From 02aa3e142d8da7f19ea5afdd9c50277a65a0216e Mon Sep 17 00:00:00 2001 From: Joel Speed Date: Thu, 5 Nov 2020 15:43:33 +0000 Subject: [PATCH] Deploy website - based on ef2628d5b26497fd58981d0ad212c7262098131a --- .nojekyll | 0 0f425520.99c2a351.js | 1 + 1.6bac5299.js | 1 + 16.7939b288.js | 1 + 17.97d991e1.js | 1 + 17896441.66eec2ae.js | 1 + 18.088d12e8.js | 1 + 2.c97238d2.js | 2 + 2.c97238d2.js.LICENSE.txt | 5 ++ 357fe94d.33b065b1.js | 1 + 3b8c55ea.dea53a7c.js | 1 + 404.html | 19 +++++ 585bdad0.bcb2d213.js | 1 + 935f2afb.93f76895.js | 1 + 94285305.635f72c5.js | 1 + 9f61b932.291b2502.js | 1 + ...cture-08b382c30c02b227fa4c86cb158b600e.png | Bin 0 -> 23502 bytes ...-page-947a0ef7ee9fb0aa2b7179b8c7a1cc76.png | Bin 0 -> 34914 bytes b5649f1e.525e7c04.js | 1 + docs/behaviour/index.html | 33 +++++++++ docs/configuration/oauth_provider/index.html | 68 ++++++++++++++++++ docs/configuration/overview/index.html | 52 ++++++++++++++ docs/configuration/session_storage/index.html | 48 +++++++++++++ docs/configuration/tls/index.html | 39 ++++++++++ docs/features/endpoints/index.html | 33 +++++++++ docs/features/request_signatures/index.html | 40 +++++++++++ docs/index.html | 33 +++++++++ efc9be4b.f8ffd2b0.js | 1 + f3976560.46f00387.js | 1 + img/architecture.png | Bin 0 -> 23502 bytes img/logos/OAuth2_Proxy_horizontal.png | Bin 0 -> 110827 bytes img/logos/OAuth2_Proxy_horizontal.svg | 1 + img/logos/OAuth2_Proxy_icon.png | Bin 0 -> 47842 bytes img/logos/OAuth2_Proxy_icon.svg | 1 + img/logos/OAuth2_Proxy_vertical.png | Bin 0 -> 56575 bytes img/logos/OAuth2_Proxy_vertical.svg | 1 + img/sign-in-page.png | Bin 0 -> 34914 bytes index.html | 30 ++++++++ main.08dca9ee.js | 2 + main.08dca9ee.js.LICENSE.txt | 44 ++++++++++++ runtime~main.1fddb884.js | 1 + sitemap.xml | 1 + styles.1b985414.js | 1 + styles.29b02411.css | 1 + 44 files changed, 470 insertions(+) create mode 100644 .nojekyll create mode 100644 0f425520.99c2a351.js create mode 100644 1.6bac5299.js create mode 100644 16.7939b288.js create mode 100644 17.97d991e1.js create mode 100644 17896441.66eec2ae.js create mode 100644 18.088d12e8.js create mode 100644 2.c97238d2.js create mode 100644 2.c97238d2.js.LICENSE.txt create mode 100644 357fe94d.33b065b1.js create mode 100644 3b8c55ea.dea53a7c.js create mode 100644 404.html create mode 100644 585bdad0.bcb2d213.js create mode 100644 935f2afb.93f76895.js create mode 100644 94285305.635f72c5.js create mode 100644 9f61b932.291b2502.js create mode 100644 assets/images/architecture-08b382c30c02b227fa4c86cb158b600e.png create mode 100644 assets/images/sign-in-page-947a0ef7ee9fb0aa2b7179b8c7a1cc76.png create mode 100644 b5649f1e.525e7c04.js create mode 100644 docs/behaviour/index.html create mode 100644 docs/configuration/oauth_provider/index.html create mode 100644 docs/configuration/overview/index.html create mode 100644 docs/configuration/session_storage/index.html create mode 100644 docs/configuration/tls/index.html create mode 100644 docs/features/endpoints/index.html create mode 100644 docs/features/request_signatures/index.html create mode 100644 docs/index.html create mode 100644 efc9be4b.f8ffd2b0.js create mode 100644 f3976560.46f00387.js create mode 100644 img/architecture.png create mode 100644 img/logos/OAuth2_Proxy_horizontal.png create mode 100644 img/logos/OAuth2_Proxy_horizontal.svg create mode 100644 img/logos/OAuth2_Proxy_icon.png create mode 100644 img/logos/OAuth2_Proxy_icon.svg create mode 100644 img/logos/OAuth2_Proxy_vertical.png create mode 100644 img/logos/OAuth2_Proxy_vertical.svg create mode 100644 img/sign-in-page.png create mode 100644 index.html create mode 100644 main.08dca9ee.js create mode 100644 main.08dca9ee.js.LICENSE.txt create mode 100644 runtime~main.1fddb884.js create mode 100644 sitemap.xml create mode 100644 styles.1b985414.js create mode 100644 styles.29b02411.css diff --git a/.nojekyll b/.nojekyll new file mode 100644 index 00000000..e69de29b diff --git a/0f425520.99c2a351.js b/0f425520.99c2a351.js new file mode 100644 index 00000000..6e0990f7 --- /dev/null +++ b/0f425520.99c2a351.js @@ -0,0 +1 @@ +(window.webpackJsonp=window.webpackJsonp||[]).push([[3],{57:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return l})),a.d(t,"metadata",(function(){return i})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),b=(a(0),a(73)),l={id:"overview",title:"Overview"},i={unversionedId:"configuration/overview",id:"configuration/overview",isDocsHomePage:!1,title:"Overview",description:"oauth2-proxy can be configured via config file, command line options or environment variables.",source:"@site/docs/configuration/overview.md",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/configuration/overview",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/overview.md",version:"current",sidebar:"docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/configuration/oauth_provider"}},c=[{value:"Config File",id:"config-file",children:[]},{value:"Command Line Options",id:"command-line-options",children:[]},{value:"Upstreams Configuration",id:"upstreams-configuration",children:[]},{value:"Environment variables",id:"environment-variables",children:[]},{value:"Logging Configuration",id:"logging-configuration",children:[{value:"Auth Log Format",id:"auth-log-format",children:[]},{value:"Request Log Format",id:"request-log-format",children:[]},{value:"Standard Log Format",id:"standard-log-format",children:[]}]},{value:"Configuring for use with the Nginx auth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",children:[]}],o={rightToc:c};function d(e){var t=e.components,a=Object(r.a)(e,["components"]);return Object(b.b)("wrapper",Object(n.a)({},o,a,{components:t,mdxType:"MDXLayout"}),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),", ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#command-line-options"}),"command line options")," or ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#environment-variables"}),"environment variables"),"."),Object(b.b)("p",null,"To generate a strong cookie secret use ",Object(b.b)("inlineCode",{parentName:"p"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'")),Object(b.b)("h3",{id:"config-file"},"Config File"),Object(b.b)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),Object(b.b)("p",null,"An example ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"}),"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",Object(b.b)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),Object(b.b)("h3",{id:"command-line-options"},"Command Line Options"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Option"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Type"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Default"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--acr-values")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"optional, see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"}),"docs")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--approval-prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth approval_prompt"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"force"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log authentication attempts"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--auth-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for authentication log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate against emails via file (one per line)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--azure-tenant")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"go to a tenant-specific or common (tenant-independent) endpoint."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"common"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--basic-auth-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the password to set when passing the HTTP Basic Auth header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-id")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client ID, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--client-secret-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the file with OAuth Client Secret"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--config")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to config file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Optional cookie domains to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-expire")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"expire timeframe for cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"168h0m0s")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-httponly")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HttpOnly cookie flag"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the name of the cookie that the oauth_proxy creates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"an optional cookie path to force cookies to (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"/poc/"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-refresh")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"refresh the cookie after this duration; ",Object(b.b)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote1"}),"1"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secret")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the seed string for secure cookies (optionally base64 encoded)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-secure")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://owasp.org/www-community/controls/SecureFlag"}),"secure (HTTPS only) cookie flag")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--cookie-samesite")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set SameSite cookie attribute (",Object(b.b)("inlineCode",{parentName:"td"},'"lax"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"strict"'),", ",Object(b.b)("inlineCode",{parentName:"td"},'"none"'),", or ",Object(b.b)("inlineCode",{parentName:"td"},'""'),")."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--custom-templates-dir")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to custom html templates"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"display username / password login form if an htpasswd file is provided"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--email-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"authenticate emails with the specified domain (may be given multiple times). Use ",Object(b.b)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--errors-to-info-log")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"redirects error-level logging to default log channel instead of stderr"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"if ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",Object(b.b)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",Object(b.b)("inlineCode",{parentName:"td"},"iss"),", ",Object(b.b)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",Object(b.b)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--exclude-logging-paths")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"comma separated list of paths to exclude from logging, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"/ping,/path2"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--flush-interval")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"duration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"period between flushing response buffers when streaming responses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"1s"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--force-https")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enforce https redirect"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"false"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--banner")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) banner string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--footer")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"custom (html) footer string. Use ",Object(b.b)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gcp-healthchecks")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will enable ",Object(b.b)("inlineCode",{parentName:"td"},"/liveness_check"),", ",Object(b.b)("inlineCode",{parentName:"td"},"/readiness_check"),", and ",Object(b.b)("inlineCode",{parentName:"td"},"/")," (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-org")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this organisation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-team")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these teams (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to collaborators of this repository formatted as ",Object(b.b)("inlineCode",{parentName:"td"},"orgname/repo")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the token to use when verifying repository collaborators (must have push access to the repository)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--github-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--gitlab-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of any of these groups (slug), separated by a comma"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-admin-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the google admin to impersonate for api calls"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this google group (may be given multiple times)."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--google-service-account-json")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the path to the service account json credentials"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--htpasswd-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"additionally authenticate against a htpasswd file. Entries must be created with ",Object(b.b)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--http-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"[http://]:")," or ",Object(b.b)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--https-address")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},":")," to listen on for HTTPS clients"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'":443"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-compress")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Should rotated log files be compressed using gzip"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-filename")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File to log requests to, empty for ",Object(b.b)("inlineCode",{parentName:"td"},"stdout")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (stdout)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-local-time")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Use local time in log files and backup filenames instead of UTC"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true (local time)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-age")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of days to retain old log files"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"7")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-backups")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum number of old log files to retain; 0 to disable"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--logging-max-size")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"int"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Maximum size in megabytes of the log file before rotation"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"100")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"private key in PEM format used to sign JWT, so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to the private key file in PEM format used to sign the JWT so that you can say something like ",Object(b.b)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--login-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authentication endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"don't fail if an email address in an id_token is not verified"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OpenID Connect issuer URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which claim contains the user groups"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"groups"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass OIDC IDToken to upstream via Authorization Bearer header"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-host-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass the request Host Header to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pass-user-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--profile-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Profile access endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--prompt")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"}),"OIDC prompt"),"; if present, ",Object(b.b)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth provider"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"google")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-ca-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--provider-display-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Override the provider's name with the given string; used for the sign-in page"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(depends on provider)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-path")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the ping endpoint that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/ping"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ping-user-agent")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"a User-Agent that can be used for basic health checks"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-prefix")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the url root path that this proxy should be nested under (e.g. /",Object(b.b)("inlineCode",{parentName:"td"},"/sign_in"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},'"/oauth2"'))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--proxy-websockets")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"enables WebSocket proxying"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--pubjwk-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"JWK pubkey access endpoint: required by login.gov"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Header used to determine the real IP of the client, requires ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"X-Real-IP")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Token redemption endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redirect-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the OAuth Redirect URL, e.g. ",Object(b.b)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis cluster connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"URL of redis server for redis session storage (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis password. Applicable for all Redis configurations. Will override any password set in ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-connection-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-password")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Redis sentinel master name. Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"List of Redis sentinel connection URLs (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-cluster")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis cluster. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Connect to redis via sentinels. Must set ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--request-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for request log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--resource")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The resource that is protected (Azure AD only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--scope")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"OAuth scope specification"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--session-store-type")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"/oauth2-proxy/docs/configuration/session_storage"}),"Session data storage backend"),"; redis or cookie"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"cookie")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-xauthrequest")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",Object(b.b)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-authorization-header")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set Authorization Bearer response header (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--set-basic-auth")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--signature-key")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GAP-Signature request signature key (algorithm:secretkey)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--silence-ping-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"disable logging of requests to ping endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip authentication for OPTIONS requests"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"(DEPRECATED for ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"strips ",Object(b.b)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",Object(b.b)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy for allowlisted requests (",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-route"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-regex"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--skip-auth-preflight"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--trusted-ip"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip requests that have verified JWT bearer tokens (the token must have ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"}),Object(b.b)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",Object(b.b)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bypass OIDC endpoint discovery. ",Object(b.b)("inlineCode",{parentName:"td"},"--login-url"),", ",Object(b.b)("inlineCode",{parentName:"td"},"--redeem-url")," and ",Object(b.b)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--skip-provider-button")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"will skip sign-in-page to directly reach the next step: oauth/start"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS providers"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"skip validation of certificates presented when using HTTPS upstreams"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"false")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"bool"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Log standard runtime information"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"true")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--standard-logging-format")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Template for standard log lines"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"see ",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#logging-configuration"}),"Logging Configuration"))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-cert-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to certificate file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--tls-key-file")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"path to private key file"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--upstream")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"the http url(s) of the upstream endpoint, file:// paths for static files or ",Object(b.b)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--user-id-claim")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"which claim contains the user ID"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"[",'"email"',"]")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--allowed-group")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"restrict logins to members of this group (may be given multiple times)"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--validate-url")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Access token validation endpoint"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--version")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"n/a"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"print version string"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--whitelist-domain")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"allowed domains for redirection after authentication. Prefix domain with a ",Object(b.b)("inlineCode",{parentName:"td"},".")," to allow subdomains (e.g. ",Object(b.b)("inlineCode",{parentName:"td"},".example.com"),")","\xa0","[",Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"#footnote2"}),"2"),"]"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("inlineCode",{parentName:"td"},"--trusted-ip")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"string ","|"," list"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",Object(b.b)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",Object(b.b)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}))))),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),Object(b.b)("p",null,"[",Object(b.b)("a",{name:"footnote2"},"2"),"]",": When using the ",Object(b.b)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",Object(b.b)("inlineCode",{parentName:"p"},".")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",Object(b.b)("inlineCode",{parentName:"p"},"*"),": ",Object(b.b)("inlineCode",{parentName:"p"},"example.com:*"),"."),Object(b.b)("p",null,"See below for provider specific options"),Object(b.b)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),Object(b.b)("p",null,Object(b.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",Object(b.b)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",Object(b.b)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),Object(b.b)("p",null,"Static file paths are configured as a file:// URL. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",Object(b.b)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",Object(b.b)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",Object(b.b)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),Object(b.b)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",Object(b.b)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"#config-file"}),"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),Object(b.b)("h3",{id:"environment-variables"},"Environment variables"),Object(b.b)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",Object(b.b)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",Object(b.b)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",Object(b.b)("inlineCode",{parentName:"p"},"S"),")."),Object(b.b)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),Object(b.b)("p",null,"For example, the ",Object(b.b)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",Object(b.b)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",Object(b.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),Object(b.b)("h2",{id:"logging-configuration"},"Logging Configuration"),Object(b.b)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",Object(b.b)("inlineCode",{parentName:"p"},"--logging-filename")," command."),Object(b.b)("p",null,"If logging to a file you can also configure the maximum file size (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",Object(b.b)("inlineCode",{parentName:"p"},"--logging-compress"),")."),Object(b.b)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging"),", ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging"),"."),Object(b.b)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),Object(b.b)("p",null,"Logging of requests to the ",Object(b.b)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-user-agent"),") can be disabled with ",Object(b.b)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume. This flag appends the ",Object(b.b)("inlineCode",{parentName:"p"},"--ping-path")," to ",Object(b.b)("inlineCode",{parentName:"p"},"--exclude-logging-paths"),"."),Object(b.b)("h3",{id:"auth-log-format"},"Auth Log Format"),Object(b.b)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{})," - [19/Mar/2015:17:20:19 -0400] [] \n")),Object(b.b)("p",null,"The status block will contain one of the below strings:"),Object(b.b)("ul",null,Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),Object(b.b)("li",{parentName:"ul"},Object(b.b)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for auth logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Status"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"AuthSuccess"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The status of the auth request. See above for details.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Authenticated via OAuth2"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the auth attempt.")))),Object(b.b)("h3",{id:"request-log-format"},"Request Log Format"),Object(b.b)("p",null,"HTTP request logs will output by default in the below format:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),' - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),Object(b.b)("p",null,"Available variables for request logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Client"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"74.125.224.72"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Host"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"domain.com"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The value of the Host header.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Protocol"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP/1.0"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request protocol.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestDuration"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"0.001"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The time in seconds that a request took to process.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestMethod"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"GET"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The request method.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"RequestURI"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),'"/oauth2/auth"'),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The URI path of the request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"ResponseSize"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"12"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The size in bytes of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"StatusCode"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"200"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The HTTP status code of the response.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Upstream"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The upstream data of the HTTP request.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"UserAgent"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"-"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The full user agent as reported by the requesting client.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Username"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),Object(b.b)("a",Object(n.a)({parentName:"td"},{href:"mailto:username@email.com"}),"username@email.com")),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The email or username of the auth request.")))),Object(b.b)("h3",{id:"standard-log-format"},"Standard Log Format"),Object(b.b)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),Object(b.b)("p",null,"If you require a different format than that, you can configure it with the ",Object(b.b)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{}),"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),Object(b.b)("p",null,"Available variables for standard logging:"),Object(b.b)("table",null,Object(b.b)("thead",{parentName:"table"},Object(b.b)("tr",{parentName:"thead"},Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Variable"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Example"),Object(b.b)("th",Object(n.a)({parentName:"tr"},{align:null}),"Description"))),Object(b.b)("tbody",{parentName:"table"},Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Timestamp"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"19/Mar/2015:17:20:19 -0400"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The date and time of the logging event.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"File"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"main.go:40"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The file and line number of the logging statement.")),Object(b.b)("tr",{parentName:"tbody"},Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"Message"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"HTTP: listening on 127.0.0.1:4180"),Object(b.b)("td",Object(n.a)({parentName:"tr"},{align:null}),"The details of the log statement.")))),Object(b.b)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",Object(b.b)("inlineCode",{parentName:"h2"},"auth_request")," directive"),Object(b.b)("p",null,"The ",Object(b.b)("a",Object(n.a)({parentName:"p"},{href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"}),"Nginx ",Object(b.b)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",Object(b.b)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-nginx"}),'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),Object(b.b)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",Object(b.b)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",Object(b.b)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",Object(b.b)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",Object(b.b)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",Object(b.b)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",Object(b.b)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),Object(b.b)("pre",null,Object(b.b)("code",Object(n.a)({parentName:"pre"},{className:"language-yaml"}),'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),Object(b.b)("p",null,"It is recommended to use ",Object(b.b)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",Object(b.b)("em",{parentName:"p"},"e.g.")," with MS Azure)."),Object(b.b)("p",null,"You have to substitute ",Object(b.b)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),Object(b.b)("div",{className:"admonition admonition-note alert alert--secondary"},Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-heading"}),Object(b.b)("h5",{parentName:"div"},Object(b.b)("span",Object(n.a)({parentName:"h5"},{className:"admonition-icon"}),Object(b.b)("svg",Object(n.a)({parentName:"span"},{xmlns:"http://www.w3.org/2000/svg",width:"14",height:"16",viewBox:"0 0 14 16"}),Object(b.b)("path",Object(n.a)({parentName:"svg"},{fillRule:"evenodd",d:"M6.3 5.69a.942.942 0 0 1-.28-.7c0-.28.09-.52.28-.7.19-.18.42-.28.7-.28.28 0 .52.09.7.28.18.19.28.42.28.7 0 .28-.09.52-.28.7a1 1 0 0 1-.7.3c-.28 0-.52-.11-.7-.3zM8 7.99c-.02-.25-.11-.48-.31-.69-.2-.19-.42-.3-.69-.31H6c-.27.02-.48.13-.69.31-.2.2-.3.44-.31.69h1v3c.02.27.11.5.31.69.2.2.42.31.69.31h1c.27 0 .48-.11.69-.31.2-.19.3-.42.31-.69H8V7.98v.01zM7 2.3c-3.14 0-5.7 2.54-5.7 5.68 0 3.14 2.56 5.7 5.7 5.7s5.7-2.55 5.7-5.7c0-3.15-2.56-5.69-5.7-5.69v.01zM7 .98c3.86 0 7 3.14 7 7s-3.14 7-7 7-7-3.12-7-7 3.14-7 7-7z"})))),"note")),Object(b.b)("div",Object(n.a)({parentName:"div"},{className:"admonition-content"}),Object(b.b)("p",{parentName:"div"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",Object(b.b)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated."))))}d.isMDXComponent=!0},73:function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return m}));var n=a(0),r=a.n(n);function b(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function l(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,n)}return a}function i(e){for(var t=1;t=0||(r[a]=e[a]);return r}(e,t);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(r[a]=e[a])}return r}var o=r.a.createContext({}),d=function(e){var t=r.a.useContext(o),a=t;return e&&(a="function"==typeof e?e(t):i(i({},t),e)),a},p=function(e){var t=d(e.components);return r.a.createElement(o.Provider,{value:t},e.children)},O={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},j=r.a.forwardRef((function(e,t){var a=e.components,n=e.mdxType,b=e.originalType,l=e.parentName,o=c(e,["components","mdxType","originalType","parentName"]),p=d(a),j=n,m=p["".concat(l,".").concat(j)]||p[j]||O[j]||b;return a?r.a.createElement(m,i(i({ref:t},o),{},{components:a})):r.a.createElement(m,i({ref:t},o))}));function m(e,t){var a=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var b=a.length,l=new Array(b);l[0]=j;var i={};for(var c in t)hasOwnProperty.call(t,c)&&(i[c]=t[c]);i.originalType=e,i.mdxType="string"==typeof e?e:n,l[1]=i;for(var o=2;o=0||Object.prototype.hasOwnProperty.call(e,r)&&(n[r]=e[r]);return n},z=function(e,t){if(!e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!t||"object"!=typeof t&&"function"!=typeof t?e:t},K=function(e){var t=!(arguments.length>1&&void 0!==arguments[1])||arguments[1];return!1===t?String(e):String(e).replace(/&/g,"&").replace(//g,">").replace(/"/g,""").replace(/'/g,"'")},J=function(e){var t=Z(e,w.TITLE),n=Z(e,R);if(n&&t)return n.replace(/%s/g,(function(){return Array.isArray(t)?t.join(""):t}));var r=Z(e,I);return t||r||void 0},$=function(e){return Z(e,M)||function(){}},G=function(e,t){return t.filter((function(t){return void 0!==t[e]})).map((function(t){return t[e]})).reduce((function(e,t){return Y({},e,t)}),{})},Q=function(e,t){return t.filter((function(e){return void 0!==e[w.BASE]})).map((function(e){return e[w.BASE]})).reverse().reduce((function(t,n){if(!t.length)for(var r=Object.keys(n),o=0;o=0;n--){var r=e[n];if(r.hasOwnProperty(t))return r[t]}return null},ee=(r=Date.now(),function(e){var t=Date.now();t-r>16?(r=t,e(t)):setTimeout((function(){ee(e)}),0)}),te=function(e){return clearTimeout(e)},ne="undefined"!=typeof window?window.requestAnimationFrame&&window.requestAnimationFrame.bind(window)||window.webkitRequestAnimationFrame||window.mozRequestAnimationFrame||ee:e.requestAnimationFrame||ee,re="undefined"!=typeof window?window.cancelAnimationFrame||window.webkitCancelAnimationFrame||window.mozCancelAnimationFrame||te:e.cancelAnimationFrame||te,oe=function(e){return console&&"function"==typeof console.warn&&console.warn(e)},ie=null,ae=function(e,t){var n=e.baseTag,r=e.bodyAttributes,o=e.htmlAttributes,i=e.linkTags,a=e.metaTags,u=e.noscriptTags,c=e.onChangeClientState,s=e.scriptTags,f=e.styleTags,l=e.title,d=e.titleAttributes;se(w.BODY,r),se(w.HTML,o),ce(l,d);var p={baseTag:fe(w.BASE,n),linkTags:fe(w.LINK,i),metaTags:fe(w.META,a),noscriptTags:fe(w.NOSCRIPT,u),scriptTags:fe(w.SCRIPT,s),styleTags:fe(w.STYLE,f)},v={},h={};Object.keys(p).forEach((function(e){var t=p[e],n=t.newTags,r=t.oldTags;n.length&&(v[e]=n),r.length&&(h[e]=p[e].oldTags)})),t&&t(),c(e,v,h)},ue=function(e){return Array.isArray(e)?e.join(""):e},ce=function(e,t){void 0!==e&&document.title!==e&&(document.title=ue(e)),se(w.TITLE,t)},se=function(e,t){var n=document.getElementsByTagName(e)[0];if(n){for(var r=n.getAttribute(H),o=r?r.split(","):[],i=[].concat(o),a=Object.keys(t),u=0;u=0;l--)n.removeAttribute(i[l]);o.length===i.length?n.removeAttribute(H):n.getAttribute(H)!==a.join(",")&&n.setAttribute(H,a.join(","))}},fe=function(e,t){var n=document.head||document.querySelector(w.HEAD),r=n.querySelectorAll(e+"["+"data-react-helmet]"),o=Array.prototype.slice.call(r),i=[],a=void 0;return t&&t.length&&t.forEach((function(t){var n=document.createElement(e);for(var r in t)if(t.hasOwnProperty(r))if(r===j)n.innerHTML=t.innerHTML;else if(r===O)n.styleSheet?n.styleSheet.cssText=t.cssText:n.appendChild(document.createTextNode(t.cssText));else{var u=void 0===t[r]?"":t[r];n.setAttribute(r,u)}n.setAttribute(H,"true"),o.some((function(e,t){return a=t,n.isEqualNode(e)}))?o.splice(a,1):i.push(n)})),o.forEach((function(e){return e.parentNode.removeChild(e)})),i.forEach((function(e){return n.appendChild(e)})),{oldTags:o,newTags:i}},le=function(e){return Object.keys(e).reduce((function(t,n){var r=void 0!==e[n]?n+'="'+e[n]+'"':""+n;return t?t+" "+r:r}),"")},de=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};return Object.keys(e).reduce((function(t,n){return t[k[n]||n]=e[n],t}),t)},pe=function(e,t,n){switch(e){case w.TITLE:return{toComponent:function(){return e=t.title,n=t.titleAttributes,(r={key:e})[H]=!0,o=de(n,r),[v.a.createElement(w.TITLE,o,e)];var e,n,r,o},toString:function(){return function(e,t,n,r){var o=le(n),i=ue(t);return o?"<"+e+' data-react-helmet="true" '+o+">"+K(i,r)+"":"<"+e+' data-react-helmet="true">'+K(i,r)+""}(e,t.title,t.titleAttributes,n)}};case g:case y:return{toComponent:function(){return de(t)},toString:function(){return le(t)}};default:return{toComponent:function(){return function(e,t){return t.map((function(t,n){var r,o=((r={key:n})[H]=!0,r);return Object.keys(t).forEach((function(e){var n=k[e]||e;if(n===j||n===O){var r=t.innerHTML||t.cssText;o.dangerouslySetInnerHTML={__html:r}}else o[n]=t[e]})),v.a.createElement(e,o)}))}(e,t)},toString:function(){return function(e,t,n){return t.reduce((function(t,r){var o=Object.keys(r).filter((function(e){return!(e===j||e===O)})).reduce((function(e,t){var o=void 0===r[t]?t:t+'="'+K(r[t],n)+'"';return e?e+" "+o:o}),""),i=r.innerHTML||r.cssText||"",a=-1===B.indexOf(e);return t+"<"+e+' data-react-helmet="true" '+o+(a?"/>":">"+i+"")}),"")}(e,t,n)}}}},ve=function(e){var t=e.baseTag,n=e.bodyAttributes,r=e.encode,o=e.htmlAttributes,i=e.linkTags,a=e.metaTags,u=e.noscriptTags,c=e.scriptTags,s=e.styleTags,f=e.title,l=void 0===f?"":f,d=e.titleAttributes;return{base:pe(w.BASE,t,r),bodyAttributes:pe(g,n,r),htmlAttributes:pe(y,o,r),link:pe(w.LINK,i,r),meta:pe(w.META,a,r),noscript:pe(w.NOSCRIPT,u,r),script:pe(w.SCRIPT,c,r),style:pe(w.STYLE,s,r),title:pe(w.TITLE,{title:l,titleAttributes:d},r)}},he=f()((function(e){return{baseTag:Q([A,x],e),bodyAttributes:G(g,e),defer:Z(e,V),encode:Z(e,N),htmlAttributes:G(y,e),linkTags:X(w.LINK,[D,A],e),metaTags:X(w.META,[S,T,C,P,E],e),noscriptTags:X(w.NOSCRIPT,[j],e),onChangeClientState:$(e),scriptTags:X(w.SCRIPT,[L,j],e),styleTags:X(w.STYLE,[O],e),title:J(e),titleAttributes:G(m,e)}}),(function(e){ie&&re(ie),e.defer?ie=ne((function(){ae(e,(function(){ie=null}))})):(ae(e),ie=null)}),ve)((function(){return null})),be=(o=he,a=i=function(e){function t(){return q(this,t),z(this,e.apply(this,arguments))}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Super expression must either be null or a function, not "+typeof t);e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,enumerable:!1,writable:!0,configurable:!0}}),t&&(Object.setPrototypeOf?Object.setPrototypeOf(e,t):e.__proto__=t)}(t,e),t.prototype.shouldComponentUpdate=function(e){return!d()(this.props,e)},t.prototype.mapNestedChildrenToProps=function(e,t){if(!t)return null;switch(e.type){case w.SCRIPT:case w.NOSCRIPT:return{innerHTML:t};case w.STYLE:return{cssText:t}}throw new Error("<"+e.type+" /> elements are self-closing and can not contain children. Refer to our API for more information.")},t.prototype.flattenArrayTypeChildren=function(e){var t,n=e.child,r=e.arrayTypeChildren,o=e.newChildProps,i=e.nestedChildren;return Y({},r,((t={})[n.type]=[].concat(r[n.type]||[],[Y({},o,this.mapNestedChildrenToProps(n,i))]),t))},t.prototype.mapObjectTypeChildren=function(e){var t,n,r=e.child,o=e.newProps,i=e.newChildProps,a=e.nestedChildren;switch(r.type){case w.TITLE:return Y({},o,((t={})[r.type]=a,t.titleAttributes=Y({},i),t));case w.BODY:return Y({},o,{bodyAttributes:Y({},i)});case w.HTML:return Y({},o,{htmlAttributes:Y({},i)})}return Y({},o,((n={})[r.type]=Y({},i),n))},t.prototype.mapArrayTypeChildrenToProps=function(e,t){var n=Y({},t);return Object.keys(e).forEach((function(t){var r;n=Y({},n,((r={})[t]=e[t],r))})),n},t.prototype.warnOnInvalidChildren=function(e,t){return!0},t.prototype.mapChildrenToProps=function(e,t){var n=this,r={};return v.a.Children.forEach(e,(function(e){if(e&&e.props){var o=e.props,i=o.children,a=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};return Object.keys(e).reduce((function(t,n){return t[_[n]||n]=e[n],t}),t)}(W(o,["children"]));switch(n.warnOnInvalidChildren(e,i),e.type){case w.LINK:case w.META:case w.NOSCRIPT:case w.SCRIPT:case w.STYLE:r=n.flattenArrayTypeChildren({child:e,arrayTypeChildren:r,newChildProps:a,nestedChildren:i});break;default:t=n.mapObjectTypeChildren({child:e,newProps:t,newChildProps:a,nestedChildren:i})}}})),t=this.mapArrayTypeChildrenToProps(r,t)},t.prototype.render=function(){var e=this.props,t=e.children,n=W(e,["children"]),r=Y({},n);return t&&(r=this.mapChildrenToProps(t,r)),v.a.createElement(o,r)},F(t,null,[{key:"canUseDOM",set:function(e){o.canUseDOM=e}}]),t}(v.a.Component),i.propTypes={base:c.a.object,bodyAttributes:c.a.object,children:c.a.oneOfType([c.a.arrayOf(c.a.node),c.a.node]),defaultTitle:c.a.string,defer:c.a.bool,encodeSpecialCharacters:c.a.bool,htmlAttributes:c.a.object,link:c.a.arrayOf(c.a.object),meta:c.a.arrayOf(c.a.object),noscript:c.a.arrayOf(c.a.object),onChangeClientState:c.a.func,script:c.a.arrayOf(c.a.object),style:c.a.arrayOf(c.a.object),title:c.a.string,titleAttributes:c.a.object,titleTemplate:c.a.string},i.defaultProps={defer:!0,encodeSpecialCharacters:!0},i.peek=o.peek,i.rewind=function(){var e=o.rewind();return e||(e=ve({baseTag:[],bodyAttributes:{},encodeSpecialCharacters:!0,htmlAttributes:{},linkTags:[],metaTags:[],noscriptTags:[],scriptTags:[],styleTags:[],title:"",titleAttributes:{}})),e},a);be.renderStatic=be.rewind}).call(this,n(29))},114:function(e,t,n){"use strict";var r,o=n(0),i=(r=o)&&"object"==typeof r&&"default"in r?r.default:r;function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var u=!("undefined"==typeof window||!window.document||!window.document.createElement);e.exports=function(e,t,n){if("function"!=typeof e)throw new Error("Expected reducePropsToState to be a function.");if("function"!=typeof t)throw new Error("Expected handleStateChangeOnClient to be a function.");if(void 0!==n&&"function"!=typeof n)throw new Error("Expected mapStateOnServer to either be undefined or a function.");return function(r){if("function"!=typeof r)throw new Error("Expected WrappedComponent to be a React component.");var c,s=[];function f(){c=e(s.map((function(e){return e.props}))),l.canUseDOM?t(c):n&&(c=n(c))}var l=function(e){var t,n;function o(){return e.apply(this,arguments)||this}n=e,(t=o).prototype=Object.create(n.prototype),t.prototype.constructor=t,t.__proto__=n,o.peek=function(){return c},o.rewind=function(){if(o.canUseDOM)throw new Error("You may only call rewind() on the server. Call peek() to read the current state.");var e=c;return c=void 0,s=[],e};var a=o.prototype;return a.UNSAFE_componentWillMount=function(){s.push(this),f()},a.componentDidUpdate=function(){f()},a.componentWillUnmount=function(){var e=s.indexOf(this);s.splice(e,1),f()},a.render=function(){return i.createElement(r,this.props)},o}(o.PureComponent);return a(l,"displayName","SideEffect("+function(e){return e.displayName||e.name||"Component"}(r)+")"),a(l,"canUseDOM",u),l}}},115:function(e,t){var n="undefined"!=typeof Element,r="function"==typeof Map,o="function"==typeof Set,i="function"==typeof ArrayBuffer&&!!ArrayBuffer.isView;function a(e,t){if(e===t)return!0;if(e&&t&&"object"==typeof e&&"object"==typeof t){if(e.constructor!==t.constructor)return!1;var u,c,s,f;if(Array.isArray(e)){if((u=e.length)!=t.length)return!1;for(c=u;0!=c--;)if(!a(e[c],t[c]))return!1;return!0}if(r&&e instanceof Map&&t instanceof Map){if(e.size!==t.size)return!1;for(f=e.entries();!(c=f.next()).done;)if(!t.has(c.value[0]))return!1;for(f=e.entries();!(c=f.next()).done;)if(!a(c.value[1],t.get(c.value[0])))return!1;return!0}if(o&&e instanceof Set&&t instanceof Set){if(e.size!==t.size)return!1;for(f=e.entries();!(c=f.next()).done;)if(!t.has(c.value[0]))return!1;return!0}if(i&&ArrayBuffer.isView(e)&&ArrayBuffer.isView(t)){if((u=e.length)!=t.length)return!1;for(c=u;0!=c--;)if(e[c]!==t[c])return!1;return!0}if(e.constructor===RegExp)return e.source===t.source&&e.flags===t.flags;if(e.valueOf!==Object.prototype.valueOf)return e.valueOf()===t.valueOf();if(e.toString!==Object.prototype.toString)return e.toString()===t.toString();if((u=(s=Object.keys(e)).length)!==Object.keys(t).length)return!1;for(c=u;0!=c--;)if(!Object.prototype.hasOwnProperty.call(t,s[c]))return!1;if(n&&e instanceof Element)return!1;for(c=u;0!=c--;)if(("_owner"!==s[c]&&"__v"!==s[c]&&"__o"!==s[c]||!e.$$typeof)&&!a(e[s[c]],t[s[c]]))return!1;return!0}return e!=e&&t!=t}e.exports=function(e,t){try{return a(e,t)}catch(n){if((n.message||"").match(/stack|recursion/i))return console.warn("react-fast-compare cannot handle circular refs"),!1;throw n}}},74:function(e,t,n){"use strict";n.d(t,"a",(function(){return o}));var r=n(76);function o(){return Object(r.a)().siteConfig.themeConfig}},75:function(e,t,n){"use strict";function r(e){var t,n,o="";if("string"==typeof e||"number"==typeof e)o+=e;else if("object"==typeof e)if(Array.isArray(e))for(t=0;t0)&&(l.unobserve(t),l.disconnect(),n())}))}))).observe(t))},to:C||""},d&&{isActive:b,activeClassName:h}))}},79:function(e,t,n){"use strict";n.d(t,"b",(function(){return i})),n.d(t,"a",(function(){return a}));var r=n(76),o=n(81);function i(){var e=Object(r.a)().siteConfig,t=(e=void 0===e?{}:e).baseUrl,n=void 0===t?"/":t,i=e.url;return{withBaseUrl:function(e,t){return function(e,t,n,r){var i=void 0===r?{}:r,a=i.forcePrependBaseUrl,u=void 0!==a&&a,c=i.absolute,s=void 0!==c&&c;if(!n)return n;if(n.startsWith("#"))return n;if(Object(o.b)(n))return n;if(u)return t+n;var f=n.startsWith(t)?n:t+n.replace(/^\//,"");return s?e+f:f}(i,n,e,t)}}}function a(e,t){return void 0===t&&(t={}),(0,i().withBaseUrl)(e,t)}},80:function(e,t,n){"use strict";n.r(t);var r=n(13);n.d(t,"MemoryRouter",(function(){return r.d})),n.d(t,"Prompt",(function(){return r.f})),n.d(t,"Redirect",(function(){return r.g})),n.d(t,"Route",(function(){return r.h})),n.d(t,"Router",(function(){return r.i})),n.d(t,"StaticRouter",(function(){return r.j})),n.d(t,"Switch",(function(){return r.k})),n.d(t,"generatePath",(function(){return r.l})),n.d(t,"matchPath",(function(){return r.m})),n.d(t,"useHistory",(function(){return r.n})),n.d(t,"useLocation",(function(){return r.o})),n.d(t,"useParams",(function(){return r.p})),n.d(t,"useRouteMatch",(function(){return r.q})),n.d(t,"withRouter",(function(){return r.r})),n.d(t,"BrowserRouter",(function(){return r.a})),n.d(t,"HashRouter",(function(){return r.b})),n.d(t,"Link",(function(){return r.c})),n.d(t,"NavLink",(function(){return r.e}))},81:function(e,t,n){"use strict";function r(e){return!0===/^(\w*:|\/\/)/.test(e)}function o(e){return void 0!==e&&!r(e)}n.d(t,"b",(function(){return r})),n.d(t,"a",(function(){return o}))},85:function(e,t,n){"use strict";n.d(t,"a",(function(){return a}));var r=n(0),o=n(101),i=n(77);function a(e){void 0===e&&(e="default");var t=Object(i.useDocsData)(e),n=Object(o.b)(),a=n[0],u=n[1],c=a[e].preferredVersionName;return{preferredVersion:c?t.versions.find((function(e){return e.name===c})):null,savePreferredVersionName:Object(r.useCallback)((function(t){u.savePreferredVersion(e,t)}),[u])}}},86:function(e,t,n){"use strict";var r=n(0),o=n.n(r),i=n(113);t.a=function(e){return o.a.createElement(i.a,Object.assign({},e))}}}]); \ No newline at end of file diff --git a/16.7939b288.js b/16.7939b288.js new file mode 100644 index 00000000..257b5a86 --- /dev/null +++ b/16.7939b288.js @@ -0,0 +1 @@ +(window.webpackJsonp=window.webpackJsonp||[]).push([[16,18],{72:function(e,t,n){"use strict";n.r(t);var a=n(0),r=n.n(a),o=n(73),l=n(76),c=n(22),i=n(84),s=n(2),u=n(6),p=n(75),m=n(74),d=n(99),y=n(92),f=n(96),h=n(97),b=n(98),g=n(95),v=n(78),k=n(81),j=n(59),O=n.n(j);var E=function e(t,n){return"link"===t.type?Object(d.a)(t.href,n):"category"===t.type&&t.items.some((function(t){return e(t,n)}))};function N(e){var t,n,o,l=e.item,c=e.onItemClick,i=e.collapsible,m=e.activePath,d=Object(u.a)(e,["item","onItemClick","collapsible","activePath"]),y=l.items,f=l.label,h=E(l,m),b=(n=h,o=Object(a.useRef)(n),Object(a.useEffect)((function(){o.current=n}),[n]),o.current),g=Object(a.useState)((function(){return!!i&&(!h&&l.collapsed)})),v=g[0],k=g[1];Object(a.useEffect)((function(){h&&!b&&v&&k(!1)}),[h,b,v]);var j=Object(a.useCallback)((function(e){e.preventDefault(),k((function(e){return!e}))}),[k]);return 0===y.length?null:r.a.createElement("li",{className:Object(p.a)("menu__list-item",{"menu__list-item--collapsed":v}),key:f},r.a.createElement("a",Object(s.a)({className:Object(p.a)("menu__link",(t={"menu__link--sublist":i,"menu__link--active":i&&h},t[O.a.menuLinkText]=!i,t)),onClick:i?j:void 0,href:i?"#!":void 0},d),f),r.a.createElement("ul",{className:"menu__list"},y.map((function(e){return r.a.createElement(x,{tabIndex:v?"-1":"0",key:e.label,item:e,onItemClick:c,collapsible:i,activePath:m})}))))}function w(e){var t=e.item,n=e.onItemClick,a=e.activePath,o=(e.collapsible,Object(u.a)(e,["item","onItemClick","activePath","collapsible"])),l=t.href,c=t.label,i=E(t,a);return r.a.createElement("li",{className:"menu__list-item",key:c},r.a.createElement(v.a,Object(s.a)({className:Object(p.a)("menu__link",{"menu__link--active":i}),to:l},Object(k.a)(l)?{isNavLink:!0,exact:!0,onClick:n}:{target:"_blank",rel:"noreferrer noopener"},o),c))}function x(e){switch(e.item.type){case"category":return r.a.createElement(N,e);case"link":default:return r.a.createElement(w,e)}}var C=function(e){var t,n,o=e.path,c=e.sidebar,i=e.sidebarCollapsible,u=void 0===i||i,d=Object(a.useState)(!1),k=d[0],j=d[1],E=Object(m.a)().navbar,N=E.title,w=E.hideOnScroll,C=Object(l.a)().isClient,P=Object(b.a)(),_=P.logoLink,T=P.logoLinkProps,S=P.logoImageUrl,I=P.logoAlt,D=Object(y.a)().isAnnouncementBarClosed,L=Object(g.a)().scrollY;Object(f.a)(k);var M=Object(h.a)();return Object(a.useEffect)((function(){M===h.b.desktop&&j(!1)}),[M]),r.a.createElement("div",{className:Object(p.a)(O.a.sidebar,(t={},t[O.a.sidebarWithHideableNavbar]=w,t))},w&&r.a.createElement(v.a,Object(s.a)({tabIndex:-1,className:O.a.sidebarLogo,to:_},T),null!=S&&r.a.createElement("img",{key:C,src:S,alt:I}),null!=N&&r.a.createElement("strong",null,N)),r.a.createElement("div",{className:Object(p.a)("menu","menu--responsive",O.a.menu,(n={"menu--show":k},n[O.a.menuWithAnnouncementBar]=!D&&0===L,n))},r.a.createElement("button",{"aria-label":k?"Close Menu":"Open Menu","aria-haspopup":"true",className:"button button--secondary button--sm menu__button",type:"button",onClick:function(){j(!k)}},k?r.a.createElement("span",{className:Object(p.a)(O.a.sidebarMenuIcon,O.a.sidebarMenuCloseIcon)},"\xd7"):r.a.createElement("svg",{"aria-label":"Menu",className:O.a.sidebarMenuIcon,xmlns:"http://www.w3.org/2000/svg",height:24,width:24,viewBox:"0 0 32 32",role:"img",focusable:"false"},r.a.createElement("title",null,"Menu"),r.a.createElement("path",{stroke:"currentColor",strokeLinecap:"round",strokeMiterlimit:"10",strokeWidth:"2",d:"M4 7h22M4 15h22M4 23h22"}))),r.a.createElement("ul",{className:"menu__list"},c.map((function(e){return r.a.createElement(x,{key:e.label,item:e,onItemClick:function(e){e.target.blur(),j(!1)},collapsible:u,activePath:o})})))))},P=n(89),_=n(91),T=n(80),S=n(60),I=n.n(S),D=n(100);function L(e){var t,n,a=e.currentDocRoute,c=e.versionMetadata,s=e.children,u=Object(l.a)(),p=u.siteConfig,m=u.isClient,d=c.pluginId,y=c.permalinkToSidebar,f=c.docsSidebars,h=c.version,b=y[a.path],g=f[b];return r.a.createElement(i.a,{key:m,searchMetadatas:{version:h,tag:Object(D.b)(d,h)}},r.a.createElement("div",{className:I.a.docPage},g&&r.a.createElement("div",{className:I.a.docSidebarContainer,role:"complementary"},r.a.createElement(C,{key:b,sidebar:g,path:a.path,sidebarCollapsible:null===(t=null===(n=p.themeConfig)||void 0===n?void 0:n.sidebarCollapsible)||void 0===t||t})),r.a.createElement("main",{className:I.a.docMainContainer},r.a.createElement(o.a,{components:P.a},s))))}t.default=function(e){var t=e.route.routes,n=e.versionMetadata,a=e.location,o=t.find((function(e){return Object(T.matchPath)(a.pathname,e)}));return o?r.a.createElement(L,{currentDocRoute:o,versionMetadata:n},Object(c.a)(t)):r.a.createElement(_.default,e)}},73:function(e,t,n){"use strict";n.d(t,"a",(function(){return p})),n.d(t,"b",(function(){return y}));var a=n(0),r=n.n(a);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function l(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,a)}return n}function c(e){for(var t=1;t=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var s=r.a.createContext({}),u=function(e){var t=r.a.useContext(s),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},p=function(e){var t=u(e.components);return r.a.createElement(s.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return r.a.createElement(r.a.Fragment,{},t)}},d=r.a.forwardRef((function(e,t){var n=e.components,a=e.mdxType,o=e.originalType,l=e.parentName,s=i(e,["components","mdxType","originalType","parentName"]),p=u(n),d=a,y=p["".concat(l,".").concat(d)]||p[d]||m[d]||o;return n?r.a.createElement(y,c(c({ref:t},s),{},{components:n})):r.a.createElement(y,c({ref:t},s))}));function y(e,t){var n=arguments,a=t&&t.mdxType;if("string"==typeof e||a){var o=n.length,l=new Array(o);l[0]=d;var c={};for(var i in t)hasOwnProperty.call(t,i)&&(c[i]=t[i]);c.originalType=e,c.mdxType="string"==typeof e?e:a,l[1]=c;for(var s=2;s{const n=document.createElement("textarea"),a=document.activeElement;n.value=e,n.setAttribute("readonly",""),n.style.contain="strict",n.style.position="absolute",n.style.left="-9999px",n.style.fontSize="12pt";const r=document.getSelection();let o=!1;r.rangeCount>0&&(o=r.getRangeAt(0)),t.append(n),n.select(),n.selectionStart=0,n.selectionEnd=e.length;let l=!1;try{l=document.execCommand("copy")}catch(c){}return n.remove(),o&&(r.removeAllRanges(),r.addRange(o)),a&&a.focus(),l};e.exports=a,e.exports.default=a},88:function(e,t){e.exports.parse=function(e){var t=e.split(",").map((function(e){return function(e){if(/^-?\d+$/.test(e))return parseInt(e,10);var t;if(t=e.match(/^(-?\d+)(-|\.\.\.?|\u2025|\u2026|\u22EF)(-?\d+)$/)){var n=t[1],a=t[2],r=t[3];if(n&&r){var o=[],l=(n=parseInt(n))<(r=parseInt(r))?1:-1;"-"!=a&&".."!=a&&"\u2025"!=a||(r+=l);for(var c=n;c!=r;c+=l)o.push(c);return o}}return[]}(e)}));return 0===t.length?[]:1===t.length?Array.isArray(t[0])?t[0]:t:t.reduce((function(e,t){return Array.isArray(e)||(e=[e]),Array.isArray(t)||(t=[t]),e.concat(t)}))}},89:function(e,t,n){"use strict";var a=n(2),r=n(0),o=n.n(r),l=n(78),c=n(75),i={plain:{backgroundColor:"#2a2734",color:"#9a86fd"},styles:[{types:["comment","prolog","doctype","cdata","punctuation"],style:{color:"#6c6783"}},{types:["namespace"],style:{opacity:.7}},{types:["tag","operator","number"],style:{color:"#e09142"}},{types:["property","function"],style:{color:"#9a86fd"}},{types:["tag-id","selector","atrule-id"],style:{color:"#eeebff"}},{types:["attr-name"],style:{color:"#c4b9fe"}},{types:["boolean","string","entity","url","attr-value","keyword","control","directive","unit","statement","regex","at-rule","placeholder","variable"],style:{color:"#ffcc99"}},{types:["deleted"],style:{textDecorationLine:"line-through"}},{types:["inserted"],style:{textDecorationLine:"underline"}},{types:["italic"],style:{fontStyle:"italic"}},{types:["important","bold"],style:{fontWeight:"bold"}},{types:["important"],style:{color:"#c4b9fe"}}]},s={Prism:n(20).a,theme:i};function u(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function p(){return(p=Object.assign||function(e){for(var t=1;t0&&e[n-1]===t?e:e.concat(t)},f=function(e,t){var n=e.plain,a=Object.create(null),r=e.styles.reduce((function(e,n){var a=n.languages,r=n.style;return a&&!a.includes(t)||n.types.forEach((function(t){var n=p({},e[t],r);e[t]=n})),e}),a);return r.root=n,r.plain=p({},n,{backgroundColor:null}),r};function h(e,t){var n={};for(var a in e)Object.prototype.hasOwnProperty.call(e,a)&&-1===t.indexOf(a)&&(n[a]=e[a]);return n}var b=function(e){function t(){for(var t=this,n=[],a=arguments.length;a--;)n[a]=arguments[a];e.apply(this,n),u(this,"getThemeDict",(function(e){if(void 0!==t.themeDict&&e.theme===t.prevTheme&&e.language===t.prevLanguage)return t.themeDict;t.prevTheme=e.theme,t.prevLanguage=e.language;var n=e.theme?f(e.theme,e.language):void 0;return t.themeDict=n})),u(this,"getLineProps",(function(e){var n=e.key,a=e.className,r=e.style,o=p({},h(e,["key","className","style","line"]),{className:"token-line",style:void 0,key:void 0}),l=t.getThemeDict(t.props);return void 0!==l&&(o.style=l.plain),void 0!==r&&(o.style=void 0!==o.style?p({},o.style,r):r),void 0!==n&&(o.key=n),a&&(o.className+=" "+a),o})),u(this,"getStyleForToken",(function(e){var n=e.types,a=e.empty,r=n.length,o=t.getThemeDict(t.props);if(void 0!==o){if(1===r&&"plain"===n[0])return a?{display:"inline-block"}:void 0;if(1===r&&!a)return o[n[0]];var l=a?{display:"inline-block"}:{},c=n.map((function(e){return o[e]}));return Object.assign.apply(Object,[l].concat(c))}})),u(this,"getTokenProps",(function(e){var n=e.key,a=e.className,r=e.style,o=e.token,l=p({},h(e,["key","className","style","token"]),{className:"token "+o.types.join(" "),children:o.content,style:t.getStyleForToken(o),key:void 0});return void 0!==r&&(l.style=void 0!==l.style?p({},l.style,r):r),void 0!==n&&(l.key=n),a&&(l.className+=" "+a),l}))}return e&&(t.__proto__=e),t.prototype=Object.create(e&&e.prototype),t.prototype.constructor=t,t.prototype.render=function(){var e=this.props,t=e.Prism,n=e.language,a=e.code,r=e.children,o=this.getThemeDict(this.props),l=t.languages[n];return r({tokens:function(e){for(var t=[[]],n=[e],a=[0],r=[e.length],o=0,l=0,c=[],i=[c];l>-1;){for(;(o=a[l]++)0?u:["plain"],s=p):(u=y(u,p.type),p.alias&&(u=y(u,p.alias)),s=p.content),"string"==typeof s){var f=s.split(m),h=f.length;c.push({types:u,content:f[0]});for(var b=1;b0}))}l&&T.test(l)&&(k=l.match(T)[0].split("title=")[1].replace(/"+/g,""));var x=n&&n.replace(/language-/,"");!x&&i.defaultLanguage&&(x=i.defaultLanguage);var S=t.replace(/\n$/,"");if(0===g.length&&void 0!==x){for(var I,D="",L=function(e){switch(e){case"js":case"javascript":case"ts":case"typescript":return _(["js","jsBlock"]);case"jsx":case"tsx":return _(["js","jsBlock","jsx"]);case"html":return _(["js","jsBlock","html"]);case"python":case"py":return _(["python"]);default:return _()}}(x),M=t.replace(/\n$/,"").split("\n"),B=0;B=0||(a[n]=e[n]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(a[n]=e[n])}return a}var i=a.a.createContext({}),u=function(e){var t=a.a.useContext(i),n=t;return e&&(n="function"==typeof e?e(t):l(l({},t),e)),n},p=function(e){var t=u(e.components);return a.a.createElement(i.