends makes it impossible for a group of arbitrarily appointed moderators to deplatform you for wrong-think, and gives you greater freedom of communication. + </p> + <h2 id="installing">Installing an IRCd</h2> + <p> + An IRCd is short for "IRC daemon", which just means an IRC server. + The most easy IRCd to setup is <a href="https://ergo.chat/">Ergo</a>. + </p> + <p> + The first thing you need to do is create a new user for the server to be run by. + This is good practice for installing software/servers manually, as it give you more fine-grained control over which permissions the application has. + </p> +<pre><code>useradd -m ergo -s /bin/bash</code></pre> + <p> + Next, we want to switch to our newly created <code>ergo</code> user and create the server directory. + </p> +<pre><code>sudo -i -u ergo +mkdir server</code></pre> + <p> + You can find the latest release of Ergo on its GitHub <a href="https://github.com/ergochat/ergo/releases/latest">latest release</a> page.<br> + There are several platforms available, but you want to choose Linux, most likely <code>linux-x86_64</code>.<br> + Once you have selected the correct package, copy its URL and replace <code><i><release url></i></code> with the package URL (still as the <code>ergo</code> user): + </p> +<pre><code>wget https://github.com/ergochat/ergo/releases/download/v2.7.0/ergo-2.7.0-linux-x86_64.tar.gz +tar -xf ergo-2.7.0-linux-x86_64.tar.gz +mv ergo-2.7.0-linux-x86_64/* +rm -r ergo-2.7.0-linux-x86_64*</code></pre> + <p>Executing <code>ls -l</code> should now yield something like this:</p> +<pre><code>-rw-r--r-- 1 ergo ergo 118825 Jun 8 00:51 CHANGELOG.md +-rw-r--r-- 1 ergo ergo 1983 May 31 01:48 README +-rw-r--r-- 1 ergo ergo 41440 Jun 8 00:42 default.yaml +drwxr-xr-x 2 ergo ergo 4096 Jul 1 09:01 docs +-rwxr-xr-x 1 ergo ergo 9654272 Jun 8 00:53 ergo +-rw-r--r-- 1 ergo ergo 1753 May 31 01:48 ergo.motd +drwxr-xr-x 2 ergo ergo 12288 Jul 1 09:01 languages +-rw-r--r-- 1 ergo ergo 39722 Jun 8 00:42 traditional.yaml</code></pre> + <p>If you see something similar to the above, that means Ergo is installed, although not quite ready to run yet.</p> + <h2 id="configuring">Configuring Ergo</h2> + <p> + Now that Ergo is installed, you want to configure it to fit the needs of your group.<br> + The configuration in this section is tailored towards a small group of people, and less for a possibly large network, + but it should work for any size of group. + </p> + <p> + First thing, make sure you're still using the <code>ergo</code> user, and are in the <code>~/server</code> directory.<br> + If you aren't, you can run the following to get back there: + </p> +<pre><code>sudo -i -u ergo +cd ~/server</code></pre> + <p> + Next, generate certificate files for TLS: + </p> + <pre><code>./ergo mkcerts</code></pre> + <p> + Ergo comes with a default configuration file with detailed documentation that can be used to guide you through the configuration process. + This guide will help you setup the server for a typical use-case, but if you see any settings that you would like to change along the way, + go ahead and change them, as long as you know what you're doing. + </p> + <p>To start configuring, we need to copy some files:</p> +<pre><code>cp default.yaml ircd.yaml +cp ergo.motd ircd.motd</code></pre> + <p> + The next steps involve editing the newly copied <code>ircd.yaml</code> file. If you do not know how to edit text files from the comment line, + you can use <code>nano</code>, which is very simple, using arrow keys to navigate, <code>CTRL+O</code> to save, and <code>CTRL+X</code> to exit.<br> + Another option is <code>vim</code>, which is a much more powerful text editor, but has a learning curve. It is only recommended for this guide if you already know it.<br> + Lastly, you can copy the <code>ircd.yaml</code> file to a text editor on your computer and edit it with a GUI text editor of your choice. + If that is what you choose to do, you may want to just download the file from <a href="https://raw.githubusercontent.com/ergochat/ergo/master/default.yaml">Ergo's GitHub</a>, + edit it on your computer, clear the <code>ircd.yaml</code> file on the server, and then paste the contents from your computer into the blank file.<br> + No matter how you do it, the next steps assume you can edit the configuration file. + </p> + <p> + <b>Note</b>:<br> + The options highlighted in this section are not a complete overview of all options. + Instead, the options shown are the ones which are most relevant to a small network.<br> + You should read over the configuration file yourself if you are curious about everything you can change. + </p> + <h3 id="configuring-names">Network and server names</h3> + <p> + One of the first properties in the config file is network name. + You can change this to whatever you like, as it will show up as the name when you connect to the server. + </p> +<pre><code># network configuration +network: + # name of the network + name: "Land-Chat"</code></pre> + <p>Change the server name to your server's domain name.</p> +<pre><code># server configuration +server: + # server name + name: "example.org"</code></pre> + <h3 id="configuring-password">Network password</h3> + <p> + The next step is optional, depending on if you want your network password protected or not. + The benefit of password protection is fairly obvious; nobody can connect to your network unless you gave them the password. + If you're wanting to run a public network which anyone can join and create a channel, you want to skip this, but for personal setups, + it is highly recommended. + </p> + <p>Generate a password to use by executing the following:</p> + <pre><code>./ergo genpasswd</code></pre> + <p> + It will ask you to enter a password and confirm it, then you will be given a hashed password.<br> + Copy this password, and paste it into the following field (also removing the <code>#</code> before the <code>password:</code> line): + </p> +<pre><code># password to login to the server, generated using `ergo genpasswd`: +password: "<i><your hashed password></i>"</code></pre> + <h3 id="configuring-motd">Message of the day (MotD)</h3> + <p>Change the MotD (<b>M</b>essage <b>o</b>f <b>t</b>he <b>D</b>ay) file to the one you copied earlier:</p> +<pre><code># motd filename +# if you change the motd, you should move it to ircd.motd +motd: ircd.motd</code></pre> + <p>Feel free to edit <code>ircd.motd</code> to your heart's content. Its contents will be sent to clients when they connect to the network.</p> + <h3 id="configuring-ip-limits">IP limits</h3> + <p> + For security purposes, you might want to limit the amount of client connections per IP. + For a private network, 4 is likely the maximum amount of connections you will have per IP, so that is a safe value.<br> + If your network is password protected, this is less of an issue, since the only people connecting will be people who have the password. + The following is the default, but you can change it to be whichever value you like: + </p> +<pre><code># IP-based DoS protection +ip-limits: + # whether to limit the total number of concurrent connections per IP/CIDR + count: true + # maximum concurrent connections per IP/CIDR + max-concurrent-connections: 16</code></pre> + <h3 id="configuring-ip-cloaking">IP cloaking</h3> + <p> + Traditionally, IRC networks expose users' IP addresses to everyone. This is not a good practice for privacy, however. + With Ergo, IP cloaking is enable by default. You can enable or disable it if you like, and change how it looks to users.<br> + In this case, <code>netname</code> was changed to <code>"chad"</code>. + </p> +<pre><code># IP cloaking hides users' IP addresses from other users and from channel admins +# (but not from server admins), while still allowing channel admins to ban +# offending IP addresses or networks. In place of hostnames derived from reverse +# DNS, users see fake domain names like pwbs2ui4377257x8.irc. These names are +# generated deterministically from the underlying IP address, but if the underlying +# IP is not already known, it is infeasible to recover it from the cloaked name. +# If you disable this, you should probably enable lookup-hostnames in its place. +ip-cloaking: + # whether to enable IP cloaking + enabled: true + # whether to use these cloak settings (specifically, `netname` and `num-bits`) + # to produce unique hostnames for always-on clients. you can enable this even if + # you disabled IP cloaking for normal clients above. if this is disabled, + # always-on clients will all have an identical hostname (the server name). + enabled-for-always-on: true + # fake TLD at the end of the hostname, e.g., pwbs2ui4377257x8.irc + # you may want to use your network name here + netname: "chad"</code></pre> + <h3 id="configuring-hexchat-password">Password enforcement adjustments for HexChat (and possibly other clients)</h3> + <p> + Ergo offers account registration to allow users to do things like use history and bouncer features, register channels, etc.<br> + In clients such as HexChat, server password may conflict with account passwords, so the following setting should be enable if you wish to use accounts with clients such as HexChat.<br> + Note that this could under some circumstances be considered a security hazard, as a user with an account does not need to know the server password to connect, + although that user would have needed to register an account before the server had a password, and then a password would need to have been set after the fact, so this can be considered a very small concern if your setup always has had a password.<br> + Also keep in mind that this setting has no effect if your network does not even have a password at all. + </p> +<pre><code># some clients (notably Pidgin and Hexchat) offer only a single password field, +# which makes it impossible to specify a separate server password (for the PASS +# command) and SASL password. if this option is set to true, a client that +# successfully authenticates with SASL will not be required to send +# PASS as well, so it can be configured to authenticate with SASL only. +skip-server-password: true</code></pre> + <h3 id="configuring-multiclient">Multiclient, always-on clients, history, etc</h3> + <p> + Traditionally, IRC servers have no message history, and once you close your client, you cannot receive messages, and are not shown to be online at all. + Ergo includes functionality to allow users to both receive history, and keep their clients "online" even after they have left. + It also allows multiple clients to connect to the same account.<br> + If you are running a private network for friends, you should set <code>always-on</code> and <code>auto-away</code> to <code>opt-out</code>, + to have all users with accounts to appear as if they are online at all times, and be able to receive messages when they are offline.<br> + For a public network, keep everything as their default values, since you probably do not want randoms having this by default.<br> + If for some reason you do not want any of these features at all, you can set <code>enabled</code> to <code>false</code>, but this is not recommended. + Below are the recommended values for a private network (e.g. for friends) where users with accounts will be able to receive messages and history while they are offline. + </p> +<pre><code># multiclient controls whether Ergo allows multiple connections to +# attach to the same client/nickname identity; this is part of the +# functionality traditionally provided by a bouncer like ZNC +multiclient: + # when disabled, each connection must use a separate nickname (as is the + # typical behavior of IRC servers). when enabled, a new connection that + # has authenticated with SASL can associate itself with an existing + # client + enabled: true + # if this is disabled, clients have to opt in to bouncer functionality + # using nickserv or the cap system. if it's enabled, they can opt out + # via nickserv + allowed-by-default: true + # whether to allow clients that remain on the server even + # when they have no active connections. The possible values are: + # "disabled", "opt-in", "opt-out", or "mandatory". + always-on: "opt-out" + # whether to mark always-on clients away when they have no active connections: + auto-away: "opt-out" + # QUIT always-on clients from the server if they go this long without connecting + # (use 0 or omit for no expiration): + #always-on-expiration: 90d</code></pre> + <h3 id="configuring-vhosts">VHosts</h3> + <p> + IP cloaking was mentioned previously, and somewhat related to that, Ergo includes "vhost" functionality, which allows users to set a custom IP/host string. + This is mostly for cosmetic value, and does not interfere with operators being able to see actual IP addresses for banning, but if you do not want it enable for some reason, you can disable it. + </p> +<pre><code># vhosts controls the assignment of vhosts (strings displayed in place of the user's +# hostname/IP) by the HostServ service +vhosts: + # are vhosts enabled at all? + enabled: true</code></pre> + <h3 id="configuring-channels">Channels</h3> + <p> + Channels are where everyone on an IRC network talk. By default, anyone can create a channel, and anyone with an account can register one. + The difference between a normal channel and a registered one is that the registered one will preserve the operator status of the person who created, + whereas a normal channel's owner will lose operator status if they leave the channel or disconnect from the network.<br> + There are various settings for channels available, but the defaults are suitable for a private network with trust among users, or where you just want anyone to have the ability to create a channel. + Below are the default values: + </p> +<pre><code># channel options +channels: + # modes that are set when new channels are created + # +n is no-external-messages and +t is op-only-topic + # see /QUOTE HELP cmodes for more channel modes + default-modes: +nt + # how many channels can a client be in at once? + max-channels-per-client: 100 + # if this is true, new channels can only be created by operators with the + # `chanreg` operator capability + operator-only-creation: false + # channel registration - requires an account + registration: + # can users register new channels? + enabled: true + # restrict new channel registrations to operators only? + # (operators can then transfer channels to regular users using /CS TRANSFER) + operator-only: false + # how many channels can each account register? + max-channels-per-account: 15</code></pre> + <h3 id="configuring-operators">Operators (administrators, etc)</h3> + <p> + The IRC term for an administrator or another privileged user is "operator", or "oper" for short.<br> + Ergo's opers have different permissions that can be granted to them, and are defined in "classes", basically groups of permissions under a name. + For example, "chat-moderator" and "server-admin" are defined in the default configuration: + </p> +<pre><code># operator classes +oper-classes: + # chat moderator: can ban/unban users from the server, join channels, + # fix mode issues and sort out vhosts. + "chat-moderator": + # title shown in WHOIS + title: Chat Moderator + # capability names + capabilities: + - "kill" + - "ban" + - "nofakelag" + - "roleplay" + - "relaymsg" + - "vhosts" + - "sajoin" + - "samode" + - "snomasks" + # server admin: has full control of the ircd, including nickname and + # channel registrations + "server-admin": + # title shown in WHOIS + title: Server Admin + # oper class this extends from + extends: "chat-moderator" + # capability names + capabilities: + - "rehash" + - "accreg" + - "chanreg" + - "history" + - "defcon" + - "massmessage"</code></pre> + <p> + The above can be kept with their default values, but you are free to modify them or create any new classes that are appropriate for your setup.<br> + Next, let's actually create an operator account: + </p> +<pre><code># ircd operators +opers: + # default operator named 'gigachad'; log in with /OPER gigachad <password> + "gigachad": + # which capabilities this oper has access to + class: "server-admin" + # custom whois line + whois-line: is the server administrator + # custom hostname + vhost: "gigachad" + # normally, operator status is visible to unprivileged users in WHO and WHOIS + # responses. this can be disabled with 'hidden'. ('hidden' also causes the + # 'vhost' line above to be ignored.) + hidden: false + # modes are modes to auto-set upon opering-up. uncomment this to automatically + # enable snomasks ("server notification masks" that alert you to server events; + # see `/quote help snomasks` while opered-up for more information): + #modes: +is acjknoqtuxv + # operators can be authenticated either by password (with the /OPER command), + # or by certificate fingerprint, or both. if a password hash is set, then a + # password is required to oper up (e.g., /OPER dan mypassword). to generate + # the hash, use `ergo genpasswd`. + password: "<i><your oper password></i>"</code></pre> + <p> + This is a modified version of the default oper entry. The account name is "gigachad", but you can change it to anything.<br> + Replace <code><i><your oper password></i></code> with a password generated by <code>./ergo genpasswd</code>, and you will have a new oper account to use.<br> + Note that to log into an oper account, clients have to enter <code>/OPER <i><oper name></i> <i><oper password></i></code> each time they log in. + This can be automated by most clients by setting the command to be executed when the client logs in. + In the case of HexChat, you can edit your network and add the command to the <code>Connect commands</code> tab of the menu.<br> + You can copy everything from <code>"gigachad"</code> to the end of the line, paste it again, and change the name to create another oper account. + Another, less privileged example of an oper is shown as a comment below the above configuration snippet. + </p> + <h3 id="configuring-history">Chat history</h3> + <p> + Traditionally, IRC networks do not store, relay, or handle chat history in any way.<br> + On a privacy standpoint, this is a good thing, since chats are entirely ephemeral and handled by clients.<br> + On a practicality standpoint, this is a bad thing, since people have to keep a client connected 24/7 to see message history.<br> + For normalfriends, this can be a big problem, not only because having to stay online 24/7 is just annoying or infeasible, + but also because they are likely used to chat platforms that handle history for them.