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},y=a.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,c=e.parentName,i=s(e,["components","mdxType","originalType","parentName"]),p=u(n),y=r,m=p["".concat(c,".").concat(y)]||p[y]||d[y]||o;return n?a.a.createElement(m,l(l({ref:t},i),{},{components:n})):a.a.createElement(m,l({ref:t},i))}));function m(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,c=new Array(o);c[0]=y;var l={};for(var s in t)hasOwnProperty.call(t,s)&&(l[s]=t[s]);l.originalType=e,l.mdxType="string"==typeof e?e:r,c[1]=l;for(var i=2;i{const n=document.createElement("textarea"),r=document.activeElement;n.value=e,n.setAttribute("readonly",""),n.style.contain="strict",n.style.position="absolute",n.style.left="-9999px",n.style.fontSize="12pt";const a=document.getSelection();let o=!1;a.rangeCount>0&&(o=a.getRangeAt(0)),t.append(n),n.select(),n.selectionStart=0,n.selectionEnd=e.length;let c=!1;try{c=document.execCommand("copy")}catch(l){}return n.remove(),o&&(a.removeAllRanges(),a.addRange(o)),r&&r.focus(),c};e.exports=r,e.exports.default=r},88:function(e,t){e.exports.parse=function(e){var t=e.split(",").map((function(e){return function(e){if(/^-?\d+$/.test(e))return parseInt(e,10);var t;if(t=e.match(/^(-?\d+)(-|\.\.\.?|\u2025|\u2026|\u22EF)(-?\d+)$/)){var n=t[1],r=t[2],a=t[3];if(n&&a){var o=[],c=(n=parseInt(n))<(a=parseInt(a))?1:-1;"-"!=r&&".."!=r&&"\u2025"!=r||(a+=c);for(var l=n;l!=a;l+=c)o.push(l);return o}}return[]}(e)}));return 0===t.length?[]:1===t.length?Array.isArray(t[0])?t[0]:t:t.reduce((function(e,t){return Array.isArray(e)||(e=[e]),Array.isArray(t)||(t=[t]),e.concat(t)}))}},89:function(e,t,n){"use strict";var r=n(2),a=n(0),o=n.n(a),c=n(78),l=n(75),s={plain:{backgroundColor:"#2a2734",color:"#9a86fd"},styles:[{types:["comment","prolog","doctype","cdata","punctuation"],style:{color:"#6c6783"}},{types:["namespace"],style:{opacity:.7}},{types:["tag","operator","number"],style:{color:"#e09142"}},{types:["property","function"],style:{color:"#9a86fd"}},{types:["tag-id","selector","atrule-id"],style:{color:"#eeebff"}},{types:["attr-name"],style:{color:"#c4b9fe"}},{types:["boolean","string","entity","url","attr-value","keyword","control","directive","unit","statement","regex","at-rule","placeholder","variable"],style:{color:"#ffcc99"}},{types:["deleted"],style:{textDecorationLine:"line-through"}},{types:["inserted"],style:{textDecorationLine:"underline"}},{types:["italic"],style:{fontStyle:"italic"}},{types:["important","bold"],style:{fontWeight:"bold"}},{types:["important"],style:{color:"#c4b9fe"}}]},i={Prism:n(20).a,theme:s};function u(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function p(){return(p=Object.assign||function(e){for(var t=1;t0&&e[n-1]===t?e:e.concat(t)},f=function(e,t){var n=e.plain,r=Object.create(null),a=e.styles.reduce((function(e,n){var r=n.languages,a=n.style;return r&&!r.includes(t)||n.types.forEach((function(t){var n=p({},e[t],a);e[t]=n})),e}),r);return a.root=n,a.plain=p({},n,{backgroundColor:null}),a};function h(e,t){var n={};for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&-1===t.indexOf(r)&&(n[r]=e[r]);return n}var g=function(e){function t(){for(var t=this,n=[],r=arguments.length;r--;)n[r]=arguments[r];e.apply(this,n),u(this,"getThemeDict",(function(e){if(void 0!==t.themeDict&&e.theme===t.prevTheme&&e.language===t.prevLanguage)return t.themeDict;t.prevTheme=e.theme,t.prevLanguage=e.language;var n=e.theme?f(e.theme,e.language):void 0;return t.themeDict=n})),u(this,"getLineProps",(function(e){var n=e.key,r=e.className,a=e.style,o=p({},h(e,["key","className","style","line"]),{className:"token-line",style:void 0,key:void 0}),c=t.getThemeDict(t.props);return void 0!==c&&(o.style=c.plain),void 0!==a&&(o.style=void 0!==o.style?p({},o.style,a):a),void 0!==n&&(o.key=n),r&&(o.className+=" "+r),o})),u(this,"getStyleForToken",(function(e){var n=e.types,r=e.empty,a=n.length,o=t.getThemeDict(t.props);if(void 0!==o){if(1===a&&"plain"===n[0])return r?{display:"inline-block"}:void 0;if(1===a&&!r)return o[n[0]];var c=r?{display:"inline-block"}:{},l=n.map((function(e){return o[e]}));return Object.assign.apply(Object,[c].concat(l))}})),u(this,"getTokenProps",(function(e){var n=e.key,r=e.className,a=e.style,o=e.token,c=p({},h(e,["key","className","style","token"]),{className:"token "+o.types.join(" "),children:o.content,style:t.getStyleForToken(o),key:void 0});return void 0!==a&&(c.style=void 0!==c.style?p({},c.style,a):a),void 0!==n&&(c.key=n),r&&(c.className+=" "+r),c}))}return e&&(t.__proto__=e),t.prototype=Object.create(e&&e.prototype),t.prototype.constructor=t,t.prototype.render=function(){var e=this.props,t=e.Prism,n=e.language,r=e.code,a=e.children,o=this.getThemeDict(this.props),c=t.languages[n];return a({tokens:function(e){for(var t=[[]],n=[e],r=[0],a=[e.length],o=0,c=0,l=[],s=[l];c>-1;){for(;(o=r[c]++)0?u:["plain"],i=p):(u=m(u,p.type),p.alias&&(u=m(u,p.alias)),i=p.content),"string"==typeof i){var f=i.split(d),h=f.length;l.push({types:u,content:f[0]});for(var g=1;g0}))}c&&S.test(c)&&(j=c.match(S)[0].split("title=")[1].replace(/"+/g,""));var w=n&&n.replace(/language-/,"");!w&&s.defaultLanguage&&(w=s.defaultLanguage);var L=t.replace(/\n$/,"");if(0===v.length&&void 0!==w){for(var B,D="",_=function(e){switch(e){case"js":case"javascript":case"ts":case"typescript":return P(["js","jsBlock"]);case"jsx":case"tsx":return P(["js","jsBlock","jsx"]);case"html":return P(["js","jsBlock","html"]);case"python":case"py":return P(["python"]);default:return P()}}(w),A=t.replace(/\n$/,"").split("\n"),I=0;I=n}));if(t){if(t.getBoundingClientRect().top>=n){var r=e[e.indexOf(t)-1];return null!=r?r:t}return t}return e[e.length-1]}();if(r)for(var a=0,l=!1,s=document.getElementsByClassName(e);a1,B=h?h+" "+d+" "+m:m,D=Object(c.a)(k,{absolute:!0});return l.a.createElement(l.a.Fragment,null,l.a.createElement(r.a,null,l.a.createElement("title",null,B),l.a.createElement("meta",{property:"og:title",content:B}),b&&l.a.createElement("meta",{name:"description",content:b}),b&&l.a.createElement("meta",{property:"og:description",content:b}),j&&j.length&&l.a.createElement("meta",{name:"keywords",content:j.join(",")}),k&&l.a.createElement("meta",{property:"og:image",content:D}),k&&l.a.createElement("meta",{property:"twitter:image",content:D}),k&&l.a.createElement("meta",{name:"twitter:image:alt",content:"Image for "+h}),N&&l.a.createElement("meta",{property:"og:url",content:n+N}),N&&l.a.createElement("link",{rel:"canonical",href:n+N})),l.a.createElement("div",{className:Object(v.a)("container padding-vert--lg",p.a.docItemWrapper)},l.a.createElement("div",{className:"row"},l.a.createElement("div",{className:Object(v.a)("col",(t={},t[p.a.docItemCol]=!x,t))},l.a.createElement(u,null),l.a.createElement("div",{className:p.a.docItemContainer},l.a.createElement("article",null,S&&l.a.createElement("div",null,l.a.createElement("span",{className:"badge badge--secondary"},"Version: ",A.label)),!C&&l.a.createElement("header",null,l.a.createElement("h1",{className:p.a.docTitle},h)),l.a.createElement("div",{className:"markdown"},l.a.createElement(E,null))),(_||w||O)&&l.a.createElement("div",{className:"margin-vert--xl"},l.a.createElement("div",{className:"row"},l.a.createElement("div",{className:"col"},_&&l.a.createElement("a",{href:_,target:"_blank",rel:"noreferrer noopener"},l.a.createElement("svg",{fill:"currentColor",height:"1.2em",width:"1.2em",preserveAspectRatio:"xMidYMid meet",viewBox:"0 0 40 40",style:{marginRight:"0.3em",verticalAlign:"sub"}},l.a.createElement("g",null,l.a.createElement("path",{d:"m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"}))),"Edit this page")),(w||O)&&l.a.createElement("div",{className:"col text--right"},l.a.createElement("em",null,l.a.createElement("small",null,"Last updated"," ",w&&l.a.createElement(l.a.Fragment,null,"on"," ",l.a.createElement("time",{dateTime:new Date(1e3*w).toISOString(),className:p.a.docLastUpdatedAt},new Date(1e3*w).toLocaleDateString()),O&&" "),O&&l.a.createElement(l.a.Fragment,null,"by ",l.a.createElement("strong",null,O)),!1))))),l.a.createElement("div",{className:"margin-vert--lg"},l.a.createElement(o,{metadata:f})))),!x&&E.rightToc&&l.a.createElement("div",{className:"col col--3"},l.a.createElement(g.a,{headings:E.rightToc})))))}},90:function(e,t,a){"use strict";var n=a(0),l=a.n(n);var r=function(e,t,a){var l=Object(n.useState)(void 0),r=l[0],i=l[1];Object(n.useEffect)((function(){function n(){var n=function(){var e=Array.from(document.getElementsByClassName("anchor")),t=e.find((function(e){return e.getBoundingClientRect().top>=a}));if(t){if(t.getBoundingClientRect().top>=a){var n=e[e.indexOf(t)-1];return null!=n?n:t}return t}return e[e.length-1]}();if(n)for(var l=0,c=!1,m=document.getElementsByClassName(e);lthis.startX&&(this.setState({checked:!0}),this.startX=t,this.activated=ta?this.previouslyChecked!==this.state.checked&&(this.setState({checked:!1}),this.previouslyChecked=this.state.checked,t.click()):this.startX-4=0||Object.prototype.hasOwnProperty.call(e,n)&&(a[n]=e[n]);return a}(t,["className","icons"])),c=(0,l.default)("react-toggle",{"react-toggle--checked":this.state.checked,"react-toggle--focus":this.state.hasFocus,"react-toggle--disabled":this.props.disabled},a);return o.default.createElement("div",{className:c,onClick:this.handleClick,onTouchStart:this.handleTouchStart,onTouchMove:this.handleTouchMove,onTouchEnd:this.handleTouchEnd},o.default.createElement("div",{className:"react-toggle-track"},o.default.createElement("div",{className:"react-toggle-track-check"},this.getIcon("checked")),o.default.createElement("div",{className:"react-toggle-track-x"},this.getIcon("unchecked"))),o.default.createElement("div",{className:"react-toggle-thumb"}),o.default.createElement("input",n({},r,{ref:function(t){e.input=t},onFocus:this.handleFocus,onBlur:this.handleBlur,className:"react-toggle-screenreader-only",type:"checkbox"})))}}]),t}(c.PureComponent);t.default=f,f.displayName="Toggle",f.defaultProps={icons:{checked:o.default.createElement(s.default,null),unchecked:o.default.createElement(u.default,null)}},f.propTypes={checked:i.default.bool,disabled:i.default.bool,defaultChecked:i.default.bool,onChange:i.default.func,onFocus:i.default.func,onBlur:i.default.func,className:i.default.string,name:i.default.string,value:i.default.string,id:i.default.string,"aria-labelledby":i.default.string,"aria-label":i.default.string,icons:i.default.oneOfType([i.default.bool,i.default.shape({checked:i.default.node,unchecked:i.default.node})])}},103:function(e,t,a){var n;!function(){"use strict";var a={}.hasOwnProperty;function r(){for(var e=[],t=0;t0){var a=t[0];return{x:a.clientX,y:a.clientY}}var n=e.pageX;if(void 0!==n)return{x:n,y:e.pageY}}return{x:0,y:0}}},107:function(e,t,a){"use strict";a.r(t),a.d(t,"default",(function(){return u}));var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(83),i=a(77),s=a(85);function u(e){var t,a=e.label,c=e.to,u=e.docsPluginId,d=Object(r.a)(e,["label","to","docsPluginId"]),m=Object(i.useActiveVersion)(u),f=Object(s.a)(u).preferredVersion,h=Object(i.useLatestVersion)(u),v=null!==(t=null!=m?m:f)&&void 0!==t?t:h,b=null!=a?a:v.label,p=null!=c?c:function(e){return e.docs.find((function(t){return t.id===e.mainDocId}))}(v).path;return o.a.createElement(l.a,Object(n.a)({},d,{label:b,to:p}))}},111:function(e,t,a){"use strict";a.r(t),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(83),i=a(77),s=a(85),u=function(e){return e.docs.find((function(t){return t.id===e.mainDocId}))};function d(e){var t,a,c=e.mobile,d=e.docsPluginId,m=e.dropdownActiveClassDisabled,f=e.dropdownItemsBefore,h=e.dropdownItemsAfter,v=Object(r.a)(e,["mobile","docsPluginId","dropdownActiveClassDisabled","dropdownItemsBefore","dropdownItemsAfter"]),b=Object(i.useActiveDocContext)(d),p=Object(i.useVersions)(d),g=Object(i.useLatestVersion)(d),k=Object(s.a)(d),E=k.preferredVersion,O=k.savePreferredVersionName;var j=null!==(t=null!==(a=b.activeVersion)&&void 0!==a?a:E)&&void 0!==t?t:g,y=c?"Versions":j.label,_=c?void 0:u(j).path;return o.a.createElement(l.a,Object(n.a)({},v,{mobile:c,label:y,to:_,items:function(){var e=p.map((function(e){var t=(null==b?void 0:b.alternateDocVersions[e.name])||u(e);return{isNavLink:!0,label:e.label,to:t.path,isActive:function(){return e===(null==b?void 0:b.activeVersion)},onClick:function(){O(e.name)}}})),t=[].concat(f,e,h);if(!(t.length<=1))return t}(),isActive:m?function(){return!1}:void 0}))}},112:function(e,t,a){"use strict";a.r(t),a.d(t,"default",(function(){return d}));var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(83),i=a(77),s=a(75),u=a(85);function d(e){var t,a,c=e.docId,d=e.activeSidebarClassName,m=e.label,f=e.docsPluginId,h=Object(r.a)(e,["docId","activeSidebarClassName","label","docsPluginId"]),v=Object(i.useActiveDocContext)(f),b=v.activeVersion,p=v.activeDoc,g=Object(u.a)(f).preferredVersion,k=Object(i.useLatestVersion)(f),E=null!==(t=null!=b?b:g)&&void 0!==t?t:k,O=E.docs.find((function(e){return e.id===c}));if(!O)throw new Error("DocNavbarItem: couldn't find any doc with id="+c+" in version "+E.name+".\nAvailable docIds=\n- "+E.docs.join("\n- "));return o.a.createElement(l.a,Object(n.a)({exact:!0},h,{className:Object(s.a)(h.className,(a={},a[d]=p&&p.sidebar===O.sidebar,a)),label:null!=m?m:O.id,to:O.path}))}},82:function(e,t,a){"use strict";var n=a(0),r=a(94);t.a=function(){var e=Object(n.useContext)(r.a);if(null==e)throw new Error("`useThemeContext` is used outside of `Layout` Component. See https://v2.docusaurus.io/docs/theme-classic#usethemecontext.");return e}},83:function(e,t,a){"use strict";var n=a(2),r=a(6),c=a(0),o=a.n(c),l=a(75),i=a(78),s=a(79),u=a(80),d=a(99);function m(e){var t=e.activeBasePath,a=e.activeBaseRegex,c=e.to,l=e.href,u=e.label,d=e.activeClassName,m=void 0===d?"navbar__link--active":d,f=e.prependBaseUrlToHref,h=Object(r.a)(e,["activeBasePath","activeBaseRegex","to","href","label","activeClassName","prependBaseUrlToHref"]),v=Object(s.a)(c),b=Object(s.a)(t),p=Object(s.a)(l,{forcePrependBaseUrl:!0});return o.a.createElement(i.a,Object(n.a)({},l?{target:"_blank",rel:"noopener noreferrer",href:f?p:l}:Object.assign({isNavLink:!0,activeClassName:m,to:v},t||a?{isActive:function(e,t){return a?new RegExp(a).test(t.pathname):t.pathname.startsWith(b)}}:null),h),u)}function f(e){var t=e.items,a=e.position,i=e.className,s=Object(r.a)(e,["items","position","className"]),u=Object(c.useRef)(null),d=Object(c.useRef)(null),f=Object(c.useState)(!1),h=f[0],v=f[1];Object(c.useEffect)((function(){var e=function(e){u.current&&!u.current.contains(e.target)&&v(!1)};return document.addEventListener("mousedown",e),document.addEventListener("touchstart",e),function(){document.removeEventListener("mousedown",e),document.removeEventListener("touchstart",e)}}),[u]);var b=function(e,t){return void 0===t&&(t=!1),Object(l.a)({"navbar__item navbar__link":!t,dropdown__link:t},e)};return t?o.a.createElement("div",{ref:u,className:Object(l.a)("navbar__item","dropdown","dropdown--hoverable",{"dropdown--left":"left"===a,"dropdown--right":"right"===a,"dropdown--show":h})},o.a.createElement(m,Object(n.a)({className:b(i)},s,{onClick:s.to?void 0:function(e){return e.preventDefault()},onKeyDown:function(e){"Enter"===e.key&&(e.preventDefault(),v(!h))}}),s.label),o.a.createElement("ul",{ref:d,className:"dropdown__menu"},t.map((function(e,a){var c=e.className,l=Object(r.a)(e,["className"]);return o.a.createElement("li",{key:a},o.a.createElement(m,Object(n.a)({onKeyDown:function(e){if(a===t.length-1&&"Tab"===e.key){e.preventDefault(),v(!1);var n=u.current.nextElementSibling;n&&n.focus()}},activeClassName:"dropdown__link--active",className:b(c,!0)},l)))})))):o.a.createElement(m,Object(n.a)({className:b(i)},s))}function h(e){var t=e.items,a=e.className,i=(e.position,Object(r.a)(e,["items","className","position"])),s=Object(u.useLocation)().pathname,f=Object(c.useState)((function(){var e;return null===(e=!(null==t?void 0:t.some((function(e){return Object(d.a)(e.to,s)}))))||void 0===e||e})),h=f[0],v=f[1],b=function(e,t){return void 0===t&&(t=!1),Object(l.a)("menu__link",{"menu__link--sublist":t},e)};return t?o.a.createElement("li",{className:Object(l.a)("menu__list-item",{"menu__list-item--collapsed":h})},o.a.createElement(m,Object(n.a)({role:"button",className:b(a,!0)},i,{onClick:function(){v((function(e){return!e}))}}),i.label),o.a.createElement("ul",{className:"menu__list"},t.map((function(e,t){var a=e.className,c=Object(r.a)(e,["className"]);return o.a.createElement("li",{className:"menu__list-item",key:t},o.a.createElement(m,Object(n.a)({activeClassName:"menu__link--active",className:b(a)},c,{onClick:i.onClick})))})))):o.a.createElement("li",{className:"menu__list-item"},o.a.createElement(m,Object(n.a)({className:b(a)},i)))}t.a=function(e){var t=e.mobile,a=void 0!==t&&t,n=Object(r.a)(e,["mobile"]),c=a?h:f;return o.a.createElement(c,n)}},84:function(e,t,a){"use strict";var n=a(0),r=a.n(n),c=a(75),o=a(74),l=a(92),i=a(52),s=a.n(i);var u=function(){var e,t=Object(l.a)(),a=t.isAnnouncementBarClosed,n=t.closeAnnouncementBar,i=Object(o.a)().announcementBar;if(!i)return null;var u=i.content,d=i.backgroundColor,m=i.textColor,f=i.isCloseable;return!u||f&&a?null:r.a.createElement("div",{className:s.a.announcementBar,style:{backgroundColor:d,color:m},role:"banner"},r.a.createElement("div",{className:Object(c.a)(s.a.announcementBarContent,(e={},e[s.a.announcementBarCloseable]=f,e)),dangerouslySetInnerHTML:{__html:u}}),f?r.a.createElement("button",{type:"button",className:s.a.announcementBarClose,onClick:n,"aria-label":"Close"},r.a.createElement("span",{"aria-hidden":"true"},"\xd7")):null)},d=a(2),m=a(78),f=a(76),h=function(){return null},v=a(102),b=a.n(v),p=a(53),g=a.n(p),k=function(e){var t=e.icon,a=e.style;return r.a.createElement("span",{className:Object(c.a)(g.a.toggle,g.a.dark),style:a},t)},E=function(e){var t=e.icon,a=e.style;return r.a.createElement("span",{className:Object(c.a)(g.a.toggle,g.a.light),style:a},t)},O=function(e){var t=Object(o.a)().colorMode.switchConfig,a=t.darkIcon,n=t.darkIconStyle,c=t.lightIcon,l=t.lightIconStyle,i=Object(f.a)().isClient;return r.a.createElement(b.a,Object(d.a)({disabled:!i,icons:{checked:r.a.createElement(k,{icon:a,style:n}),unchecked:r.a.createElement(E,{icon:c,style:l})}},e))},j=a(82),y=a(80);var _=function(e){var t=Object(n.useState)(e),a=t[0],r=t[1];return Object(n.useEffect)((function(){var e=function(){return r(window.location.hash)};return window.addEventListener("hashchange",e),function(){return window.removeEventListener("hashchange",e)}}),[]),[a,r]},w=a(95),C=function(e){var t=Object(n.useState)(!0),a=t[0],r=t[1],c=Object(n.useState)(!1),o=c[0],l=c[1],i=Object(n.useState)(0),s=i[0],u=i[1],d=Object(n.useState)(0),m=d[0],f=d[1],h=Object(n.useCallback)((function(e){null!==e&&f(e.getBoundingClientRect().height)}),[]),v=Object(y.useLocation)(),b=_(v.hash),p=b[0],g=b[1];return Object(w.a)((function(t){var a=t.scrollY;if(e&&(0===a&&r(!0),!(a=s?r(!1):a+c0&&r.a.createElement("div",{className:"row footer__links"},l.map((function(e,t){return r.a.createElement("div",{key:t,className:"col footer__col"},null!=e.title?r.a.createElement("h4",{className:"footer__title"},e.title):null,null!=e.items&&Array.isArray(e.items)&&e.items.length>0?r.a.createElement("ul",{className:"footer__items"},e.items.map((function(e,t){return e.html?r.a.createElement("li",{key:t,className:"footer__item",dangerouslySetInnerHTML:{__html:e.html}}):r.a.createElement("li",{key:e.href||e.to,className:"footer__item"},r.a.createElement(U,e))}))):null)}))),(s||a)&&r.a.createElement("div",{className:"text--center"},s&&s.src&&r.a.createElement("div",{className:"margin-bottom--sm"},s.href?r.a.createElement("a",{href:s.href,target:"_blank",rel:"noopener noreferrer",className:F.a.footerLogoLink},r.a.createElement(H,{alt:s.alt,url:u})):r.a.createElement(H,{alt:s.alt,url:u})),r.a.createElement("div",{dangerouslySetInnerHTML:{__html:a}})))):null},G=a(9),W="light",Y="dark",K=function(e){return e===Y?Y:W},z=function(){return G.a.canUseDOM?K(document.documentElement.getAttribute("data-theme")):W},J=function(e){try{localStorage.setItem("theme",K(e))}catch(t){console.error(t)}},q=function(){var e=Object(o.a)().colorMode.disableSwitch,t=void 0!==e&&e,a=Object(n.useState)(z),r=a[0],c=a[1],l=Object(n.useCallback)((function(){c(W),J(W)}),[]),i=Object(n.useCallback)((function(){c(Y),J(Y)}),[]);return Object(n.useEffect)((function(){document.documentElement.setAttribute("data-theme",K(r))}),[r]),Object(n.useEffect)((function(){if(!t)try{var e=localStorage.getItem("theme");null!==e&&c(K(e))}catch(a){console.error(a)}}),[c]),Object(n.useEffect)((function(){t||window.matchMedia("(prefers-color-scheme: dark)").addListener((function(e){var t=e.matches;c(t?Y:W)}))}),[]),{isDarkTheme:r===Y,setLightTheme:l,setDarkTheme:i}},Q=a(94);var Z=function(e){var t=q(),a=t.isDarkTheme,n=t.setLightTheme,c=t.setDarkTheme;return r.a.createElement(Q.a.Provider,{value:{isDarkTheme:a,setLightTheme:n,setDarkTheme:c}},e.children)},$="docusaurus.tab.",ee=function(){var e=Object(n.useState)({}),t=e[0],a=e[1],r=Object(n.useCallback)((function(e,t){try{localStorage.setItem("docusaurus.tab."+e,t)}catch(a){console.error(a)}}),[]);return Object(n.useEffect)((function(){try{for(var e={},t=0;t996?r.desktop:r.mobile}var a=Object(n.useState)(t),c=a[0],o=a[1];return Object(n.useEffect)((function(){if(e)return window.addEventListener("resize",a),function(){return window.removeEventListener("resize",a)};function a(){o(t())}}),[]),c}},98:function(e,t,a){"use strict";var n=a(82),r=a(79),c=a(81),o=a(74);t.a=function(){var e=Object(o.a)().navbar.logo,t=Object(n.a)().isDarkTheme,a=Object(r.a)(e.href||"/"),l={};e.target?l={target:e.target}:Object(c.a)(a)||(l={rel:"noopener noreferrer",target:"_blank"});var i=e.srcDark&&t?e.srcDark:e.src;return{logoLink:a,logoLinkProps:l,logoImageUrl:Object(r.a)(i),logoAlt:e.alt}}},99:function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));var n=function(e,t){var a=function(e){return e.endsWith("/")?e:e+"/"};return a(e)===a(t)}}}]); \ No newline at end of file diff --git a/2.c97238d2.js.LICENSE.txt b/2.c97238d2.js.LICENSE.txt new file mode 100644 index 00000000..bae6dd8e --- /dev/null +++ b/2.c97238d2.js.LICENSE.txt @@ -0,0 +1,5 @@ +/*! + Copyright (c) 2017 Jed Watson. + Licensed under the MIT License (MIT), see + http://jedwatson.github.io/classnames +*/ diff --git a/357fe94d.33b065b1.js b/357fe94d.33b065b1.js new file mode 100644 index 00000000..9bcc981a --- /dev/null +++ b/357fe94d.33b065b1.js @@ -0,0 +1 @@ +(window.webpackJsonp=window.webpackJsonp||[]).push([[5],{62:function(e,t,a){"use strict";a.r(t),a.d(t,"frontMatter",(function(){return i})),a.d(t,"metadata",(function(){return l})),a.d(t,"rightToc",(function(){return c})),a.d(t,"default",(function(){return b}));var o=a(2),n=a(6),r=(a(0),a(73)),i={id:"oauth_provider",title:"OAuth Provider Configuration"},l={unversionedId:"configuration/oauth_provider",id:"configuration/oauth_provider",isDocsHomePage:!1,title:"OAuth Provider Configuration",description:"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on.",source:"@site/docs/configuration/auth.md",slug:"/configuration/oauth_provider",permalink:"/oauth2-proxy/docs/configuration/oauth_provider",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/auth.md",version:"current",sidebar:"docs",previous:{title:"Overview",permalink:"/oauth2-proxy/docs/configuration/overview"},next:{title:"Session Storage",permalink:"/oauth2-proxy/docs/configuration/session_storage"}},c=[{value:"Google Auth Provider",id:"google-auth-provider",children:[]},{value:"Azure Auth Provider",id:"azure-auth-provider",children:[]},{value:"Facebook Auth Provider",id:"facebook-auth-provider",children:[]},{value:"GitHub Auth Provider",id:"github-auth-provider",children:[]},{value:"Keycloak Auth Provider",id:"keycloak-auth-provider",children:[]},{value:"GitLab Auth Provider",id:"gitlab-auth-provider",children:[]},{value:"LinkedIn Auth Provider",id:"linkedin-auth-provider",children:[]},{value:"Microsoft Azure AD Provider",id:"microsoft-azure-ad-provider",children:[]},{value:"OpenID Connect Provider",id:"openid-connect-provider",children:[]},{value:"login.gov Provider",id:"logingov-provider",children:[]},{value:"Nextcloud Provider",id:"nextcloud-provider",children:[]},{value:"DigitalOcean Auth Provider",id:"digitalocean-auth-provider",children:[]},{value:"Bitbucket Auth Provider",id:"bitbucket-auth-provider",children:[]},{value:"Gitea Auth Provider",id:"gitea-auth-provider",children:[]},{value:"Email Authentication",id:"email-authentication",children:[]},{value:"Adding a new Provider",id:"adding-a-new-provider",children:[]}],p={rightToc:c};function b(e){var t=e.components,a=Object(n.a)(e,["components"]);return Object(r.b)("wrapper",Object(o.a)({},p,a,{components:t,mdxType:"MDXLayout"}),Object(r.b)("p",null,"You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on."),Object(r.b)("p",null,"Valid providers are :"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#google-auth-provider"}),"Google")," ",Object(r.b)("em",{parentName:"li"},"default")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#azure-auth-provider"}),"Azure")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#facebook-auth-provider"}),"Facebook")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#github-auth-provider"}),"GitHub")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#keycloak-auth-provider"}),"Keycloak")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitlab-auth-provider"}),"GitLab")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#linkedin-auth-provider"}),"LinkedIn")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#microsoft-azure-ad-provider"}),"Microsoft Azure AD")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#openid-connect-provider"}),"OpenID Connect")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#logingov-provider"}),"login.gov")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#nextcloud-provider"}),"Nextcloud")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#digitalocean-auth-provider"}),"DigitalOcean")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#bitbucket-auth-provider"}),"Bitbucket")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"#gitea-auth-provider"}),"Gitea"))),Object(r.b)("p",null,"The provider can be selected using the ",Object(r.b)("inlineCode",{parentName:"p"},"provider")," configuration value."),Object(r.b)("p",null,"Please note that not all providers support all claims. The ",Object(r.b)("inlineCode",{parentName:"p"},"preferred_username")," claim is currently only supported by the OpenID Connect provider."),Object(r.b)("h3",{id:"google-auth-provider"},"Google Auth Provider"),Object(r.b)("p",null,"For Google, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://console.developers.google.com/project"}),"https://console.developers.google.com/project")),Object(r.b)("li",{parentName:"ol"},"Choose the new project from the top right project dropdown (only if another project is selected)"),Object(r.b)("li",{parentName:"ol"},"In the project Dashboard center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"API Manager"')),Object(r.b)("li",{parentName:"ol"},"In the left Nav pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth consent screen"')," tab. Fill in ",Object(r.b)("strong",{parentName:"li"},'"Product name shown to users"')," and hit save."),Object(r.b)("li",{parentName:"ol"},"In the center pane, choose ",Object(r.b)("strong",{parentName:"li"},'"Credentials"')," tab.",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Open the ",Object(r.b)("strong",{parentName:"li"},'"New credentials"')," drop down"),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"OAuth client ID"')),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Web application"')),Object(r.b)("li",{parentName:"ul"},"Application name is freeform, choose something appropriate"),Object(r.b)("li",{parentName:"ul"},"Authorized JavaScript origins is your domain ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")),Object(r.b)("li",{parentName:"ul"},"Authorized redirect URIs is the location of oauth2/callback ex: ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")),Object(r.b)("li",{parentName:"ul"},"Choose ",Object(r.b)("strong",{parentName:"li"},'"Create"')))),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Client ID")," and ",Object(r.b)("strong",{parentName:"li"},"Client Secret"))),Object(r.b)("p",null,"It's recommended to refresh sessions on a short interval (1h) with ",Object(r.b)("inlineCode",{parentName:"p"},"cookie-refresh")," setting which validates that the account is still authorized."),Object(r.b)("h4",{id:"restrict-auth-to-specific-google-groups-on-your-domain-optional"},"Restrict auth to specific Google groups on your domain. (optional)"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a service account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/identity/protocols/OAuth2ServiceAccount"}),"https://developers.google.com/identity/protocols/OAuth2ServiceAccount")," and make sure to download the json file."),Object(r.b)("li",{parentName:"ol"},"Make note of the Client ID for a future step."),Object(r.b)("li",{parentName:"ol"},'Under "APIs & Auth", choose APIs.'),Object(r.b)("li",{parentName:"ol"},"Click on Admin SDK and then Enable API."),Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account"}),"https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account")," and give the client id from step 2 the following oauth scopes:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),"https://www.googleapis.com/auth/admin.directory.group.readonly\nhttps://www.googleapis.com/auth/admin.directory.user.readonly\n")),Object(r.b)("ol",{start:6},Object(r.b)("li",{parentName:"ol"},"Follow the steps on ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://support.google.com/a/answer/60757"}),"https://support.google.com/a/answer/60757")," to enable Admin API access."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing administrative email address on the Gmail domain to assign to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-admin-email")," flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why."),Object(r.b)("li",{parentName:"ol"},"Create or choose an existing email group and set that email to the ",Object(r.b)("inlineCode",{parentName:"li"},"google-group")," flag. You can pass multiple instances of this flag with different groups\nand the user will be checked against all the provided groups."),Object(r.b)("li",{parentName:"ol"},"Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the ",Object(r.b)("inlineCode",{parentName:"li"},"google-service-account-json")," flag."),Object(r.b)("li",{parentName:"ol"},"Restart oauth2-proxy.")),Object(r.b)("p",null,"Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour )."),Object(r.b)("h3",{id:"azure-auth-provider"},"Azure Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Add an application: go to ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://portal.azure.com"}),"https://portal.azure.com"),", choose ",Object(r.b)("strong",{parentName:"li"},'"Azure Active Directory"')," in the left menu, select ",Object(r.b)("strong",{parentName:"li"},'"App registrations"')," and then click on ",Object(r.b)("strong",{parentName:"li"},'"New app registration"'),"."),Object(r.b)("li",{parentName:"ol"},"Pick a name and choose ",Object(r.b)("strong",{parentName:"li"},'"Webapp / API"')," as application type. Use ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com")," as Sign-on URL. Click ",Object(r.b)("strong",{parentName:"li"},'"Create"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Properties"')," page of the app, pick a logo and select ",Object(r.b)("strong",{parentName:"li"},'"Multi-tenanted"')," if you want to allow users from multiple organizations to access your app. Note down the application ID. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Required Permissions"')," page of the app, click on ",Object(r.b)("strong",{parentName:"li"},'"Windows Azure Active Directory"')," and then on ",Object(r.b)("strong",{parentName:"li"},'"Access the directory as the signed in user"'),". Hit ",Object(r.b)("strong",{parentName:"li"},'"Save"')," and then then on ",Object(r.b)("strong",{parentName:"li"},'"Grant permissions"')," (you might need another admin to do this)."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Reply URLs"')," page of the app, add ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompanycom/oauth2/callback")," for each host that you want to protect by the oauth2 proxy. Click ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"On the ",Object(r.b)("strong",{parentName:"li"},'"Settings"')," / ",Object(r.b)("strong",{parentName:"li"},'"Keys"')," page of the app, add a new key and note down the value after hitting ",Object(r.b)("strong",{parentName:"li"},'"Save"'),"."),Object(r.b)("li",{parentName:"ol"},"Configure the proxy with")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=azure\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null,"Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"/oauth2-proxy/docs/configuration/session_storage#redis-storage"}),"redis session storage")," should resolve this."),Object(r.b)("h3",{id:"facebook-auth-provider"},"Facebook Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new FB App from ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developers.facebook.com/"}),"https://developers.facebook.com/")),Object(r.b)("li",{parentName:"ol"},"Under FB Login, set your Valid OAuth redirect URIs to ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("h3",{id:"github-auth-provider"},"GitHub Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/settings/developers"}),"https://github.com/settings/developers")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization callback URL")," enter the correct url ie ",Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback"))),Object(r.b)("p",null,"The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*")),Object(r.b)("p",null,"NOTE: When ",Object(r.b)("inlineCode",{parentName:"p"},"--github-user")," is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators."),Object(r.b)("p",null,"To restrict by organization only, include the following flag:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-org="": restrict logins to members of this organisation\n')),Object(r.b)("p",null,"To restrict within an organization to specific teams, include the following flag in addition to ",Object(r.b)("inlineCode",{parentName:"p"},"-github-org"),":"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-team="": restrict logins to members of any of these teams (slug), separated by a comma\n')),Object(r.b)("p",null,"If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo\n')),Object(r.b)("p",null,"If you'd like to allow access to users with ",Object(r.b)("strong",{parentName:"p"},"read only")," access to a ",Object(r.b)("strong",{parentName:"p"},"public")," repository you will need to provide a ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/settings/tokens"}),"token")," for a user that has write access to the repository. The token must be created with at least the ",Object(r.b)("inlineCode",{parentName:"p"},"public_repo")," scope:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-token="": the token to use when verifying repository collaborators\n')),Object(r.b)("p",null,"To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-github-user="": allow logins by username, separated by a comma\n')),Object(r.b)("p",null,"If you are using GitHub enterprise, make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-login-url="http(s):///login/oauth/authorize"\n-redeem-url="http(s):///login/oauth/access_token"\n-validate-url="http(s):///api/v3"\n')),Object(r.b)("h3",{id:"keycloak-auth-provider"},"Keycloak Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create new client in your Keycloak with ",Object(r.b)("strong",{parentName:"li"},"Access Type")," 'confidental' and ",Object(r.b)("strong",{parentName:"li"},"Valid Redirect URIs")," '",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://internal.yourcompany.com/oauth2/callback'"}),"https://internal.yourcompany.com/oauth2/callback'")),Object(r.b)("li",{parentName:"ol"},"Take note of the Secret in the credential tab of the client"),Object(r.b)("li",{parentName:"ol"},"Create a mapper with ",Object(r.b)("strong",{parentName:"li"},"Mapper Type")," 'Group Membership' and ",Object(r.b)("strong",{parentName:"li"},"Token Claim Name")," 'groups'.")),Object(r.b)("p",null,"Make sure you set the following to the appropriate url:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'-provider=keycloak\n-client-id=\n-client-secret=\n-login-url="http(s):///auth/realms//protocol/openid-connect/auth"\n-redeem-url="http(s):///auth/realms//protocol/openid-connect/token"\n-validate-url="http(s):///auth/realms//protocol/openid-connect/userinfo"\n-keycloak-group=\n')),Object(r.b)("p",null,"The group management in keycloak is using a tree. If you create a group named admin in keycloak you should define the 'keycloak-group' value to /admin."),Object(r.b)("h3",{id:"gitlab-auth-provider"},"GitLab Auth Provider"),Object(r.b)("p",null,"Whether you are using GitLab.com or self-hosting GitLab, follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.gitlab.com/ce/integration/oauth_provider.html"}),"these steps to add an application"),". Make sure to enable at least the ",Object(r.b)("inlineCode",{parentName:"p"},"openid"),", ",Object(r.b)("inlineCode",{parentName:"p"},"profile")," and ",Object(r.b)("inlineCode",{parentName:"p"},"email")," scopes, and set the redirect url to your application url e.g. ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://myapp.com/oauth2/callback"}),"https://myapp.com/oauth2/callback"),"."),Object(r.b)("p",null,"The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/docs/configuration/configuration.md#configuration"}),"these steps")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="gitlab"\n --redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab\n --client-id=GITLAB_CLIENT_ID\n --client-secret=GITLAB_CLIENT_SECRET\n --cookie-secret=COOKIE_SECRET\n')),Object(r.b)("p",null,"Restricting by group membership is possible with the following option:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma\n')),Object(r.b)("p",null,"If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'--oidc-issuer-url=""\n')),Object(r.b)("h3",{id:"linkedin-auth-provider"},"LinkedIn Auth Provider"),Object(r.b)("p",null,"For LinkedIn, the registration steps are:"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new project: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://www.linkedin.com/secure/developer"}),"https://www.linkedin.com/secure/developer")),Object(r.b)("li",{parentName:"ol"},"In the OAuth User Agreement section:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"In default scope, select r_basicprofile and r_emailaddress."),Object(r.b)("li",{parentName:"ul"},'In "OAuth 2.0 Redirect URLs", enter ',Object(r.b)("inlineCode",{parentName:"li"},"https://internal.yourcompany.com/oauth2/callback")))),Object(r.b)("li",{parentName:"ol"},"Fill in the remaining required fields and Save."),Object(r.b)("li",{parentName:"ol"},"Take note of the ",Object(r.b)("strong",{parentName:"li"},"Consumer Key / API Key")," and ",Object(r.b)("strong",{parentName:"li"},"Consumer Secret / Secret Key"))),Object(r.b)("h3",{id:"microsoft-azure-ad-provider"},"Microsoft Azure AD Provider"),Object(r.b)("p",null,"For adding an application to the Microsoft Azure AD follow ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"}),"these steps to add an application"),"."),Object(r.b)("p",null,"Take note of your ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," if applicable for your situation. The ",Object(r.b)("inlineCode",{parentName:"p"},"TenantId")," can be used to override the default ",Object(r.b)("inlineCode",{parentName:"p"},"common")," authorization server with a tenant specific server."),Object(r.b)("h3",{id:"openid-connect-provider"},"OpenID Connect Provider"),Object(r.b)("p",null,"OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects. This provider was originally built against CoreOS Dex and we will use it as an example."),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Launch a Dex instance using the ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://github.com/coreos/dex/blob/master/Documentation/getting-started.md"}),"getting started guide"),"."),Object(r.b)("li",{parentName:"ol"},"Setup oauth2-proxy with the correct provider and using the default ports and callbacks."),Object(r.b)("li",{parentName:"ol"},"Login with the fixture use in the dex guide and run the oauth2-proxy with the following args:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' -provider oidc\n -provider-display-name "My OIDC Provider"\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -cookie-secure=false\n -email-domain example.com\n')),Object(r.b)("p",null,"The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta. To configure the OIDC provider for Okta, perform\nthe following steps:"),Object(r.b)("h4",{id:"configuring-the-oidc-provider-with-okta"},"Configuring the OIDC Provider with Okta"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Log in to Okta using an administrative account. It is suggested you try this in preview first, ",Object(r.b)("inlineCode",{parentName:"li"},"example.oktapreview.com")),Object(r.b)("li",{parentName:"ol"},"(OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications,\nyou may wish to configure an authorization server for each application. Otherwise, the provided ",Object(r.b)("inlineCode",{parentName:"li"},"default")," will work.")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Security")," then select ",Object(r.b)("strong",{parentName:"li"},"API")),Object(r.b)("li",{parentName:"ul"},"Click ",Object(r.b)("strong",{parentName:"li"},"Add Authorization Server"),", if this option is not available you may require an additional license for a custom authorization server."),Object(r.b)("li",{parentName:"ul"},"Fill out the ",Object(r.b)("strong",{parentName:"li"},"Name")," with something to describe the application you are protecting. e.g. 'Example App'."),Object(r.b)("li",{parentName:"ul"},"For ",Object(r.b)("strong",{parentName:"li"},"Audience"),", pick the URL of the application you wish to protect: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://example.corp.com"}),"https://example.corp.com")),Object(r.b)("li",{parentName:"ul"},"Fill out a ",Object(r.b)("strong",{parentName:"li"},"Description")),Object(r.b)("li",{parentName:"ul"},"Add any ",Object(r.b)("strong",{parentName:"li"},"Access Policies")," you wish to configure to limit application access."),Object(r.b)("li",{parentName:"ul"},"The default settings will work for other options.\n",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/docs/guides/customize-authz-server/overview/"}),"See Okta documentation for more information on Authorization Servers"))),Object(r.b)("ol",{start:3},Object(r.b)("li",{parentName:"ol"},"Navigate to ",Object(r.b)("strong",{parentName:"li"},"Applications")," then select ",Object(r.b)("strong",{parentName:"li"},"Add Application"),".")),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"Web")," for the ",Object(r.b)("strong",{parentName:"li"},"Platform")," setting."),Object(r.b)("li",{parentName:"ul"},"Select ",Object(r.b)("strong",{parentName:"li"},"OpenID Connect")," and click ",Object(r.b)("strong",{parentName:"li"},"Create")),Object(r.b)("li",{parentName:"ul"},"Pick an ",Object(r.b)("strong",{parentName:"li"},"Application Name")," such as ",Object(r.b)("inlineCode",{parentName:"li"},"Example App"),"."),Object(r.b)("li",{parentName:"ul"},"Set the ",Object(r.b)("strong",{parentName:"li"},"Login redirect URI")," to ",Object(r.b)("inlineCode",{parentName:"li"},"https://example.corp.com"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"General")," set the ",Object(r.b)("strong",{parentName:"li"},"Allowed grant types")," to ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token"),"."),Object(r.b)("li",{parentName:"ul"},"Leave the rest as default, taking note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client Secret"),"."),Object(r.b)("li",{parentName:"ul"},"Under ",Object(r.b)("strong",{parentName:"li"},"Assignments")," select the users or groups you wish to access your application.")),Object(r.b)("ol",{start:4},Object(r.b)("li",{parentName:"ol"},"Create a configuration file like the following:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "https://example.corp.com/oauth2/callback"\noidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"\nupstreams = [\n "https://example.corp.com"\n]\nemail_domains = [\n "corp.com"\n]\nclient_id = "XXXXX"\nclient_secret = "YYYYY"\npass_access_token = true\ncookie_secret = "ZZZZZ"\nskip_provider_button = true\n')),Object(r.b)("p",null,"The ",Object(r.b)("inlineCode",{parentName:"p"},"oidc_issuer_url")," is based on URL from your ",Object(r.b)("strong",{parentName:"p"},"Authorization Server"),"'s ",Object(r.b)("strong",{parentName:"p"},"Issuer")," field in step 2, or simply ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://corp.okta.com"}),"https://corp.okta.com"),"\nThe ",Object(r.b)("inlineCode",{parentName:"p"},"client_id")," and ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," are configured in the application settings.\nGenerate a unique ",Object(r.b)("inlineCode",{parentName:"p"},"client_secret")," to encrypt the cookie."),Object(r.b)("p",null,"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"p"},"./oauth2-proxy --config /etc/example.cfg")),Object(r.b)("h4",{id:"configuring-the-oidc-provider-with-okta---localhost"},"Configuring the OIDC Provider with Okta - localhost"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Signup for developer account: ",Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://developer.okta.com/signup/"}),"https://developer.okta.com/signup/")),Object(r.b)("li",{parentName:"ol"},"Create New ",Object(r.b)("inlineCode",{parentName:"li"},"Web")," Application: https://${your-okta-domain}/dev/console/apps/new"),Object(r.b)("li",{parentName:"ol"},"Example Application Settings for localhost:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Name:")," My Web App"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Base URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Login redirect URIs:")," http://localhost:4180/oauth2/callback"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Logout redirect URIs:")," http://localhost:4180/"),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Group assignments:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Everyone")),Object(r.b)("li",{parentName:"ul"},Object(r.b)("strong",{parentName:"li"},"Grant type allowed:")," ",Object(r.b)("inlineCode",{parentName:"li"},"Authorization Code")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Refresh Token")))),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("inlineCode",{parentName:"li"},"Client ID")," and ",Object(r.b)("inlineCode",{parentName:"li"},"Client secret"),", they are needed in a future step"),Object(r.b)("li",{parentName:"ol"},"Make note of the ",Object(r.b)("strong",{parentName:"li"},"default")," Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as"),Object(r.b)("li",{parentName:"ol"},"Example config file ",Object(r.b)("inlineCode",{parentName:"li"},"/etc/localhost.cfg"),Object(r.b)("pre",{parentName:"li"},Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'provider = "oidc"\nredirect_url = "http://localhost:4180/oauth2/callback"\noidc_issuer_url = "https://${your-okta-domain}/oauth2/default"\nupstreams = [\n "http://0.0.0.0:8080"\n]\nemail_domains = [\n "*"\n]\nclient_id = "XXX"\nclient_secret = "YYY"\npass_access_token = true\ncookie_secret = "ZZZ"\ncookie_secure = false\nskip_provider_button = true\n# Note: use the following for testing within a container\n# http_address = "0.0.0.0:4180"\n'))),Object(r.b)("li",{parentName:"ol"},"Then you can start the oauth2-proxy with ",Object(r.b)("inlineCode",{parentName:"li"},"./oauth2-proxy --config /etc/localhost.cfg"))),Object(r.b)("h3",{id:"logingov-provider"},"login.gov Provider"),Object(r.b)("p",null,"login.gov is an OIDC provider for the US Government.\nIf you are a US Government agency, you can contact the login.gov team through the contact information\nthat you can find on ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://login.gov/developers/"}),"https://login.gov/developers/")," and work with them to understand how to get login.gov\naccounts for integration/test and production access."),Object(r.b)("p",null,"A developer guide is available here: ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://developers.login.gov/"}),"https://developers.login.gov/"),", though this proxy handles everything\nbut the data you need to create to register your application in the login.gov dashboard."),Object(r.b)("p",null,"As a demo, we will assume that you are running your application that you want to secure locally on\nhttp://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that\nyou have an agency integration account for testing."),Object(r.b)("p",null,"First, register your application in the dashboard. The important bits are:"),Object(r.b)("ul",null,Object(r.b)("li",{parentName:"ul"},"Identity protocol: make this ",Object(r.b)("inlineCode",{parentName:"li"},"Openid connect")),Object(r.b)("li",{parentName:"ul"},"Issuer: do what they say for OpenID Connect. We will refer to this string as ",Object(r.b)("inlineCode",{parentName:"li"},"${LOGINGOV_ISSUER}"),"."),Object(r.b)("li",{parentName:"ul"},"Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key.\nA quick way to do this is ",Object(r.b)("inlineCode",{parentName:"li"},"openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost'"),",\nThe contents of the ",Object(r.b)("inlineCode",{parentName:"li"},"key.pem")," shall be referred to as ",Object(r.b)("inlineCode",{parentName:"li"},"${OAUTH2_PROXY_JWT_KEY}"),"."),Object(r.b)("li",{parentName:"ul"},"Return to App URL: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/")),Object(r.b)("li",{parentName:"ul"},"Redirect URIs: Make this be ",Object(r.b)("inlineCode",{parentName:"li"},"http://localhost:4180/oauth2/callback"),"."),Object(r.b)("li",{parentName:"ul"},"Attribute Bundle: Make sure that email is selected.")),Object(r.b)("p",null,"Now start the proxy up with the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),'./oauth2-proxy -provider login.gov \\\n -client-id=${LOGINGOV_ISSUER} \\\n -redirect-url=http://localhost:4180/oauth2/callback \\\n -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \\\n -cookie-secure=false \\\n -email-domain=gsa.gov \\\n -upstream=http://localhost:3000/ \\\n -cookie-secret=somerandomstring12341234567890AB \\\n -cookie-domain=localhost \\\n -skip-provider-button=true \\\n -pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \\\n -profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \\\n -jwt-key="${OAUTH2_PROXY_JWT_KEY}"\n')),Object(r.b)("p",null,"You can also set all these options with environment variables, for use in cloud/docker environments.\nOne tricky thing that you may encounter is that some cloud environments will pass in environment\nvariables in a docker env-file, which does not allow multiline variables like a PEM file.\nIf you encounter this, then you can create a ",Object(r.b)("inlineCode",{parentName:"p"},"jwt_signing_key.pem")," file in the top level\ndirectory of the repo which contains the key in PEM format and then do your docker build.\nThe docker build process will copy that file into your image which you can then access by\nsetting the ",Object(r.b)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem"),"\nenvironment variable, or by setting ",Object(r.b)("inlineCode",{parentName:"p"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem")," on the commandline."),Object(r.b)("p",null,"Once it is running, you should be able to go to ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:4180/")," in your browser,\nget authenticated by the login.gov integration server, and then get proxied on to your\napplication running on ",Object(r.b)("inlineCode",{parentName:"p"},"http://localhost:3000/"),". In a real deployment, you would secure\nyour application with a firewall or something so that it was only accessible from the\nproxy, and you would use real hostnames everywhere."),Object(r.b)("h4",{id:"skip-oidc-discovery"},"Skip OIDC discovery"),Object(r.b)("p",null,"Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata."),Object(r.b)("p",null,"In this case, you can set the ",Object(r.b)("inlineCode",{parentName:"p"},"--skip-oidc-discovery")," option, and supply those required endpoints manually:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," -provider oidc\n -client-id oauth2-proxy\n -client-secret proxy\n -redirect-url http://127.0.0.1:4180/oauth2/callback\n -oidc-issuer-url http://127.0.0.1:5556\n -skip-oidc-discovery\n -login-url http://127.0.0.1:5556/authorize\n -redeem-url http://127.0.0.1:5556/token\n -oidc-jwks-url http://127.0.0.1:5556/keys\n -cookie-secure=false\n -email-domain example.com\n")),Object(r.b)("h3",{id:"nextcloud-provider"},"Nextcloud Provider"),Object(r.b)("p",null,"The Nextcloud provider allows you to authenticate against users in your\nNextcloud instance."),Object(r.b)("p",null,"When you are using the Nextcloud provider, you must specify the urls via\nconfiguration, environment variable, or command line argument. Depending\non whether your Nextcloud instance is using pretty urls your urls may be of the\nform ",Object(r.b)("inlineCode",{parentName:"p"},"/index.php/apps/oauth2/*")," or ",Object(r.b)("inlineCode",{parentName:"p"},"/apps/oauth2/*"),"."),Object(r.b)("p",null,"Refer to the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/oauth2.html"}),"OAuth2\ndocumentation"),'\nto setup the client id and client secret. Your "Redirection URI" will be\n',Object(r.b)("inlineCode",{parentName:"p"},"https://internalapp.yourcompany.com/oauth2/callback"),"."),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' -provider nextcloud\n -client-id \n -client-secret \n -login-url="/index.php/apps/oauth2/authorize"\n -redeem-url="/index.php/apps/oauth2/api/v1/token"\n -validate-url="/ocs/v2.php/cloud/user?format=json"\n')),Object(r.b)("p",null,"Note: in ",Object(r.b)("em",{parentName:"p"},"all")," cases the validate-url will ",Object(r.b)("em",{parentName:"p"},"not")," have the ",Object(r.b)("inlineCode",{parentName:"p"},"index.php"),"."),Object(r.b)("h3",{id:"digitalocean-auth-provider"},"DigitalOcean Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://cloud.digitalocean.com/account/api/applications"}),"Create a new OAuth application"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"You can fill in the name, homepage, and description however you wish."),Object(r.b)("li",{parentName:"ul"},'In the "Application callback URL" field, enter: ',Object(r.b)("inlineCode",{parentName:"li"},"https://oauth-proxy/oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"oauth2-proxy")," with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL."))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=digitalocean\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null," Alternatively, set the equivalent options in the config file. The redirect URL defaults to ",Object(r.b)("inlineCode",{parentName:"p"},"https:///oauth2/callback"),". If you need to change it, you can use the ",Object(r.b)("inlineCode",{parentName:"p"},"--redirect-url")," command-line option."),Object(r.b)("h3",{id:"bitbucket-auth-provider"},"Bitbucket Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},Object(r.b)("a",Object(o.a)({parentName:"li"},{href:"https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html"}),"Add a new OAuth consumer"),Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},'In "Callback URL" use ',Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback"),", substituting ",Object(r.b)("inlineCode",{parentName:"li"},"")," with the actual hostname that oauth2-proxy is running on."),Object(r.b)("li",{parentName:"ul"},"In Permissions section select:",Object(r.b)("ul",{parentName:"li"},Object(r.b)("li",{parentName:"ul"},"Account -> Email"),Object(r.b)("li",{parentName:"ul"},"Team membership -> Read"),Object(r.b)("li",{parentName:"ul"},"Repositories -> Read"))))),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret.")),Object(r.b)("p",null,"To use the provider, pass the following options:"),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{})," --provider=bitbucket\n --client-id=\n --client-secret=\n")),Object(r.b)("p",null,"The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-team="),". To restrict the access to only these users who has access to one selected repository use ",Object(r.b)("inlineCode",{parentName:"p"},"--bitbucket-repository="),"."),Object(r.b)("h3",{id:"gitea-auth-provider"},"Gitea Auth Provider"),Object(r.b)("ol",null,Object(r.b)("li",{parentName:"ol"},"Create a new application: ",Object(r.b)("inlineCode",{parentName:"li"},"https://< your gitea host >/user/settings/applications")),Object(r.b)("li",{parentName:"ol"},"Under ",Object(r.b)("inlineCode",{parentName:"li"},"Redirect URI")," enter the correct URL i.e. ",Object(r.b)("inlineCode",{parentName:"li"},"https:///oauth2/callback")),Object(r.b)("li",{parentName:"ol"},"Note the Client ID and Client Secret."),Object(r.b)("li",{parentName:"ol"},"Pass the following options to the proxy:")),Object(r.b)("pre",null,Object(r.b)("code",Object(o.a)({parentName:"pre"},{}),' --provider="github"\n --redirect-url="https:///oauth2/callback"\n --provider-display-name="Gitea"\n --client-id="< client_id as generated by Gitea >"\n --client-secret="< client_secret as generated by Gitea >"\n --login-url="https://< your gitea host >/login/oauth/authorize"\n --redeem-url="https://< your gitea host >/login/oauth/access_token"\n --validate-url="https://< your gitea host >/api/v1"\n')),Object(r.b)("h2",{id:"email-authentication"},"Email Authentication"),Object(r.b)("p",null,"To authorize by email domain use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=yourcompany.com"),". To authorize individual email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--authenticated-emails-file=/path/to/file")," with one email per line. To authorize all email addresses use ",Object(r.b)("inlineCode",{parentName:"p"},"--email-domain=*"),"."),Object(r.b)("h2",{id:"adding-a-new-provider"},"Adding a new Provider"),Object(r.b)("p",null,"Follow the examples in the ",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/"}),Object(r.b)("inlineCode",{parentName:"a"},"providers")," package")," to define a new\n",Object(r.b)("inlineCode",{parentName:"p"},"Provider")," instance. Add a new ",Object(r.b)("inlineCode",{parentName:"p"},"case")," to\n",Object(r.b)("a",Object(o.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go"}),Object(r.b)("inlineCode",{parentName:"a"},"providers.New()"))," to allow ",Object(r.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," to use the\nnew ",Object(r.b)("inlineCode",{parentName:"p"},"Provider"),"."))}b.isMDXComponent=!0},73:function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return h}));var o=a(0),n=a.n(o);function r(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function i(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),a.push.apply(a,o)}return a}function l(e){for(var t=1;t=0||(n[a]=e[a]);return n}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(o=0;o=0||Object.prototype.propertyIsEnumerable.call(e,a)&&(n[a]=e[a])}return n}var p=n.a.createContext({}),b=function(e){var t=n.a.useContext(p),a=t;return e&&(a="function"==typeof e?e(t):l(l({},t),e)),a},s=function(e){var t=b(e.components);return n.a.createElement(p.Provider,{value:t},e.children)},u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.a.createElement(n.a.Fragment,{},t)}},d=n.a.forwardRef((function(e,t){var a=e.components,o=e.mdxType,r=e.originalType,i=e.parentName,p=c(e,["components","mdxType","originalType","parentName"]),s=b(a),d=o,h=s["".concat(i,".").concat(d)]||s[d]||u[d]||r;return a?n.a.createElement(h,l(l({ref:t},p),{},{components:a})):n.a.createElement(h,l({ref:t},p))}));function h(e,t){var a=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var r=a.length,i=new Array(r);i[0]=d;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l.mdxType="string"==typeof e?e:o,i[1]=l;for(var p=2;p&1 | grep OK\noauth2-proxy-x.y.z.linux-amd64: OK\n")),Object(o.b)("ol",{start:2},Object(o.b)("li",{parentName:"ol"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/configuration/oauth_provider"}),"Select a Provider and Register an OAuth Application with a Provider")),Object(o.b)("li",{parentName:"ol"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/configuration/overview"}),"Configure OAuth2 Proxy using config file, command line options, or environment variables")),Object(o.b)("li",{parentName:"ol"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"/oauth2-proxy/docs/configuration/tls"}),"Configure SSL or Deploy behind a SSL endpoint")," (example provided for Nginx)")))}u.isMDXComponent=!0},73:function(e,t,r){"use strict";r.d(t,"a",(function(){return b})),r.d(t,"b",(function(){return m}));var n=r(0),a=r.n(n);function o(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function c(e){for(var t=1;t=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var l=a.a.createContext({}),u=function(e){var t=a.a.useContext(l),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},b=function(e){var t=u(e.components);return a.a.createElement(l.Provider,{value:t},e.children)},s={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},d=a.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,o=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),b=u(r),d=n,m=b["".concat(i,".").concat(d)]||b[d]||s[d]||o;return r?a.a.createElement(m,c(c({ref:t},l),{},{components:r})):a.a.createElement(m,c({ref:t},l))}));function m(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var o=r.length,i=new Array(o);i[0]=d;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:n,i[1]=c;for(var l=2;l + + + + + +Page Not Found | OAuth2 Proxy + + + + + +
+

Page Not Found

We could not find what you were looking for.

Please contact the owner of the site that linked you to the original URL and let them know their link is broken.

Copyright © 2020 OAuth2 Proxy.
+ + + + + \ No newline at end of file diff --git a/585bdad0.bcb2d213.js b/585bdad0.bcb2d213.js new file mode 100644 index 00000000..455de0bc --- /dev/null +++ b/585bdad0.bcb2d213.js @@ -0,0 +1 @@ +(window.webpackJsonp=window.webpackJsonp||[]).push([[7],{64:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return i})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return p})),n.d(t,"default",(function(){return s}));var r=n(2),o=n(6),a=(n(0),n(73)),i={id:"tls",title:"TLS Configuration"},c={unversionedId:"configuration/tls",id:"configuration/tls",isDocsHomePage:!1,title:"TLS Configuration",description:"There are two recommended configurations.",source:"@site/docs/configuration/tls.md",slug:"/configuration/tls",permalink:"/oauth2-proxy/docs/configuration/tls",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/tls.md",version:"current",sidebar:"docs",previous:{title:"Session Storage",permalink:"/oauth2-proxy/docs/configuration/session_storage"},next:{title:"Endpoints",permalink:"/oauth2-proxy/docs/features/endpoints"}},p=[],l={rightToc:p};function s(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(a.b)("wrapper",Object(r.a)({},l,n,{components:t,mdxType:"MDXLayout"}),Object(a.b)("p",null,"There are two recommended configurations."),Object(a.b)("ol",null,Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with OAuth2 Proxy by providing a ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-cert-file=/path/to/cert.pem")," and ",Object(a.b)("inlineCode",{parentName:"p"},"--tls-key-file=/path/to/cert.key"),"."),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n --email-domain="yourcompany.com" \\\n --upstream=http://127.0.0.1:8080/ \\\n --tls-cert-file=/path/to/cert.pem \\\n --tls-key-file=/path/to/cert.key \\\n --cookie-secret=... \\\n --cookie-secure=true \\\n --provider=... \\\n --client-id=... \\\n --client-secret=...\n'))),Object(a.b)("li",{parentName:"ol"},Object(a.b)("p",{parentName:"li"},"Configure SSL Termination with ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://nginx.org/"}),"Nginx")," (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ...."),Object(a.b)("p",{parentName:"li"},"Because ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," listens on ",Object(a.b)("inlineCode",{parentName:"p"},"127.0.0.1:4180")," by default, to listen on all interfaces (needed when using an\nexternal load balancer like Amazon ELB or Google Platform Load Balancing) use ",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="0.0.0.0:4180"')," or\n",Object(a.b)("inlineCode",{parentName:"p"},'--http-address="http://:4180"'),"."),Object(a.b)("p",{parentName:"li"},"Nginx will listen on port ",Object(a.b)("inlineCode",{parentName:"p"},"443")," and handle SSL connections while proxying to ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," on port ",Object(a.b)("inlineCode",{parentName:"p"},"4180"),".\n",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," will then authenticate requests for an upstream application. The external endpoint for this example\nwould be ",Object(a.b)("inlineCode",{parentName:"p"},"https://internal.yourcompany.com/"),"."),Object(a.b)("p",{parentName:"li"},"An example Nginx config follows. Note the use of ",Object(a.b)("inlineCode",{parentName:"p"},"Strict-Transport-Security")," header to pin requests to SSL\nvia ",Object(a.b)("a",Object(r.a)({parentName:"p"},{href:"http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security"}),"HSTS"),":"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{}),"server {\n listen 443 default ssl;\n server_name internal.yourcompany.com;\n ssl_certificate /path/to/cert.pem;\n ssl_certificate_key /path/to/cert.key;\n add_header Strict-Transport-Security max-age=2592000;\n\n location / {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_connect_timeout 1;\n proxy_send_timeout 30;\n proxy_read_timeout 30;\n }\n}\n")),Object(a.b)("p",{parentName:"li"},"The command line to run ",Object(a.b)("inlineCode",{parentName:"p"},"oauth2-proxy")," in this configuration would look like this:"),Object(a.b)("pre",{parentName:"li"},Object(a.b)("code",Object(r.a)({parentName:"pre"},{className:"language-bash"}),'./oauth2-proxy \\\n --email-domain="yourcompany.com" \\\n --upstream=http://127.0.0.1:8080/ \\\n --cookie-secret=... \\\n --cookie-secure=true \\\n --provider=... \\\n --reverse-proxy=true \\\n --client-id=... \\\n --client-secret=...\n')))))}s.isMDXComponent=!0},73:function(e,t,n){"use strict";n.d(t,"a",(function(){return u})),n.d(t,"b",(function(){return d}));var r=n(0),o=n.n(r);function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function i(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=o.a.createContext({}),s=function(e){var t=o.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},u=function(e){var t=s(e.components);return o.a.createElement(l.Provider,{value:t},e.children)},m={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,a=e.originalType,i=e.parentName,l=p(e,["components","mdxType","originalType","parentName"]),u=s(n),b=r,d=u["".concat(i,".").concat(b)]||u[b]||m[b]||a;return n?o.a.createElement(d,c(c({ref:t},l),{},{components:n})):o.a.createElement(d,c({ref:t},l))}));function d(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var a=n.length,i=new Array(a);i[0]=b;var c={};for(var p in t)hasOwnProperty.call(t,p)&&(c[p]=t[p]);c.originalType=e,c.mdxType="string"==typeof e?e:r,i[1]=c;for(var l=2;l=0||(o[r]=e[r]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(o[r]=e[r])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),r=t;return e&&(r="function"==typeof e?e(t):c(c({},t),e)),r},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},b=o.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(r),b=n,f=l["".concat(a,".").concat(b)]||l[b]||d[b]||i;return r?o.a.createElement(f,c(c({ref:t},u),{},{components:r})):o.a.createElement(f,c({ref:t},u))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var i=r.length,a=new Array(i);a[0]=b;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:n,a[1]=c;for(var u=2;u=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var l=i.a.createContext({}),u=function(e){var t=i.a.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},b=function(e){var t=u(e.components);return i.a.createElement(l.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return i.a.createElement(i.a.Fragment,{},t)}},p=i.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,o=e.originalType,a=e.parentName,l=c(e,["components","mdxType","originalType","parentName"]),b=u(n),p=r,h=b["".concat(a,".").concat(p)]||b[p]||d[p]||o;return n?i.a.createElement(h,s(s({ref:t},l),{},{components:n})):i.a.createElement(h,s({ref:t},l))}));function h(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var o=n.length,a=new Array(o);a[0]=p;var s={};for(var c in t)hasOwnProperty.call(t,c)&&(s[c]=t[c]);s.originalType=e,s.mdxType="string"==typeof e?e:r,a[1]=s;for(var l=2;l(G4B2AyPV^ZxAyzQde)kAuDQ=^B?XzYXD**X5ag`v1F6Rdg8KkL za2yFw!!s1;FWiH_@Qm-t!{7N~#D~xE;W3W=V;Kn~_xF_rc)(!r;ITY{xUnLLk3WL! z!&5%<2;#_tAd7kkA{c`p)HVs_%EIu%X?-~vDdYtGC#5nY5}qNld7y5OAQ$7&KRB|E ze(w=PqgGbx-V>L>r4e_n_l~1t$9;F+T#CSaB$kVzxmx`FOQffC*ZX2VsYr>+zR7S` z^Q2ppWJXK4GjFq;R-a6M?C#X1A!zF@;x~zMJyjAn+L_`c@f#g`&!A^4V<9=v7h14R7WI9Z(&qLm0j>?>Cf|U++mVy zVL0zc$NKW=3fKL-V_r=p|{It+~N5p-b_Q>Yv$*K1zPbiJ7jA`Wv zZAq1M4vg2<{EX@qMTML=Fz1YnB(Uv1L4tvCx|7t0VjqJ}x*hGj&cWNL;bPw%4{#U0 zIEMtXD}|a;`H*{42ge*to_b|ne9RG)X&|y^wPr&vzY#LCBGJ+Ax#l|*qZ`Dfg5e0i z|4XzNOSVQdg$R$0&Mt*AG2Ftbcz;qacXF_%nU}AK6A^fs_CPH!Vr`@T`kyj+uY7Ss zK6MUm&%@c%v(%}4i_h>oQ!6vxXL-0Csw;nch*i^2V&~BRxx8f_7VTLSDL*Aer{57; z+x*n?;8BIj=7?xNM;Bp4g<@sV-t(k3I8`{)Q8;JyDWy?w zO$4)FoR4Dlmy>M*t*vhLl+$` z{})0I*CXzm_&vtI)rvv`Grxbw{uodV6sxe|chGsK8~1H`%W#&O$y`UB;jPDfKK6LE z@lY^lYTiU5sE9g^fX$4SK-qb=c(0DBQzxPEP=dwvsV^muP0FpQvPXWn+MyY`J!MQj zkw*1X=e|eMSEe{}NR7zW)c7_tvv-{pad6{q=ayl1Vrwr$U(wk33Y&RU|3JEf_K#pF zmy-F-`2CzDkA^S}0*P*IhpfX?mHnL1%kVuTaSB*OPy()0p0RyF@d@P&ZH~bLlc&Qz z-AsO#4snMdIg>Rt48&^T`v^z18r}x6qq|PW%gyep$=AWTLoD1hRE15^oU&4h#tYx; zC>-ZM?@4Fu7F>N@&K_oU@61JhC0DcRn~ysfRj_JBsa-qQyiMxNeKi{HO>#bt@bM1gud?L0R!jx&9%<+sx$b*W6)FzyWb~d9y|yOu zgtp5Wan{zZru8DN+}%0z#iZj8|5;Vac{>fwc2(}xcpdRPx}?34;~i;y-9C&~!;Rou z<2O9R6mbd8(keUdv&^Y8nPo(fi8yJKB_{3Ri_Jyr;`3B1VWuKD|FgfQ#59_kd3{f7 zyh%-d-l5Yx&3CXZgYSCMJrS6!p`%C`v8%s1&YLrJb=|O)`}fUiCFiLK{7#hv#gp`6 zBI6Z8azf%F@s*CsY_I1f$V$|rl52jtZmbEV#2b&BgR5V9*Ur0s&Dc&n4oNlevSqm} z9eHcLPS!6*H&b)9G;c@cAb7BEu4)iAGD^|&Cd%F6`tsL>!d z{rb3KrAtVYJ+$1>Ywcc#$t?9EtMDSbD3jCgJHZNjGUnK=4g14X&C6V=6Z5i%tIruP zhbH-_PoyrL5xawXB24uDiskW&VkqZdqqk>wr@spxuIx}N8JnexlvCgx6z3$@(ofE{ zudI&;2@eN}wUynU_lVKeuvLZZ77_tN@!}x|$38rK;h=F+d+xN>~hqk!9IF7YE zJ-5ckeu&Nb>OR}u6iHbR(bXY1qAES|+A=aVIAxc0Vp-T;inaFf4$CUvyxsr!Z`bE7 zJPsUgQN7&~IX~ugJ;h3Qx6imd)kVHOT;p{FRt8>-d9yb;AIR-^F6N25=5t~-{&M;I z54@olJ7}I2iSMJjt@Kp?dqj_U2>EWx=fMg7^taR#CI0JS5oEtNSC`YIv<=qA#I{tC z+31q<@~zy{Tf(X0XUg2mQ?HdPBAccy`=LbHL_Bu~s!WdtJG&3tU$9kIlpwoJ`nLQE zkv3y8?iZvlk&9Y(oOB72GC5P*?Kq?dChg7GT?@XYH{C5YOTBJJr_Av7&2H`4;8c>* z$;gUwHn+`#;x>1_ye$#mlW*EqM;dw8F1q9xRR8kHDlgePu)8jyP6ZbVD}Vd2yXTe6 zn-^YXxFVFa8^o@6!mfqy)4Wo&ToKKUKaWp;GKwJZpHi!b@0ZTJBJx@B<~{j)K;M>^ z^Jak}g*89RL2#IQ)!ct~-}I=X=+O`Vz$oE8p`2OU6TI%Rkc>j)kayVX5p}KgoB{HgIFg%k+&nv&~ zP-2r9V}0+;NgjUK#I1MK1CJ?LY%0u^QreHdD(@4z4WwsH#N92w$zfiGpN5|Q^{uK zg9UbOF0iJ?yht?Q_gXtU?TD@{Zg{riuGF&6UL8K9><>d!54?lqF1n=;?Q3HLYjoYQ zeiu|lkCYonx;_+yIl0YkG)YBIESI`U=52=598SX7aHYXi)_uO_@(_EmLcaRMW=Qw0 za`gG&(7klOo7LeM+m@5GWREEo{NVLujfM%!SBi-<+o$}_JMzs&|Gw$5NCCn5bhtp= zY+Z%RnqSq7g1$0dQCqwlf3uZ4@u!S+uOMD3=}Z*LiDx`A5HZy_NRoP+c;$6}Qv~VC$wqQLX;`uIitbc7)@$ULR=wnSYX{OOXoQGnBeDZKK_?eE)UrrGOY`@ za!U>B5uZPI?py>d)dMN`adHXCIW_E(b`MJ))F^ken%uOOQ!|`HVow>?E<&Nh{ zf>3NbyD<92Q1l0XauR>KZCx2~kRft#CWXb6R!-BU*~eTrQQ+%;8AOSEH`A{yjfU|6 zmjD?&@#p{U2J9q05%Nri=6GxKdqy#7n!Ip2#Y`+_bn$DLe`AhF`{B<+iS9EP%X_%U zkE{w(W)A&#Xv9*KJa)bUyW+}-;R;9AoO760sl?P<2Q(VQrxhqa@>DyJCx^h~J%_ic zXb{Rz*85|tUxamxtEc=j0TR-N41)NPNZgd@aVvGCSy_C4BVNR-u$BJp8?*^yP|njgJi0@o|b`s z*-xxBMVA-b{ToLvR2Hg8wR%h{(9cFYHF?`pz;Lgk!-b4}n%>*Ydrd%E`Lqdb2>Y04 z-x?9gu44lWk1v_1mw5}B_VGt@SD!nr+)HUZ)!{pKSWSy($Jv0gWqJATyl&Evxi|eA zkE4}aRf<>VRxFI%yv&pMJaVX5|M`>wUDDX{QN>1moWkq&w?fLfy0=|<@|J@%R&DE} zP61NO{k0#>I`#u*)WWP0ejKsYOeT@i)`hE8Vc01+tzcU=x0RVic|ELsua{kn z@cDDEveu0oN1GR64rua4#xq#EHY9@VE!B5g&a8Ow&$I+v4^b$w(UH1N=wiTCh!9b+H8D%KgeMt&Q#D`mzHw|w zdN{AiErutMU#nr+y(iv6WXOIh1GE-!8w8{gd}#p&Dy5tNRr3Nvh1Py>nb` zX6uQQ;9;=PeeOdtwXLCMYRmtIz*_oVAD4ekonb*-+)ft6#D7FY_2$R4?N+Vpl2e8B zPB;-tXGpG$lV2;RqB%0-j+L*TEn<>VU0!fjIKdHZp+|Hx0GA@wY!} z!L|txMAykw(XGqOQo92zp2!pZ4RAJ4ri4Kjpu@gDE=i9dsWXF5BDW}y$*W#la#!Nn zXkEZ~&eO_?MN1zpg~=e9@Rp_5Prvu&x<0{P3#yQfUAwkHjKHCDRG}MriHFGTB$aDq ztSFPFg!Sf|+ymgbI@UY7-=rxdQusEx@hxYYsD1HoCNxcC(yY%@u^?(9d!h6v>K@td ze161h&aB+2zY7J;7|`?z*BpDv;)sc2(HS`Bn7G{g?$@EjG(P8p&c!C@L$&>d{4tDU zInvJh?4~Qc-lKf#JJ2OatvIWxR4k?)qbki$_vw;duw87p{blY;aWVp}V#wHa4d zqiE;-F@R!km;Ih3#Oc_OuWgoaKx%oaJvL)A%Dj@fdVW#9P(Xq&f-?_}G{d~J6)^47O90v zzUiZW(Ag-~wy+j>@~}1FrF(H`I;X$%BRAX0aZexvQaLnx83H25Jj^$#f8JgXsY`vN zAz}-wrc5ks$5q0<)@IDcIdkH?W_>b|;hp2GWW(&kBfjv_QOn7Uadkf8&D*f$hq0#J zf)|<0;;lu6Ot0sa?%ov>8!}%Rfmkq=ZEV&K!mYSG_`m{`&N^aF zizx~!FY8d=crSOW`WM&gTG`^Q4Y^4Dl6il1W2)JcCVekPrk!8@Qc{TldjSuab#7DB zKp9t-dG3pral=6T|5DY}7~sWo1OJ0B%H%mBbPos`es=ELTi`Mjk-h`*D3krHq&?2` zqOM}jDHf)@A0eDf>lZ~P%K2|}3i30p-{1%jYD}a2;p)r#2wM}>nDtGZi79Myk&nhY z52mUQQ>CjLuq-LmAdr^QL8t7RP&mGHhiOp@{p3{t*o!Ijk;y-gc7K$>#}`dnIi;o} z3~hOJu;M|D?D^tMoe!eJJ{>hOhh3|xs=^R5-Z%AJU)oynK5_T<^z?L4Qu>qV<>l39 zPOIpy&Ji^-_dC&icRnqwh%_K5=z+>ZRXU61;j$efMmr=$x7v%4l(cvMaKTvDV-3IR zm9_jH!ApK)RIL%QQc2uLI*qhpN3X63oMyO=0ICyy}DOex*kTV(WZ!RP> z#smeG=Wwxy`;({bZ($oI8{0-4`?L|CtlaV&N?0{m>!MC0{PR9s3-(Wxm3=EJgn9Y+ z1}k)*Jn;_>4t|C?OH7RI-n~pilUPr{J2u(e(qg}_BP&bP`occL+e^gVj-QQ*DV2*e zy!>T{iPXb~XZS1!4L6Q8tt;`M{CtXFh%Ul#-kKd-kZl{yqx} z3&Yi`(w^3Bad(2=zODP6D0Gg7Cgh7shSOSxtdvx@h^w|Q9^!ehE&c2n6--?#R|N+3 z@+EFe+lyl92E$ulq~BZEnps%mO|*A$D`>1jh4>(7t$Q5*>+ z76UKMbIa&>T`dD z_0riR*%VJBy9Wo%92_J@Mn;GaqvR_F_+4FHT@7QED2a^_am}(kbZNLGYdA6e)yQQ2 z&quXw4Mzyouq97n8edQx9Zi@2RO>OifF};T>bL zu&|K2cMr#HbKV!`%*@D$gV?N3%jSqZgK6c>ZTaDR{`5(&^OJ1mmoN8RTuR+Su;V}c zfB^Rqn0X$w%u)2Xx=jjmI)vEey9I?DGvaC-m#J%ga&Wym+Ro#}D{-n2l| z?#6<;{Kj&qgvfcdM^*QAUe*3XLPn`)&!U3fyrE=`l*NA2Du-c2*WWe%edQ+nd8RKl zNTER>-mUF=#K~t&N-z2bc*6x)fNR&U{}?W_*IY8mxvHzH3;YsdLh#=KOaaeF#0HIp3iXC=L&;nz2Hr6mX=pxiB}vA%7@6dGe`>FTRa4RHb{+&RJPm z`MJH$Qb&LPJWs>WOk+#SMo{}3NS1O|DhyAbJkjgTR$nCS8!EA^4LZln16$%B5HPXU zK#$q09qn9)W0c`1sUfGJ@QlE!=%gZnyKJPi!eH1v+(soegemd~l9}qU-ZaSy>s= z_3K~iWCqO5&81yk%dT;AQ*X?+QD|bUp6cpWxG2Ml!qY8FOZ4BPhZ>D~^E88h40tVt z9l(+oyNFVA>sYM0^fug#eZ<7ddjBYUFGegvbIRaY>auMJ)u-U#GgrjCv=YtIs;cOa z?k3HKF#0g(QC9-%s=XKSQJ8@0>S{spG>C-#ot3;QQP*`A$S~(&IHH*VbMUU&$ZzQ-UiFpyb5K;2T> z-tkJMPT1bY+|*W|Zr^^N0t9u*aH_bV_pvafpRCZG+lGzg{;yu4K@Ed=tC7-}AFQD{ zO827h5_(1|cSb`F4?RdO@*wc=aWp-@4brFM&iPnH1qXrY%XoMQqhSv@S@`5|!)2rG z?oE$fn~MF#ECp+$rQtFPA*a7J5R8y#U&4@~IHl(1lCnR`u7TsHtfJ!Qi0x(M=f8+P z1F6(z@)uG3(G>wZJT`>{aW5~?^^FZ>RnjxF714&sHjl!&V$31)XaH? z#n?Ux5;e)CTX=91??YjP9nSYUax0epTs))taI`AYZD%=0ffC#5gLA4o`RM4VCwXS6 zI!X=W65IBoHU6$*V*mE2`--LG!Qi0A=JLqUtcbBP&XiR+gVL_IIV zG}XR4aiTA)WGLYHXsq`1^axOTLk%f$OP@&}-s0?eJa@>rfqIB1R!L6l~rz+%(6CT z^vb}A{Y>{471D#eoSX}gF!;jSqobokV6tT%mX*mN)ZAZ(H1mwqUGQQh~` zwTI7LT?ML+wl#CwV>N6x=arEfMX{qN>CnRh0J>0s`z1erjU92BOLSIaDf1S4A?IaYjCUBkD@k^t*{>~8Xh)P$iWJ$z_JyShe2?I++Ql97J`r&c)XuNdzf|Ig zeKu;&+?ga!J!i^f);ptHAw%aXwYIfYIrB9u_cC^Bs!I|}mQtzXwKuaxOwFa0?RaHr zt4mSr&hciKqIHsxbM8c1m}sZq6(+NK+}Ah{xd{a?mp z;$>0>&)Atu+ay)IGNrwE&Q;jBY=(^&!*%Xl*&S8PfQ$Rvpuv_NOTJMZW+u$sU%nyr z96tb2NRb zL4hhrWBY0zlGG!ZvTXP}K|loO5&k!AtXgJl>a|#Td3hp8NsjcMo66BwR6-((E+81> zV)~DKp+PUC16jtisqFpX;4^|;E+S36bKCg$=Bd>>sC8&gp4!J&PNeNvz+sR8kSTh& zT02Z9;%4IcW1OIdM&p7rP7sdGMe%Rw1s)zg-Ym;m=*qz291RH*4}d@m9$Cq#^0^P=`oOC+ zcg!f?MMidXcW;smdoWGa)QAHhWrM*JAb%DdsdyL)>R1IEeH zW@a}aUYtr@Px|7m%4MhY_>{O-qiZ4VM(>?LS>R0~kPyi<^tnxY|H`N8dA2Oc~1#`wkn7 z`A(qP+`WU1ci4djou^M{!ZjgsD$5;19?0FEoSc-BAv|;D{As^?pVHG`r=&1M#Kc_l zC;w@}dj^4eBY}qxO_sDUavS$K_M+AS25x=j2@~W;De5hCvr10Gfa2ys%ims3ocQ7`0#vj zadA$r^J4dPWgQ)>jXdU_-rnF(pI9B1R%+c-4lwy}ch$w}Aqy{j;t zHs)P{yTBTrKK+2C%u=b%oGxwTwxhSTwO!nP{rdG!J)X>ici9_{oSaG?$jO=Cc~)i} zt4VU&4`!;m5z=~#cbmC^bx^`^ z6;56iNo(4xSX$-)Z>gRX?v2`j0Cy~ZG+UCJs_eDkK>M!7@El8%6oZsKZlrXGmZI0k z2_|24Ywj^cSYZi52ptB5pOSWKYl{hh9cPus%jC%STUgLswo2{Bw&#p^FZcXn4aopW zBz_|(Bt*sF!;tO*b%*E+he*7r_wQL=kJPBvRY9P6ckbLFZDGH0LrFi;Iil(a|WWL)tKsf5X`O@>P|UC%)w#@m;uZfpo1U`Fj>n z7W9N2S&g}2a~5}OR>x=6EkDc0zk+E{AT|>}16oAuCCNnakQgyiaR!A7*RR_zp z$;X>)cQD1XzlB!t{v7%QczQ*&gkBNQx7WdpIMKYh&-^tj>l`_`&)>fmQqs~B9|P%r z`V&zgNV~|+6_A~9Qv}4Wva+r-hPJ@uf>4!Vs{U;)pkK=N8n@yl85^3Mny-T@@Y|c z_ZZbzbXtC?L6(FA{P&eW?-W?vrv#pI5nNqxb`SP1l z3)Pl)g>u?`#%tFI3CQSvfmS=%ZS3on?|tG$LN9s+2!XV$?CUmaQ4l$gBs8m!fosri z7n*jlqUs@#VF?!(mw3TG(#yPrpt^%r#I0$4hR1wNhOs=O;6!xWHQ^>@&9D({war;GU z4Tw~v2+!rWYDFgJpp-@=C+BVD)pO2FPwV}7iND*Td;Icg)-wT)lYbPsp0VmH><`P= z>S=Iz=U&0wK~b0*Fdh{$l(bh?$6$eLCJ@(zsAK? z55>OwXXxN;V+1pLT7dMvo@xjinvMh=@5$4r0u?$KD_RIJrW5bx-@otc>odJ*iwo%Q z@8_d+2QCetdAjiwbP7^hLI2FmYw!_9I1iv6f!;_9ye@&c}|ijub9Xi+Exm zam6>!6tpZ&F&lharXJ5;7#VPF@{%c7_zvX@s0JanU3vRvc=A0N@w+CtcR>@nb?dR^ zzD}i^V~G6Fx+5q_7txG#fTk)5Lf95=$e%Z=_7~X$rvSCS&e6ntJ%Ge{J|ZGwkyCkq zg-iPW{jUe0E-kLv|H~5F+zQBi-mqW4E(-@_;8#q1eAY6XnAjNWDA4RYpvwt*k@}+gmhwJ{erv03e zku`U7PFb!!E~HJzfg13fJ`~N5!qmEne$U;X8_iwyt~9ql51-Sgjdq z?2wk7wkxsjvdk;{1b$H0qN0W z%x{sUADR}NgoK3RZf=68xCOf6sbuftvcch_zlH5g!opYJpp?Q9K`{>G_UCY%U6#w{ z5QJGKw5V+6!uj(rA(IOOP~V-6x7MQD>CZPn;xZm9QA!{6MadjNJ_-81Tuyv<#DSu- ztIM|b?A@Y;3dlo&uU?&o%=HDcdF$4#@YvWdqI-M>^(0T8J^MN*V`;y?X$l(1cnEiu zIOuL@uKn=AQM#>qXV{+1XZGYSQflEg3MvHjKK$k5`EX3C9u`&oq~|puhk~*UszP!4 zy}Uky-PH*=g%@wXAc1y<5~xy;uHm|wL$V;jeKSqJc-QI*lBt@FCI=AYs5mw75I)Xm zyHA75Hy9WYzze0@gXXB9*P0-pa%43#JDXZwei<|7CA7Uf5>iyeYtjD=M?gT}fr7#- z=*B?4wAA=3At3?e0{+!#y$}!(094}FOMGH3p=zWCmgn5%%fYZ_@rN&H1BLUT<3NiF zCw$hUB!vTSKpFj%k-^Nuf_JdJR12T#o>GYCI}4{AzM*$tbxPSV#6d}k9Hc{=23lvm z_9PKiUWZygGEqV#M#R0O+}il@c2;zuhX5C)OzY0k8cAfuM3FPt6F zNed{?8UC%}Vi@>gch}`tLqpofk3S}ob_?4@Ljas@k%fIL?_rIn*>bCFJGgY|(jxQ5 z&*k0(58CtRCpSy9HHW=Vj-c38$yfZ|o?EQQ?jt57{N~EJA~$rR_=t0;+>u>EQt~;V zo*lH=0#T+1=?U=xl?T`4DC%{EJY(67TcABW;A0&qCm84L6AK_12M;M}}<)5OF?{J{f4sNkP<2x&#!C_!o~ zop?o~q@iJE@5`b~fQOe-RMgE#WlXKIjS6J&(I={^Sw|F5;}*V&x#~zuOPh_!z($9O z9jlFS!9J&_r<1z&nE88}`Juuz!eidc5x=9DEczCjK8T6CSAOy{*;yiYkXub|R%^L0 z74zjmtHCVL5qcA7ECKbHgw?M_+gezxc_h7=nVH6$yKre}b`kv1dXInl^w);%BGH1R z3puo^w5PR?&I?XOt2}%53h;@bwiA@?;_IU&Nzs)7#MJsI$xu`@o@;7B&kGb0W_I?L z&oKifmNZVw!(T?L6(2mP5n8G6gT3MZ%goK)Zgi`FJ7(}9t3>Q4Qaa(Fn3#)O%@)v+ zLVN(-kMGSTs|q;`(ty<-lws&p_(B6=D_CV2Q&DjR25?_l`P`@*ma}-}{L#<$_V&;G z?>5~kH6E#*knrkOG=}!{t{m*`4QO3dFC2|7T(Oaq^lOQ-#3~H;HrPkW2Dw+tlJgzy{#<)<7%;g6A!kzP_`R(4LWTTx(E}26 zMtyW-21Si+mcB=k4Xay-}a>vEIZ23CmMZM91S?9w6s)#T?Z7}R~gA(afyZ8U7)(7*9_DgL-VbU=hoBi zo}MpdtWe_tA3g0OA|a77F}VgUK})*&c@sFC_0SgKfouU1`xQW%D%K5WX$2`Et=hSf zif?dM!<8?i{aa*+YNIZM+5kFusD2OPQy@Ha*UE}`CTPKMcTww4F2xK9;*CEZMz!Bi zjG-_Ba@DdHm`$L08;Wpy?rHZz@39^?;D(%`vYnkymI4GoHhFY{wY;GA1s?TRJCz)L zSf5rH?B3&T<(|SJIrXP7{X_YU>i5ynS+u!1)hE4va!xP2(2fz5?FAy<8o7x^#bF|6nk7 zPZ};k7FASI<>~bYyS2C^X3@^syEkRA_GebXbi@}tSA94D0y(`A`0JK1Ek{_93g%i+=v zR>cRmbQ_!UeP?A3rlzKBkGA>@fUj^W;0aj{@ExfYB=}xmO3o0j~dSJ=Wko>I|^&}+b+1uIKbjja+4l>%cYuChIykK=& z89j@{@S2`S8%H2NgoaF~7aFjmebS!bkdS=6AGrUhAnuc|+5Q0vYlDCO_@Ji@DzSNA zZXFPTZy@4i9JDnx{g|i??CJQ9!VVx4ph@U24HoxTy59w*rzdJ5D(WsMGPiGceY`N# z-cFWRxqbP??*vzAgDoxJZ7rYc^Si`6OavU^fBP|nMuvvtAgGd_N~aZeA?L0>EU4W^ z$rq3j8*n8|_G(%eUn-o0#qEdO2sNL_``F_m$!QNLDH_QI>_-U|8Ko}m$DSQO%Pj{+ zV=>4fm5-w4OYZB}ZDYPSdL?}feXOk9u_!E?lb_@#4;9@mhI+{^Y{pEqg#E4Z@4nuV zrkgD+0^|A`8gaGdb#-+x4@_GD%nOAGckfce4ugbI3sX*{!*YA?5d+nj0MjDp-gcliE!PR{gO5(y7@&YKe&YR#tjsI{l~u$o!^9eWEW;6mZ9ao3DlnEu9abg|E$d49JUn?h=SEWl4KLd z2P+tLMJffLf<;Y?1ukE*vLrz%1ZT>N+a_P`q;+I2tA=jUUbqkd0$yrq=|$+)OF{A8 zbo0z=(X@wNbyneN2a1Agoj5L3;#s;>P?Vv)m3fMl>cR!I11_){d%8Hety2y9d$lp7NOqPETW>v z!Sy!_lKyT07UOIA8~Hx#`PBFP3nmI`qR3=NeQM(%fC(O>W=g0aP)o_&cb4lwtgwX! znWJ7E3^@}k6hA^|ay-(HsR0`f(9V?n{0>uMvOftt#AnWE$iD+f5p&0!3RNh8h3WwW zMg2FD<}cd9B{SVNe*F4xf850=YUhB_(C#wG6=Hk#fgftnSI+Q_S<>-c04R zZX9YO;*P;$bK2g>fXFQ3uK);`AnAjp2tcfZ8W(qVw*4P?9mJxyPys*fD zjgQ7mLuLCVL+|-%t6^v$;exbf)!CixA!~yg9~|J9z|D!0y!K6Dkx!!l6I!>SJ7eDT zfUy_%f4{&Gq>%nGQ7mcZH=l?YDxUeS1?^{G;BcTSPL2=MDqQmAEr8GLE?Ikrq^2@~ zZK(gRNlIOCUi*|OQavQGd6$~<{O z=`*Xp1&!RN^s2Tzm`%*vzHpJ2Hiym_>|Ur1 z3iOJhksj0}1HKyD_-AM&3_A^30tBo6yCiyYXdmAP(gnCy0(J6K*Nv%zJC1)+95FYfU`7w{6$<4V`%uo zIyb~ySG_JT7fcX#?KH|pC0#Ny=b)UgUz=x7$Xst0!`mS~+9IhA*H2GM19Iw&ljJCdjU+8XB$Zb%}_GsIj&6 zNybOWSWm3ygaN_E2-vft!3gz>@y?wOUH%R{dqz>1TLuOOYfWs){jIO@c-aC_3m@3s z%w9rql#-V}d%TtBjk9Zn6oDWIA|Qp|>9apki-%{UdUiVWEmP1KIZsSXTo}vSoAg7k z21ZOf>mVm9Yib*ZgEhrL__d^)WqGa&5Ol#ow7A`M_+fo#$9k=z{M24)RRZQA>`krw z-H}gK#v&`R7O#^)0|vmewpvRz1$tMw-CyFs}qTHO2enc##&rQfK8>bz>@lk04vzZFuV<-qLn{ zag=WMhLJhu_w-mfxC|Z5K5e7YP~xanFD{h3-2E%4(Y5p+8B_884Iz0A=jMvpICCDe zZd6d508tVLLC@337--e2z+~N%>u5)925hCGz^x zAkD$E_Ls~d9iq?z5;7w%Z#N^Kd(PIuK()6R=#5uclSRN<1y=_((E9dD*9TD6?PD$_ z#O>|vF>-PJUMPU2RZgtY7;PT>?#zv54}f0=lfPaoU_yd|;6`d09+y=;Xo7z6HVg>~ zQP$K%J(v|6zl9bpOQWK|#C8svPrHX3?UowfffW*qiHSjf{WKiggkJizp@Md9GSOXz z604D5)P}mcv(o@I033TkrwB+9ld7P1W7R;JHsuNFQiCpLK#{xA%<3 zYkZLuo$1CU?J_iEfYG7NvA0WhO(6oiNQu*n){}{^ZfwpTg@y{?y|}8;hw@683;|L$^|b* z@@Y)C-f20GmcWt=0=|Iq#Qp5?%y{%m?*zFV8^l%QXwr0IyUNX z0&CGvC_bod8ENxYJl^lCp6rmJuLA?wO{jxN8}$oFS+&zmktp3p)A+q=uOrY=GDJUh z0HKaII5;>!g#r-s?gJJT-5oz=F;Ia2_U&7R4LM-c=-iS*MQkVWX2IGXscRT<_28}m z1ysiO?FA+<2C! zv$R^ZB^A+|Ab;liFYd_ugL!Ohc2__EFIU7iU0%|Sf5Zyqw}MK{{-B95;9H_kK}kvP zLVosCROEdPMUv~$Ly9kA-@l)BSbtcSxYgd*-?1+`$+3JPi@C1yb%3TbOF z6!R|OmJtY~<3wcSCr!N>MsHYrm&*};=Iwohc-BWOOE53V<9WKs3G(8$1t_I!WZ&W; z86+R(e-=4lTs)(#&ftm9t2o)n)Fg5NOcc;LU0qw-V;9uZZ}>gU6?y4h&ic9?;!~$@ zYB86~)ptEbpt^|fDzPaj$T(=_r<9f@u#v^OXoP$iZYL8v{FB~*ZEiRWP{@dfIvC5$ zX8*yyC43vTO*c0`+}+)!ynE+PPPbsvvsO2tbC@vz-SCYaf>Z^Mm6Q;q)M24BfJ?Lp zZprEfK*BKu+W{_E0i8%1S11~A&Fi|N>5jsj%9K}cgZFYd$$hy)kg~vjy73$$ZeTEV z;#jvvdG@z5j!ny*KCRo^V2E4%_+w3|8)#9luJedv$WS$#CA4gLV;+4bL9DzNc(Yj2bKXZ9rhf}ix_6?2>H)ZQ&Y=m|Yb#6Fl=d;kd7<;F2XF|NrQ$wBuNS%~y4c_; zGi3%>8XT`sZ7b-#Viq0BMW{m3w+2MNu#XtuiX~m{&#%onA#@|3jplNKWtsxrB9X{P zx+ET^y#a3aE|7HxuI_Z~)tQU2@|-;yj_cOM@|O#R)OETnbfyz~g9FvSH{a#bEcILA z^+x94yu1}oi6CW-hRzYVkIow*wH_(&$vMc4U_QRb@E_|RDJ9%c^52;r|9`dq{a@S| z6?TV?bBIqU&d74m!fN~x|9%<33mgNN61WdU6txqH}r~4cVv(niJ)ROWk;-VcphRSSC9i7 zsZ*sCHCq}4T{upsO#TQGraG;k`lE?u5UkNe=s#Qkh&$SD2t#q^?&oJNC`L+s%N={<2m+rVDmaQooYPiGjT`~uELoW=J6 zV+sZIFG8-cg5rT92GVEzmtctyZU1E!_UeXP{8MJyJ4VqXyk2f>j?IVUoV zc6TwjdbZQEka-QO2^0(;C9z!e0cG&dKD!iWxb*q*-DUia4}Z`*uK1eucop^5_rmrN&SM#)j*WId|7a30`((+FI^d{ za&`S0+%Ey`dz3K)ec_33TRZ@I1ImX02nv?HcjMa{8yl4{I6lzVgbJC7RjYkaOEH78Eg@qw)eP^pSUpL0~^{y3d(-yS{tQT+D8j&{c)S&`0Ko=H;EgQ#~Wnsx_t&~8!>kZ&Y{bOlLh zNKS*}P6`}TsAUW-y3me?y$6#R9)fy{K!C(Y9IJcty1Kf0wz@hyyN$p(wkZ1Mej2$% z5cr$!(81fsQ|-%+4%Ul@G2l6C=LGW%AtPW5N~C+o@8!#1ka(rEv=VqOk}!#gXpe~g zAG;X~I+~s7Z3$j6*VE{YF`3xzzP_wAHShZ{LMU+(=y;0$e7w+>c&+mJ@P$QDtyya9 z3Lz2^6~zkubs-_mBhqGJy<4&VO@@!{BU**-r{(t?!mXQ(sD%!o&NWWXr}i>1LHKsF z-0*`a?9>@Bj9u!T19Fo-OXKOuhW}esN=5N*8d0wi=(P0rvKH;mB&N5?(tWPBG;0erNXgS!f+x6sY6r^LY zP0Fsa6v~q7P|Dg#WT-in%1)vow9zynStglM45!l+MJZ^A&f=jI0GXf7Y55(Jd{N~hD*hpbPnHFtIatiF+W)& z>dwjhu`v9XLpuhbbkei7MRt4A1bXUbt$zAA_ML?$hl;gnf&osUsvvH3nanRITDLO; z0%v4CaDf=4g*7Vqvq$;!X5To~Us9W%iz*#ob&qhEa~&nEmKqp1)=b94OPsPy<%l#~ zw-(KlpJ1FRHmjJejprjcxSl8SW@P#lR`aTZy3(TnIBaZ*sktlC2s^_osC!n?cDZCU z`LWd~)1hfub+t#xv@$!