<br> + With this in mind, enabling history is a good idea if you want to move friends over to IRC, and will make things a lot more pleasant for private networks. + </p> + <p> + Ergo's <code>history</code> configuration group is very long, so it is encouraged to read over it yourself. + This section will go over the most important pieces of that configuration group. + </p> + <p> + History is not endless (unless you want it to be), and the amount that can be stored for channels is configurable: + </p> +<pre><code># how many channel-specific events (messages, joins, parts) should be tracked per channel? +channel-length: 2048</code></pre> + <p> + History is already enabled by default, but that just means it is being collected, not relayed by default. + To relay history to clients when they connect, change the following to the amount of messages that you think is appropriate: + </p> +<pre><code># number of messages to automatically play back on channel join (0 to disable): +autoreplay-on-join: 250</code></pre> + <p> + History older than a certain time can be configured to be deleted or be inaccessible. + The default cutoff time is 1 week, but this is configurable as well. + </p> +<pre><code> +# options to delete old messages, or prevent them from being retrieved +restrictions: + # if this is set, messages older than this cannot be retrieved by anyone + # (and will eventually be deleted from persistent storage, if that's enabled) + expire-time: 1w +</code></pre> + <p> + By default, Ergo only stores chat history in memory, so when the server restarts, all history is lost. + If you wish to have chat history persist beyond restarts, you must store it in a MySQL database: + </p> +<pre><code># options to store history messages in a persistent database (currently only MySQL). +# in order to enable any of this functionality, you must configure a MySQL server +# in the `datastore.mysql` section. +persistent: + enabled: true + # store unregistered channel messages in the persistent database? + unregistered-channels: true</code></pre> +<br> +<pre><code># connection information for MySQL (currently only used for persistent history): +mysql: + enabled: false + host: "localhost" + port: 3306 + # if socket-path is set, it will be used instead of host:port + #socket-path: "/var/run/mysqld/mysqld.sock" + user: "ergo" + password: "hunter2" + history-database: "ergo_history" + timeout: 3s + max-conns: 4 + # this may be necessary to prevent middleware from closing your connections: + #conn-max-lifetime: 180s</code></pre> + <p> + For privacy reasons, you may want to allow users to delete their own messages in history, or export their messages to JSON: + </p> +<pre><code># options to control how messages are stored and deleted: +retention: + # allow users to delete their own messages from history? + allow-individual-delete: true + # if persistent history is enabled, create additional index tables, + # allowing deletion of JSON export of an account's messages. this + # may be needed for compliance with data privacy regulations. + enable-account-indexing: true</code></pre> + <h3 id="configuring-spam">Spam reduction</h3> + <p> + Most IRC networks have measures in place to reduce chat spam. By default, "fakelag" is enabled in Ergo, and that can deal with most aggregious chat spam.<br> + If you are running a private network where user trust is high, you can disable it so that there are no limits on the speed that messages can be sent. + </p> +<pre><code># fakelag: prevents clients from spamming commands too rapidly +fakelag: + # whether to enforce fakelag + enabled: true + # time unit for counting command rates + window: 1s + # clients can send this many commands without fakelag being imposed + burst-limit: 5 + # once clients have exceeded their burst allowance, they can send only + # this many commands per `window`: + messages-per-window: 2 + # client status resets to the default state if they go this long without + # sending any commands: + cooldown: 2s</code></pre> + <h2 id="using">Starting and using your server</h3> + <p> + Now that Ergo is both installed and configured, you can actually start using it! + </p> + <h3 id="using-starting">Starting the server</h3> + <p> + First thing, make sure you're still using the <code>ergo</code> user, and are in the <code>~/server</code> directory.<br> + If you aren't, you can run the following to get back there: + </p> +<pre><code>sudo -i -u ergo +cd server</code></pre> + <p> + Starting the server is done in one command: + </p> + <pre><code>./ergo run</code></pre> + <p> + It will stay online until you close the terminal, or press CTRL+C. Don't worry, the next section goes over how to make it run like a normal server with a SystemD service.<br> + If you have not already, make sure the port <code>6697</code> is not blocked on your server. If you are using UFW as your firewall, + you need to run <code>ufw enable 6697</code> (not as the <code>ergo</code> user, of course).<br> + If you make and configuration changes while the server is running, you can apply them without restarting by typing <code>/rehash</code> as an operator. + </p> + <h3 id="using-connecting">Connecting to the server</h3> + <p> + To use IRC, you of course need an IRC client. There are many choices available, but the most widely used for Windows and Linux is <a href="https://hexchat.github.io/">HexChat</a>. + On Mac, you have a slightly nicer option with <a href="https://www.codeux.com/textual/">Textual</a>, although you have to <a href="https://github.com/Codeux-Software/Textual/#building-textual">compile it from source</a> if you want to use it for free.<br> + A more user-friendly and modern client choice is TheLounge, which is explained in the last section of this guide, if you want to look into it. + </p> + <p> + Connecting with HexChat is very easy. When you start it, you will see something like this: + </p> + <img src="pix/irc/hexchat-network-select.png" alt="HexChat network select"> + <p> + From there, you should click <code>+ Add</code> and name the server whatever you like (so you can find it on the server list).<br> + Once you have created a new server and named it, select it and click <code>Edit...</code>. + A menu will show up like the one below. Change the domain to whatever domain your server is running on, + and make sure to put in your server password if you set one. + </p> + <img src="pix/irc/hexchat-network-edit.png" alt="HexChat network edit menu"> + <p> + Once you're done editing the network, click <code>(X) Close</code>, select your network from the network list, and click <code>Connect</code>.<br> + If all is well, you should be connected! + </p> + <img src="pix/irc/hexchat-connection-complete.png" alt="HexChat connection complete"> + <p> + The process is very similar on Textual.<br> + Create a new network and connect to it. Note that it will ask if you want to connect even though the certificate is unsigned. + This is due to the self-signed certificates generated for the server, and is not a problem or security vulnerability, it is just a little annoying. + </p> + <img src="pix/irc/textual-network-edit.png" alt="Textual network edit menu"> + <h2 id="service">Surviving restarts with a SystemD service</h3> + <p> + In the beginning of the last section, Ergo was started by simply running <code>./ergo run</code>, but this is only suitable for testing. + To have a proper server setup, you need to run it as a service. This can be achieved via a SystemD service. + </p> + <p> + Before creating your service file, make sure you are in <code>~/server</code> as the <code>ergo</code> user.<br> + Once you have done that, create a file called <code>start.sh</code> with the following content: + </p> +<pre><code>#!/bin/bash +./ergo run</code></pre> + <p>Save the file, then mark it as executable:</p> + <pre><code>chmod +x start.sh</code></pre> + <p>Now, create a file called <code>ergo.service</code> with the following content:</p> +<pre><code>[Unit] +Description=Ergo IRC server +After=network.target +# If you are using MySQL for history storage, comment out the above line +# and uncomment these two instead (you must independently install and configure +# MySQL for your system): +# Wants=mysql.service +# After=network.target mysql.service +[Service] +Type=simple +User=ergo +WorkingDirectory=/home/ergo/server +ExecStart=/home/ergo/server/start.sh +ExecReload=/bin/kill -HUP $MAINPID +Restart=on-failure +LimitNOFILE=1048576 +# Uncomment this for a hidden service: +# PrivateNetwork=true +[Install] +WantedBy=multi-user.target</code></pre> + <p> + You now have your service file, but it is not installed yet. + To install it, switch to your normal user, and execute the following lines to install, enable, and start the SystemD service: + </p> +<pre><code>ln -s /home/ergo/server/ergo.service /etc/systemd/system/ergo.service +systemctl enable ergo +systemctl start ergo</code></pre> + <p>Ergo is now installed and running as a service, and will automatically start when the system boots.</p> + <h2 id="registering">Registering accounts and channels</h2> + <p> + Account and channel registration were mentioned multiple times in this guide, and are indeed very important parts of the modern IRC ecosystem. + You can connect to most IRC networks and talk without creating an account, but you will not be able to reserve your nickname or register channels, so it is important to register an account. + </p> + <h3 id="registering-accounts">Registering an account with NickServ</h3> + <p> + First, make sure you are connected to your IRC network. + Once you are, type <code>/nickserv help</code> to make sure NickServ (the registration system) is working propertly.<br> + If all is well, type the following, replacing <code><i><your password></i></code> with the password you want to use: + </p> + <pre><code>/nickserv register <i><your password></i></code></pre> + <p> + At this point, you are now registered!<br> + The final step is to configure authentication with your client. + </p> + <p>In HexChat, all that needs to be done is changing <code>Login method</code> to <code>SASL (username + password)</code>, and entering your NickServ password that you used earlier into the password field:</p> + <img src="pix/irc/hexchat-sasl.png" alt="HexChat SASL in network edit menu"> + <p> + In Textual, open up your network in the menu, and click <code>Identity</code> under <code>Server Properties</code>. + Enter your password in <code>Personal Password</code>, and check <code>Wait for identification before joining channels</code>. + </p> + <img src="pix/irc/textual-identity.png" alt="Textual identity menu"> + <p>You will now be logged into your account when you connect to your network.</p> + <h3 id="registering-channels">Registering channels with ChanServ</h3> + <p> + Once you have an account registered, you can register channels with ChanServ.<br> + To do so, join the channel you want to register, then type the following, replacing <code><i><your channel></i></code> with the name of the channel you want to register: + </p> + <pre><code>/chanserv register #<i><your channel></i></code></pre> + <p> + You are now the channel owner, and are free to appoint operators, administrators, etc for it. + When you go offline, you won't lose ownership, and you cannot be removed as the owner unless you unregister the channel later. + </p> + <h2 id="moderation">Moderation</h2> + <p> + Like any chat, there will come a point where you need to use moderation tools to keep things under control. + Many IRC setup guides do not go over moderation, so it can be stressful when operators need to actually use moderation tools.<br> + The main difference between IRC and other chat systems in terms of moderation is the difference between channel bans and network bans. + Channel ban keeps a person out of channel a channel, whereas a network ban keeps a person out of the entire network. + </p> + <h3 id="moderation-masks">Understanding masks</h3> + <p> + Bans are applied "masks", which are formatted pieces of text that contain a user's nick (username), their realname value, and their IP address or host.<br> + This is what a mask looks like: <code>nick!~nick-dude@127.0.0.1</code>.<br> + In bans, asterisks can be used as wildcards, which is useful for banning IP address ranges, patterns of nicknames, or whatever else you can think of.<br> + A ban on the nick <code>person</code>, for example, would look like this: <code>person!*@*</code>.<br> + A ban on anyone with the IP address <code>127.0.0.1</code> would look like this: <code>*!*@127.0.0.1</code> + </p> + <h3 id="moderation-real-ips">Discovering real IPs</h3> + <p> + Even if IP cloaking is enabled on your network, you can still obtain real IP addresses/hosts if you are an operator. + See the <b>Operators</b> part of the configuration section of this guide on how to become an operator.<br> + To find out a user's real IP, simply type <code>/whois</code> along with the user's nick, and you will see information about the user, along with their real IP address/host.<br> + <code>/whois</code> is not a command that is exclusive to operators, but it does not reveal as much information to non-operators. + </p> + <h3 id="moderation-network-ban">Banning someone from the network</h3> + <p> + Any netword-wide moderation action requires being an operator. See the <b>Operators</b> part of the configuration section of this guide on how to become an operator.<br> + Banning someone from the network is achieved with the <code>/kline</code> command. To see more info on the command, type <code>/helpop kline</code>.<br> + </p> + <p>To ban a nick from the network:</p> + <pre><code>/kline andkill <i><nick></i>!*@*</code></pre> + <p>To ban an IP address or host from the network:</p> + <pre><code>/kline andkill *!*@<i><IP or mask></i></code></pre> + <p>To unban a mask, you can use the <code>/unkline</code> command with the mask you want to unban.</p> + <h3 id="moderation-channel-ban">Banning someone from a channel</h3> + <p> + Channel owners, administrators, and operators can ban people from channels. + This is not the same as banning someone from the network, since it only has an effect on one channel. + Additionally, a channel operator is not the same as a network operator. + </p> + <p>To ban someone in a channel, type the following in that channel, replacing <code><i><mask></i></code> with the user's mask:</p> + <pre><code>/mode +b <i><mask></i></code></pre> + <p> + Note that this will only ban the user, not kick them immediately. + You will want to run <code>/kick</code> along with the user's nick to also kick them.<br> + To unban a user, run the command above, but replace the <code>+</code> with a <code>-</code>.<br> + You can see who is banned in a channel by typing <code>/banlist</code>. + </p> + <h3 id="moderation-muting">Muting people in a channel</h3> + <p> + By default, anyone can speak in an IRC channel. To change this, you must be a channel owner, administrator, or operator.<br> + Channels, along with users, have modes, which modify their behavior. There is a special mode for channels called <code>m</code> (moderated) which requires users to be privileged in some way to talk.<br> + To set a channel as moderated, type the following in the channel: + </p> + <pre><code>/mode +m</code></pre> + <p> + Now, users must be an owner, administrator, operator, or be voiced to talk in the channel + This be reversed by typing the command above, but changing the <code>+</code> to a <code>-</code>.<br> + To voice a user, run the following, replacing <i><nick></i> with the user's nick: + </p> + <pre><code>/mode +v <i><nick></i></code></pre> + <p>Unvoice the user by typing the above command, but replacing the <code>+</code> with a <code>-</code>.</p> + <h3 id="moderation-appointing">Appointing channel administrators and operators</h3> + <p> + Assuming you a channel owner, you can appoint both administrators and operators. + If you are only an operator, you may only appoint operators.<br> + The difference between administrator and operator is mainly that administrators cannot have their privileges taken away by operators, only owners. + To appoint an administrator, type the following, replacing <i><nick></i> with the user's nick: + </p> + <pre><code>/mode +a <i><nick></i></code></pre> + <p>To appoint an operator, type the following, replacing <i><nick></i> with the user's nick:</p> + <pre><code>/mode +o <i><nick></i></code></pre> + <p> + You can also use <code>/op</code> and <code>/deop</code> on most clients to appoint and remove an operator.<br> + To remove administrator or operator status, run either of the above commands, but replace the <code>+</code> with a <code>-</code>. + </p> + <h2 id="thelounge">Bringing modern-day features to IRC with TheLounge</h3> + <p> + A large downside to IRC as a protocol is just how old it is, and the limitations that exist because of it. + Other old protocols such as HTTP were built to be content-agnostic and versitile, but IRC was built with a very specific set of features, so it has not held up so well to contemporary chat systems.<br> + A notable thing that IRC as a protocol is missing is file uploads, and other fancy features that many other chats have.<br> + With that said, these problems can be fixed by clients, although many clients are still very primitive. + </p> + <p> + <a href="https://thelounge.chat/">TheLounge</a> is a modern self-hosted IRC web client that tries to make IRC as user-friendly as possible. + It can be the answer to many of the complaints that normalfriends may have about IRC. It runs on anything with a web browser, can be "installed" since it is a PWA (Progressive Web App), + and is optimized for both desktops and mobile devices. It keeps you logged in even when you are gone, and even supports file uploads and embeds.<br> + Effectively, it brings IRC up to the standard of most other chat systems. + </p> + <p> + If you would like to setup an instance of TheLounge for you and your friends, you can take a look at their <a href="https://thelounge.chat/docs/install-and-upgrade">installation guide</a>.<br> + It is a self-hosted web app, so you can run it for multiple people, not just yourself. + </p> + <hr> + <p><i>Written by <a href="https://termer.net/">Termer</a></i></p> + </main> + +]]></description> +</item> + + +<item> +<title>Setting up Gitea</title> +<guid>https://landchad.net/gitea.html</guid> +<link>https://landchad.net/gitea.html</link> +<pubDate>Thu, 01 Jul 2021 16:14:22 -0400</pubDate> +<description><![CDATA[ + <header><h1>Setting up Gitea</h1></header> + + <main> + <img class=titleimg src="pix/gitea.svg"> + <p>Gitea allows you to self-host your git repositories similar to <a href="git.html">bare repositories</a>, but comes with additional features that you might know from GitHub, such as issues, pull requests or multiple users. Its advantage over GitLab—another Free Software GitHub clone—is that it is much more lightweight and easier to setup.</p> + <p>Head over to <a href="https://gitea.com">gitea.com</a> to see what it looks like in practice.</p> + <p>Although Gitea is lighter than Gitlab, if you have a VPS with only 512MB of RAM, you will probably have to upgrade. Gitea is more memory-intensive than having just a bare git repository.</p> + <h2>Installing Gitea</h2> + <p>First install a few dependencies:</p> + <pre><code>apt install curl sqlite3</code></pre> + <p>Unfortunately, Gitea itself is not in the official Debian repos, so we will add a third-party repository for it.</p> + <p>Add the repo's gpg key to apt's trusted keys:</p> + <pre><code>curl -sL -o /etc/apt/trusted.gpg.d/morph027-gitea.asc https://packaging.gitlab.io/gitea/gpg.key</code></pre> + <p>Then add the actual repository to apt:</p> + <pre><code>echo "deb [arch=amd64] https://packaging.gitlab.io/gitea gitea main" > /etc/apt/sources.list.d/morph027-gitea.list</code></pre> + <p>Now we can install Gitea:<p> + <pre><code>apt update +apt install gitea</code></pre> + <p>Since apt automatically enables and starts the Gitea service, it should already be running on port <code>3000</code> on your server!