=M=yP9tsbhMnbk@HyHYMe+Dq$3B^8#t#6#ktrL8SS5h(*` z(`$lBXkR&o4foOecYRs7aN(0mU#Ih26mt*+9*lZ?Wab=iv}Z0=0l&2f#l*y@oRMa* znN`t-w^0(Hv3BIvhW|MqglBY|$13%4BDx?bxo_)zxTz9(Jf1?T9LRhu>tWHyX48=` z?|S6P%@EQglRb-i10H1Cx3@_=4`}JoB`X-XB@t=_xTMXmQeqSVrU+?4c|l+NVQlQ4 zZvNo}Jf~SgXr57`euV&Oaf&7=;{KbxA@@*}_b#Zlw6l*<*G8Lal2x*!YGcb~5S~RH zpFdA}K8*vVX=5-eM`%>yc56PccUy?LP)Ye$)@>{GFrC&O)yX;d^sLif!kMI6jVs~k z5$P7{V(3C&L;mocFZb|Bfmi^Alh?yEbpSQCh?7Lo20Ginkv2nC9c+T z7=6J0p~uSTvG0Jj5pYYJfszrN1M5^c`JDt>-{ z!HPJ-nwtw1%_`EK)yLFw1|Z{-BPh<_R`TK(h17`QXJUWL`F+&{U!H1&_tb4z6L$?! z+i}PcplDDztGHl+7*#JCwWs0%0h~4TOaU4DU3m@l4g_FV4%}Y_wQ9$_Tf&hBHM`&C z@R1>7Sc8w0qG}}xpA-Vk2kQqap8}YtF+qrh2ZG!~ARp)B;D3Nci@FJbF|1*l)%4 zscE0q3na~nb3~~djR*x#QmOQbPIM?`ajMfl27eh=EpVY}@td#sNyJB_klubv}9{Xg?#bg?(uo< zO%AsDV>vU}IWY+UmG0un6{FUrEZ)CkJ^Gp(^crt_j_byg`oSwfZa&VpZgA+W+1#(q z+(T@sct>i54D*fS>iBu*mXNc5acJwM^PLd|*9NPyMV4P2P!L zyWwkn?(&qS-Pb4&UGtQr+%5}e zgt=#U@?Vt_1-Dk2pLWB;k-b{$ZZbw(O z@ce&TA>-$t?@83#?4Utg7JgskWo3P-Pzj?h=uQQ?G?AsmrNzZN9J}Whrte`mJYT}i zJf2}?9#E8fjgI011oHJv+egZkgIDW}kFbM}$x3S;rR`4SCo4pK)Y83Qm1j1N^$!U8 zNo2gNq22EW+t4`mVGP^F=VgUK6Fv0RcFZH&;t`Ro4}>2FSqY{LG_PH~0ma!yyTqv< zbacey2a1az7}L_xApj`1#61$!vm7LOPOBznp?singiCnHBapzoeP50c1s+FgZ|*e(fQ1i3di+tgX? z5|=*$T-Q`_eP}HS+N;CLHFWD|=QKNTT3Q~EgpK2)X=1Xq#Sruo(cg1VL$Yu9N?dyJ z)q3lwQ6DUKk$bHI$zY%?g1ytCY@3)|0l13`9_KJj=~Qy^J&>Z9P2h0Jyi`B!9gwr@ z*5HkL!xO$iU@42ug+6E|1-U`cO=vr85ZnoCL?S+v7etja%n}%&dFzKJJOT7p>C>Xj z{J-M@IyBJjNJ-C@XElpZXb{vI-HjXwrL7h&DWGMsN53N3Ao+Cq*xL>l7Zpiit% zft$q=VgV{1%I9n5S6Qs*SCq8gmejpfIIo8q-KES+jN~++?Q-O`Af37fNt7W@8(05v z7&DEcKlvez66_tR`o8k03{UmsFTWAS%9COja zP`6)>v%&$~6Der<{sBAURUl_$AjRT?uy0zGl2ubn&COj*?gDz02<3GU2;@cfOQ7X2 z<0~TXqG8&Egby79xy3^xw|&QA@&1I9zynFY;U@3=$J-~_w3q`gRQbUee4 zqMI~4Z0%|F$U^*b`b|Qe^e>YulwxBqXqcFEsjqX%WYiAy_Xp)&`mOI!PrEA;Tjhy$ zL()ALd%L15G!H;=(sEQ4feeP8c6HwfaUc)o`)Ye`TE+bGu62eEjSQ?)oq-u^>Z}Lf zhuJYX?U-zc?O5UYL{=`Mh@1~V0y`4d*lxS(s)&hp3>-xZOF4VnyrchXB2IxlM#}lN z`o+|DN~T<}&wCV`;U8*^D{Wv^tX>Ac%3FRCKM!=CdR);{x&o84ZxWA+Xy&^i=q7aI ziU9vHyTf-M`LuvSsb0Q5bTc|@|$EMZ&+o11YOK zA^j?&`=e}?9bB`2hO>mr73`%cJX=zW&Hf=6E67(_byx|z4uElKNI<|sajXIDBvVu^ z>#h96@=h3JeBJ8pZ74RapjLX6HAQXlQ;~NLWZhU@K_AlRx`nko!vvV?iQQ_H2`G9$ zsM(dN$kYVO?0*A+(#K*yjveQ2qIAW`s9Z$a|L@ns;HhcDtvTXTs_u4}ajhM`)+O9$ zXZUXVuF&21Mj6wLO!R4{`ZTjGv>)k4#`GUe^k_6XjdsZVpw@r9Ab78j|DLG-{sKv# SHq6(is10i!ZA*UgO86%=uK;BL literal 0 HcmV?d00001 diff --git a/assets/images/sign-in-page-947a0ef7ee9fb0aa2b7179b8c7a1cc76.png b/assets/images/sign-in-page-947a0ef7ee9fb0aa2b7179b8c7a1cc76.png new file mode 100644 index 0000000000000000000000000000000000000000..06e095616d17bcf688afd1b123bedcffc3185db1 GIT binary patch literal 34914 zcmZ^}18^o$w>Fw&VoYo&Z*1GPZQHhO+n(6ACbn(czVn^)<5b;yyQ;fZ@3o%AUA@&2 z^0H!Z&{)twKtOO3;=+nRK)_%B=yOQ$f6sFBY{xQ6WWV%X=n2$A8X#OhlUd53U7R%AqtWB`CQ3>|^`>Vw|p>la&AuAfb! zxUb*cw0a9nhAqFcJ3YnT4+rj#8x&OR+XJj_G14b7Ty^V6^yEfKK7A66G{3!9d09JH zpatS5d7qb-FHG-q97EGaO5RK4yudLmJ%~TZHb4g%l-Mc4FdC|1VSSjf_^*wQFrEn> zf{k%!6c6!WmD^R3p-ur05${a2>H|?tQvsO$nRDMQ zp$$$s%}ao0vGcmo;e-m&v(a6@fhDj@94Itf zW$w~MxsK9qNu&Z^9jy9YG%E9SQlZXMMZ1hp8Hf5dF$iOT8@(uwaGPiIV{XW62+oj{ zPB_Vaj7l%y=@ZXj#{m1q#preGyD@%k_u{|!*UxAgZnBTPu&kGhQ%>0HI1W}5!GI=i zS+tVy6Y<(yl$i=aY=V$@PSA?LC`nB7C&ge=5AA32sF%+!YNt2Wp*4qGGI_^j?=7u& zTCc*dweW$?=`dzf=3578I@qpn>(-|Y!Zu6`h|L?_HsoV>L+jNJ(6tjA%qQ2leT){o z3iV1%?4n^QYWc;NE4yxj(0*lyaD|ND-Av#-Fn~<->+`dyy*VCtEo_5)QOXd$H9ENo z2T1GVWBU1S%hPKo6eI6@;g|`oPZuyU2JvkH!wto6gAOFU_R|E_0o2z3;cqq5Wk_V? zwmz$c4(n(tPe>I6W)H$k5FIT6P7b7!5B2EJPzTh~2h~Q{cnvRzukE#tplaIRz0pD*#4;0#m4PfQ<=cofx?ZW~UU=K$s3{oec6$e5JGA1Aq z$DI$7Cbaqsb?^U~FHa7>4qqa`AR@k-)dIoly~tLoM3G}lsWi2_?KWmIY=bl zZ~&69L}9YLCOL94jV1m#JZgZXa7j^Yk!%sAf|~qP`A7L^IpHF^QKu8H2P+%=&`}@18eq(+E6R~HsQ5-g9o?VU6CV&XS18;4gg-bIahN!XV7QqFkU=`uz zQe;+ytYDr9j+TzVj;M|>j&}E;_uBU`hc<_DV|?+odlt8X?krt2 zya;)Ld@;3yZhK;PI~3&P?i9%sRpcP#zZJ4e&GX%b83gJj^GU*yoFQw1F$Nq2S@!Vu zQ1`eks|FN72SygXo}dL3mPkBXlGB5cvH5QhE1%2Lsmx=K%K#bq_@f-GDua zrY|BWLNuZ`qCIdKF&NR4#*x;P=9Sivc9EV*_oZ)Suwwk6H)C31f@k9Er0uMIt_`dWrtQ{l+K$=Q+!oX>=j7%{cU$*>aX)mceEaxN zbq9U7ephEuYrChfNR>3yk zG(R$5F>f=!V=QdaWh`l|`&V)Ne1deMWt?_AV(jg2PKpoKU^8gK&iInBrOaJh4f1LyKdBW9R*!$Uw=aahH_ZKl^_K{xttt@Ctc;zwEAa zlZ;V|DON3Dt(mUAF7TE0(GC&|Dpsgqs2D3dtJWxalaLaolD~*tMz^8362Bt7!sn#q zgmAt-8|VP?2SO7?Bcs{Ygw_yM-)( z_i0LP*|yuV5i&clRkCU{thC9p`WTU2r5&jm%pKoe>KXYC3#t+78Eh*mJ^&sam93Hm zmaU#R#aqYa4J(6|o-3z$0zb$`KC)0?h zl$gjB%`M4=(dE=F>pJdY>4xbt^Ir76_u+l}^LG3p`%&?h^O$wFa!Yrg2R{qNj$DUf zj-ihCO8l3ooYS0Xm9ULBn0ko#(3IT9T;ALa!%W?KRliN$UG&vGSW?(vNU&JKSOo>8 zneGouCZ5OASrlR{2M!ZrC7u@22h%j~wJ5iYx4E}opt+#xK$-B@P?W?eptd;ni~B?A zSq^8GQ{DlA^VFk`ID?LZ=WUQMNGMJ5mO_9+PO(JsK`Ct>XMTO2V;;Ul4wsePn3ud!K!;cLFlqT}5ARUV~Ca%^Amo@AZ8E_5rhno*|ws7H3WA8-q#hlPr7<@-_#|^Kd*Wz~3 zyi=oEMe9-hz`-%^TTdz3yU&lmC9e&xJf1oBCYSq3#z^DGj7uJ$x54B7UHseZ zZr#@H1ma4x(dU}K^lJ?;Y&Citf`34%rN+ofnnZ?7;)Kc#PFaRh- zmz0GxxrIH%>QatEchD2iV_OiP6l_88PTG@6s2O>ojFm46M{G zRj!NAbzdEWnaK8}ZiF3**Fra1u366bw{2n_dm2Y7mpNBSyB8;B7qz$q=;T;K$dgEd zsL)}wAu^%x!kdv@2rk^59Hhi86nHtiN$z%h>;&%eBx|SfQj*f=cTEG2#eZZ`f3dTV=iwc=W1EWh$Q*!Kw94B0P&eU~uO*9RhCcf*%tGm&z5uO!}8J8M&j&n|m zsH7Uq)`=-4^+7uZ*v~7gZkVYc^iydho(@D@RFvz~x{+Z1O~5v$4IOviCy{ zgfDr44Z0&QMy3UjVG!&`co+p*#|x}B@rDxYOv9vWR-nB3u>BpRAu7$4AF z5?xH4iZzdG&~tb_WWRjuYo9I|V)4=|)bj5v3Zs>nPg;Yy&wRqWKYO&fue_&&7Kew0 zafDumMT9O9CNd!MrZ%LABwObxWqz zU8Nno6X!S8RMmK1$}TOM8pVp!o9Ol|B)u{GZcics3khi#(I``tBSQ(xxub$2=TUZT z)jr%Tkt}$4L(kRIt|rwrtlq0c71`&%`{S8o+pQ6_(7bzr$u`ZlZGmNtXO&_5wGF;w zXo=og?J4$9v(JKfZR+-HY-BGBE{va><>&HH<5+#g*ozZBL->o5Dfo%`aS88)AL6Iv)6>bo z=x~Bv_l_N{3N=~n>JP$u{e7bk%U#+zmVu6&k?G10(k#v&SXZGaefxBgOIX`f>qPGa z5IKbWMIuh65_!D>%;K$Lbp2T)SYysf?dkcy>%-6CUxcGH)6g~Uwl>##-01Ey?kBH| zZy~Q-pqrqoU@*bO!JZ*s!uCWDHhJbPY!6{Z%)D$&iwFJLT7FYYf|F15`1 zmK@YJR%lh2Rmj!+^y&8&Wbaiel+;&3HICI;6lBD3qu4~iI0h&^4fsz z^m(R!ro(Z>g~Mgb$;=MYdDYqOK)YhvY28=drQO{=EjYT%M7bHectctf`}BeJM*T|u ziUAQ1AQULpk3l$(pPP*`Al$p(yFi2|YAm8I!YtewN*?tbg&OgR=F7@YqtC?17S4P0 z{;B@u_S=<|kKLK6gtVEQhKA>|PAYU8aZXzLII3#j`UK}YySeCKG#95g!|QsepF7Pv zC8>%`4JH((7Cnd4<XSljwSE`mgx&dHfrpoOsp)w7Rnu1JF1?g*=^5{<(%Bki5ECdTi11G8aMQ( zzt26VT+25M`j65VA|Wo ziEjJAb;Y24s+jqpKERQ)5Cka^y(bXC*{tgPz~(?qyC8!6(B%Z}^s(2AddYS z@(|blW%?l0gc-zK060wkYk8bx2%P{t0el7ZWcqOw)DTLc`z{$kZB&TeK<^y*Y0{}g zG&L#m!|%#KnvohpOjWuJA`KP}Y!AF#kUWuqGIjxd5@n@vg%;$ca2sVw<<@ezik(^E z1;qv3l7$lN;?@#;<2rr!k<;ndq>6Nn7?0>9AS!Gt>?~|94lgb->N1=Yx0;L11nzt8 zi>@tikV(VV+JcS0AxOU%dgtNc?21o{^r*bN*7pEuXHA(d{=%+TQreC)EU6HUHmnP$3elaAVlzUqmhjZ(3L z`a|S|GU%X!8Nb+ky`;F*-lD9whXD3&KiLbXua#yyXsLIqSNu`m=Nj3c_qu1xZij;* zyBV2^t1qL8A9jAACV#M7AO!-LMSsFNFgyZKKmfHotYx3fEk+j@3<9`eNO4Pd9uO)& zoIKwnrbtMl2uIPp{E7m;KJ6-Q570~z>g?GmVKgKu7*phH4=9BFcN-xiPlKwX#Jy%0 zD7{xE{X&j`S;qDq; zS)HC7=3&{>g)^=)74t;1a5L=NB)dAxP^)OWe;x?u7O#H&f;dW|E3PX+D?WfHGnq6? zY#?<)ijz1hl7@9+7YqTHmkO1GzV?4xXIkmxF)-K@+x}_EkyZ#9!gv)UGhIO4Lpn!z92TL_1pc~ z@x?mHZ1T>#zng|#*o>eHgpun(ufow`(M;0d>%9AZ*{}JT^T&}VuFQi72L{XkMIC^> z|MBbZcr8%OE+U4|G7m6PFmr*AJd!fVRw$|bVfczfx!@wuB+y4+>)hq3(5Xf=@-dVu zgco*MXs4X1X>$6n7<; z7Kj&f7+D!j8b>Q;9A+&=9%gT|f2V%(EW@5=f>1FD)A z8x}mYoSPkb-iz;_Zw_GmpsJt`!Kr~b2|H+Qmrc57-)F z7>!n^SiFZRmcK@0e%iZQZH|=H>BrJ06@qI?jyurh4Ud8I!v*K*SS{;fYKa%HSb*9K zHc~dVmg5$VW~ME?b}h%9GvJzseWCViEgsKqVxPOO#9z0&0}p2f{Rv%ag0&OdpT3oB zsbAN3pi9MDi|sE=_$7Q`GI?1Z%v@Y?ZCml3wve{ln0iFmJjFabW?g~y`IbAR;*TK%izmn%PcDgE49@#*0}@7B57mmBwf$+cCJ&v(FxO~8H8HnzU#pg?KxeWKgP$C^jS$0Htq zH4Ly_-P`HboU6uAEdTjxJMR3nvO~U}`cL%IyJ0DsrR!E8AP`UsWp!tD8EH-?3=T6Y`!e}@S`K-}(}|417XX9EIv8*5u9PIn%n|B~SRNB^gpj)>sDM4YX7h}31| z354t%O$bZOcTG%^V*x3^NN3VgQor^OM5z&7P z{h#Z<{WNj6_`jBHo&Hx?{{p1@4~LF{mY(ka3+8NL`u_v_59hyO{}tDNo8$hEGER95 zcN1$3VGA1*Tc>}n@iH>8a{rf^{}<=~I{H75>i-wX!oc`Hk^h79Kal_Ngj3GZ!sK6) z{*ww`25!3lSKI%R=cfBlp8iMP{<|pu)%ve0ywKcq|EI#d(AH@b=|DjIKoY_N%I?6I z-7xyeOF69H#*7kefK8Baas-$_boE(C+Co)xwo|ltFikk+@%U07F zVlPua9}gOXpR&9JMUkFEJ72+K1;21%seM_3x5WDd^=o1Y#wb2usG~_Cq^AV>gh`)c z1idgJfOTSzIcuR2-~l?(i7_tTE<+$$YJS%@{YX_I@zpaZ?GzlPOn6K%XfF2HHoh*lmZ> z=QCHxo732pkJE<~;Jw(7 zSV4OB>8K@&z;bEFTl1C=6JZ2k^VEq%qk88zUgfsP5~W$>Moar>ze$kIpGu(cu5G*( zr+RGSvs6k+(V1!F)9-=)N}zpcXMCz7ix3w_5Qv&ge9Tdf9nwd7StH_o^daI)44Q=E z)g_+NMgy|}%(@XQ@MQIQW`z7C1`_e&8FjkIntWss3eJUsbzC5;r{#@`#5*edb7vS?`>{vAuYt)ItUyG=f$BKM9vuu^ z>4s4sefoqnk935T;6Kzsr7jCwM9+|@Pbw9Qb@J>yQ|D9Yi%%CWu5Rq5p41uFHt5|U zl+J$28$&VLKS6h?f&RtF3k5NWS_qU>&R_}^nn2GI{m8A@@bTBz>h7Cc@{X*)>m|2s z7oXNqTj?5p1gN zPEYR3d|QbNBeFzfv0#HdcK{@XFd-lS9%T5pynt9bK=FDAeVJ@3FBKf$=vN@X8b3nT zI5%EAkEa^O5k7dV@Y>+dB$AE!8p7T?$^rj?!h{D0_T3SKWlDN*HNH=9;=U1v=bDLm zRw@<=d#c?S0zD`!uu#4R0Rfen!x)2imk*cg)n>rM$Fqo`#pi7%>^s20aulGS;rS(S z7MPo=op30|(d^{0{f@c#AN7=I3vKf z8**1#I5?(2*-RS~dU6A5+Wyi5zNr-BN%aH)!GH9*-yV*3Qa#jocjJpemNAJm-Up7T zGl_sEQtY&P+%!`FFmra5;eFck@B`8{Z(d%K6$#kU(P~pCxJ!&W}j604El@Z-KQcQ2kbVs6kMWY9@M-)E%yw`0IiujY{xeVuhClzD>1IUF7(BE^?vueW0n0d!TKpO8Et0 zM39&JT^pRv#ez*J(E8iCwX-roh+C3w0poWz|GPvQ#QA33?&75P?)xkiL$R-iQ!jI$ z`4)~6j9W@T{|4jw6-fDRGw&Q^pzMmke$V-7R1bX9KEYtcXqefeP-^_nRmEc`#2P)# z_D_&#uz1B<7a$_Q1|YGL`4rUh8+sN-=~f;{*N`9ahdPcHLS(IxAX6lr@2|}=)tpe6 z$$%Mg_VG>Nw0bJhsL^OQa!(83UY_4z3(A>KIoM*~ zYy`+MKE@wHL-xM&T#8pO-i+w14?S;7Li*-O{uB!%UYg?9yD{JIR0MIaX5Zw+B z$+9iG06ZIrIWm(e8IMJvs28UE%y4~?daXYgD;_M-@$*Hzn{J^hi-8C&%Z{fZT`&m; zth4AMLS6qHi~*+k0pZ5rhbfJC_$+P-je)SpLzuUUg9Q(;WD&~LyCMfg^=!{8@k zZW?M1xJ^g#*v!*y=A(T>;m50lV787J2ysPdxd&NNykH{esTiFZDWXx}<+*jhUkzzo z!ZpRWkwCpKyDASCINPp0(M{)t7Yj79dP^6s_c<04x`;&n;8B2Z_$>*Zc`k>Pn}8z} zk^1%6ZGnhA^NrTRg?CkDAgSjGlDx=f9KEF65n0QhzR$OpgBiNs=$p?6H~W*ER<3@5 zZ_ks`lh!x~uzuqfA(zBHkylLw@hfO(0w|m&ZgT`c*59gHlAu)@90TJoq24#RZO;pu z;?mMWmy6|T9KXj?g(@E(IL99{^qsDEO6g7;@Lb&|h$_uD=I`DLCAmIwYNr5DjQx@) zFqBq;00{>0rxJbw{>|OGs@$@sCX|U(nn9--p16xzw*A`J7#r;Wd>RmDAOVSC#WGwZ zO?bLeyRfbFZ)!?&Pj+kbqqqA~m1A;%^6??ZVqhr@dx=j8kP}TdHtFnehn2Wz)7hnc zmg-b&#JDIglLT}z$;wnHZOsN0*NpLr3ZBmPXX65d9HdO7QA`hj;dvWugV!$K_ph6t zq#2L!t$NcdETnQ|68D(NUFu|1i}&nw^@Xp%bv4Y**jXq#+O(021rT1)Aw+s?QmuCB zcWdls&q$0-_=HO(_v-PeWQg1C4{V3;x08b_x9yR@klw;RL7m+BsJh!Ry=zm*Sw?|7 zvJ4Za4nC;76OB-0hC^5V5X~fhn^zQ?U*SsGOM6(>1RAkOSMu(tquJi&fNGk}{KvWFQ1H6-j%nLtb>+p z|23vUAtGGN=5G?zTJRv9y=qd4NuHl~@fF!@w4BZs2sO)jIh*TQ<(()gD&CIg{amtF zv({2<%c{E3Wa$V!MrfB>cdiao@lEeggMi8B7mf50q_LtiMya~2T3o%%tL z4$u+}=#U&C)pR+c*T`|qr@Lqgm89bB*PFzn=L6f+=R>ocW{e^mClCtm>yB9O1%V;FqCIQI_^b3Hy@FJBjWKi~_#+=Ci0P2sXcQ{WPh zGgd4B8gyzZ5ToBbP!UrJhe94OVDPygH?y9f@IG~QepwX(IswQ7J*ut;G8VrUS47}bDB5+SzwY~aJ9s{&=`yyBA zEl;*L-Ioi-Epqb{aW?VQJ#(gRm-+{Js4U$}EGl9#LxMu>ms%^QQgdDguU7ScW+h#S<>4LmC0)y- zR;Zbjbi--DHiY*hLzmd}Z>3|0C=}%lzrBoameUda5EJi2G;z*6YtD2{sF0C<-G$#J|cIGnV83NIpXIIP1@%#&w!bi1!38q4#a(K{=! zB3M+4T8r?p%alnH#MFu9Hb`$ox;cY(6oB}vFEoMGN{x#tO7kh#&*zN!N@?@LF|viB zT=G&NFiIR>53Jw&LSFpjTbgwXf0Fhf{Kjxk`_qSpYI+dAN8|$7+HwB+^eV`nB=zbi zxRUh3irb}&c6rcSiuDeSaSHD#5=qlpNes#6o zon}fiXc*QX;`LdftlUvtBQf`<#?5*T_}%K65Y?}-B^GmTYm9(;_^$I< z@9S|~3>r5AM?Cci^?I(nydXpls=ek-D*cObF8cl0lQkjzlW`6VuN%p(ml4L5m3sJ| z(V}5@7pU5(ryO+}FPAbmh96dCJ=lx1?eYQ7-Bqu^KiYxu$m&mB*Ttvfh7K(`k>_HX}# zR%M(~bBE0Wf_W&UxP$AbB$7N(+h&hqLrGg`I}MFCuOC>U)EJ3U{3|iL>nHp8sUxpz z7wl*p?&w`2P;5#{VS1kanF9_n9S$9hfChz8f4ToXx@yo0vrUfj5YlkYp<-&D_)3>) z^&2Wb*|TG+i>bt;6{c=CAmm}MBqK4|ukn^`ReB)JbSt#qW-_*m@5JEk{)o1NM^trb zRN85mOlG`Plrsa1fyJGbK)OPV6sDUXY`p%WsSs_VWbdJVNZ)7WZRh*h;E?x+%<}3_ zg=u16f%*G%4p-5IhE76ac62U}m*G|i+ZlvKP?lZpfC`ugu8O_O`tXg?em-2_F=`-X z6DC>yY6z%ly#MXk&d)W-OL6xLK0S~CG}_R($VvGV3}sGR;%r>{{ZDfS0GG^SWQak zg2N|?8(7EJr9iSFn`+lLkm@Wl(|JwU?PN)x-fT(1Q+!G%j1{jRT2Snb(DlVb{DvQ1R-e`Ji(p%M z0Oz=G$o8Dg+TWu36GDBaOVGtVOT3&w1pF=afQkhi$)09AbMD6W&u@KIJCNwr}bcHLX_uJ1J4 zjz5ek=sx}{dOUG$K%-I5L~h%^KJ8B|QxoR!?6~cD8jibSE7xAkLfu9(_2fntt56}k z{2-B&R9V#V4cTEK8cz5k$uxcXe5VKPRqUUfx$hQ{S3kqX-1YD2AF=EqIWR}>3~Xr~ z-xPf0wze@Z)OT`<93235@V=ad$g1Dv_@y;%7;Zd|pw}{VBMUFvp&Jd~u>xVb!y@(X z=U7_%zTfR4Z8p0vZicp{=Me6r?b$Ik7b@Ce{bP8Q>2ZD~fl zm-RlYBaR){>`>Dmyu#N+`{9-Kw-IIX&+CKfOlCNES%V1~9|*bct;Fu`_c+lPd9gVK zZ>K68SS<#S%x0kFeF+eo8&+c!5!x`Mr$kr79*YANw~^RX=7gyv+zC6qAGKl$FN(QJ zpR%FRueYHQZ2FT=D+_QkH4*oj%s#^pALQ16gp)@>rUpb08C83*yE)ie|5gMj8L4T` zy`aib1#)`@Kj_?lm2lEw?qqA_z5LvUW}Ow}YF3g)*6Dm^@%|~5061EfqTn5>%|_{D zV+RBOwy&3wy6;j0 zj>NIyJov&c6!7i5rUF`u20X9r*NvQ?oTx_h&^h!KZpu~12lY62THaB76cAEEjSrXL zEA1XB4q{C(e9sbJa$HfqW6H^^?NYzgmv#F;~F9F7~Wu}ks}_x$9)0Gt!|q0Z_SB! z3v#i-VNVz6imSphgZNeh){1$%|%=iM^Mk*4GwX!vQunOs+#o(vBE zuTj!X=4%)ELjLXAkv49l2Jl_}bCTDC%qj7md3&FOB6TyqM^@iF;!8nsQ$9OyYtEJ< zh1WfsP&?PbyyBOIJ9v}8A zkZk;~Xq6X?-oLlkdCZ<}c?fJNovf*YSn&-w1b)hpf&y-bf~QI#tV4ma9q*b5ydss6v!UeMu+=>1ut~ z!0sbXWK)gT{hnrO_x0FIw3zk{yHp8fV|aDN|LsRncJF)MXY!TCoafx%6Nqcc=-cK1 z^f>psp4YAFJr+!L$umh36r<3KBqm}>6e`1IBr?mJ?x<=z663f{5ATfMDaR#75EDB~ z>1N6M47i{ddW(DRymj``DW3psw zIP0D$bF)}MgCVi1H-4z{Xu8NHL^HQ>xdjG?8hHy06by#hf4ciCp<|-=b!4N>^p+fH z3(U$?6oJbH2ng+2LojcZb1?46iwZGb4b!RABg`5!$4G4 zNta2#&r#K4`zn}Ve*f0lY8l0x_ecSmhQ0n_&%?rA$Z51+;JT8Z40G08SGZY)=tPK3 z{2o}_aSE=js#n&-t)@*6pDi$OH=1(fzD;v0x1lXW=wps-P`%vu?4iT`>h<3c-K$^; zY4euG`hM)iC#E=2bfOvM!e3aX_tQ+i?FOOEVTV)OX#o+lz^mj^(Yx`_8FZFL-eW>- zyrFvSzAdf%v%X{rn zELSr;Q=1dMWtC@qZSDO69k*&Ef^zjei`!eXeiy5@B@#8S!#(YrhhnzxekZ6+Hc*?o z?qZ|Wp5`#@viWUPlC9)1zzQ2+8VN)Z=uKe~UmKP7!FJfaNVAVtoPeFSDZJv2)Go={ zW*q1Md+7CX)yrysS8JT>t1 ze%zmKnn-D*FON4B0dp7t%5)V`F(q}wiNJ7DlczJq>(W8xHxGdjW17Y~og5nJaj z2rY{n48LvC|&@L&|gNQ?fyo`7@)d7DWi zMbv4h8jd2)k0Ag1Dacy-`x`Ky<}QRHxUG)~?VMIc5W5I-h9XCL4GSv7j>kP>w7*SW z8{vo2CF={5;D#!9yba9Hi;Rls$2&=m$nK+pMcI7d2v*2Yw7ft^<{_8;>I2)>*2`pe zVFFUARy#r@I+cckKdexr>6X5*^;=1c_pkYj;WP=K@+848q&nqSXjaAALlbnIN^{r1 zI9ybNQu0Lk0KdXTDMpWg}_)UJ8N)Gun;r7!PRwe7OWiMJ&F z(PeVP{Do*e(1lcPrmo4+#@G_2+R^cWY&N zNnJ_emyTfNOE{FeFBW@dZ8q=Bn+#W@>?6C87^2&SLW$PutRIwCfh|k;VEE8_t(Udq zkr_hgZ5JfY7nksRR+ioD>{6`a(;hiV2yFsLKDUjt;uSJf1D9xKIWX-`ouLo7ITl{F#?WikUwbCfoV1yIy_E+uOq1Tx-8XItee!l3)n8|UzYpP+gh_-|0OdS+;|=XE5F z?Vo*^dAeWT-?ao=T)p(20>x6+9sT0VyOI8olg80L=-QA#%#GXY#{HZURa*0cCu%mL z{I07wYWgBl}>AKw_St5hhW&K0zo8OiM{t zFetr9!YK#pQ3St1g&1#>jRJWcmv>Dbm5gPQ^S|kb;xx$Tto1;%(?Bc#QN$3RD`eYu z_su@f{0rpoSh39*l;r+5Ar__>IAq#}b=nh#1_YD*4FfIrdk;{`mOGJ}n zf}qijA|Bvn?D8B60w<9#=wq@qU*3$zKjSpx()e#{VtptSr12(qsv=-#u#T$MP+p5F zIV8~C=1G&<@15c~DQKX9mGNe_KrKF-1vNevgciEk1>~>>!NW>3AH_?;Wd3#Qb)It; z;Y`iqy{j$&WnzUtRf!ihzVP{-%KiKeh9k&;z}K0|{vhTn{#zK&wz~^vTki?THoFnz zVTGP?f<#w-I!5%Nr&F zwP`-s3pMBdY3Oo$c*t1?Ux!UfG%lFYT;?k2o+k*K8$NKPy7Q?klSH^6ak_4pJxtED zoeF+FyEM*!B%HIj%-F9_GsChgJM@|AO~t{4NE_~AioMk~rRct)cCNqU*q^@_Fno(V z?HRt`1qi3p1a^%pmP*nYUM!8Lv<{_jfBxOW>Z~oqrTc_9hT0?k7k=TD90W;ruMCQ5 z+W|dC8+VlkZViWL7_v@sSxLLvP2a{b<(#z}BZ-8wNC@^)D-Qw(%M}%2D>xzy$1&6b z`!an-Qus~*-V7vlgxT5z_*;7`ad=nKA1Ym>D~)aB;<*Qw?67#suvjV@iM;4DbMLPa zkF{2!owW0Uz>Eq~j`IAOrMV*F$tK>-+r^g>vRU7|LA@OwS2x`+c$BtB&Y)n3@zy5W zbYuw~952S4XD^y+dT_UMu({Gm0OSTIfJp*9`j^2H_vpI{As4NZI}z08=qkwD76mkW zb*@!^47<{RfU)^zR;ZimMzxtYm4AY)OtY~?uyJ*Hf$6U zO^$_Q>k|b`78qYiA@1xKveLLOZk7kNh66%e5)exE8;8{ByCvES_?khO01|7NyIO>|u)f(Z)x zq_%TkR>1D7Jy44*&Qd=*Icp=3eGY{jve`*EhMvsc);EH6{OEQgn-?1}`|$t*78;ri z4GYR!$*jET#ebMM^mt$_lCq=Aem*e8`UXRF0uWcekdfjVl~sw{JQ<;;tIuvGQ30x% zv_#p0Cop6R$h2h@dj0m71X@Il&UUB7jEv1z8oD*`L#C1C6rS<~b5X8`U9*opd|ziG zYBwf95JsEn_1ek#$&Sz$$6`Hx-4-)5uHr4TQntoAY2URPAep%*MjD9kiidG-AYiq7 z!&pe)4|~0N8fU5NaPvb*re4J=6KaLPvp8Q;j7)brnrO-<^1ff3^z-Bw?Z>)uliwtN zCFf{SH~3y5)8KITQ)N+dmlhI;#p;~T7-?adi{AG*Tm2rgAQ()>X>3&nIGLFD1l}5= zq=d|KmJzGDW8W1^(opdYrTML#r5~h0hr@moRw$UHDKN>Dn7)Hb=H{q}1r)#zhhf<4 z+D+vTB2U5B=*p&@tEn? zC$^pQ&fYWod>8-ae|65u-Rjl7s=B(;c>1Y&TM{JA=Sx~IU>6rtuC+63ALxmkA#Ikl z0@9&hPeDZd7R<%Vz#7=#xcl$RTnR&nZwgp!Q`;}oU7f~E+>JVxq z4YkRWHiX}7nE8{Y5gwn3E}ws#*i8qa6WHClwYQO-)JeaDK}(5C^f*#|VB5C8CGDnQ zupMc_h^*L4vawOk4xNY^JSz7Nm*sD1w2}FCq=SEF*ufp3=t%OcxOw}Pv?t5at2FIV9#z+D^y5| z&%GxJDy#8yLcspiz-gPZtfq#=(@dqhqYoo;l^hom)O3BJgP@{7BOi1#$$N1L>Bn`8 zpYjOm?INLxj0V%yh-Qis3H{-z%{S9NFuqyKg0sA7FtAl@r1+w__IcXvOD>aH&`| z7!}iOE}qsSQ8Fvd5PpW|dtK!$;$N63>z8}K)BRXf6@0Eg;YEIF-BkO|*YSw6&&~hP z(=utF41fisnG23iBI4fbZGY+}vkndD7N6Jluw6cm)ISo_fK+WJhEKg(cFJ?O!~(AF z(>Z}pbUi`PZ#xmhfD7)fvCKoeT_Uja0w^9D*(rk7zAU(M_rNGdAv-Ce8Q~=$rhec? zCqj%41$BG4%itV^CR>%0-oHU{BX19fRvJIMC4q&(NHkpwC{Yz&Ziy@J9rbLgSq5oh z76+!aVv*=~w@x&JrqD@iHtMYHMwMx$auhdPe%2YL-m_bT8@Goir2@|UC9igAAGrh7 z@r!QAAwK^to_=27;hDdIR(kwK?XzYX>L+tiSLj{#ao(Lmuu`vn7{&v?Cd_)hVI0iz;45_zZWwA;l%P)iCyu_DpQe zd79Mqs|WOp*xF>0We|Z3Si*-u)jA-^qP@y%p6H51r923_xXUpM))?(G)oBH?APP{4 zB{BCQI`&O^?(Q88P>>)p*e4B43hH5_+``fFss|W~4!@R;GBGJoa!EgX#`qDvj7sTw za{XS*A8W9>XnA!D*40nF<4rsGRoQY%U<=YvaB~`;$aT%5y@|F@&LnBRKU(G*djf9F z^dS5AfNd*1k-@`EexF4wWoiwi7De@MTcqc&;f zHU^kD#1^6*&3il|n(ve7sRQLFwl-TES(-m_W|B|^eA#MX1C!MUoAYxP2L@)b0edj7 zCrI5jZk?iXqf~6VW?7dDf1;?40sn;V8N=_O0_BK^)4nWQ5)i--ypEV}aZbX}iH4DT z$)6(}7pn;>{$}9r03`l=H7&Tkg8_WX6kaZ#&*Jw{|4I+W9O6$u{k4-WJQk;>Hee30 z=>%p&auqW71+dJz5FS^E2}otToufX6*z9{P&m+0!{ES^(eB6=r1HM|t(#dQSd9iiI z2oHao(5mbLF&|4541mlq`5Xijb7F2W<-~%2-$B5@Nr0#kjj{I;)w~J;B#f;sX%@Swf{kRDc@qVLGO1gRFVgEF zGP1)|>R;9sfVnb`FvX-Z`K{^d8+$58$F#%B_h(f_BJnpHS;3)xr0C2SDUe$&GI~lO+6!`bvT&oNhx3 za+w~ZWt{r(Ofu3ws+=E|nbKy|;TE}*s=G6r_4uDe^JhYqGC?)ykeciS*hSEQVWT#X zyWkk(q099;Ne#TzBZy9wzUZ#DT3+acNW8$|V%@Hn1ttA6cJ!bfI*=6S$CuN@OFvEN zW**bwmFeN6TddMAHF_$ep$|t2pR_D!Q#D6{!6njYWwZ9mIbP3Y?yZ>7kI7XP^T_=@ zc%7r??%+IW-r|LK3Zu@36fYp6D1Zg_%8NZRA2Bs+j4!732_#U z*u%BIu9KL8jgU@v>rCk8Wf|e+Hk^{XkFH%5HFNjec|WOoFoEnZVNUSRzVbIi3a4v) zsFF~kck1jC_p1xo&(w)bq&-xo0$ra`Wo-!Od##`?TaIL`LHt7DjVq266W>T1y>Rlj zIGbtv1$-$bFaLe4oD>%KVN|2rH|;xu!4EAw4R8w6OYRr`icFLX19&86_^ggwP)R)` zbfk39>`+fA5Nfu*@I6#{Tp52vO9$I8(zyg8-@m~cY`AcHMpO$|fTYiG&ZsI$Im_(pt^rrqd(J$Z6|^c28weuZMBQ1$z< z-*_anjU^xP{UNEvl1^}iz?BQ&5abB zdksQ8Tp>GX%1&orwlRHmVZKLl>Hvl2;qT{p94{%{f|z!XjF}>aX0L?!DgZ@jpx1)% z)fdx&Iw^%Te3iGM}$s!8Ia3a#a$MAOtO$6xJJZZG!WV~aIe))SUzdR34~0jTz50 zFkjD5JBvIqu^i;;abCDk73o5*c-k;Rq27St7lxe?DTN3%2>diS;%3&+*j$M_SpcjF zM+{tO9xu@&?eO{JexUEW5gh3xtWbD3HL4X~nR5+#k9Zj?lV>K*TVY`HRVOi>i}-wt2QzifMU^1(gB#PQp)ch~Xb(H~RD zh_BtxcnTzVd66pX_;IgCfwO(vfPO_6L9c@?x;qKxCI{~q4w+YSe~x=WG!OPFm3q0^ z{|L_)$20hhcNf2u?=oUK*##VjrXDbCzHbypG5{Xao3Sj1Rd^h8L@)*{?)+Mu5EC9c z=XvZsR)u;ANh2ZT|0xc=xF-Baf{5|rgs8&*G@n*k4C%TigGk!GAon#<%$TGWcIMW* zjh@6ZP~Qk+*;}|V^X=dN)GDSb`(aP81X&C_JWxj;a0!%yP5dBVgJj_2c%|Ow&e_|)@_E|pi zqIo3I>WqG~M1Su9Fo4H#{R4YL;H7LE|7Rf%&`SH?wdXgXREob#ypuGd_HO!L8g~~0 z0kG(^3-*7Xp#cRVenVrNT95%OzW*@2yTmuof3L*<(!PTT^zt_a!B<+${}X+*%JUCf z^|u~%2%r(SnnV1WY_NaZ5PP>m{8U&H{(~gSm~dG z#6OzZks+`<9U?$MK>aS6|7BPYBQ`u$K(Bvp-#dQ^)!#tSreYn@L7SR5PqxdC&&8!0{S0sA|$Xu9_*J2gPvJz6CLmU z-;T>n4%%nE)8r;$FYv5kK8d#RJz2A7MgLzjPJM+8UEMKfS#BbDD+FE~VfgDQF#gYo z^fOiX*j#@Mt_R6X1@NCA^L84h|9Rm5tMh+|eKIE|Pz*JFcv(?#9%mA9D3<0(elb@P zT0D@UfMX?d(K@1{6Y+I^(mkNq`OQE-^jXWp#YaV+;WWn zWd@@GzFz;SW}Op(Jto>6+s|A|#lVKFdMCDiUV0p;T$dh~1A1YRz2P|%hgwbBub!K2 z`+c2%nmC1>w@4CXGb03b^t{_RS$kkod`vx4_sk<(@9oQ8#9Z?zJ>vmhIn5<#B>%R? zUW6{c*Dq6qi1#Iy{D_q9%wZyH?Jd+!+DM~p?u()7+&{&Zc3V#G|)a?M1&5P z4`)?mQbi_uxz50~n8z8`unUc*R5)l*rpGfPg<7<6iTJ3Z=s`b2Gcz^>dC6}+Ru7-Ji81TyE$LW-({ljFKVxv2Di6mbL`$2qsD8oD&qs@ zAM{><*YSI#AG*l)s&uw4)jMPim+0SN7YBXTZh)^BYd4m>e_HWCHB=b$AJ>k0hGGkMKnH-u#>yPrh|OhhP0$&{E7tfN8r~_D60l|F#88 zmJ{2xBqNX2i*;9g4IqEtjhU0SQQ^>o9eY&Rz;T|*M;MO6zk9lZ;$j@er+-@^t{BF(UWRGM(ZK-H)1UTqNdvZ9KGU&?yJ?WP*tZnKePIB&E7y_ zq8VJP`a9}GQaG~ef64GKz?=T0M#HKCWWcUe7=rT)Q(IDtuD$E7p$W9K?!2|lLFBqmgB+ufpZJ<;-(;x>yH#&yycc2=dN zYF;riW6AzPkMYRu<(Y_p2YY!}ERPF5I^U1Q8*g=Yi7F|2QDn5_=ZF6lg@!=z4kV4Y z4=*^y#gJu;3Ns8&5Ap!Sq4f0_5d+=8{?7D}Q4#baGJ%e-l!|jEWtKk`Zl>i@}A|{+>Bks%YI&{shW0uyp>9?dMd85{h4h!P8rGGyekxNzXkOlJ_ssD? zmUY<7sPs{_4FJT`FaY)+hT==E8Gxxx1A6+?GJM%gLwq2Vc#ZVKL2gX`$&lRt_w0rbJjx z!o~%b4ebN7x=z&!us^|vib|I?US3i;^Lbjw`Rdz|512~lOJ(DxE#iW4Z6$gVv2QPU z`H*A1%CCy)=uctyM_+08WlWnZGwO7kq^_$oKu^URkB`9{X6SE2^7xhU4TCHAt8((_ zedf%@yzR(1e?mt+SZZs#et_m za%;#Z*;xT^j=Mjvojwd$n!4b2w1;^u8r>{Nau_4hby1;p zvpQ`db+I}#u=58d&lRDENR{PrhaBa#ksPr@xGq1T1fTb+M=m7y<9Nhjkg~36;imH4 zY7(J5E?{OpHd}I`0X4&NO(Ra6ibHMs@VRi}>ON$(xd!HP+FBO;_boN3KiueGGdTNhv_Qun7}9~ibH7E zVscHIM6zV~hk17R_*<^=q1e*x!MV1gqQ*&MIh*;PV!-vCYEh`a=%GcEv_`iZ>qy0FmCKDRzEYNg%+V&I;bgyl zg3oi;rKIx2@_8J!-APqVe*na)zI_5bo__ zGUutsZ)6#%v<=xS+mS2|8c*l=c|8mN5|i%Zg6co#>V4}bDOrC%H>4SeUOcZt_Us%2 ziydt2M6<^y*n{tZztG+a%4CZvGwPOPDdlb4>~k^E2VYk2_?0i4fCKmFTtHVH+WMr# zrpQBmbrA}1E^8m}4hwJsC!OfaRlYD-A9-=}VrxK0ZN-Uvi(kp$P~FSTz6Q29ZLab7 z0>7|?;c=5uZoz;?oie$*{AiMJsH`%*qdY&7iyl$~9(OPoZDhOEj7xR?X`!;%TtQr> zk_YZ?TQ?wn9=+^W-^JGVkT21DhK>R(nx6+>5Lp$_5(4g`=~dBGDm~F}OgDP2I>0yQ z##QHYMih_NvJ=f%BVlgPs6X|B$9UgNfuB!SwQM>!EWu#`15T+wvUNaF1gaps?x%cM zZt{(`lB{@fZ!l1G(*t}`Q=^z27Hx&}1$fW(FIDfv_)yJj2OY{a#>Fii)J_p`U!qWT zc32thZZcADWe(_beR-gup=*5Rd4|-R0!%(uK#^K!UMh7qu8qs8eUtlsO_w^>8V28J@olS$?51=&g$DL{q|Qp2c+%ahBRB3QS;wNAWzYEBFC7(9WCkGi0? zP-mtd@jAIF+6ZULs#WF|errB7l5MvTy(?=vS*wgy1l(pfNwVUb!l@c*Uk>NZ7UBCW zaT1>B%!p&~WU%=lm*ziTbJfw`%2sxM#I2zk_{3V?VhV$HJ+PiJ_Ld_Zt&g^G&;`F>$!UjEF)ckU@Rz4l1UjX+w~Fd5i}vN^fg^|W7Y0?gRh zL?28GsfpF61@5dP@v+(JS$fA`id$$6ET)2W_c|%9Mu;HIic_xd-f9y=53NOR2aM*| zxb;2^#0v*{j`tR~RnyTdO$D36>q<_LoN%|^wbzZi8|8wpSeyF1uK22Qp_5BkTT42ra+@#wELI^m+rffQl#fO@S*kV z8=VO;z&eQ~)9^ixQb4Iwp{C})XTeNdo|)^^1;?c6#Ndc;1D;{}d9_7nOSsNpY@~0q zK%C;rNBmm9X^B$%69ZadFR}vqa_(wmt{Lbx^@!vSwLtVmM_p&+I|FIy98>An{bQDd zZKU}DPu9Vgv~zAA4_?uVv_4F9C5je?8rxaXia~?4V^u&tgZI)(|Cg`HP7`CfLruV> z%Z*=e-flpHR!f~sp0$-btucX>AxUs}y_#|@9>%QBmTEv!XV7T8D-a=3(22zzZ8QwW z^TznkHTH5!*U19z%cgBc1O=r%)5g^2Sq{(T?A?tMbIr)}#m+ zIA8q)BB^xTM0Z^NU5SJa+mUU*QtM!xqL@i(zPl=SQ@MUwrHvqFl636l_6Qk$oI!?< zHaN$fnW%u5=p}cZ_^KbTPq!}gxl&5vd+hUfj=AX4KGv_B6`Tsz;h^hkaqQ|@9R$mR zSjf~HenB@5SC7HwDO^6E!WI;fi{dgl0KZd^F~}&|34Nn#*uSDxzSPzHC{^|e@RNkMAu-0;oOv!eX2gDjZN zVRrM9cdVUhK3Vb=xb&c3eq%O)zd6fQe8B5fO%PQ0V|~QYbiENch>CR5t+tf4&1iz! zlx}|ekEp8*7WYU-@a!c{N~(xgo)JKaLLpHu-6=8~;JiSBXwhPL+|NXIYHE&?Va;Uyx$c(}A-lZAz5Dr)cRxkNNpKN#6=b zo>pgU#{h&o6v!py7D{=mZR0kvcppVYMQE|^7F)=4JkZs4Js?*(Yq#i67dv@17}NP&-A|L**mJ!a8NfSnYxF(yTJO}Bp}NNL8hN+U)wYsv z1)(=?r%sk>FZTUV61(fY#Iv5F407