</p> + <h2>Setting up a Nginx reverse proxy</h2> + <p>You should know how to generate SSL certificates and use Nginx by now. Add this to your Nginx config to proxy requests made to your git subdomain to Gitea running on port 3000:</p> + <pre><code> +server { + listen 443 ssl; + listen [::]:443 ssl; + ssl_certificate /etc/ssl/nginx/<strong>git.example.org</strong>.crt; + ssl_certificate_key /etc/ssl/nginx/<strong>git.example.org</strong>.key; + server_name <strong>git.example.org</strong>; + location / { + proxy_pass http://localhost:3000/; # The / is important! + proxy_redirect off; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} + </pre></code> + <p>And reload Nginx:</p> + <pre><code>systemctl reload nginx</code></pre> + <h2>Setting up Gitea</h2> + <p>If everything worked fine you should now see a setup screen when you go to your configured domain in the browser. The options should be pretty self-explanatory, it is only important to select SQLite3 and to replace the base url and SSH server domain with your own.</p> + <dl> + <dt>Database Type:</dt> + <dd>SQLite3</dd> + <dt>SSH Server Domain:</dt> + <dd><strong>git.example.org</strong></dd> + <dt>Gitea Base URL:</dt> + <dd><strong>git.example.org</strong></dd> + </dl> + <p>These and other settings can be changed in a configuration file later so don't worry about making wrong decisions right now.</p> + <p>After clicking the install button you should now be able to log into your Gitea instance with the account you just created! Explore the settings for more things to do, such as setting up your SSH keys.</p> + <p>If Gitea does not load fully and has random errors, it is possible that you need to increase your available memory on your VPS. This can usually be done on your VPS-provider's website without too much trouble.</p> + <h2>A few extras</h2> + <h3>Automatically create a new repo on push</h3> + <p>This is an incredicly useful feature for me. Open up <code>/etc/gitea/app.ini</code> and add <code>DEFAULT_PUSH_CREATE_PRIVATE = true</code> to the <code>repository</code> section like so:</p> + <img src=pix/gitea-push-create.png> + <br> + <p>If you now add a remote to a repository like this</p> + <pre><code>git remote add origin 'ssh://gitea@git.<strong>example.org</strong>/<strong>username</strong>/<strong>coolproject</strong>.git'</code></pre> + <p>and push, Gitea will automatically create a private <code>coolproject</code> repository in your account!</p> + <h3>Change tab-width</h3> + <p>By default Gitea displays tabs 8 spaces wide, however I prefer 4 spaces. We can change this!</p> + <pre><code>mkdir -p /var/lib/gitea/custom/templates/custom/</code></pre> + <p>And write this into <code>/var/lib/gitea/custom/templates/custom/header.tmpl</code>:</p> + <pre><code><style> +.tab-size-8 { + tab-size: 4 !important; + -moz-tab-size: 4 !important; +} +</style></code></pre> + <h2>Contribution</h2> + <ul> + <li><a href="https://phire.cc">phire</a></li> + </ul> + </main> + +]]></description> +</item> + + +<item> +<title>Hosting Your Own Git Repositories</title> +<guid>https://landchad.net/git.html</guid> +<link>https://landchad.net/git.html</link> +<pubDate>Thu, 01 Jul 2021 07:19:51 -0400</pubDate> +<description><![CDATA[ + <header><h1>Hosting Your Own Git Repositories</h1></header> + + <main> + <img class=titleimg src="pix/git.svg"> + <p> + Once you have your own VPS or other Internet-available server, you can + start hosting your own git repositories. The goal of this tutorial is + for you to go from</p> + <pre><code>git clone github.com/...</code></pre> + <p>to</p> + <pre><code>git clone YourLandChadDomainName.xyz/...</code></pre> + <p> + so you can cultivate your own homegrown, grass-fed code, rather than + relying on a centralized proprietary service like GitHub. + </p> + <h2>Installing git</h2> + <p> + You most likely already have it installed on your server, but if not, + run:</p> + <pre><code>apt install git</code></pre> + <p> + We don't need any additional software, <code>git</code> itself ships + with everything needed to host a remote repository! + </p> + <h2>Creating bare repositories</h2> + <p> + For each repository you want to host, you will need to manually create + what's called a "bare" repository on your server. These hold all the + commits and any other git data needed for your repository, but without + an expanded "index" in which you can just browse all the files of a + certain commit in the file system. + </p> + <p> + These repositories need to be owned by the <code>git</code> user, and + you should probably pick a directory where you will store them all. One + sane choice is under <code>/srv/git/</code>, and we will use this as the + example directory for the rest of the tutorial, but any other path will + do as well. + </p> + <h3>Become the git user and create the directory</h3> + <p> + If you're logged in to your server as root and have <code>git</code> + installed, you can become the <code>git</code> user by executing + </p> + <pre><code>su git</code></pre> + <p> + Now navigate to/create your desired directory, for example + </p> + <pre><code>cd /srv +mkdir git</code></pre> + <h3>Create the repo</h3> + <p> + Now you can create the bare repository with + </p> + <pre><code>git init --bare my-repo.git</code></pre> + <p> + By convention, bare repository names end with ".git". + </p> + <p> + Repeat the above command for any other repositories you want to host. + </p> + <h2>Syncing local repositories with your server</h2> + <h3>Set up SSH login for the git user</h3> + <p> + You will need to be able to login remotely via <code>ssh</code> as the + <code>git</code> user we've used before. To do this, you will either + need to set up a password for the <code>git</code> user by running + <code>passwd git</code>, + or copy your public SSH key from your local machine to + <code>/home/git/.ssh/authorized_keys</code>. + See the <a href="sshkeys.html">SSH keys instructional</a> for details + (just log in as <code>git</code> instead of <code>root</code>). + </p> + <h3>Syncing a new repository with your server</h3> + <p> + If you've just created a new repository on your local machine, you will + need to tell <code>git</code> where the remote repository is to be able + to sync with it (using commands like <code>git push</code> or + <code>git pull</code>). We do this by defining a "remote" for your + repository. + </p> + <p> + A remote is just a named URL remembered in your repo's configuration. So + we need a name and a URL. By convention, the "main" remote is called + "origin". The URL has the format <code>user@host:path</code>, where: + </p> + <ul> + <li> + <code>user</code> is <code>git</code>, the <code>git</code> user + we've already worked with before. + </li> + <li> + <code>host</code> is your domain name. + Alternatively you could even use your server's raw IP address. + </li> + <li> + <code>path</code> is the absolute path to the repository on the + server, in our example <code>/srv/git/my-repo.git</code> + </li> + </ul> + </p> + <p> + So, to create a new remote, run: + </p> + <pre><code>git remote add origin git@yourdomain.xyz:/srv/git/my-repo.git</code></pre> + <p> + Now you'll be able to run <code>git push origin master</code> to push + your commits or <code>git pull origin</code> to pull from the remote. + </p> + <h3>Syncing an existing repository</h3> + <p> + If you've already set up your local repository to sync with a service + like GitHub it probably already has a remote called "origin". You can + see your repo's remotes with: + </p> + <pre><code>git remote -v</code></pre> + <p> + You can follow the above instructions, substituting an arbitrary other + name other than "origin" to create a differently named remote, e.g. + </p> + <pre><code>git remote add vps git@...</code></pre> + <p> + Now you'll be able to push/pull with <code>git push vps master</code> + and <code>git pull vps</code>, respectively. + </p> + <p> + Or, to completely sever ties with your centralized git provider, first + remove the original origin with: + <code>git remote remove origin</code> + and then follow the instructions as above. + </p> + <h2>Contribution</h2> + <ul> + <li>Martin Chrzanowski -- <a + href="https://m-chrzan.xyz">website</a>, <a href="https://m-chrzan.xyz/crypto.html">donate</a></li> + </ul> + </main> + +]]></description> +</item> + + +<item> +<title>Requiring Passwords for Webpages (HTTP Authentication)</title> +<guid>https://landchad.net/auth.html</guid> +<link>https://landchad.net/auth.html</link> +<pubDate>Thu, 01 Jul 2021 07:19:27 -0400</pubDate> +<description><![CDATA[ + <header><h1>Requiring Passwords for Webpages</h1></header> + + <main> + <img class=titleimg src="pix/auth.svg" alt="access control with nginx"/> + <p>HTTP basic authentication will allow you to secure parts (or all) of your website with a username and password without the trouble of PHP or Javascript. + This will work with any Nginx server. + </p> + <h2>Installation</h2> + <p>We will be using the command <code>htpasswd</code> to make username and password pairs.</p> + <pre><code>apt install apache2-utils</code></pre> + <aside> + <p>The apache utils has a small username-password pair encryption tool.</p> + <p>Like the other on this site, this tutorial is for Nginx, <strong>not</strong> for Apache servers.</p> + </aside> + <p> + Now think of a username and password and remember them. + </p> + <pre><code>htpasswd -c /etc/nginx/<strong>myusers</strong> <strong>username</strong></code></pre> + <aside> + <p>The <code>-c</code> flag creates a file. You can make the path of this file anywhere outside of your webroot.</p> + <p>Obviously the username is up to you as well.</p> + </aside> + <p> + Type out your password twice to confirm. You can do this as many times as you'd like. + </p> + <p>Check out user name password pairs (the password will be securely hashed):</p> + <pre><code>cat /etc/nginx/<strong>myusers</strong></code></pre> + <h2>Nginx Config and Auth Basic</h2> + <p> + From here, we are going to edit our websites config file in <code>/etc/nginx/sites-enabled</code>. + Have in mind which folder you'd like to secure. Add something like this: + </p> + <pre><code>server { + #... + location /<strong>secret-folder </strong> { + auth_basic "What's the Password?" ; + auth_basic_user_file /etc/nginx/<strong>myusers</strong> ; + } + #... +}</code></pre> + <aside> + <h4>Huh?</h4> + <p>If you're stuck, try finding the line <code>location / {</code></p> + <p>Just below this block is where you should add the custom location block</p> + </aside> + <p>If you'd like to do the opposite, such as making the entire site private except for a public section, do this:</p> + <pre><code>server { + #... + auth_basic "What's the Password?" ; + auth_basic_user_file /etc/nginx/<strong>myusers</strong> ; + location /<strong>public</strong>/ { + #... + auth_basic off ; + } + #... +}</code></pre> + <h3>IP Addresses</h3> + <p>If passwords aren't enough we can ban an ip or accept one.</p> + <pre><code>location /api { + #... + allow 192.168.1.23:8080 ; + deny 127.0.0.1 ; +}</code></pre> + <p>If you want to check both a username and password with an ip address, use the <code>satisfy</code> directive.</p> + <pre><code>location /api { + #... + satify all ; + allow 192.168.1.23:8080 ; + deny 127.0.0.1 ; + auth_basic "What's the Password?" ; + auth_basic_user_file /etc/nginx/<strong>myusers</strong> ; +}</code></pre> + <h3>Complete Example</h3> + <pre><code>http { + server { + listen 80; + root /var/www/website ; + #... + location /<strong>secret-folder</strong> { + satisfy all ; + allow 192.168.1.3/24; + deny 127.0.0.1 ; + auth_basic "What's the Password?" ; + auth_basic_user_file /etc/nginx/<strong>myusers</strong> ; + } + } +}</code></pre> + <p> + Now check your configuration with <code>nginx -t</code> + </p> + <p>Reload nginx and you're good to go!</p> + <strong>Contributor</strong> - <a href="https://tomfasano.xyz" target="_blank">tomfasano.xyz</a> + </main> + +]]></description> +</item> + + +<item> +<title>Cronjobs</title> +<guid>https://landchad.net/cron.html</guid> +<link>https://landchad.net/cron.html</link> +<pubDate>Thu, 01 Jul 2021 07:19:04 -0400</pubDate> +<description><![CDATA[ + <header><h1>Using Cronjobs to run scheduled tasks</h1></header> + + <main> + <p> + Cron is a service that lets you run scheduled tasks. These tasks are called <strong> cronjobs. </strong> If you have already followed the initial course you will have already used cron when you set up certbot. + </p> + <h2> What tasks would I want to schedule? </h2> + <p> + You can schedule anything! Some examples of what you might have done already include: + <ul> + <li> <code> updatedb </code> to update your <code> locate </code> database </li> + <li> <code> certbot </code> to update renewing of your https certs </li> + </ul> + Some tasks that you might <em>want</em> to schedule may include: + <ul> + <li> Package updates - if you really just want to leave your server alone you can automated updating packages on your server </li> + <li> Backups - you may want to backup certain files every day and some every week, this is possible with cron </li> + </ul> + <p> + And many more, anything you can do can be turned into a cronjob. + </p> + <h2>Basic Cronjobs</h2> + <p> + This the preferred method for personal tasks and scripts, it's also the easiest to get started with. Run the command <code> crontab -e </code> to access your users crontab + </p> + <p> + Once you have figured out the command you want to run you need to figure out how often you want to run it and when. I am going to schedule my system updates once a week on at 3:30 AM on a Monday. + </p> + <p> + We now have to convert this time (Every Monday at 3:30 AM) into a cron time. Cron uses a simple but effective way of scheduling when to run things. + </p> + <p> + Crontab expressions look like this <code> * * * * * command-to-run </code> + The five elements before the command tell when the command is supposed to be run automatically. + <p> + So for our Monday at 3:30AM job we would do the following: + <p> + <pre><code> .---------------- minute (0 - 59) + | .------------- hour (0 - 23) + | | .---------- day of month (1 - 31) + | | | .------- month (1 - 12 + | | | | .---- day of week (0 - 6) + | | | | | + * * * * * +30 3 * * 1 apt -y update && apt -y upgrade</code></pre> + <h3>Some notes</h3> + <ul> + <li>On the day of the week option, Sunday is 0 and counting up from there, Saturday will be 6.</li> + <li><code>*</code> designates "everything". Our command above has a <code>*</code> in the day of month and month columns. This means it will run regardless of the day of the month or month.</li> + <li>The hour option uses 24 hour time. 3 = 3AM, while use 15 for 3PM.</li> + </ul> + <h3>More examples</h3> + <p> + Let's add another job, our backup job (for the purposes of this our backup command is just called <code> backup</code>) We want to run <code> backup </code> Every evening at 11PM, once we work out the timings for this we can add the to the same file as the above by running <code> crontab -e </code> This would mean our full crontab would look like this: + <pre><code>0 23 * * * backup</code></pre> + <h3>Consecutive times</h3> + <p> + Suppose we want a command to run every weekday. + We know we can put <code>1</code> (Monday), but we can also use <code>1-5</code> + to signify from day 1 (Monday) to day 5 (Friday). + </p> + <pre><code>0 6 * * 1-5 echo "Wakey, wakey, wagie!" >> /home/wagie/alarm</code></pre> + <p>The above <code>echo</code> command runs every Monday through Friday at 6:00AM.</p> + <h3>Non-consecutive times</h3> + <p> + We can also randomly specify non-consecutive arguments with a comma. + Suppose you have a script you want to run at the midday of the 1st, 15th, and 20th day of every month. + You can specify that my putting <code>1,15,20</code> for the day of the month argument: + </p> + <pre><code>0 12 1,15,20 * * /usr/bin/pay_bills_script</code></pre> + <h3>"Every X minutes/days/months"</h3> + <p>We can also easily run a command very several minutes or months, without specifying the specific times: + </p> + <pre><code>*/15 * * * * updatedb</code></pre> + <p> + This cronjob will run the <code>updatedb</code> command every 15 minutes. + </p> + <h3>Beware of this Rookie Mistake Though...</h3> + <p> + Suppose you want to run a script once every other month. + You might be <em>tempted</em> write this: + </p> + <pre><code>* * * */2 *</code></pre> + <p> + That might <em>feel right</em>, but this script <em>will be running once every minute during that every other month</em>. + You should specify the first two arguments, because with <code>*</code> it will be running every minute and hour! + </p> + <pre><code>0 0 1 */2 *</code></pre> + <p>This makes the command run <em>only</em> at 0:00 (12:00AM) on the first day of every two months, which is what we really want.</p> + <p> + Consult the website <a href="https://crontab.guru">crontab.guru</a> for an intuitive and interactive tester of cronjobs. + </p> + <h2>User vs. Root Cronjobs</h2> + <p> + It is important to note that user accounts all have different cronjobs. + If you have a user account <code>chad</code> and edit his crontab with <code>crontab -e</code>, + the commands you add will be run as the <code>chad</code> user, not <code>root</code> or anyone else. + </p> + <p> + Bear in mind that if you need root access to run a particular command, + you will usually want to add it as root. + </p> + <h2>System-wide cron directories</h2> + <p> + <code>crontab -e</code> is the typical interface for adding cronjobs, but it's important to at least know that system-wide jobs are often stored in the file directory. + Some programs which need cronjobs will automatically install them in the following way. + </p> + <p> + Run the command <code> ls /etc/cron* </code> you should see a list of directories and there contents. The directories should be something like the below + <ul> + <li> /etc/cron.d <em> This is a crontab like the ones that you create with </em> <code> crontab -e </code> </li> + <li> /etc/cron.hourly </li> + <li> /etc/cron.daily </li> + <li> /etc/cron.weekly </li> + <li> /etc/cron.monthly </li> + </ul> + <p> + The directories cron.{hourly,daily,weekly,monthly} are where you can put <strong> scripts </strong> to run at those times. You don't put normal cron entries here. I prefer to use these directories for system wide jobs that don't relate to an individual user. + </p> + <h2>Contribution</h2> + <ul> + <li>Mark McNally -- <a href="https://mark.mcnally.je">website</a>, <a href="https://www.youtube.com/channel/UCMiInY8BhSUtCarO6uu6i_g">Youtube</a></li> + <li>Edits and examples by Luke</li> + </ul> + </main> + +]]></description> +</item> + + +<item> +<title>Mirror your site over tor</title> +<guid>https://landchad.net/tor.html</guid> +<link>https://landchad.net/tor.html</link> +<pubDate>Thu, 01 Jul 2021 07:15:39 -0400</pubDate> +<description><![CDATA[ + <header><h1>Mirror Your Site Over Tor</h1></header> + + <main> + <img class=titleimg src="pix/tor.svg" alt="Tor logo"> + <p> + Now that you have a website, why not offer it on a private alternative such as the onion network? + </p> + <h2>Setting up Tor</h2> + <h3>Installing Tor</h3> + <p>Firstly we need to add the tor repo's to have the latest up to date version or tor.