3P_Ww^fTd3l*MLsnVxzGH*qOeop_y@fvd z5u9;nYWWCrrDdmWnjajstB`af+uM9r4(P?4U>Eb7hTqb;Y9N0yp4;<&CdN!X3uisi zc8K3x10{x2_p+Of16>v3+3HsAEi1;-ol`kbOdxb?V>bcPwz*9Gv)#*{)a6LIl$~m@ z>PZaV+4N6KF0HwDr}|u6wAT|oBi$*u^%cbd^6k7t{Pmet{a5F=n!{CGS=D~>gw-Oc zFCIuY8|3Ncum1L`uDt{sOx`U;hHC|po#zn;W9;yg<5&^s?9BeW>3X`>|!S`;3y?8GQ9%DHO@PZ@YC+n;3W!G+~`gemiT#zG1?dFEA;8i)q_ zZ*=b!oLy=CVqt)|Q|>|Zvo7q@t5REa8IzA)CO+xPDcJKy-ya=~~#oM$P+f zghDJ;A}evCNgt^%i^`j^H+>+yzkP3!-ajyKbG;+=+f*j@N=$vY7CW51LyEY_4CVE9 z(}Upi_Rv4#a~7R6!=8^~yZH!iwiO1;i_Z`P*}Vx22|tc1z>n<2$eXm>y-R&ts=2!u zG9Q{}+@rqLcZKtLrM!148pztfQ&L~bs{wxUet~_X#Hg#JzELu``H8`bo)uEi%aub; zBPH2g`$-!If7W@gnLQZxB77C1L5y5r;Hx0|5Hy`lcOF>R9QHfVvgu3p@p7bF%8Ml5 zjyHXW(kDL6S47%2|5fdgn)4gb7KL28!S7MKX_ar6H)Ae3KW4ag6U{5uSWemuPOAtn z6N$Fg-*n9rRZ`or1 zN!~FGGsSjtw2~>j)0^3ox8z9ObFE~L{q|lz8zQDoA4h))Jjv{{`&1(SD^^xpiDAk3 zJlG!zr-#IUg!j?zP>sW2#iqI(2LdEBsY;47_EIWL@={-cV@s}QX#4G$`P+xl2pi6} z)Yfv-1G}W4mFJ?<+T9uF^Ah=TJ=Ksymi<}j)4}$yi(Spmu_6(X!O8wv!&c57)n%^S zv!?57pOk~KLvk+PxT_L%78@M7IF#*p4A)b-0<{C7ENBls36S&PEG_B;;zzwV9qym1 z4{}Js4Ew}Mg>i0T;g`x}gCDbu_$`P(g4oibhcf!qJ|Vt$=k7k*`F~)o^v)G0F(5tYw z>b2)nL&LW0R|=%M_@=gcwupF&5>2>8SbbhFt~S3gd&@a(>s!G4*1FBg zTg_&(9+FDut%6)CRkB>4>!R{C@FeMdJmZAtRggQ5l1L8;o+?Q4YO0FOlf>0tx6MJ@ zGhdN_UHy89J%CMjY*4F6KP!mb^iG(KXUVdltuf4g6|7?V=2Vv35d(xvN1&GJg*JwjAyEofLPjnq;LY-#r#6U*_t`O}l^J!1ss%u=BLiLY>Zy19Jz2OC3 zkKKchp|q&=w_6+DkLUP&_QvpJ9UlT-AuzAtg_)a`-8V*k!GnXA*0&eUBwh`Tr|dpW zZc=kA0yzc?%OvkVr(S;bI)gsnb?HGFvAaNa64(s!gdz?2-i{qgr-!9{tQ8;ebzOZ} zejWNArJv0F>LeUy`BBt*uQ&4r{-FHi1L(uW2MYZDB47jEQ*d@*k&?fsu)3gz z;cYS8<4`@f=o$;>u8TpBmiBJS^*yV!M=QEcdcQwi?l1GB?<&#AQgy_^T}Oa>*^k>T zivm_){}5H{?%pxBQ^mBLVUzY&rm1ivwqjp7YC`t|cGx*8Gd0&q=nm5h|B*P?%HV84wL~IKgt5r4QHU#_iL7pMlO1X)L-Fj z+8W@Kq@N(1EVFvl;S;?_4Ky1iy>;>YX4yEp2o^sR##|lbH$4_+bAa&h0 z5j#M>)4eQbp@j!eY_4dl%1?0&KQ>7#K!X-z(sl66;?CeN%0kh#H)|^`0o95sxG9lo z=qAY?O~PuJ)NOu2ji&?O2RBfO+$p^pG)=jcf?v#%R^X{a+Ed+5e^}GatNa0{Ryv!G zc={S@+Cs|Dm_<0TLuKDwLP@&n>6%iF{0{&kEYrPREzMyPlfC@mtebat&&z>Q@h z-K*%`QmUqfpeq%e62sXVqDY`4)%VkS*sAE5>ZatE#(`$!8Xy)o~M(8;^sXtMN85$jE#V}1oc)@6?nDX4OF$k+K~$>MF} zQ}#6ayz!FJ7{{nv83+}_tt|z^kE(f=xu_|QKb+Nv*ng^%>{FbIEx-q1DwEl6O%bpq zsv$O}U>|;Jlr#2<5|&`MgNgTfQ1yCf#D03BatVH$+c>(3V)=6KZLeCj>2&6Gl6>(M zkVeQ|snsQalSgvuOfjRNt2F`ZbsU9g&<7*~m)l2+U4HjhL3iHsjTYaUvo-eQv%qNY zW5klW2KsZOv*2zKMD+ITE?&24q$Y&c()%2KR<{{fnMDna&{mm9cCgm-yoz;wy%s2( z;e3?hEB4z?@1RNU!v^tVsK4RxnG!=px3(lc=S)KIae=FjN#A|8ZPSsLoSf`H$lxmm z()fvk*Dx1H;V_E|LkRKL=&kOq9@C{z{VWK2Mr~n9rt5tSY|pc*r{wA9#k=0K9}jcf zUbXEhtm_T9Ao!j+>4oRp3NW0`XTr5*XV83Msg`it{U@9=s_(Ge>m^JZ`j_|^*<`Sd z9`Y+y<|B9Jp*Of(_q&Up9531aHy7m+7H(dp4`(;+YN~UI zYW0KRd`$?JE(zI&(N2}iF@am}VaU=iji!aoWqfNjRUVXU@1Peb8T}55^w$AAZZG1d zTEotWXtGBkEMUfm0)!HR`okT>O_q*+SGaxp^0w4w&Iq2Z}7c>;b{*8tj^(!Vi494`-0HvDdZottfZTkQxeuXc+j*q zq2c)&Ujltt_dP}pA-&W=WwpP))v~PI1%E;u8eNY-W#m)RJYUWu7KJ-LhNMmnY&Ja6 zk=Avb+uo~lE9ytnAKCRhl8UC+XveKYSr*CL#?@Dv{koyIH2Y{kz_tLjHLs-58@+K^ zFIGd#39`NALnm*uzOb7)pHmK624z4KszH>S_E<{OPaFMAp8`GahQ)d_M-a_9Ht?l# z%T`VMP~<^(d9$}H5QCy%rbm9&Vn^0$+26bhZCfd+ic`$Qg;*f$lK9c?gix+bW!2>s zwsVN@cn8BH&MzeX@)y%0Clm)(czj0DOLq5_ePqe;B8Zf$0rB_~((N3X*kd};Q!BYk zbGowc3?>Do3r#$+&L(^~uZL!1o#l2og?s@a&)S>i%mR+Hk#Iyo;c9-zZ zWehexIF8N~YTkE&FPNUY1KKttSQg<wq%mE^Bn8XTyT<|_qIBkf zr`uS=9AcP?ddsP~3@L z)OLDA+-uIjJ6zAF<{ILQTvMuYz8*Z$aq>o5c?zACc-xSVmUm{gZ60cr^09dFb^Ij$ zVz;2{m%#wKg9XHNF?e^Wwp)tu2>S7U4Af{Q*?4}&bHkKZ!DjQ0ZL*+$U(qtr(18VN z<<)_eUV$dGHA<+L_MY53S@{lyxHRm%P~@e(pz#4^|2?_X%4^4%q#QSx{|#_t)a7G! z8Td=|GE)I?yV%OM>n8rAbKMc^<^Qfz7z?8bAA9mgB%FX}svG|pK z^H>thG}Qkq!2xs>fAE{34AWmOR2tH6g@tEF82^^+U;s+k@o+5D{v+EZ{I(crno82& z5`;lO$>7zN+U$RHsX}1@5<)p$SNmTHyJ(jgM&^-Nvjc;o*pqXGvn6X_m|lP;A?#b-eI-ZYRd<3 zyA~=m^O~C2b?9qc{u@!5fWOVf`AA9o#rbs3AuU7xfHv`j1T*OW^2y|6WB^yDeK|rQ zJ7DO4EBFy!79g9omYo%` z7kXy&t+U<41569_JA5+Vto#2k2-AH)g&%in0XgjY6U_n1e6VL!4QFO&wYz#l@O{h* zeSi%9WGUUU4DyqH-l0#uj(b;PhiB^?vH6nMSeWqC|P8#&fH)Z%J`X0ByVaUQj(JCCAxl4L*gVzT*jM!y`c+J zj34^K46g%43DKJy>}(!PRx92|8@9plZw-JU`Vm5@vfj~80<`}dGYsI!-|R^S3U$2y za8b6ZTpp3L9?HyX$`a{tdCO#A@g854%^Nx)w>n!*6Uso3A*e*H(yO9KLU z$haOt1@vDX_zizEJz*r1{&chp!3_MjJAM@ zt#-xCfqQk8hn~~!W~)X)S&{6b2Pbf!DTy+cYM7oov7e^(Iqy;cyaZP z0P%o>DmApKD3wBeuLY(Xoa??j*D=d z;5vX=f4OT|ldby%Dm`lp^bLnko7;~~*Bu=ULNYe}v^Q3ccc4XevwNCprps_i`I3Q` z#?tGTan`wL_c=)07R83gld=`hzCB2uU$MI3KxAMl9d~3s^tUr9ueniS?NT3g71(gvz6rdCYKL+(t zC}S&jHn6r>=MC_!)Ty*$omglu&S^-xA=V7kLn#ZQg57)X>&SmSv~ksK)x4KRZXR2E zV()BjpG;>0Da@k9ax_}`XvQKB4Q{M%{~0YzCfPLn`s0Act!_;cu?Z*TlV1uRb^{vbI! zJv(byM+YG{ra4fp#AyPB30X$7i3)9ecUIh>7I?V_jWJ^>3$_(nWXB=CoW~*snOLh@ z_wA8-#xU@BPlH<`uzto5tokqoF8<<8n z-R&C--6X1pgk3eOokMLBxK=@w~08ZW$~)@>ZSpx@ltB#1}uEzk0wq$JtrrW zJUOzd^G|T_bAlx?W(UoQs8+Na&#HV>JZ$@~Kb_}4p7dvv@e9YmW3m-JB=;<;S|bWBx?J{dd$Rtvwy>$p5bpj zB&HzEXuuFuj#c;u7mRxx=f-`5Y%<2gnKd>fM zl@7DqARWJvj+^S^9b$CH$cfopm~#7O^!L`_3Gbs#W?{R&5CnLj@KxeF_$T$3v}4LF zz%NN;U=cUAa$T7fU+pvt9{nutULAj~P-#n3&o(>gE-`f=pl5_~@yv9RgVs=#HJWK{ zyEx_Ubc^NX-t%gPa!%VSS?A|06W-JkN4{Qw4D*ay08XsT|l zi7-`CO7VCmM$+KnUVzb2xMVuFiI9uRdy&QaQC1e(p1YORLeI$YeR$gi=Rz1E&u{N( zfn}rBC}})P(TZtE$^K?piTMt0*ONyWaXin{2xpfVrEiZ+WuxfwxQJes@@u?R72s;9 zN7<@B(AM%=&~Q(HL-(cCOTf|nGE>&Vz!6^E6U64==TPQb@K&A=`;mGh%=;&No@MU& zMQj|?)^B#{Ui^n~52CR-7RQ;ZqU4^o$(K9*IA}y6Lnbrg?YcW^(bF8#*yJIU4y|fB zVY}`6t;oH>XBq74>s^Z6LG$x6dlydFtZNUoj$u%nj#g?`nKYM*dr>P*05D?ri0@_Sn$!?%c!6?DMF@6si~>; z^liXThN*EHosHy{H%egJd!x5M)F$?E*Sy{EC*-(Nd>Fn(=7X)ngHP`-*dctz%&-b_ zZIZP70@*P#vu)_kh{P~Le8DTP)c*Jw7LetPeHz?~&Hh#v`qMY+6DutaK14oXvnCY0;m15kew4BlMAK)t22z7(H#*q-@K1`k@Pe?%>#4cj*KpCcmsv-kitFgN^ z%uvHwTK@&5y*-Te$~LxOASvhE5ht7{X(Wv7Sw;kXO2<9i z-Y$7tl>A-`NjD)l93(Ou!?*Tpn-cc@rO;Gk6V=br@u~JyQ*(N6sY~aO#$u+vX|~G| zVwx>4dK#uj}`OxgruUgkzLc4Ut%Ft0cLSYOx&j@=E}`xr#8V2KRs#Z ztYEqE-6MAi!HR3PPCMa$+_JhC`i(;5Wvt8N@bI*KrH(XOF-_1=#%rXH@S?R%*ZE2F zBeL1uXlWBwNug{pucT(;GIUid(yUOkL%iL^1$^3TG`P>DuzZ}K>KVjljL|5Mh}h}e z-xGI9?~!!GlsvOG+xXGJC?^&|faa${(qPTa_g~%>;_q$UrbOR=9Tn{_v4ow}DC(mJ z@QmZwz_nXb1`5$#MTo96$5f*~((efed&xe(wPhW83p5G-6el}scFb8^>JCCu(uS>= z#KT@x{V*Dr@0z#TZPhqLRSK3_Sl|lR{iOuyg$msN@k_UW>1c0LW{ae`|C{!WTk=qs z#q9Lbjxhl~JC|d2RH?xOI0Gv~aI9a*vr;&?w$K-}fH--Q4Fii~%G}quqCszqHd|zF zSUJL$YZR_^Ng4}89PHk{CCJ`l6q+IkS(@-e3$6NK;)Wl&X4)lComD{Ot(xNMHhBj& z#9#?8)$Zh+X>{RDVXQ{s*gb8uoG!ugIx7?N)6;uhMHR|z%Tm26n`5)5EbQF*8V*}6 zv%y|pf>Uz9#N5Uq{R&%iR;k5Bbg>~0W1_B9LEH~*=&XlsR6j9j#0Xij3=~8b?5ToO z*5ceb3apCVZlTBqw~{yeT8nby)G-Xizkadu1}EO~Mj^%~y)zlfi>d0^uMDYxZp6fw zys*N<_gcfce0f88jeB(US0w$>Z5{6p)iHV^`mTp->6veFW8ZBk@c4^Uw&~9P!C&?B!hZP8cEzF02x(f#5RT=UAb zQD<`Qa~vYKqXhBg*dzp*@31|Ig>=YM-kW*ews=2Af8H{V=X3nH%pL`4ErR_yN|mz0 zdb6JK?a<6}VBA=NTF`tV^Iu;RKIQECmPk7AiZJ* z_O}X~U?olZ*4plV5FP=cnXp=ujl%a84R1Ru90JXYAelwXr48Ygb%Vf!`PP;4ZZFXV zSF@0fMT1b+8Zbv7hss*fhJy_XU{l9|fFeD-Q!D=6p8l1U=zDEZlKrBHVo+wb=Mar2 z!xqj{*{Ut$Zt(H>;CB`B@;jih@enf*LyQ5v<1p=;+2EIlDo5%O8!|i=IK_L{RIZ)U zT=FfkvwP0m7n>%_M%t8`F@qf3`&F$Jd(XWiq-V|)Rf9AGALaYG7}_NMQV1qW+MpxC zT?f|18=P+L>or|pgj>T+#t>9mg!bL&tqUt*H+Klw_Xz{XWL~aj_EnALpw&qr#(Frg z8X=cSD0n5BRjZ2iL0@R%Y6pd#z8(%uyyvcLT`~4t3v^6045q>P1$g{LuYINBa|Nq} zyTn-$b*$Jsgt!TA4gC9@b)IiB6L(}~787U_l-NlmpdCd17rZ{NkE^PuaxF-}Br!tI zp?tctwgMtUQc7eM*LO%4i8*%r(=shiRV#Qy7Rfh~s|=Oyed!g`mb7OigZH(ky)Gru zmd>_B--`O9-H6sy25g+;xW}unf7Qe#)W&1uL=-apx-_u|8jR$@xLh>+I0IH`pys~0 z>{<*cgY~J*4j5N0!x2I6zDZuo^ObktzdqJp>@@vK@y0Y6%DFyC z?r$ZP6&>zk6BcxwEXGweekU^NKniLTU-%CG9az6Ol8uL>+dH&z^4SWOCduKRp*_;7zFttA%OtpUyu=|tHwkn z|9#I7`4tri@vSsXmO=F2_ksMzz(mi9%i`aEw+A%xFC`+#)m5IQ9Qda_pj|OQ!A?eO zO2mKO0};wAg9_i4S#b7a{FR#s*!!!R5R?8DS{mjT>Z2@EghBjQFGhgW5vzRRze1G} z0cw>Vp&0(B7a2fmYGlHHLcajiQfA38i1@452tX>;&se0tLX|}TYLyl$Mf|5%DnP0+ it0K`~q5mJoc*L)sJW-wJOiB9$_>&Nk6|NN23;18}QjNO+ literal 0 HcmV?d00001 diff --git a/b5649f1e.525e7c04.js b/b5649f1e.525e7c04.js new file mode 100644 index 00000000..127c6553 --- /dev/null +++ b/b5649f1e.525e7c04.js @@ -0,0 +1 @@ +(window.webpackJsonp=window.webpackJsonp||[]).push([[11],{68:function(e,t,r){"use strict";r.r(t),r.d(t,"frontMatter",(function(){return i})),r.d(t,"metadata",(function(){return s})),r.d(t,"rightToc",(function(){return u})),r.d(t,"default",(function(){return p}));var n=r(2),a=r(6),o=(r(0),r(73)),i={id:"request_signatures",title:"Request Signatures"},s={unversionedId:"features/request_signatures",id:"features/request_signatures",isDocsHomePage:!1,title:"Request Signatures",description:"If signature_key is defined, proxied requests will be signed with the",source:"@site/docs/features/request_signatures.md",slug:"/features/request_signatures",permalink:"/oauth2-proxy/docs/features/request_signatures",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/features/request_signatures.md",version:"current",sidebar:"docs",previous:{title:"Endpoints",permalink:"/oauth2-proxy/docs/features/endpoints"}},u=[],c={rightToc:u};function p(e){var t=e.components,r=Object(a.a)(e,["components"]);return Object(o.b)("wrapper",Object(n.a)({},c,r,{components:t,mdxType:"MDXLayout"}),Object(o.b)("p",null,"If ",Object(o.b)("inlineCode",{parentName:"p"},"signature_key")," is defined, proxied requests will be signed with the\n",Object(o.b)("inlineCode",{parentName:"p"},"GAP-Signature")," header, which is a ",Object(o.b)("a",Object(n.a)({parentName:"p"},{href:"https://en.wikipedia.org/wiki/Hash-based_message_authentication_code"}),"Hash-based Message Authentication Code\n(HMAC)"),"\nof selected request information and the request body ",Object(o.b)("a",Object(n.a)({parentName:"p"},{href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/oauthproxy.go"}),"see ",Object(o.b)("inlineCode",{parentName:"a"},"SIGNATURE_HEADERS"),"\nin ",Object(o.b)("inlineCode",{parentName:"a"},"oauthproxy.go")),"."),Object(o.b)("p",null,Object(o.b)("inlineCode",{parentName:"p"},"signature_key")," must be of the form ",Object(o.b)("inlineCode",{parentName:"p"},"algorithm:secretkey"),", (ie: ",Object(o.b)("inlineCode",{parentName:"p"},'signature_key = "sha1:secret0"'),")"),Object(o.b)("p",null,"For more information about HMAC request signature validation, read the\nfollowing:"),Object(o.b)("ul",null,Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html"}),"Amazon Web Services: Signing and Authenticating REST\nRequests")),Object(o.b)("li",{parentName:"ul"},Object(o.b)("a",Object(n.a)({parentName:"li"},{href:"http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/"}),"rc3.org: Using HMAC to authenticate Web service\nrequests"))))}p.isMDXComponent=!0},73:function(e,t,r){"use strict";r.d(t,"a",(function(){return l})),r.d(t,"b",(function(){return f}));var n=r(0),a=r.n(n);function o(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function i(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,n)}return r}function s(e){for(var t=1;t=0||(a[r]=e[r]);return a}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(n=0;n=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}var c=a.a.createContext({}),p=function(e){var t=a.a.useContext(c),r=t;return e&&(r="function"==typeof e?e(t):s(s({},t),e)),r},l=function(e){var t=p(e.components);return a.a.createElement(c.Provider,{value:t},e.children)},b={inlineCode:"code",wrapper:function(e){var t=e.children;return a.a.createElement(a.a.Fragment,{},t)}},d=a.a.forwardRef((function(e,t){var r=e.components,n=e.mdxType,o=e.originalType,i=e.parentName,c=u(e,["components","mdxType","originalType","parentName"]),l=p(r),d=n,f=l["".concat(i,".").concat(d)]||l[d]||b[d]||o;return r?a.a.createElement(f,s(s({ref:t},c),{},{components:r})):a.a.createElement(f,s({ref:t},c))}));function f(e,t){var r=arguments,n=t&&t.mdxType;if("string"==typeof e||n){var o=r.length,i=new Array(o);i[0]=d;var s={};for(var u in t)hasOwnProperty.call(t,u)&&(s[u]=t[u]);s.originalType=e,s.mdxType="string"==typeof e?e:n,i[1]=s;for(var c=2;c + + + + + +Behaviour | OAuth2 Proxy + + + + + + + + + + + + +
+