</p> + <pre><code>apt install -y apt-transport-https gpg +echo "deb https://deb.torproject.org/torproject.org buster main +deb-src https://deb.torproject.org/torproject.org buster main" > /etc/apt/sources.list.d/tor.list</code></pre> + <p>Then we need to add the gpg keys to our keyring</p> + <pre><code>curl -s https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --import +gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add -</code></pre> + <p>Now update and install tor</p> + <pre><code>apt update +apt install tor deb.torproject.org-keyring</code></pre> + <h3>Enabling Tor</h3> + <p>Then edit the file <code>/etc/tor/torrc</code>, uncommenting the following lines:</p> + <pre><code>HiddenServiceDir /var/lib/tor/hidden_service/ +HiddenServicePort 80 127.0.0.1:80</code></pre> + <aside> + <h4>Optional: Running multiple onion services</h4> + <p>If you want to forward multiple virtual ports for a single onion + service, just add more HiddenServicePort lines (replace the 80 with any unoccupied port). + </p> + <p>If you want to run multiple onion services from the same Tor client, just add another + HiddenServiceDir line.</p> + </aside> + <p>Now start and enable tor at boot</p> + <pre><code> systemctl enable --now tor </code></pre> + <p>If the next command outputs <q>active</q> in green you're golden!</p> + <pre><code> systemctl status tor</code></pre> + <p>Now you're server is on the dark web. The following command will give you your onion address:</p> + <pre><code> cat /var/lib/tor/hidden_service/hostname</code></pre> + <h2>Adding the Nginx Config</h2> + <p> + From here, the steps are almost identical to setting up a normal website configuration file. + Follow the steps as if you were making a new website on the webserver + <a href="nginx.html">tutorial</a> up until the server block of code. Instead, paste this: + </p> + <pre><code> server { + listen 127.0.0.1:80 ; + root /var/www/<strong>landchad</strong> ; + index index.html ; + server_name <strong>your-onion-address</strong>.onion ; + }</code></pre> + <aside> + <h4>Clarification</h4> + <p>Nginx will listen on port 80 for your <em>server's</em> localhost.</p> + <p>The <code>root</code> line is the path to whichever website of yours you'd like to mirror.</p> + </aside> + <p> + From here we are almost done, all we have to do is enable the site and reload nginx which is also covered in <a href="nginx.html#enable">the webserver tutorial</a>. + </p> + <h3>Update regularly!</h3> + <p>Make sure to update Tor on a regular basis by running:</p> + <pre><code>apt update +apt install tor</code></pre> + <p><strong>Contributor</strong> - <a href="https://tomfasano.xyz" target="_blank">tomfasano.xyz</a></p> + </main> + +]]></description> +</item> + + <item> <title>Cryptocurrency Tutorials Completed</title> <guid>https://landchad.net/index.html#crypto</guid> diff --git a/sshkeys.html b/sshkeys.html index 53382ee..24154ba 100644 --- a/sshkeys.html +++ b/sshkeys.html @@ -18,15 +18,15 @@ This allows us to do two main things: </p> <ol> - <li><strong>Password-less login</strong>: With SSH keys, we can permanently designate our profile on our local computer as safe for hour server, allowing us to bypass password verification when logging into our server.</li> + <li><strong>Password-less login</strong>: With SSH keys, we can permanently designate our profile on our local computer as safe for our server, allowing us to bypass password verification when logging into our server.</li> <li><strong>Prevent hacking</strong>: Since we no longer need a password to log in, we can simply deactivate password logins on our server altogether, which prevents hacking from people who may be so lucky as to guess our password!</li> </ol> <p> - In order words, using an SSH key to login is <strong>both safer, faster and easier</strong>. + In other words, using an SSH key to login is <strong>both safer, faster and easier</strong>. </p> <p> - This is especially better once you start making scripts on your computer that interact with your server. + This is especially useful once you start making scripts on your computer that interact with your server. You can upload files in the background, edit your spam filters or anything else from your local computer without having to input your password each time you touch the server. </p> @@ -58,15 +58,15 @@ <h2>Making your server trust your key.</h2> <p> - Now that you have an SSH key generate, just run the following: + Now that you have generated an SSH key, just run the following: </p> <pre><code>ssh-copy-id root@yourdomain.com</code></pre> <p> - That will ask for your server's root password and will log you in briefly. + The command will ask for your server's root password and log you in briefly. What this does is that it puts your public SSH key fingerprint on your server in a file <code>/root/.ssh/authorized_keys</code>. - What this does is that it allows approved SSH keys to login without passwords. + This file in turn allows approved SSH keys to log in without passwords. </p> <aside> @@ -83,7 +83,7 @@ <pre><code>ssh root@yourdomain.com</code></pre> <p> - It should now let your log in without a password prompt! + It should now let you log in without a password prompt! </p> <aside class=callout> <p> @@ -107,7 +107,7 @@ <p> Once we have authorized ssh keys for all the devices we need, we can actually just disable password logins. If you've ever looked at your system logs (<code>journalctl -xe</code>) you will find that there are always hundreds of random Chinese computers trying to brute force every server connected to the internet with random passwords. - They usually always are unsuccessful, but let's make it <strong>impossible</strong> for them. + They are usually unsuccessful, but let's make it <strong>impossible</strong> for them. </p> <p> @@ -124,7 +124,7 @@ ChallengeResponseAuthentication <strong>no</strong> UsePAM <strong>no</strong></code></pre> <p> - Once we've done that, we will reload hour SSH daemon: + Once we've done that, we will reload our SSH daemon: </p> <pre><code>systemctl reload sshd</code></pre> @@ -142,11 +142,11 @@ UsePAM <strong>no</strong></code></pre> <h2>What if I lose my SSH key?!</h2> <p> - Firstly, don't do this. Make every precaution that you have a backup. + Firstly, don't do this. Take every precaution that you have a backup. </p> <p> - If this does happens, Vultr and most other VPS providers will have one little out. + If this does happen, Vultr and most other VPS providers will have a way out. Log onto their website and select the server you want to log into. </p> @@ -163,7 +163,7 @@ UsePAM <strong>no</strong></code></pre> </p> <p> - From here, simply reverse the settings we set above and you can login via SSH with a password and you can reapprove a newly created SSH key or whatever you want to do. + From here, simply reverse the settings we set above and you can log in via SSH with a password and reapprove a newly created SSH key or whatever you want to do. </p> </main> @@ -64,9 +64,12 @@ pre { margin: auto ; } +.wide { max-width: inherit ; } + p img, li img, h1 img, h2 img, h3 img, h4 img { vertical-align: middle ; max-width: 1em; + max-height: 1em; border: none ; display: inline ; } @@ -77,6 +80,10 @@ img { display: block ; border: solid 5px beige ; } +.titleimg { + border: none ; + height: 150px ; +} strong { color: orange ; } diff --git a/tor.html b/tor.html new file mode 100644 index 0000000..eb7bad9 --- /dev/null +++ b/tor.html @@ -0,0 +1,97 @@ +<!DOCTYPE html> +<html lang=en> + <head> + <title>Mirror your site over Tor</title> + <meta charset="utf-8"/> + <link rel="shortcut icon" href="favicon.ico" type="image/x-icon" /> + <link rel='stylesheet' type='text/css' href='style.css'> + <meta name="viewport" content="width=device-width, initial-scale=1"> + <link rel='alternate' type='application/rss+xml' title='Land Chad RSS' href='/rss.xml'> + </head> +<body> + <header><h1>Mirror Your Site Over Tor</h1></header> + <nav></nav> + <main> + + <img class=titleimg src="pix/tor.svg" alt="Tor logo"> + <p> + Now that you have a website, why not offer it on a private alternative such as the onion network? + </p> + + <h2>Setting up Tor</h2> + + <h3>Installing Tor</h3> + + <p>Firstly we need to add the Tor repos to our system to get the latest version of Tor:</p> + <pre><code>apt install -y apt-transport-https gpg +echo "deb https://deb.torproject.org/torproject.org buster main +deb-src https://deb.torproject.org/torproject.org buster main" > /etc/apt/sources.list.d/tor.list</code></pre> + + <p>Then we need to add the gpg keys to our keyring:</p> + + <pre><code>curl -s https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --import +gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add -</code></pre> + + <p>Now update and install Tor:</p> + + <pre><code>apt update +apt install tor deb.torproject.org-keyring</code></pre> + + <h3>Enabling Tor</h3> + + <p>Next edit the file <code>/etc/tor/torrc</code>, uncommenting the following lines:</p> + <pre><code>HiddenServiceDir /var/lib/tor/hidden_service/ +HiddenServicePort 80 127.0.0.1:80</code></pre> + <aside> + <h4>Optional: Running multiple onion services</h4> + <p>If you want to forward multiple virtual ports for a single onion + service, just add more HiddenServicePort lines (replace the 80 with any unoccupied port). + </p> + <p>If you want to run multiple onion services from the same Tor client, just add another + HiddenServiceDir line.</p> + </aside> + + <p>Now start and enable Tor at boot:</p> + <pre><code> systemctl enable --now tor </code></pre> + + <p>If the next command outputs <q>active</q> in green you're golden!</p> + <pre><code> systemctl status tor</code></pre> + + <p>Now your server is on the dark web. The following command will give you your onion address:</p> + <pre><code> cat /var/lib/tor/hidden_service/hostname</code></pre> + + <h2>Adding the Nginx Config</h2> + <p> + From here, the steps are almost identical to setting up a normal website configuration file. + Follow the steps as if you were making a new website in the webserver + <a href="nginx.html">tutorial</a> up until the server block of code. Instead, paste this: + </p> + + <pre><code> server { + listen 127.0.0.1:80 ; + root /var/www/<strong>landchad</strong> ; + index index.html ; + server_name <strong>your-onion-address</strong>.onion ; + }</code></pre> + + <aside> + <h4>Clarification</h4> + <p>Nginx will listen on port 80 for your <em>server's</em> localhost.</p> + <p>The <code>root</code> line is the path to whichever website of yours you'd like to mirror.</p> + </aside> + <p> + Now we are almost done, all we have to do is enable the site and reload nginx which, is also covered in <a href="nginx.html#enable">the webserver tutorial</a>. + </p> + + <h3>Update regularly!</h3> + + <p>Make sure to update Tor on a regular basis by running:</p> + <pre><code>apt update +apt install tor</code></pre> + + <p><strong>Contributor</strong> - <a href="https://tomfasano.xyz" target="_blank">tomfasano.xyz</a></p> + + </main> + <footer><a href="https://landchad.net">LandChad.net</a></br>Because Everyone should be an Internet LandChad.</br><li><a href="index.html"><img src="pix/chad.gif" alt="chad"></a></li><li><a href="rss.xml"><img src="pix/rss.svg" alt="RSS"></a></li><li><a href="pix/btc.png"><img src="pix/btc.svg" alt="BTC"></a></li><li><a href="pix/xmr.png"><img src="pix/xmr.svg" alt="XMR"></a></li><li><a href="https://github.com/lukesmithxyz/landchad"><img src="pix/git.svg" alt="Github"></a></footer> +</body> +</html> diff --git a/ufw.html b/ufw.html new file mode 100644 index 0000000..b036242 --- /dev/null +++ b/ufw.html @@ -0,0 +1,193 @@ +<!DOCTYPE html> +<html lang=en> + <head> + <title>Using UFW as a Firewall – LandChad.net</title> + <meta charset="utf-8"/> + <link rel="shortcut icon" href="favicon.ico" type="image/x-icon" /> + <link rel='stylesheet' type='text/css' href='style.css'> + <meta name="viewport" content="width=device-width, initial-scale=1"> + <link rel='alternate' type='application/rss+xml' title='Land Chad RSS' href='/rss.xml'> + </head> +<body> + <header><h1>Using UFW as a Firewall</h1></header> + <nav></nav> + <main> + <p> + <strong>Uncomplicated Firewall</strong> (UFW) is a front-facing program for the more involved <code>iptables</code> firewall program installed in most GNU/Linux distributions. + We can use <code>ufw</code> to restrict machines on the internet to only access the services (SSH, websites etc) you want them to, but it can also be used to prevent programs on the computer itself from accesing parts of the internet it shouldn't. + </p> + + <h2 id="how-to-get-it">How to Get It</h2> + + <p>Log into your server by pulling up a terminal and typing:</p> + + <pre><code>ssh root@<strong>example.org</strong></code></pre> + + <p> + This command will attempt to log into your server and run a remote shell. + If you leave the settings default, it should prompt you for your password, and you can just copy or type in the password from Vultr's site. + </p> + + <p> + Some VPS providers automatically install <code>ufw</code>, but if you do not have it installed already, install it in the typical way: + </p> + + <pre><code>apt install ufw</code></pre> + + <h2 id="first-time-setup">First-Time Setup</h2> + + <p>You can check the status of <code>ufw</code> right now by running:</p> + + <pre><code>ufw status</code></pre> + + <p>Without any changes, it should report back <code>Status: inactive</code>. Let's set it up so that only connections to SSH (standardized at port 22) are allowed in, and then enable the firewall:</p> + + <aside> + <strong>Careful!</strong> Enabling <code>ufw</code> without allowing SSH will block you from remoting to your server. + Double-check that you have allowed SSH, and if you have changed the default SSH port, put in <em>that</em> number instead. + </aside> + + <pre><code>ufw default deny incoming # block all incoming connections by default +ufw allow in ssh # or: ufw allow in 22 +ufw enable</code></pre> + + <aside> + <code>ufw</code> has an internal list of protocols applications, and the ports used by them. + In this case, it knwos SSH is on port 22. + We'll go more in detail how to view all protocols <code>ufw</code> knows about. + By default, when you allow an incoming port, it allows that port both on IPv4 and IPv6. + </aside> + + <p> + With the firewall enabled and allowing only SSH in, all other ports are prortected from incoming requests. + To view all your rules, run: + </p> + + <pre><code>ufw status verbose</code></pre> + + <p>A firewall that allows to connect to SSH and their website may look like:</p> + + <pre><code>Status: active +Logging: on (low) +Default: deny (incoming), allow (outgoing), deny (routed) +New profiles: skip + +To Action From +-- ------ ---- +22 (SSH) ALLOW IN Anywhere +80,443/tcp (WWW Full) ALLOW IN Anywhere +22 (SSH (v6)) ALLOW IN Anywhere (v6) +80,443/tcp (WWW Full (v6)) ALLOW IN Anywhere (v6)</code></pre> + + <p>If you want to delete e.g. the 'WWW Full' rule, run:</p> + + <pre><code>ufw delete allow in 'WWW Full' +ufw reload</pre></code> + + <h2 id="enabling-common-services">Enabling Common Services</h2> + + <p> + You have blocked all incoming ports but SSH, which means no outsiders would be able to access other services, like an email server or your website. + You should look at the ports your services are open on and enable them individually. + Here is a list of a few common services: + </p> + + <h3>Opening Port Numbers</h3> + + <p>Suppose you install <a href="gemini.html">a Gemini server</a>, which must broadcast on port 1965. By default <code>ufw</code> blocks all incoming connections on all ports, so whenever you install a new service like this you will have to tell <code>ufw</code> to enable the desired port:</p> + + <pre><code>ufw allow 1985</code></pre> + + <h3>Websites: HTTP and HTTPS</h3> + + <p>HTTP uses port 80 and HTTPS uses port 443. We can enable them like this:</p> + + <pre><code>ufw allow 80 +ufw allow 443</code></pre> + + <p>But <code>ufw</code> additionally knows the typical ports of common serives, so you can also run this:</p> + + <pre><code>ufw allow http +ufw allow https</code></pre> + + <p>And that will do the same thing. There are also other abbreviations for common port lists:</p> + + <pre><code>ufw allow in 'WWW Full'</code></pre> + + + <p>To see these other "apps" that <code>ufw</code> knows by default, run <code>ufw app list</code></p> + + + <h3>Email: IMAP, POP3, and SMTP</h3> + + <pre><code>ufw allow in IMAPS +ufw allow in POP3 +ufw allow in SMTP +ufw allow in 'Postfix SMTPS' +ufw allow in 'Mail Submission'</pre></code> + + <h2 id="fine-tuning-rules">Fine-Tuning Rules</h2> + + <p>Instead of denying all ports by default, you may want to deny (ignores incoming requests) or reject (explicitly tells requests they're not allowed):</p> + + <pre><code>ufw default allow in +ufw deny in <strong>PORT</strong> +ufw reject in <strong>PORT</strong> +ufw reload</code></pre> + + <p>You can add rules to comments to remember what they are there for:</p> + + <pre><code>ufw allow in <strong>PORT</strong> comment 'Secret SSH' +ufw reload +ufw status verbose</code></pre> + + <p>Output:</p> + + <pre><code>To Action From +-- ------ ---- +<strong>PORT</strong> ALLOW IN Anywhere # Secret SSH +<strong>PORT</strong> (v6) ALLOW IN Anywhere (v6) # Secret SSH</pre></code> + + <p>To deny outgoing ports:</p> + + <pre><code>ufw deny out <strong>PORT</strong></code></pre> + + <p>Ratelimiting is useful to protect against brute-force login attacks, like in SSH. Only IPv4 is supported for now. Enable it by running:</p> + + <pre><code>ufw limit <strong>PORT</strong>/tcp</code></pre> + + <p>To blocklist IP addresses:</p> + + <pre><code>ufw deny from <strong>IP_ADDRESS</strong></code></pre> + + <p>To read more what you can do with <code>ufw</code>, run:</p> + + <pre><code>man ufw</code></pre> + + <h2 id="recovering-from-losing-ssh">Recovering SSH</h2> + + <p> + If you have accidentally firewalled yourself from logging on your computer, you can recover access by using your VPS's virtual console. + On Vultr, this is on your VPS's menu. To the right of the server name, It is the leftmost icon that looks like a monitor. + </p> + + <a href="pix/ssh-01.png"><img src="pix/ssh-01.png" alt="View Console"></a> + + <p>Log in through there, and disable ufw by typing:</p> + + <pre><code>ufw disable</code></pre> + + + <h2 id="further-reading">Further Reading</h2> + + <ul> + <li><a href="https://wiki.ubuntu.com/UncomplicatedFirewall">Ubuntu Wiki: UncomplicatedFirewall</a></li> + <li><a href="https://help.ubuntu.com/community/Gufw">Gufw (Graphical UFW)</a></li> + <li><code>man ufw</code></li> + </ul> + + <strong>Contributor</strong> - <a href="https://shunter.xyz">shunter.xyz</a> + </main> + <footer><a href="https://landchad.net">LandChad.net</a></br>Because Everyone should be an Internet LandChad.</br><li><a href="index.html"><img src="pix/chad.gif" alt="chad"></a></li><li><a href="rss.xml"><img src="pix/rss.svg" alt="RSS"></a></li><li><a href="pix/btc.png"><img src="pix/btc.svg" alt="BTC"></a></li><li><a href="pix/xmr.png"><img src="pix/xmr.svg" alt="XMR"></a></li><li><a href="https://github.com/lukesmithxyz/landchad"><img src="pix/git.svg" alt="Github"></a></footer> +</body> +</html> |