Behaviour

  1. Any request passing through the proxy (and not matched by --skip-auth-regex) is checked for the proxy's session cookie (--cookie-name) (or, if allowed, a JWT token - see --skip-jwt-bearer-tokens).
  2. If authentication is required but missing then the user is asked to log in and redirected to the authentication provider (unless it is an Ajax request, i.e. one with Accept: application/json, in which case 401 Unauthorized is returned)
  3. After returning from the authentication provider, the oauth tokens are stored in the configured session store (cookie, redis, ...) and a cookie is set
  4. The request is forwarded to the upstream server with added user info and authentication headers (depending on the configuration)

Notice that the proxy also provides a number of useful endpoints.

Edit this page
Copyright © 2020 OAuth2 Proxy.
+ + + + + + + + + + + + \ No newline at end of file diff --git a/docs/configuration/oauth_provider/index.html b/docs/configuration/oauth_provider/index.html new file mode 100644 index 00000000..ae21d839 --- /dev/null +++ b/docs/configuration/oauth_provider/index.html @@ -0,0 +1,68 @@ + + + + + + +OAuth Provider Configuration | OAuth2 Proxy + + + + + + + + + + + + +
+

OAuth Provider Configuration

You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run oauth2-proxy on.

Valid providers are :

The provider can be selected using the provider configuration value.

Please note that not all providers support all claims. The preferred_username claim is currently only supported by the OpenID Connect provider.

Google Auth Provider

For Google, the registration steps are:

  1. Create a new project: https://console.developers.google.com/project
  2. Choose the new project from the top right project dropdown (only if another project is selected)
  3. In the project Dashboard center pane, choose "API Manager"
  4. In the left Nav pane, choose "Credentials"
  5. In the center pane, choose "OAuth consent screen" tab. Fill in "Product name shown to users" and hit save.
  6. In the center pane, choose "Credentials" tab.
    • Open the "New credentials" drop down
    • Choose "OAuth client ID"
    • Choose "Web application"
    • Application name is freeform, choose something appropriate
    • Authorized JavaScript origins is your domain ex: https://internal.yourcompany.com
    • Authorized redirect URIs is the location of oauth2/callback ex: https://internal.yourcompany.com/oauth2/callback
    • Choose "Create"
  7. Take note of the Client ID and Client Secret

It's recommended to refresh sessions on a short interval (1h) with cookie-refresh setting which validates that the account is still authorized.

Restrict auth to specific Google groups on your domain. (optional)

  1. Create a service account: https://developers.google.com/identity/protocols/OAuth2ServiceAccount and make sure to download the json file.
  2. Make note of the Client ID for a future step.
  3. Under "APIs & Auth", choose APIs.
  4. Click on Admin SDK and then Enable API.
  5. Follow the steps on https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account and give the client id from step 2 the following oauth scopes:
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.user.readonly
  1. Follow the steps on https://support.google.com/a/answer/60757 to enable Admin API access.
  2. Create or choose an existing administrative email address on the Gmail domain to assign to the google-admin-email flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why.
  3. Create or choose an existing email group and set that email to the google-group flag. You can pass multiple instances of this flag with different groups +and the user will be checked against all the provided groups.
  4. Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the google-service-account-json flag.
  5. Restart oauth2-proxy.

Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).

Azure Auth Provider

  1. Add an application: go to https://portal.azure.com, choose "Azure Active Directory" in the left menu, select "App registrations" and then click on "New app registration".
  2. Pick a name and choose "Webapp / API" as application type. Use https://internal.yourcompany.com as Sign-on URL. Click "Create".
  3. On the "Settings" / "Properties" page of the app, pick a logo and select "Multi-tenanted" if you want to allow users from multiple organizations to access your app. Note down the application ID. Click "Save".
  4. On the "Settings" / "Required Permissions" page of the app, click on "Windows Azure Active Directory" and then on "Access the directory as the signed in user". Hit "Save" and then then on "Grant permissions" (you might need another admin to do this).
  5. On the "Settings" / "Reply URLs" page of the app, add https://internal.yourcompanycom/oauth2/callback for each host that you want to protect by the oauth2 proxy. Click "Save".
  6. On the "Settings" / "Keys" page of the app, add a new key and note down the value after hitting "Save".
  7. Configure the proxy with
--provider=azure
--client-id=<application ID from step 3>
--client-secret=<value from step 6>

Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the redis session storage should resolve this.

Facebook Auth Provider

  1. Create a new FB App from https://developers.facebook.com/
  2. Under FB Login, set your Valid OAuth redirect URIs to https://internal.yourcompany.com/oauth2/callback

GitHub Auth Provider

  1. Create a new project: https://github.com/settings/developers
  2. Under Authorization callback URL enter the correct url ie https://internal.yourcompany.com/oauth2/callback

The GitHub auth provider supports two additional ways to restrict authentication to either organization and optional team level access, or to collaborators of a repository. Restricting by these options is normally accompanied with --email-domain=*

NOTE: When --github-user is set, the specified users are allowed to login even if they do not belong to the specified org and team or collaborators.

To restrict by organization only, include the following flag:

-github-org="": restrict logins to members of this organisation

To restrict within an organization to specific teams, include the following flag in addition to -github-org:

-github-team="": restrict logins to members of any of these teams (slug), separated by a comma

If you would rather restrict access to collaborators of a repository, those users must either have push access to a public repository or any access to a private repository:

-github-repo="": restrict logins to collaborators of this repository formatted as orgname/repo

If you'd like to allow access to users with read only access to a public repository you will need to provide a token for a user that has write access to the repository. The token must be created with at least the public_repo scope:

-github-token="": the token to use when verifying repository collaborators

To allow a user to login with their username even if they do not belong to the specified org and team or collaborators, separated by a comma

-github-user="": allow logins by username, separated by a comma

If you are using GitHub enterprise, make sure you set the following to the appropriate url:

-login-url="http(s)://<enterprise github host>/login/oauth/authorize"
-redeem-url="http(s)://<enterprise github host>/login/oauth/access_token"
-validate-url="http(s)://<enterprise github host>/api/v3"

Keycloak Auth Provider

  1. Create new client in your Keycloak with Access Type 'confidental' and Valid Redirect URIs 'https://internal.yourcompany.com/oauth2/callback'
  2. Take note of the Secret in the credential tab of the client
  3. Create a mapper with Mapper Type 'Group Membership' and Token Claim Name 'groups'.

Make sure you set the following to the appropriate url:

-provider=keycloak
-client-id=<client you have created>
-client-secret=<your client's secret>
-login-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/auth"
-redeem-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/token"
-validate-url="http(s)://<keycloak host>/auth/realms/<your realm>/protocol/openid-connect/userinfo"
-keycloak-group=<user_group>

The group management in keycloak is using a tree. If you create a group named admin in keycloak you should define the 'keycloak-group' value to /admin.

GitLab Auth Provider

Whether you are using GitLab.com or self-hosting GitLab, follow these steps to add an application. Make sure to enable at least the openid, profile and email scopes, and set the redirect url to your application url e.g. https://myapp.com/oauth2/callback.

The following config should be set to ensure that the oauth will work properly. To get a cookie secret follow these steps

--provider="gitlab"
--redirect-url="https://myapp.com/oauth2/callback" // Should be the same as the redirect url for the application in gitlab
--client-id=GITLAB_CLIENT_ID
--client-secret=GITLAB_CLIENT_SECRET
--cookie-secret=COOKIE_SECRET

Restricting by group membership is possible with the following option:

--gitlab-group="mygroup,myothergroup": restrict logins to members of any of these groups (slug), separated by a comma

If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:

--oidc-issuer-url="<your gitlab url>"

LinkedIn Auth Provider

For LinkedIn, the registration steps are:

  1. Create a new project: https://www.linkedin.com/secure/developer
  2. In the OAuth User Agreement section:
    • In default scope, select r_basicprofile and r_emailaddress.
    • In "OAuth 2.0 Redirect URLs", enter https://internal.yourcompany.com/oauth2/callback
  3. Fill in the remaining required fields and Save.
  4. Take note of the Consumer Key / API Key and Consumer Secret / Secret Key

Microsoft Azure AD Provider

For adding an application to the Microsoft Azure AD follow these steps to add an application.

Take note of your TenantId if applicable for your situation. The TenantId can be used to override the default common authorization server with a tenant specific server.

OpenID Connect Provider

OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects. This provider was originally built against CoreOS Dex and we will use it as an example.

  1. Launch a Dex instance using the getting started guide.
  2. Setup oauth2-proxy with the correct provider and using the default ports and callbacks.
  3. Login with the fixture use in the dex guide and run the oauth2-proxy with the following args:
-provider oidc
-provider-display-name "My OIDC Provider"
-client-id oauth2-proxy
-client-secret proxy
-redirect-url http://127.0.0.1:4180/oauth2/callback
-oidc-issuer-url http://127.0.0.1:5556
-cookie-secure=false
-email-domain example.com

The OpenID Connect Provider (OIDC) can also be used to connect to other Identity Providers such as Okta. To configure the OIDC provider for Okta, perform +the following steps:

Configuring the OIDC Provider with Okta

  1. Log in to Okta using an administrative account. It is suggested you try this in preview first, example.oktapreview.com
  2. (OPTIONAL) If you want to configure authorization scopes and claims to be passed on to multiple applications, +you may wish to configure an authorization server for each application. Otherwise, the provided default will work.
  • Navigate to Security then select API
  • Click Add Authorization Server, if this option is not available you may require an additional license for a custom authorization server.
  • Fill out the Name with something to describe the application you are protecting. e.g. 'Example App'.
  • For Audience, pick the URL of the application you wish to protect: https://example.corp.com
  • Fill out a Description
  • Add any Access Policies you wish to configure to limit application access.
  • The default settings will work for other options. +See Okta documentation for more information on Authorization Servers
  1. Navigate to Applications then select Add Application.
  • Select Web for the Platform setting.
  • Select OpenID Connect and click Create
  • Pick an Application Name such as Example App.
  • Set the Login redirect URI to https://example.corp.com.
  • Under General set the Allowed grant types to Authorization Code and Refresh Token.
  • Leave the rest as default, taking note of the Client ID and Client Secret.
  • Under Assignments select the users or groups you wish to access your application.
  1. Create a configuration file like the following:
provider = "oidc"
redirect_url = "https://example.corp.com/oauth2/callback"
oidc_issuer_url = "https://corp.okta.com/oauth2/abCd1234"
upstreams = [
"https://example.corp.com"
]
email_domains = [
"corp.com"
]
client_id = "XXXXX"
client_secret = "YYYYY"
pass_access_token = true
cookie_secret = "ZZZZZ"
skip_provider_button = true

The oidc_issuer_url is based on URL from your Authorization Server's Issuer field in step 2, or simply https://corp.okta.com +The client_id and client_secret are configured in the application settings. +Generate a unique client_secret to encrypt the cookie.

Then you can start the oauth2-proxy with ./oauth2-proxy --config /etc/example.cfg

Configuring the OIDC Provider with Okta - localhost

  1. Signup for developer account: https://developer.okta.com/signup/
  2. Create New Web Application: https://${your-okta-domain}/dev/console/apps/new
  3. Example Application Settings for localhost:
    • Name: My Web App
    • Base URIs: http://localhost:4180/
    • Login redirect URIs: http://localhost:4180/oauth2/callback
    • Logout redirect URIs: http://localhost:4180/
    • Group assignments: Everyone
    • Grant type allowed: Authorization Code and Refresh Token
  4. Make note of the Client ID and Client secret, they are needed in a future step
  5. Make note of the default Authorization Server Issuer URI from: https://${your-okta-domain}/admin/oauth2/as
  6. Example config file /etc/localhost.cfg
    provider = "oidc"
    redirect_url = "http://localhost:4180/oauth2/callback"
    oidc_issuer_url = "https://${your-okta-domain}/oauth2/default"
    upstreams = [
    "http://0.0.0.0:8080"
    ]
    email_domains = [
    "*"
    ]
    client_id = "XXX"
    client_secret = "YYY"
    pass_access_token = true
    cookie_secret = "ZZZ"
    cookie_secure = false
    skip_provider_button = true
    # Note: use the following for testing within a container
    # http_address = "0.0.0.0:4180"
  7. Then you can start the oauth2-proxy with ./oauth2-proxy --config /etc/localhost.cfg

login.gov Provider

login.gov is an OIDC provider for the US Government. +If you are a US Government agency, you can contact the login.gov team through the contact information +that you can find on https://login.gov/developers/ and work with them to understand how to get login.gov +accounts for integration/test and production access.

A developer guide is available here: https://developers.login.gov/, though this proxy handles everything +but the data you need to create to register your application in the login.gov dashboard.

As a demo, we will assume that you are running your application that you want to secure locally on +http://localhost:3000/, that you will be starting your proxy up on http://localhost:4180/, and that +you have an agency integration account for testing.

First, register your application in the dashboard. The important bits are:

  • Identity protocol: make this Openid connect
  • Issuer: do what they say for OpenID Connect. We will refer to this string as ${LOGINGOV_ISSUER}.
  • Public key: This is a self-signed certificate in .pem format generated from a 2048 bit RSA private key. +A quick way to do this is openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 3650 -nodes -subj '/C=US/ST=Washington/L=DC/O=GSA/OU=18F/CN=localhost', +The contents of the key.pem shall be referred to as ${OAUTH2_PROXY_JWT_KEY}.
  • Return to App URL: Make this be http://localhost:4180/
  • Redirect URIs: Make this be http://localhost:4180/oauth2/callback.
  • Attribute Bundle: Make sure that email is selected.

Now start the proxy up with the following options:

./oauth2-proxy -provider login.gov \
-client-id=${LOGINGOV_ISSUER} \
-redirect-url=http://localhost:4180/oauth2/callback \
-oidc-issuer-url=https://idp.int.identitysandbox.gov/ \
-cookie-secure=false \
-email-domain=gsa.gov \
-upstream=http://localhost:3000/ \
-cookie-secret=somerandomstring12341234567890AB \
-cookie-domain=localhost \
-skip-provider-button=true \
-pubjwk-url=https://idp.int.identitysandbox.gov/api/openid_connect/certs \
-profile-url=https://idp.int.identitysandbox.gov/api/openid_connect/userinfo \
-jwt-key="${OAUTH2_PROXY_JWT_KEY}"

You can also set all these options with environment variables, for use in cloud/docker environments. +One tricky thing that you may encounter is that some cloud environments will pass in environment +variables in a docker env-file, which does not allow multiline variables like a PEM file. +If you encounter this, then you can create a jwt_signing_key.pem file in the top level +directory of the repo which contains the key in PEM format and then do your docker build. +The docker build process will copy that file into your image which you can then access by +setting the OAUTH2_PROXY_JWT_KEY_FILE=/etc/ssl/private/jwt_signing_key.pem +environment variable, or by setting --jwt-key-file=/etc/ssl/private/jwt_signing_key.pem on the commandline.

Once it is running, you should be able to go to http://localhost:4180/ in your browser, +get authenticated by the login.gov integration server, and then get proxied on to your +application running on http://localhost:3000/. In a real deployment, you would secure +your application with a firewall or something so that it was only accessible from the +proxy, and you would use real hostnames everywhere.

Skip OIDC discovery

Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata.

In this case, you can set the --skip-oidc-discovery option, and supply those required endpoints manually:

-provider oidc
-client-id oauth2-proxy
-client-secret proxy
-redirect-url http://127.0.0.1:4180/oauth2/callback
-oidc-issuer-url http://127.0.0.1:5556
-skip-oidc-discovery
-login-url http://127.0.0.1:5556/authorize
-redeem-url http://127.0.0.1:5556/token
-oidc-jwks-url http://127.0.0.1:5556/keys
-cookie-secure=false
-email-domain example.com

Nextcloud Provider

The Nextcloud provider allows you to authenticate against users in your +Nextcloud instance.

When you are using the Nextcloud provider, you must specify the urls via +configuration, environment variable, or command line argument. Depending +on whether your Nextcloud instance is using pretty urls your urls may be of the +form /index.php/apps/oauth2/* or /apps/oauth2/*.

Refer to the OAuth2 +documentation +to setup the client id and client secret. Your "Redirection URI" will be +https://internalapp.yourcompany.com/oauth2/callback.

-provider nextcloud
-client-id <from nextcloud admin>
-client-secret <from nextcloud admin>
-login-url="<your nextcloud url>/index.php/apps/oauth2/authorize"
-redeem-url="<your nextcloud url>/index.php/apps/oauth2/api/v1/token"
-validate-url="<your nextcloud url>/ocs/v2.php/cloud/user?format=json"

Note: in all cases the validate-url will not have the index.php.

DigitalOcean Auth Provider

  1. Create a new OAuth application
    • You can fill in the name, homepage, and description however you wish.
    • In the "Application callback URL" field, enter: https://oauth-proxy/oauth2/callback, substituting oauth2-proxy with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.
  2. Note the Client ID and Client Secret.

To use the provider, pass the following options:

--provider=digitalocean
--client-id=<Client ID>
--client-secret=<Client Secret>

Alternatively, set the equivalent options in the config file. The redirect URL defaults to https://<requested host header>/oauth2/callback. If you need to change it, you can use the --redirect-url command-line option.

Bitbucket Auth Provider

  1. Add a new OAuth consumer
    • In "Callback URL" use https://<oauth2-proxy>/oauth2/callback, substituting <oauth2-proxy> with the actual hostname that oauth2-proxy is running on.
    • In Permissions section select:
      • Account -> Email
      • Team membership -> Read
      • Repositories -> Read
  2. Note the Client ID and Client Secret.

To use the provider, pass the following options:

--provider=bitbucket
--client-id=<Client ID>
--client-secret=<Client Secret>

The default configuration allows everyone with Bitbucket account to authenticate. To restrict the access to the team members use additional configuration option: --bitbucket-team=<Team name>. To restrict the access to only these users who has access to one selected repository use --bitbucket-repository=<Repository name>.

Gitea Auth Provider

  1. Create a new application: https://< your gitea host >/user/settings/applications
  2. Under Redirect URI enter the correct URL i.e. https://<proxied host>/oauth2/callback
  3. Note the Client ID and Client Secret.
  4. Pass the following options to the proxy:
--provider="github"
--redirect-url="https://<proxied host>/oauth2/callback"
--provider-display-name="Gitea"
--client-id="< client_id as generated by Gitea >"
--client-secret="< client_secret as generated by Gitea >"
--login-url="https://< your gitea host >/login/oauth/authorize"
--redeem-url="https://< your gitea host >/login/oauth/access_token"
--validate-url="https://< your gitea host >/api/v1"

Email Authentication

To authorize by email domain use --email-domain=yourcompany.com. To authorize individual email addresses use --authenticated-emails-file=/path/to/file with one email per line. To authorize all email addresses use --email-domain=*.

Adding a new Provider

Follow the examples in the providers package to define a new +Provider instance. Add a new case to +providers.New() to allow oauth2-proxy to use the +new Provider.

Edit this page
Copyright © 2020 OAuth2 Proxy.
+ + + + + + + + + + + + \ No newline at end of file diff --git a/docs/configuration/overview/index.html b/docs/configuration/overview/index.html new file mode 100644 index 00000000..69658ec6 --- /dev/null +++ b/docs/configuration/overview/index.html @@ -0,0 +1,52 @@ + + + + + + +Overview | OAuth2 Proxy + + + + + + + + + + + + +
+

Overview

oauth2-proxy can be configured via config file, command line options or environment variables.

To generate a strong cookie secret use python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'

Config File

Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (_). If the argument can be specified multiple times, the config option should be plural (trailing s).

An example oauth2-proxy.cfg config file is in the contrib directory. It can be used by specifying --config=/etc/oauth2-proxy.cfg

Command Line Options

OptionTypeDescriptionDefault
--acr-valuesstringoptional, see docs""
--approval-promptstringOAuth approval_prompt"force"
--auth-loggingboolLog authentication attemptstrue
--auth-logging-formatstringTemplate for authentication log linessee Logging Configuration
--authenticated-emails-filestringauthenticate against emails via file (one per line)
--azure-tenantstringgo to a tenant-specific or common (tenant-independent) endpoint."common"
--basic-auth-passwordstringthe password to set when passing the HTTP Basic Auth header
--client-idstringthe OAuth Client ID, e.g. "123456.apps.googleusercontent.com"
--client-secretstringthe OAuth Client Secret
--client-secret-filestringthe file with OAuth Client Secret
--configstringpath to config file
--cookie-domainstring | listOptional cookie domains to force cookies to (e.g. .yourcompany.com). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match).
--cookie-expiredurationexpire timeframe for cookie168h0m0s
--cookie-httponlyboolset HttpOnly cookie flagtrue
--cookie-namestringthe name of the cookie that the oauth_proxy creates"_oauth2_proxy"
--cookie-pathstringan optional cookie path to force cookies to (e.g. /poc/)"/"
--cookie-refreshdurationrefresh the cookie after this duration; 0 to disable; not supported by all providers [1]
--cookie-secretstringthe seed string for secure cookies (optionally base64 encoded)
--cookie-secureboolset secure (HTTPS only) cookie flagtrue
--cookie-samesitestringset SameSite cookie attribute ("lax", "strict", "none", or "").""
--custom-templates-dirstringpath to custom html templates
--display-htpasswd-formbooldisplay username / password login form if an htpasswd file is providedtrue
--email-domainstring | listauthenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email
--errors-to-info-logboolredirects error-level logging to default log channel instead of stderr
--extra-jwt-issuersstringif --skip-jwt-bearer-tokens is set, a list of extra JWT issuer=audience (see a token's iss, aud fields) pairs (where the issuer URL has a .well-known/openid-configuration or a .well-known/jwks.json)
--exclude-logging-pathsstringcomma separated list of paths to exclude from logging, e.g. "/ping,/path2""" (no paths excluded)
--flush-intervaldurationperiod between flushing response buffers when streaming responses"1s"
--force-httpsboolenforce https redirectfalse
--bannerstringcustom (html) banner string. Use "-" to disable default banner.
--footerstringcustom (html) footer string. Use "-" to disable default footer.
--gcp-healthchecksboolwill enable /liveness_check, /readiness_check, and / (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingressesfalse
--github-orgstringrestrict logins to members of this organisation
--github-teamstringrestrict logins to members of any of these teams (slug), separated by a comma
--github-repostringrestrict logins to collaborators of this repository formatted as orgname/repo
--github-tokenstringthe token to use when verifying repository collaborators (must have push access to the repository)
--github-userstring | listTo allow users to login by username even if they do not belong to the specified org and team or collaborators
--gitlab-groupstring | listrestrict logins to members of any of these groups (slug), separated by a comma
--google-admin-emailstringthe google admin to impersonate for api calls
--google-groupstringrestrict logins to members of this google group (may be given multiple times).
--google-service-account-jsonstringthe path to the service account json credentials
--htpasswd-filestringadditionally authenticate against a htpasswd file. Entries must be created with htpasswd -B for bcrypt encryption
--http-addressstring[http://]<addr>:<port> or unix://<path> to listen on for HTTP clients"127.0.0.1:4180"
--https-addressstring<addr>:<port> to listen on for HTTPS clients":443"
--logging-compressboolShould rotated log files be compressed using gzipfalse
--logging-filenamestringFile to log requests to, empty for stdout"" (stdout)
--logging-local-timeboolUse local time in log files and backup filenames instead of UTCtrue (local time)
--logging-max-ageintMaximum number of days to retain old log files7
--logging-max-backupsintMaximum number of old log files to retain; 0 to disable0
--logging-max-sizeintMaximum size in megabytes of the log file before rotation100
--jwt-keystringprivate key in PEM format used to sign JWT, so that you can say something like --jwt-key="${OAUTH2_PROXY_JWT_KEY}": required by login.gov
--jwt-key-filestringpath to the private key file in PEM format used to sign the JWT so that you can say something like --jwt-key-file=/etc/ssl/private/jwt_signing_key.pem: required by login.gov
--login-urlstringAuthentication endpoint
--insecure-oidc-allow-unverified-emailbooldon't fail if an email address in an id_token is not verifiedfalse
--insecure-oidc-skip-issuer-verificationboolallow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)false
--oidc-issuer-urlstringthe OpenID Connect issuer URL, e.g. "https://accounts.google.com"
--oidc-jwks-urlstringOIDC JWKS URI for token verification; required if OIDC discovery is disabled
--oidc-groups-claimstringwhich claim contains the user groups"groups"
--pass-access-tokenboolpass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with --set-xauthrequest this adds the X-Auth-Request-Access-Token header to the responsefalse
--pass-authorization-headerboolpass OIDC IDToken to upstream via Authorization Bearer headerfalse
--pass-basic-authboolpass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstreamtrue
--prefer-email-to-userboolPrefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with --pass-basic-auth and --pass-user-headersfalse
--pass-host-headerboolpass the request Host Header to upstreamtrue
--pass-user-headersboolpass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstreamtrue
--profile-urlstringProfile access endpoint
--promptstringOIDC prompt; if present, approval-prompt is ignored""
--providerstringOAuth providergoogle
--provider-ca-filestring | listPaths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead.
--provider-display-namestringOverride the provider's name with the given string; used for the sign-in page(depends on provider)
--ping-pathstringthe ping endpoint that can be used for basic health checks"/ping"
--ping-user-agentstringa User-Agent that can be used for basic health checks"" (don't check user agent)
--proxy-prefixstringthe url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in)"/oauth2"
--proxy-websocketsboolenables WebSocket proxyingtrue
--pubjwk-urlstringJWK pubkey access endpoint: required by login.gov
--real-client-ip-headerstringHeader used to determine the real IP of the client, requires --reverse-proxy to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)X-Real-IP
--redeem-urlstringToken redemption endpoint
--redirect-urlstringthe OAuth Redirect URL, e.g. "https://internalapp.yourcompany.com/oauth2/callback"
--redis-cluster-connection-urlsstring | listList of Redis cluster connection URLs (e.g. redis://HOST[:PORT]). Used in conjunction with --redis-use-cluster
--redis-connection-urlstringURL of redis server for redis session storage (e.g. redis://HOST[:PORT])
--redis-passwordstringRedis password. Applicable for all Redis configurations. Will override any password set in --redis-connection-url
--redis-sentinel-passwordstringRedis sentinel password. Used only for sentinel connection; any redis node passwords need to use --redis-password
--redis-sentinel-master-namestringRedis sentinel master name. Used in conjunction with --redis-use-sentinel
--redis-sentinel-connection-urlsstring | listList of Redis sentinel connection URLs (e.g. redis://HOST[:PORT]). Used in conjunction with --redis-use-sentinel
--redis-use-clusterboolConnect to redis cluster. Must set --redis-cluster-connection-urls to use this featurefalse
--redis-use-sentinelboolConnect to redis via sentinels. Must set --redis-sentinel-master-name and --redis-sentinel-connection-urls to use this featurefalse
--request-loggingboolLog requeststrue
--request-logging-formatstringTemplate for request log linessee Logging Configuration
--resourcestringThe resource that is protected (Azure AD only)
--reverse-proxyboolare we running behind a reverse proxy, controls whether headers like X-Real-IP are acceptedfalse
--scopestringOAuth scope specification
--session-cookie-minimalboolstrip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)false
--session-store-typestringSession data storage backend; redis or cookiecookie
--set-xauthrequestboolset X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with --pass-access-token, X-Auth-Request-Access-Token is added to response headers.false
--set-authorization-headerboolset Authorization Bearer response header (useful in Nginx auth_request mode)false
--set-basic-authboolset HTTP Basic Auth information in response (useful in Nginx auth_request mode)false
--signature-keystringGAP-Signature request signature key (algorithm:secretkey)
--silence-ping-loggingbooldisable logging of requests to ping endpointfalse
--skip-auth-preflightboolwill skip authentication for OPTIONS requestsfalse
--skip-auth-regexstring | list(DEPRECATED for --skip-auth-route) bypass authentication for requests paths that match (may be given multiple times)
--skip-auth-routestring | listbypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods
--skip-auth-strip-headersboolstrips X-Forwarded-* style authentication headers & Authorization header if they would be set by oauth2-proxy for allowlisted requests (--skip-auth-route, --skip-auth-regex, --skip-auth-preflight, --trusted-ip)false
--skip-jwt-bearer-tokensboolwill skip requests that have verified JWT bearer tokens (the token must have aud that matches this client id or one of the extras from extra-jwt-issuers)false
--skip-oidc-discoveryboolbypass OIDC endpoint discovery. --login-url, --redeem-url and --oidc-jwks-url must be configured in this casefalse
--skip-provider-buttonboolwill skip sign-in-page to directly reach the next step: oauth/startfalse
--ssl-insecure-skip-verifyboolskip validation of certificates presented when using HTTPS providersfalse
--ssl-upstream-insecure-skip-verifyboolskip validation of certificates presented when using HTTPS upstreamsfalse
--standard-loggingboolLog standard runtime informationtrue
--standard-logging-formatstringTemplate for standard log linessee Logging Configuration
--tls-cert-filestringpath to certificate file
--tls-key-filestringpath to private key file
--upstreamstring | listthe http url(s) of the upstream endpoint, file:// paths for static files or static://<status_code> for static response. Routing is based on the path
--user-id-claimstringwhich claim contains the user ID["email"]
--allowed-groupstring | listrestrict logins to members of this group (may be given multiple times)
--validate-urlstringAccess token validation endpoint
--versionn/aprint version string
--whitelist-domainstring | listallowed domains for redirection after authentication. Prefix domain with a . to allow subdomains (e.g. .example.com) [2]
--trusted-ipstring | listlist of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with --reverse-proxy and optionally --real-client-ip-header this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them.

[1]: Only these providers support --cookie-refresh: GitLab, Google and OIDC

[2]: When using the whitelist-domain option, any domain prefixed with a . will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: example.com:8080. To allow any port, use *: example.com:*.

See below for provider specific options

Upstreams Configuration

oauth2-proxy supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as http://127.0.0.1:8080/ for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide http://127.0.0.1:8080/some/path/ then it will only be requests that start with /some/path/ which are forwarded to the upstream.

Static file paths are configured as a file:// URL. file:///var/www/static/ will serve the files from that directory at http://[oauth2-proxy url]/var/www/static/, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. file:///var/www/static/#/static/ will make /var/www/static/ available at http://[oauth2-proxy url]/static/.

Multiple upstreams can either be configured by supplying a comma separated list to the --upstream parameter, supplying the parameter multiple times or providing a list in the config file. When multiple upstreams are used routing to them will be based on the path they are set up with.

Environment variables

Every command line argument can be specified as an environment variable by +prefixing it with OAUTH2_PROXY_, capitalising it, and replacing hyphens (-) +with underscores (_). If the argument can be specified multiple times, the +environment variable should be plural (trailing S).

This is particularly useful for storing secrets outside of a configuration file +or the command line.

For example, the --cookie-secret flag becomes OAUTH2_PROXY_COOKIE_SECRET, +and the --email-domain flag becomes OAUTH2_PROXY_EMAIL_DOMAINS.

Logging Configuration

By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the --logging-filename command.

If logging to a file you can also configure the maximum file size (--logging-max-size), age (--logging-max-age), max backup logs (--logging-max-backups), and if backup logs should be compressed (--logging-compress).

There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with --standard-logging, --auth-logging, and --request-logging.

Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log.

Logging of requests to the /ping endpoint (or using --ping-user-agent) can be disabled with --silence-ping-logging reducing log volume. This flag appends the --ping-path to --exclude-logging-paths.

Auth Log Format

Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:

<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] [<STATUS>] <MESSAGE>

The status block will contain one of the below strings:

  • AuthSuccess If a user has authenticated successfully by any method
  • AuthFailure If the user failed to authenticate explicitly
  • AuthError If there was an unexpected error during authentication

If you require a different format than that, you can configure it with the --auth-logging-format flag. +The default format is configured as follows:

{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}

Available variables for auth logging:

VariableExampleDescription
Client74.125.224.72The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.
Hostdomain.comThe value of the Host header.
ProtocolHTTP/1.0The request protocol.
RequestMethodGETThe request method.
Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
UserAgent-The full user agent as reported by the requesting client.
Usernameusername@email.comThe email or username of the auth request.
StatusAuthSuccessThe status of the auth request. See above for details.
MessageAuthenticated via OAuth2The details of the auth attempt.

Request Log Format

HTTP request logs will output by default in the below format:

<REMOTE_ADDRESS> - <user@domain.com> [19/Mar/2015:17:20:19 -0400] <HOST_HEADER> GET <UPSTREAM_HOST> "/path/" HTTP/1.1 "<USER_AGENT>" <RESPONSE_CODE> <RESPONSE_BYTES> <REQUEST_DURATION>

If you require a different format than that, you can configure it with the --request-logging-format flag. +The default format is configured as follows:

{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}

Available variables for request logging:

VariableExampleDescription
Client74.125.224.72The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.
Hostdomain.comThe value of the Host header.
ProtocolHTTP/1.0The request protocol.
RequestDuration0.001The time in seconds that a request took to process.
RequestMethodGETThe request method.
RequestURI"/oauth2/auth"The URI path of the request.
ResponseSize12The size in bytes of the response.
StatusCode200The HTTP status code of the response.
Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
Upstream-The upstream data of the HTTP request.
UserAgent-The full user agent as reported by the requesting client.
Usernameusername@email.comThe email or username of the auth request.

Standard Log Format

All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:

[19/Mar/2015:17:20:19 -0400] [main.go:40] <MESSAGE>

If you require a different format than that, you can configure it with the --standard-logging-format flag. The default format is configured as follows:

[{{.Timestamp}}] [{{.File}}] {{.Message}}

Available variables for standard logging:

VariableExampleDescription
Timestamp19/Mar/2015:17:20:19 -0400The date and time of the logging event.
Filemain.go:40The file and line number of the logging statement.
MessageHTTP: listening on 127.0.0.1:4180The details of the log statement.

Configuring for use with the Nginx auth_request directive

The Nginx auth_request directive allows Nginx to authenticate requests via the oauth2-proxy's /auth endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:

server {
listen 443 ssl;
server_name ...;
include ssl/ssl.conf;
+
location /oauth2/ {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Auth-Request-Redirect $request_uri;
# or, if you are handling multiple domains:
# proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
}
location = /oauth2/auth {
proxy_pass http://127.0.0.1:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
# nginx auth_request includes headers but not body
proxy_set_header Content-Length "";
proxy_pass_request_body off;
}
+
location / {
auth_request /oauth2/auth;
error_page 401 = /oauth2/sign_in;
+
# pass information via X-User and X-Email headers to backend,
# requires running with --set-xauthrequest flag
auth_request_set $user $upstream_http_x_auth_request_user;
auth_request_set $email $upstream_http_x_auth_request_email;
proxy_set_header X-User $user;
proxy_set_header X-Email $email;
+
# if you enabled --pass-access-token, this will pass the token to the backend
auth_request_set $token $upstream_http_x_auth_request_access_token;
proxy_set_header X-Access-Token $token;
+
# if you enabled --cookie-refresh, this is needed for it to work with auth_request
auth_request_set $auth_cookie $upstream_http_set_cookie;
add_header Set-Cookie $auth_cookie;
+
# When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
# limit and so the OAuth2 Proxy splits these into multiple parts.
# Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
# so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;
+
# Extract the Cookie attributes from the first Set-Cookie header and append them
# to the second part ($upstream_cookie_* variables only contain the raw cookie content)
if ($auth_cookie ~* "(; .*)") {
set $auth_cookie_name_0 $auth_cookie;
set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
}
+
# Send both Set-Cookie headers now if there was a second part
if ($auth_cookie_name_upstream_1) {
add_header Set-Cookie $auth_cookie_name_0;
add_header Set-Cookie $auth_cookie_name_1;
}
+
proxy_pass http://backend/;
# or "root /path/to/site;" or "fastcgi_pass ..." etc
}
}

When you use ingress-nginx in Kubernetes, you MUST use kubernetes/ingress-nginx (which includes the Lua module) and the following configuration snippet for your Ingress. +Variables set with auth_request_set are not set-able in plain nginx config when the location is processed via proxy_pass and then may only be processed by Lua. +Note that nginxinc/kubernetes-ingress does not include the Lua module.

nginx.ingress.kubernetes.io/auth-response-headers: Authorization
nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
nginx.ingress.kubernetes.io/configuration-snippet: |
auth_request_set $name_upstream_1 $upstream_cookie_name_1;
+
access_by_lua_block {
if ngx.var.name_upstream_1 ~= "" then
ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
end
}

It is recommended to use --session-store-type=redis when expecting large sessions/OIDC tokens (e.g. with MS Azure).

You have to substitute name with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

note

If you set up your OAuth2 provider to rotate your client secret, you can use the client-secret-file option to reload the secret when it is updated.

Edit this page
Copyright © 2020 OAuth2 Proxy.
+ + + + + + + + + + + + \ No newline at end of file diff --git a/docs/configuration/session_storage/index.html b/docs/configuration/session_storage/index.html new file mode 100644 index 00000000..4e36d9bf --- /dev/null +++ b/docs/configuration/session_storage/index.html @@ -0,0 +1,48 @@ + + + + + + +Session Storage | OAuth2 Proxy + + + + + + + + + + + + +
+

Session Storage

Sessions allow a user's authentication to be tracked between multiple HTTP +requests to a service.

The OAuth2 Proxy uses a Cookie to track user sessions and will store the session +data in one of the available session storage backends.

At present the available backends are (as passed to --session-store-type):

Cookie Storage

The Cookie storage backend is the default backend implementation and has +been used in the OAuth2 Proxy historically.

With the Cookie storage backend, all session information is stored in client +side cookies and transferred with each and every request.

The following should be known when using this implementation:

  • Since all state is stored client side, this storage backend means that the OAuth2 Proxy is completely stateless
  • Cookies are signed server side to prevent modification client-side
  • It is mandatory to set a cookie-secret which will ensure data is encrypted within the cookie data.
  • Since multiple requests can be made concurrently to the OAuth2 Proxy, this session implementation +cannot lock sessions and while updating and refreshing sessions, there can be conflicts which force +users to re-authenticate

Redis Storage

The Redis Storage backend stores sessions, encrypted, in redis. Instead sending all the information +back the the client for storage, as in the Cookie storage, a ticket is sent back +to the user as the cookie value instead.

A ticket is composed as the following:

{CookieName}-{ticketID}.{secret}

Where:

  • The CookieName is the OAuth2 cookie name (_oauth2_proxy by default)
  • The ticketID is a 128 bit random number, hex-encoded
  • The secret is a 128 bit random number, base64url encoded (no padding). The secret is unique for every session.
  • The pair of {CookieName}-{ticketID} comprises a ticket handle, and thus, the redis key +to which the session is stored. The encoded session is encrypted with the secret and stored +in redis via the SETEX command.

Encrypting every session uniquely protects the refresh/access/id tokens stored in the session from +disclosure.

Usage

When using the redis store, specify --session-store-type=redis as well as the Redis connection URL, via +--redis-connection-url=redis://host[:port][/db-number].

You may also configure the store for Redis Sentinel. In this case, you will want to use the +--redis-use-sentinel=true flag, as well as configure the flags --redis-sentinel-master-name +and --redis-sentinel-connection-urls appropriately.

Redis Cluster is available to be the backend store as well. To leverage it, you will need to set the +--redis-use-cluster=true flag, and configure the flags --redis-cluster-connection-urls appropriately.

Note that flags --redis-use-sentinel=true and --redis-use-cluster=true are mutually exclusive.

Edit this page
Copyright © 2020 OAuth2 Proxy.
+ + + + + + + + + + + + \ No newline at end of file diff --git a/docs/configuration/tls/index.html b/docs/configuration/tls/index.html new file mode 100644 index 00000000..61140133 --- /dev/null +++ b/docs/configuration/tls/index.html @@ -0,0 +1,39 @@ + + + + + + +TLS Configuration | OAuth2 Proxy + + + + + + + + + + + + +
+

TLS Configuration

There are two recommended configurations.

  1. Configure SSL Termination with OAuth2 Proxy by providing a --tls-cert-file=/path/to/cert.pem and --tls-key-file=/path/to/cert.key.

    The command line to run oauth2-proxy in this configuration would look like this:

    ./oauth2-proxy \
    --email-domain="yourcompany.com" \
    --upstream=http://127.0.0.1:8080/ \
    --tls-cert-file=/path/to/cert.pem \
    --tls-key-file=/path/to/cert.key \
    --cookie-secret=... \
    --cookie-secure=true \
    --provider=... \
    --client-id=... \
    --client-secret=...

  2. Configure SSL Termination with Nginx (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....

    Because oauth2-proxy listens on 127.0.0.1:4180 by default, to listen on all interfaces (needed when using an +external load balancer like Amazon ELB or Google Platform Load Balancing) use --http-address="0.0.0.0:4180" or +--http-address="http://:4180".

    Nginx will listen on port 443 and handle SSL connections while proxying to oauth2-proxy on port 4180. +oauth2-proxy will then authenticate requests for an upstream application. The external endpoint for this example +would be https://internal.yourcompany.com/.

    An example Nginx config follows. Note the use of Strict-Transport-Security header to pin requests to SSL +via HSTS:

    server {
    listen 443 default ssl;
    server_name internal.yourcompany.com;
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/cert.key;
    add_header Strict-Transport-Security max-age=2592000;
    +
    location / {
    proxy_pass http://127.0.0.1:4180;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Scheme $scheme;
    proxy_connect_timeout 1;
    proxy_send_timeout 30;
    proxy_read_timeout 30;
    }
    }

    The command line to run oauth2-proxy in this configuration would look like this:

    ./oauth2-proxy \
    --email-domain="yourcompany.com" \
    --upstream=http://127.0.0.1:8080/ \
    --cookie-secret=... \
    --cookie-secure=true \
    --provider=... \
    --reverse-proxy=true \
    --client-id=... \
    --client-secret=...
Edit this page
Copyright © 2020 OAuth2 Proxy.
+ + + + + + + + + + + + \ No newline at end of file diff --git a/docs/features/endpoints/index.html b/docs/features/endpoints/index.html new file mode 100644 index 00000000..f1234083 --- /dev/null +++ b/docs/features/endpoints/index.html @@ -0,0 +1,33 @@ + + + + + + +Endpoints | OAuth2 Proxy + + + + + + + + + + + + +
+

Endpoints

OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.

  • /robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see robotstxt.org for more info
  • /ping - returns a 200 OK response, which is intended for use with health checks
  • /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
  • /oauth2/sign_out - this URL is used to clear the session cookie
  • /oauth2/start - a URL that will redirect to start the OAuth cycle
  • /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
  • /oauth2/userinfo - the URL is used to return user's email from the session in JSON format.
  • /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the Nginx auth_request directive

Sign out

To sign the user out, redirect them to /oauth2/sign_out. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the rd query parameter, i.e. redirect the user to something like (notice the url-encoding!):

/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

Alternatively, include the redirect URL in the X-Auth-Request-Redirect header:

GET /oauth2/sign_out HTTP/1.1
X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page
...

(The "sign_out_page" should be the end_session_endpoint from the metadata if your OIDC provider supports Session Management and Discovery.)

BEWARE that the domain you want to redirect to (my-oidc-provider.example.com in the example) must be added to the --whitelist-domain configuration option otherwise the redirect will be ignored.

Edit this page
Copyright © 2020 OAuth2 Proxy.
+ + + + + + + + + + + + \ No newline at end of file diff --git a/docs/features/request_signatures/index.html b/docs/features/request_signatures/index.html new file mode 100644 index 00000000..e22ad6dd --- /dev/null +++ b/docs/features/request_signatures/index.html @@ -0,0 +1,40 @@ + + + + + + +Request Signatures | OAuth2 Proxy + + + + + + + + + + + + +
+

Request Signatures

If signature_key is defined, proxied requests will be signed with the +GAP-Signature header, which is a Hash-based Message Authentication Code +(HMAC) +of selected request information and the request body see SIGNATURE_HEADERS +in oauthproxy.go.

signature_key must be of the form algorithm:secretkey, (ie: signature_key = "sha1:secret0")

For more information about HMAC request signature validation, read the +following:

Edit this page
Copyright © 2020 OAuth2 Proxy.
+ + + + + + + + + + + + \ No newline at end of file diff --git a/docs/index.html b/docs/index.html new file mode 100644 index 00000000..ce26040f --- /dev/null +++ b/docs/index.html @@ -0,0 +1,33 @@ + + + + + + +Installation | OAuth2 Proxy + + + + + + + + + + + + +
+

Installation

  1. Choose how to deploy:

    a. Download Prebuilt Binary (current release is v6.1.1)

    b. Build with $ go get github.com/oauth2-proxy/oauth2-proxy/v7 which will put the binary in $GOPATH/bin

    c. Using the prebuilt docker image quay.io/oauth2-proxy/oauth2-proxy (AMD64, ARMv6 and ARM64 tags available)

Prebuilt binaries can be validated by extracting the file and verifying it against the sha256sum.txt checksum file provided for each release starting with version v3.0.0.

$ sha256sum -c sha256sum.txt 2>&1 | grep OK
oauth2-proxy-x.y.z.linux-amd64: OK
  1. Select a Provider and Register an OAuth Application with a Provider
  2. Configure OAuth2 Proxy using config file, command line options, or environment variables
  3. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)
Edit this page
Copyright © 2020 OAuth2 Proxy.
+ + + + + + + + + + + + \ No newline at end of file diff --git a/efc9be4b.f8ffd2b0.js b/efc9be4b.f8ffd2b0.js new file mode 100644 index 00000000..46eb1457 --- /dev/null +++ b/efc9be4b.f8ffd2b0.js @@ -0,0 +1 @@ +(window.webpackJsonp=window.webpackJsonp||[]).push([[12],{69:function(e,t,n){"use strict";n.r(t),n.d(t,"frontMatter",(function(){return a})),n.d(t,"metadata",(function(){return c})),n.d(t,"rightToc",(function(){return s})),n.d(t,"default",(function(){return p}));var r=n(2),o=n(6),i=(n(0),n(73)),a={id:"endpoints",title:"Endpoints"},c={unversionedId:"features/endpoints",id:"features/endpoints",isDocsHomePage:!1,title:"Endpoints",description:"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The /oauth2 prefix can be changed with the --proxy-prefix config variable.",source:"@site/docs/features/endpoints.md",slug:"/features/endpoints",permalink:"/oauth2-proxy/docs/features/endpoints",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/features/endpoints.md",version:"current",sidebar:"docs",previous:{title:"TLS Configuration",permalink:"/oauth2-proxy/docs/configuration/tls"},next:{title:"Request Signatures",permalink:"/oauth2-proxy/docs/features/request_signatures"}},s=[{value:"Sign out",id:"sign-out",children:[]}],u={rightToc:s};function p(e){var t=e.components,n=Object(o.a)(e,["components"]);return Object(i.b)("wrapper",Object(r.a)({},u,n,{components:t,mdxType:"MDXLayout"}),Object(i.b)("p",null,"OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2")," prefix can be changed with the ",Object(i.b)("inlineCode",{parentName:"p"},"--proxy-prefix")," config variable."),Object(i.b)("ul",null,Object(i.b)("li",{parentName:"ul"},"/robots.txt - returns a 200 OK response that disallows all User-agents from all paths; see ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"http://www.robotstxt.org/"}),"robotstxt.org")," for more info"),Object(i.b)("li",{parentName:"ul"},"/ping - returns a 200 OK response, which is intended for use with health checks"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)"),Object(i.b)("li",{parentName:"ul"},"/oauth2/sign_out - this URL is used to clear the session cookie"),Object(i.b)("li",{parentName:"ul"},"/oauth2/start - a URL that will redirect to start the OAuth cycle"),Object(i.b)("li",{parentName:"ul"},"/oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url."),Object(i.b)("li",{parentName:"ul"},"/oauth2/userinfo - the URL is used to return user's email from the session in JSON format."),Object(i.b)("li",{parentName:"ul"},"/oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the ",Object(i.b)("a",Object(r.a)({parentName:"li"},{href:"/oauth2-proxy/docs/configuration/overview#configuring-for-use-with-the-nginx-auth_request-directive"}),"Nginx ",Object(i.b)("inlineCode",{parentName:"a"},"auth_request")," directive"))),Object(i.b)("h3",{id:"sign-out"},"Sign out"),Object(i.b)("p",null,"To sign the user out, redirect them to ",Object(i.b)("inlineCode",{parentName:"p"},"/oauth2/sign_out"),". This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the ",Object(i.b)("inlineCode",{parentName:"p"},"rd")," query parameter, i.e. redirect the user to something like (notice the url-encoding!):"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page\n")),Object(i.b)("p",null,"Alternatively, include the redirect URL in the ",Object(i.b)("inlineCode",{parentName:"p"},"X-Auth-Request-Redirect")," header:"),Object(i.b)("pre",null,Object(i.b)("code",Object(r.a)({parentName:"pre"},{}),"GET /oauth2/sign_out HTTP/1.1\nX-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page\n...\n")),Object(i.b)("p",null,'(The "sign_out_page" should be the ',Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1"}),Object(i.b)("inlineCode",{parentName:"a"},"end_session_endpoint"))," from ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig"}),"the metadata")," if your OIDC provider supports Session Management and Discovery.)"),Object(i.b)("p",null,"BEWARE that the domain you want to redirect to (",Object(i.b)("inlineCode",{parentName:"p"},"my-oidc-provider.example.com")," in the example) must be added to the ",Object(i.b)("a",Object(r.a)({parentName:"p"},{href:"../configuration/overview"}),Object(i.b)("inlineCode",{parentName:"a"},"--whitelist-domain"))," configuration option otherwise the redirect will be ignored."))}p.isMDXComponent=!0},73:function(e,t,n){"use strict";n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return b}));var r=n(0),o=n.n(r);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function c(e){for(var t=1;t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var u=o.a.createContext({}),p=function(e){var t=o.a.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):c(c({},t),e)),n},l=function(e){var t=p(e.components);return o.a.createElement(u.Provider,{value:t},e.children)},d={inlineCode:"code",wrapper:function(e){var t=e.children;return o.a.createElement(o.a.Fragment,{},t)}},h=o.a.forwardRef((function(e,t){var n=e.components,r=e.mdxType,i=e.originalType,a=e.parentName,u=s(e,["components","mdxType","originalType","parentName"]),l=p(n),h=r,b=l["".concat(a,".").concat(h)]||l[h]||d[h]||i;return n?o.a.createElement(b,c(c({ref:t},u),{},{components:n})):o.a.createElement(b,c({ref:t},u))}));function b(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=n.length,a=new Array(i);a[0]=h;var c={};for(var s in t)hasOwnProperty.call(t,s)&&(c[s]=t[s]);c.originalType=e,c.mdxType="string"==typeof e?e:r,a[1]=c;for(var u=2;u=0||(j[D]=M[D]);return j}(M,N);if(Object.getOwnPropertySymbols){var w=Object.getOwnPropertySymbols(M);for(L=0;L=0||Object.prototype.propertyIsEnumerable.call(M,D)&&(j[D]=M[D])}return j}var e=j.a.createContext({}),z=function(M){var N=j.a.useContext(e),D=N;return M&&(D="function"==typeof M?M(N):t(t({},N),M)),D},u=function(M){var N=z(M.components);return j.a.createElement(e.Provider,{value:N},M.children)},s={inlineCode:"code",wrapper:function(M){var N=M.children;return j.a.createElement(j.a.Fragment,{},N)}},i=j.a.forwardRef((function(M,N){var D=M.components,L=M.mdxType,w=M.originalType,T=M.parentName,e=c(M,["components","mdxType","originalType","parentName"]),u=z(D),i=L,y=u["".concat(T,".").concat(i)]||u[i]||s[i]||w;return D?j.a.createElement(y,t(t({ref:N},e),{},{components:D})):j.a.createElement(y,t({ref:N},e))}));function y(M,N){var D=arguments,L=N&&N.mdxType;if("string"==typeof M||L){var w=D.length,T=new Array(w);T[0]=i;var t={};for(var c in N)hasOwnProperty.call(N,c)&&(t[c]=N[c]);t.originalType=M,t.mdxType="string"==typeof M?M:L,T[1]=t;for(var e=2;e(G4B2AyPV^ZxAyzQde)kAuDQ=^B?XzYXD**X5ag`v1F6Rdg8KkL za2yFw!!s1;FWiH_@Qm-t!{7N~#D~xE;W3W=V;Kn~_xF_rc)(!r;ITY{xUnLLk3WL! z!&5%<2;#_tAd7kkA{c`p)HVs_%EIu%X?-~vDdYtGC#5nY5}qNld7y5OAQ$7&KRB|E ze(w=PqgGbx-V>L>r4e_n_l~1t$9;F+T#CSaB$kVzxmx`FOQffC*ZX2VsYr>+zR7S` z^Q2ppWJXK4GjFq;R-a6M?C#X1A!zF@;x~zMJyjAn+L_`c@f#g`&!A^4V<9=v7h14R7WI9Z(&qLm0j>?>Cf|U++mVy zVL0zc$NKW=3fKL-V_r=p|{It+~N5p-b_Q>Yv$*K1zPbiJ7jA`Wv zZAq1M4vg2<{EX@qMTML=Fz1YnB(Uv1L4tvCx|7t0VjqJ}x*hGj&cWNL;bPw%4{#U0 zIEMtXD}|a;`H*{42ge*to_b|ne9RG)X&|y^wPr&vzY#LCBGJ+Ax#l|*qZ`Dfg5e0i z|4XzNOSVQdg$R$0&Mt*AG2Ftbcz;qacXF_%nU}AK6A^fs_CPH!Vr`@T`kyj+uY7Ss zK6MUm&%@c%v(%}4i_h>oQ!6vxXL-0Csw;nch*i^2V&~BRxx8f_7VTLSDL*Aer{57; z+x*n?;8BIj=7?xNM;Bp4g<@sV-t(k3I8`{)Q8;JyDWy?w zO$4)FoR4Dlmy>M*t*vhLl+$` z{})0I*CXzm_&vtI)rvv`Grxbw{uodV6sxe|chGsK8~1H`%W#&O$y`UB;jPDfKK6LE z@lY^lYTiU5sE9g^fX$4SK-qb=c(0DBQzxPEP=dwvsV^muP0FpQvPXWn+MyY`J!MQj zkw*1X=e|eMSEe{}NR7zW)c7_tvv-{pad6{q=ayl1Vrwr$U(wk33Y&RU|3JEf_K#pF zmy-F-`2CzDkA^S}0*P*IhpfX?mHnL1%kVuTaSB*OPy()0p0RyF@d@P&ZH~bLlc&Qz z-AsO#4snMdIg>Rt48&^T`v^z18r}x6qq|PW%gyep$=AWTLoD1hRE15^oU&4h#tYx; zC>-ZM?@4Fu7F>N@&K_oU@61JhC0DcRn~ysfRj_JBsa-qQyiMxNeKi{HO>#bt@bM1gud?L0R!jx&9%<+sx$b*W6)FzyWb~d9y|yOu zgtp5Wan{zZru8DN+}%0z#iZj8|5;Vac{>fwc2(}xcpdRPx}?34;~i;y-9C&~!;Rou z<2O9R6mbd8(keUdv&^Y8nPo(fi8yJKB_{3Ri_Jyr;`3B1VWuKD|FgfQ#59_kd3{f7 zyh%-d-l5Yx&3CXZgYSCMJrS6!p`%C`v8%s1&YLrJb=|O)`}fUiCFiLK{7#hv#gp`6 zBI6Z8azf%F@s*CsY_I1f$V$|rl52jtZmbEV#2b&BgR5V9*Ur0s&Dc&n4oNlevSqm} z9eHcLPS!6*H&b)9G;c@cAb7BEu4)iAGD^|&Cd%F6`tsL>!d z{rb3KrAtVYJ+$1>Ywcc#$t?9EtMDSbD3jCgJHZNjGUnK=4g14X&C6V=6Z5i%tIruP zhbH-_PoyrL5xawXB24uDiskW&VkqZdqqk>wr@spxuIx}N8JnexlvCgx6z3$@(ofE{ zudI&;2@eN}wUynU_lVKeuvLZZ77_tN@!}x|$38rK;h=F+d+xN>~hqk!9IF7YE zJ-5ckeu&Nb>OR}u6iHbR(bXY1qAES|+A=aVIAxc0Vp-T;inaFf4$CUvyxsr!Z`bE7 zJPsUgQN7&~IX~ugJ;h3Qx6imd)kVHOT;p{FRt8>-d9yb;AIR-^F6N25=5t~-{&M;I z54@olJ7}I2iSMJjt@Kp?dqj_U2>EWx=fMg7^taR#CI0JS5oEtNSC`YIv<=qA#I{tC z+31q<@~zy{Tf(X0XUg2mQ?HdPBAccy`=LbHL_Bu~s!WdtJG&3tU$9kIlpwoJ`nLQE zkv3y8?iZvlk&9Y(oOB72GC5P*?Kq?dChg7GT?@XYH{C5YOTBJJr_Av7&2H`4;8c>* z$;gUwHn+`#;x>1_ye$#mlW*EqM;dw8F1q9xRR8kHDlgePu)8jyP6ZbVD}Vd2yXTe6 zn-^YXxFVFa8^o@6!mfqy)4Wo&ToKKUKaWp;GKwJZpHi!b@0ZTJBJx@B<~{j)K;M>^ z^Jak}g*89RL2#IQ)!ct~-}I=X=+O`Vz$oE8p`2OU6TI%Rkc>j)kayVX5p}KgoB{HgIFg%k+&nv&~ zP-2r9V}0+;NgjUK#I1MK1CJ?LY%0u^QreHdD(@4z4WwsH#N92w$zfiGpN5|Q^{uK zg9UbOF0iJ?yht?Q_gXtU?TD@{Zg{riuGF&6UL8K9><>d!54?lqF1n=;?Q3HLYjoYQ zeiu|lkCYonx;_+yIl0YkG)YBIESI`U=52=598SX7aHYXi)_uO_@(_EmLcaRMW=Qw0 za`gG&(7klOo7LeM+m@5GWREEo{NVLujfM%!SBi-<+o$}_JMzs&|Gw$5NCCn5bhtp= zY+Z%RnqSq7g1$0dQCqwlf3uZ4@u!S+uOMD3=}Z*LiDx`A5HZy_NRoP+c;$6}Qv~VC$wqQLX;`uIitbc7)@$ULR=wnSYX{OOXoQGnBeDZKK_?eE)UrrGOY`@ za!U>B5uZPI?py>d)dMN`adHXCIW_E(b`MJ))F^ken%uOOQ!|`HVow>?E<&Nh{ zf>3NbyD<92Q1l0XauR>KZCx2~kRft#CWXb6R!-BU*~eTrQQ+%;8AOSEH`A{yjfU|6 zmjD?&@#p{U2J9q05%Nri=6GxKdqy#7n!Ip2#Y`+_bn$DLe`AhF`{B<+iS9EP%X_%U zkE{w(W)A&#Xv9*KJa)bUyW+}-;R;9AoO760sl?P<2Q(VQrxhqa@>DyJCx^h~J%_ic zXb{Rz*85|tUxamxtEc=j0TR-N41)NPNZgd@aVvGCSy_C4BVNR-u$BJp8?*^yP|njgJi0@o|b`s z*-xxBMVA-b{ToLvR2Hg8wR%h{(9cFYHF?`pz;Lgk!-b4}n%>*Ydrd%E`Lqdb2>Y04 z-x?9gu44lWk1v_1mw5}B_VGt@SD!nr+)HUZ)!{pKSWSy($Jv0gWqJATyl&Evxi|eA zkE4}aRf<>VRxFI%yv&pMJaVX5|M`>wUDDX{QN>1moWkq&w?fLfy0=|<@|J@%R&DE} zP61NO{k0#>I`#u*)WWP0ejKsYOeT@i)`hE8Vc01+tzcU=x0RVic|ELsua{kn z@cDDEveu0oN1GR64rua4#xq#EHY9@VE!B5g&a8Ow&$I+v4^b$w(UH1N=wiTCh!9b+H8D%KgeMt&Q#D`mzHw|w zdN{AiErutMU#nr+y(iv6WXOIh1GE-!8w8{gd}#p&Dy5tNRr3Nvh1Py>nb` zX6uQQ;9;=PeeOdtwXLCMYRmtIz*_oVAD4ekonb*-+)ft6#D7FY_2$R4?N+Vpl2e8B zPB;-tXGpG$lV2;RqB%0-j+L*TEn<>VU0!fjIKdHZp+|Hx0GA@wY!} z!L|txMAykw(XGqOQo92zp2!pZ4RAJ4ri4Kjpu@gDE=i9dsWXF5BDW}y$*W#la#!Nn zXkEZ~&eO_?MN1zpg~=e9@Rp_5Prvu&x<0{P3#yQfUAwkHjKHCDRG}MriHFGTB$aDq ztSFPFg!Sf|+ymgbI@UY7-=rxdQusEx@hxYYsD1HoCNxcC(yY%@u^?(9d!h6v>K@td ze161h&aB+2zY7J;7|`?z*BpDv;)sc2(HS`Bn7G{g?$@EjG(P8p&c!C@L$&>d{4tDU zInvJh?4~Qc-lKf#JJ2OatvIWxR4k?)qbki$_vw;duw87p{blY;aWVp}V#wHa4d zqiE;-F@R!km;Ih3#Oc_OuWgoaKx%oaJvL)A%Dj@fdVW#9P(Xq&f-?_}G{d~J6)^47O90v zzUiZW(Ag-~wy+j>@~}1FrF(H`I;X$%BRAX0aZexvQaLnx83H25Jj^$#f8JgXsY`vN zAz}-wrc5ks$5q0<)@IDcIdkH?W_>b|;hp2GWW(&kBfjv_QOn7Uadkf8&D*f$hq0#J zf)|<0;;lu6Ot0sa?%ov>8!}%Rfmkq=ZEV&K!mYSG_`m{`&N^aF zizx~!FY8d=crSOW`WM&gTG`^Q4Y^4Dl6il1W2)JcCVekPrk!8@Qc{TldjSuab#7DB zKp9t-dG3pral=6T|5DY}7~sWo1OJ0B%H%mBbPos`es=ELTi`Mjk-h`*D3krHq&?2` zqOM}jDHf)@A0eDf>lZ~P%K2|}3i30p-{1%jYD}a2;p)r#2wM}>nDtGZi79Myk&nhY z52mUQQ>CjLuq-LmAdr^QL8t7RP&mGHhiOp@{p3{t*o!Ijk;y-gc7K$>#}`dnIi;o} z3~hOJu;M|D?D^tMoe!eJJ{>hOhh3|xs=^R5-Z%AJU)oynK5_T<^z?L4Qu>qV<>l39 zPOIpy&Ji^-_dC&icRnqwh%_K5=z+>ZRXU61;j$efMmr=$x7v%4l(cvMaKTvDV-3IR zm9_jH!ApK)RIL%QQc2uLI*qhpN3X63oMyO=0ICyy}DOex*kTV(WZ!RP> z#smeG=Wwxy`;({bZ($oI8{0-4`?L|CtlaV&N?0{m>!MC0{PR9s3-(Wxm3=EJgn9Y+ z1}k)*Jn;_>4t|C?OH7RI-n~pilUPr{J2u(e(qg}_BP&bP`occL+e^gVj-QQ*DV2*e zy!>T{iPXb~XZS1!4L6Q8tt;`M{CtXFh%Ul#-kKd-kZl{yqx} z3&Yi`(w^3Bad(2=zODP6D0Gg7Cgh7shSOSxtdvx@h^w|Q9^!ehE&c2n6--?#R|N+3 z@+EFe+lyl92E$ulq~BZEnps%mO|*A$D`>1jh4>(7t$Q5*>+ z76UKMbIa&>T`dD z_0riR*%VJBy9Wo%92_J@Mn;GaqvR_F_+4FHT@7QED2a^_am}(kbZNLGYdA6e)yQQ2 z&quXw4Mzyouq97n8edQx9Zi@2RO>OifF};T>bL zu&|K2cMr#HbKV!`%*@D$gV?N3%jSqZgK6c>ZTaDR{`5(&^OJ1mmoN8RTuR+Su;V}c zfB^Rqn0X$w%u)2Xx=jjmI)vEey9I?DGvaC-m#J%ga&Wym+Ro#}D{-n2l| z?#6<;{Kj&qgvfcdM^*QAUe*3XLPn`)&!U3fyrE=`l*NA2Du-c2*WWe%edQ+nd8RKl zNTER>-mUF=#K~t&N-z2bc*6x)fNR&U{}?W_*IY8mxvHzH3;YsdLh#=KOaaeF#0HIp3iXC=L&;nz2Hr6mX=pxiB}vA%7@6dGe`>FTRa4RHb{+&RJPm z`MJH$Qb&LPJWs>WOk+#SMo{}3NS1O|DhyAbJkjgTR$nCS8!EA^4LZln16$%B5HPXU zK#$q09qn9)W0c`1sUfGJ@QlE!=%gZnyKJPi!eH1v+(soegemd~l9}qU-ZaSy>s= z_3K~iWCqO5&81yk%dT;AQ*X?+QD|bUp6cpWxG2Ml!qY8FOZ4BPhZ>D~^E88h40tVt z9l(+oyNFVA>sYM0^fug#eZ<7ddjBYUFGegvbIRaY>auMJ)u-U#GgrjCv=YtIs;cOa z?k3HKF#0g(QC9-%s=XKSQJ8@0>S{spG>C-#ot3;QQP*`A$S~(&IHH*VbMUU&$ZzQ-UiFpyb5K;2T> z-tkJMPT1bY+|*W|Zr^^N0t9u*aH_bV_pvafpRCZG+lGzg{;yu4K@Ed=tC7-}AFQD{ zO827h5_(1|cSb`F4?RdO@*wc=aWp-@4brFM&iPnH1qXrY%XoMQqhSv@S@`5|!)2rG z?oE$fn~MF#ECp+$rQtFPA*a7J5R8y#U&4@~IHl(1lCnR`u7TsHtfJ!Qi0x(M=f8+P z1F6(z@)uG3(G>wZJT`>{aW5~?^^FZ>RnjxF714&sHjl!&V$31)XaH? z#n?Ux5;e)CTX=91??YjP9nSYUax0epTs))taI`AYZD%=0ffC#5gLA4o`RM4VCwXS6 zI!X=W65IBoHU6$*V*mE2`--LG!Qi0A=JLqUtcbBP&XiR+gVL_IIV zG}XR4aiTA)WGLYHXsq`1^axOTLk%f$OP@&}-s0?eJa@>rfqIB1R!L6l~rz+%(6CT z^vb}A{Y>{471D#eoSX}gF!;jSqobokV6tT%mX*mN)ZAZ(H1mwqUGQQh~` zwTI7LT?ML+wl#CwV>N6x=arEfMX{qN>CnRh0J>0s`z1erjU92BOLSIaDf1S4A?IaYjCUBkD@k^t*{>~8Xh)P$iWJ$z_JyShe2?I++Ql97J`r&c)XuNdzf|Ig zeKu;&+?ga!J!i^f);ptHAw%aXwYIfYIrB9u_cC^Bs!I|}mQtzXwKuaxOwFa0?RaHr zt4mSr&hciKqIHsxbM8c1m}sZq6(+NK+}Ah{xd{a?mp z;$>0>&)Atu+ay)IGNrwE&Q;jBY=(^&!*%Xl*&S8PfQ$Rvpuv_NOTJMZW+u$sU%nyr z96tb2NRb zL4hhrWBY0zlGG!ZvTXP}K|loO5&k!AtXgJl>a|#Td3hp8NsjcMo66BwR6-((E+81> zV)~DKp+PUC16jtisqFpX;4^|;E+S36bKCg$=Bd>>sC8&gp4!J&PNeNvz+sR8kSTh& zT02Z9;%4IcW1OIdM&p7rP7sdGMe%Rw1s)zg-Ym;m=*qz291RH*4}d@m9$Cq#^0^P=`oOC+ zcg!f?MMidXcW;smdoWGa)QAHhWrM*JAb%DdsdyL)>R1IEeH zW@a}aUYtr@Px|7m%4MhY_>{O-qiZ4VM(>?LS>R0~kPyi<^tnxY|H`N8dA2Oc~1#`wkn7 z`A(qP+`WU1ci4djou^M{!ZjgsD$5;19?0FEoSc-BAv|;D{As^?pVHG`r=&1M#Kc_l zC;w@}dj^4eBY}qxO_sDUavS$K_M+AS25x=j2@~W;De5hCvr10Gfa2ys%ims3ocQ7`0#vj zadA$r^J4dPWgQ)>jXdU_-rnF(pI9B1R%+c-4lwy}ch$w}Aqy{j;t zHs)P{yTBTrKK+2C%u=b%oGxwTwxhSTwO!nP{rdG!J)X>ici9_{oSaG?$jO=Cc~)i} zt4VU&4`!;m5z=~#cbmC^bx^`^ z6;56iNo(4xSX$-)Z>gRX?v2`j0Cy~ZG+UCJs_eDkK>M!7@El8%6oZsKZlrXGmZI0k z2_|24Ywj^cSYZi52ptB5pOSWKYl{hh9cPus%jC%STUgLswo2{Bw&#p^FZcXn4aopW zBz_|(Bt*sF!;tO*b%*E+he*7r_wQL=kJPBvRY9P6ckbLFZDGH0LrFi;Iil(a|WWL)tKsf5X`O@>P|UC%)w#@m;uZfpo1U`Fj>n z7W9N2S&g}2a~5}OR>x=6EkDc0zk+E{AT|>}16oAuCCNnakQgyiaR!A7*RR_zp z$;X>)cQD1XzlB!t{v7%QczQ*&gkBNQx7WdpIMKYh&-^tj>l`_`&)>fmQqs~B9|P%r z`V&zgNV~|+6_A~9Qv}4Wva+r-hPJ@uf>4!Vs{U;)pkK=N8n@yl85^3Mny-T@@Y|c z_ZZbzbXtC?L6(FA{P&eW?-W?vrv#pI5nNqxb`SP1l z3)Pl)g>u?`#%tFI3CQSvfmS=%ZS3on?|tG$LN9s+2!XV$?CUmaQ4l$gBs8m!fosri z7n*jlqUs@#VF?!(mw3TG(#yPrpt^%r#I0$4hR1wNhOs=O;6!xWHQ^>@&9D({war;GU z4Tw~v2+!rWYDFgJpp-@=C+BVD)pO2FPwV}7iND*Td;Icg)-wT)lYbPsp0VmH><`P= z>S=Iz=U&0wK~b0*Fdh{$l(bh?$6$eLCJ@(zsAK? z55>OwXXxN;V+1pLT7dMvo@xjinvMh=@5$4r0u?$KD_RIJrW5bx-@otc>odJ*iwo%Q z@8_d+2QCetdAjiwbP7^hLI2FmYw!_9I1iv6f!;_9ye@&c}|ijub9Xi+Exm zam6>!6tpZ&F&lharXJ5;7#VPF@{%c7_zvX@s0JanU3vRvc=A0N@w+CtcR>@nb?dR^ zzD}i^V~G6Fx+5q_7txG#fTk)5Lf95=$e%Z=_7~X$rvSCS&e6ntJ%Ge{J|ZGwkyCkq zg-iPW{jUe0E-kLv|H~5F+zQBi-mqW4E(-@_;8#q1eAY6XnAjNWDA4RYpvwt*k@}+gmhwJ{erv03e zku`U7PFb!!E~HJzfg13fJ`~N5!qmEne$U;X8_iwyt~9ql51-Sgjdq z?2wk7wkxsjvdk;{1b$H0qN0W z%x{sUADR}NgoK3RZf=68xCOf6sbuftvcch_zlH5g!opYJpp?Q9K`{>G_UCY%U6#w{ z5QJGKw5V+6!uj(rA(IOOP~V-6x7MQD>CZPn;xZm9QA!{6MadjNJ_-81Tuyv<#DSu- ztIM|b?A@Y;3dlo&uU?&o%=HDcdF$4#@YvWdqI-M>^(0T8J^MN*V`;y?X$l(1cnEiu zIOuL@uKn=AQM#>qXV{+1XZGYSQflEg3MvHjKK$k5`EX3C9u`&oq~|puhk~*UszP!4 zy}Uky-PH*=g%@wXAc1y<5~xy;uHm|wL$V;jeKSqJc-QI*lBt@FCI=AYs5mw75I)Xm zyHA75Hy9WYzze0@gXXB9*P0-pa%43#JDXZwei<|7CA7Uf5>iyeYtjD=M?gT}fr7#- z=*B?4wAA=3At3?e0{+!#y$}!(094}FOMGH3p=zWCmgn5%%fYZ_@rN&H1BLUT<3NiF zCw$hUB!vTSKpFj%k-^Nuf_JdJR12T#o>GYCI}4{AzM*$tbxPSV#6d}k9Hc{=23lvm z_9PKiUWZygGEqV#M#R0O+}il@c2;zuhX5C)OzY0k8cAfuM3FPt6F zNed{?8UC%}Vi@>gch}`tLqpofk3S}ob_?4@Ljas@k%fIL?_rIn*>bCFJGgY|(jxQ5 z&*k0(58CtRCpSy9HHW=Vj-c38$yfZ|o?EQQ?jt57{N~EJA~$rR_=t0;+>u>EQt~;V zo*lH=0#T+1=?U=xl?T`4DC%{EJY(67TcABW;A0&qCm84L6AK_12M;M}}<)5OF?{J{f4sNkP<2x&#!C_!o~ zop?o~q@iJE@5`b~fQOe-RMgE#WlXKIjS6J&(I={^Sw|F5;}*V&x#~zuOPh_!z($9O z9jlFS!9J&_r<1z&nE88}`Juuz!eidc5x=9DEczCjK8T6CSAOy{*;yiYkXub|R%^L0 z74zjmtHCVL5qcA7ECKbHgw?M_+gezxc_h7=nVH6$yKre}b`kv1dXInl^w);%BGH1R z3puo^w5PR?&I?XOt2}%53h;@bwiA@?;_IU&Nzs)7#MJsI$xu`@o@;7B&kGb0W_I?L z&oKifmNZVw!(T?L6(2mP5n8G6gT3MZ%goK)Zgi`FJ7(}9t3>Q4Qaa(Fn3#)O%@)v+ zLVN(-kMGSTs|q;`(ty<-lws&p_(B6=D_CV2Q&DjR25?_l`P`@*ma}-}{L#<$_V&;G z?>5~kH6E#*knrkOG=}!{t{m*`4QO3dFC2|7T(Oaq^lOQ-#3~H;HrPkW2Dw+tlJgzy{#<)<7%;g6A!kzP_`R(4LWTTx(E}26 zMtyW-21Si+mcB=k4Xay-}a>vEIZ23CmMZM91S?9w6s)#T?Z7}R~gA(afyZ8U7)(7*9_DgL-VbU=hoBi zo}MpdtWe_tA3g0OA|a77F}VgUK})*&c@sFC_0SgKfouU1`xQW%D%K5WX$2`Et=hSf zif?dM!<8?i{aa*+YNIZM+5kFusD2OPQy@Ha*UE}`CTPKMcTww4F2xK9;*CEZMz!Bi zjG-_Ba@DdHm`$L08;Wpy?rHZz@39^?;D(%`vYnkymI4GoHhFY{wY;GA1s?TRJCz)L zSf5rH?B3&T<(|SJIrXP7{X_YU>i5ynS+u!1)hE4va!xP2(2fz5?FAy<8o7x^#bF|6nk7 zPZ};k7FASI<>~bYyS2C^X3@^syEkRA_GebXbi@}tSA94D0y(`A`0JK1Ek{_93g%i+=v zR>cRmbQ_!UeP?A3rlzKBkGA>@fUj^W;0aj{@ExfYB=}xmO3o0j~dSJ=Wko>I|^&}+b+1uIKbjja+4l>%cYuChIykK=& z89j@{@S2`S8%H2NgoaF~7aFjmebS!bkdS=6AGrUhAnuc|+5Q0vYlDCO_@Ji@DzSNA zZXFPTZy@4i9JDnx{g|i??CJQ9!VVx4ph@U24HoxTy59w*rzdJ5D(WsMGPiGceY`N# z-cFWRxqbP??*vzAgDoxJZ7rYc^Si`6OavU^fBP|nMuvvtAgGd_N~aZeA?L0>EU4W^ z$rq3j8*n8|_G(%eUn-o0#qEdO2sNL_``F_m$!QNLDH_QI>_-U|8Ko}m$DSQO%Pj{+ zV=>4fm5-w4OYZB}ZDYPSdL?}feXOk9u_!E?lb_@#4;9@mhI+{^Y{pEqg#E4Z@4nuV zrkgD+0^|A`8gaGdb#-+x4@_GD%nOAGckfce4ugbI3sX*{!*YA?5d+nj0MjDp-gcliE!PR{gO5(y7@&YKe&YR#tjsI{l~u$o!^9eWEW;6mZ9ao3DlnEu9abg|E$d49JUn?h=SEWl4KLd z2P+tLMJffLf<;Y?1ukE*vLrz%1ZT>N+a_P`q;+I2tA=jUUbqkd0$yrq=|$+)OF{A8 zbo0z=(X@wNbyneN2a1Agoj5L3;#s;>P?Vv)m3fMl>cR!I11_){d%8Hety2y9d$lp7NOqPETW>v z!Sy!_lKyT07UOIA8~Hx#`PBFP3nmI`qR3=NeQM(%fC(O>W=g0aP)o_&cb4lwtgwX! znWJ7E3^@}k6hA^|ay-(HsR0`f(9V?n{0>uMvOftt#AnWE$iD+f5p&0!3RNh8h3WwW zMg2FD<}cd9B{SVNe*F4xf850=YUhB_(C#wG6=Hk#fgftnSI+Q_S<>-c04R zZX9YO;*P;$bK2g>fXFQ3uK);`AnAjp2tcfZ8W(qVw*4P?9mJxyPys*fD zjgQ7mLuLCVL+|-%t6^v$;exbf)!CixA!~yg9~|J9z|D!0y!K6Dkx!!l6I!>SJ7eDT zfUy_%f4{&Gq>%nGQ7mcZH=l?YDxUeS1?^{G;BcTSPL2=MDqQmAEr8GLE?Ikrq^2@~ zZK(gRNlIOCUi*|OQavQGd6$~<{O z=`*Xp1&!RN^s2Tzm`%*vzHpJ2Hiym_>|Ur1 z3iOJhksj0}1HKyD_-AM&3_A^30tBo6yCiyYXdmAP(gnCy0(J6K*Nv%zJC1)+95FYfU`7w{6$<4V`%uo zIyb~ySG_JT7fcX#?KH|pC0#Ny=b)UgUz=x7$Xst0!`mS~+9IhA*H2GM19Iw&ljJCdjU+8XB$Zb%}_GsIj&6 zNybOWSWm3ygaN_E2-vft!3gz>@y?wOUH%R{dqz>1TLuOOYfWs){jIO@c-aC_3m@3s z%w9rql#-V}d%TtBjk9Zn6oDWIA|Qp|>9apki-%{UdUiVWEmP1KIZsSXTo}vSoAg7k z21ZOf>mVm9Yib*ZgEhrL__d^)WqGa&5Ol#ow7A`M_+fo#$9k=z{M24)RRZQA>`krw z-H}gK#v&`R7O#^)0|vmewpvRz1$tMw-CyFs}qTHO2enc##&rQfK8>bz>@lk04vzZFuV<-qLn{ zag=WMhLJhu_w-mfxC|Z5K5e7YP~xanFD{h3-2E%4(Y5p+8B_884Iz0A=jMvpICCDe zZd6d508tVLLC@337--e2z+~N%>u5)925hCGz^x zAkD$E_Ls~d9iq?z5;7w%Z#N^Kd(PIuK()6R=#5uclSRN<1y=_((E9dD*9TD6?PD$_ z#O>|vF>-PJUMPU2RZgtY7;PT>?#zv54}f0=lfPaoU_yd|;6`d09+y=;Xo7z6HVg>~ zQP$K%J(v|6zl9bpOQWK|#C8svPrHX3?UowfffW*qiHSjf{WKiggkJizp@Md9GSOXz z604D5)P}mcv(o@I033TkrwB+9ld7P1W7R;JHsuNFQiCpLK#{xA%<3 zYkZLuo$1CU?J_iEfYG7NvA0WhO(6oiNQu*n){}{^ZfwpTg@y{?y|}8;hw@683;|L$^|b* z@@Y)C-f20GmcWt=0=|Iq#Qp5?%y{%m?*zFV8^l%QXwr0IyUNX z0&CGvC_bod8ENxYJl^lCp6rmJuLA?wO{jxN8}$oFS+&zmktp3p)A+q=uOrY=GDJUh z0HKaII5;>!g#r-s?gJJT-5oz=F;Ia2_U&7R4LM-c=-iS*MQkVWX2IGXscRT<_28}m z1ysiO?FA+<2C! zv$R^ZB^A+|Ab;liFYd_ugL!Ohc2__EFIU7iU0%|Sf5Zyqw}MK{{-B95;9H_kK}kvP zLVosCROEdPMUv~$Ly9kA-@l)BSbtcSxYgd*-?1+`$+3JPi@C1yb%3TbOF z6!R|OmJtY~<3wcSCr!N>MsHYrm&*};=Iwohc-BWOOE53V<9WKs3G(8$1t_I!WZ&W; z86+R(e-=4lTs)(#&ftm9t2o)n)Fg5NOcc;LU0qw-V;9uZZ}>gU6?y4h&ic9?;!~$@ zYB86~)ptEbpt^|fDzPaj$T(=_r<9f@u#v^OXoP$iZYL8v{FB~*ZEiRWP{@dfIvC5$ zX8*yyC43vTO*c0`+}+)!ynE+PPPbsvvsO2tbC@vz-SCYaf>Z^Mm6Q;q)M24BfJ?Lp zZprEfK*BKu+W{_E0i8%1S11~A&Fi|N>5jsj%9K}cgZFYd$$hy)kg~vjy73$$ZeTEV z;#jvvdG@z5j!ny*KCRo^V2E4%_+w3|8)#9luJedv$WS$#CA4gLV;+4bL9DzNc(Yj2bKXZ9rhf}ix_6?2>H)ZQ&Y=m|Yb#6Fl=d;kd7<;F2XF|NrQ$wBuNS%~y4c_; zGi3%>8XT`sZ7b-#Viq0BMW{m3w+2MNu#XtuiX~m{&#%onA#@|3jplNKWtsxrB9X{P zx+ET^y#a3aE|7HxuI_Z~)tQU2@|-;yj_cOM@|O#R)OETnbfyz~g9FvSH{a#bEcILA z^+x94yu1}oi6CW-hRzYVkIow*wH_(&$vMc4U_QRb@E_|RDJ9%c^52;r|9`dq{a@S| z6?TV?bBIqU&d74m!fN~x|9%<33mgNN61WdU6txqH}r~4cVv(niJ)ROWk;-VcphRSSC9i7 zsZ*sCHCq}4T{upsO#TQGraG;k`lE?u5UkNe=s#Qkh&$SD2t#q^?&oJNC`L+s%N={<2m+rVDmaQooYPiGjT`~uELoW=J6 zV+sZIFG8-cg5rT92GVEzmtctyZU1E!_UeXP{8MJyJ4VqXyk2f>j?IVUoV zc6TwjdbZQEka-QO2^0(;C9z!e0cG&dKD!iWxb*q*-DUia4}Z`*uK1eucop^5_rmrN&SM#)j*WId|7a30`((+FI^d{ za&`S0+%Ey`dz3K)ec_33TRZ@I1ImX02nv?HcjMa{8yl4{I6lzVgbJC7RjYkaOEH78Eg@qw)eP^pSUpL0~^{y3d(-yS{tQT+D8j&{c)S&`0Ko=H;EgQ#~Wnsx_t&~8!>kZ&Y{bOlLh zNKS*}P6`}TsAUW-y3me?y$6#R9)fy{K!C(Y9IJcty1Kf0wz@hyyN$p(wkZ1Mej2$% z5cr$!(81fsQ|-%+4%Ul@G2l6C=LGW%AtPW5N~C+o@8!#1ka(rEv=VqOk}!#gXpe~g zAG;X~I+~s7Z3$j6*VE{YF`3xzzP_wAHShZ{LMU+(=y;0$e7w+>c&+mJ@P$QDtyya9 z3Lz2^6~zkubs-_mBhqGJy<4&VO@@!{BU**-r{(t?!mXQ(sD%!o&NWWXr}i>1LHKsF z-0*`a?9>@Bj9u!T19Fo-OXKOuhW}esN=5N*8d0wi=(P0rvKH;mB&N5?(tWPBG;0erNXgS!f+x6sY6r^LY zP0Fsa6v~q7P|Dg#WT-in%1)vow9zynStglM45!l+MJZ^A&f=jI0GXf7Y55(Jd{N~hD*hpbPnHFtIatiF+W)& z>dwjhu`v9XLpuhbbkei7MRt4A1bXUbt$zAA_ML?$hl;gnf&osUsvvH3nanRITDLO; z0%v4CaDf=4g*7Vqvq$;!X5To~Us9W%iz*#ob&qhEa~&nEmKqp1)=b94OPsPy<%l#~ zw-(KlpJ1FRHmjJejprjcxSl8SW@P#lR`aTZy3(TnIBaZ*sktlC2s^_osC!n?cDZCU z`LWd~)1hfub+t#xv@$!=M=yP9tsbhMnbk@HyHYMe+Dq$3B^8#t#6#ktrL8SS5h(*` z(`$lBXkR&o4foOecYRs7aN(0mU#Ih26mt*+9*lZ?Wab=iv}Z0=0l&2f#l*y@oRMa* znN`t-w^0(Hv3BIvhW|MqglBY|$13%4BDx?bxo_)zxTz9(Jf1?T9LRhu>tWHyX48=` z?|S6P%@EQglRb-i10H1Cx3@_=4`}JoB`X-XB@t=_xTMXmQeqSVrU+?4c|l+NVQlQ4 zZvNo}Jf~SgXr57`euV&Oaf&7=;{KbxA@@*}_b#Zlw6l*<*G8Lal2x*!YGcb~5S~RH zpFdA}K8*vVX=5-eM`%>yc56PccUy?LP)Ye$)@>{GFrC&O)yX;d^sLif!kMI6jVs~k z5$P7{V(3C&L;mocFZb|Bfmi^Alh?yEbpSQCh?7Lo20Ginkv2nC9c+T z7=6J0p~uSTvG0Jj5pYYJfszrN1M5^c`JDt>-{ z!HPJ-nwtw1%_`EK)yLFw1|Z{-BPh<_R`TK(h17`QXJUWL`F+&{U!H1&_tb4z6L$?! z+i}PcplDDztGHl+7*#JCwWs0%0h~4TOaU4DU3m@l4g_FV4%}Y_wQ9$_Tf&hBHM`&C z@R1>7Sc8w0qG}}xpA-Vk2kQqap8}YtF+qrh2ZG!~ARp)B;D3Nci@FJbF|1*l)%4 zscE0q3na~nb3~~djR*x#QmOQbPIM?`ajMfl27eh=EpVY}@td#sNyJB_klubv}9{Xg?#bg?(uo< zO%AsDV>vU}IWY+UmG0un6{FUrEZ)CkJ^Gp(^crt_j_byg`oSwfZa&VpZgA+W+1#(q z+(T@sct>i54D*fS>iBu*mXNc5acJwM^PLd|*9NPyMV4P2P!L zyWwkn?(&qS-Pb4&UGtQr+%5}e zgt=#U@?Vt_1-Dk2pLWB;k-b{$ZZbw(O z@ce&TA>-$t?@83#?4Utg7JgskWo3P-Pzj?h=uQQ?G?AsmrNzZN9J}Whrte`mJYT}i zJf2}?9#E8fjgI011oHJv+egZkgIDW}kFbM}$x3S;rR`4SCo4pK)Y83Qm1j1N^$!U8 zNo2gNq22EW+t4`mVGP^F=VgUK6Fv0RcFZH&;t`Ro4}>2FSqY{LG_PH~0ma!yyTqv< zbacey2a1az7}L_xApj`1#61$!vm7LOPOBznp?singiCnHBapzoeP50c1s+FgZ|*e(fQ1i3di+tgX? z5|=*$T-Q`_eP}HS+N;CLHFWD|=QKNTT3Q~EgpK2)X=1Xq#Sruo(cg1VL$Yu9N?dyJ z)q3lwQ6DUKk$bHI$zY%?g1ytCY@3)|0l13`9_KJj=~Qy^J&>Z9P2h0Jyi`B!9gwr@ z*5HkL!xO$iU@42ug+6E|1-U`cO=vr85ZnoCL?S+v7etja%n}%&dFzKJJOT7p>C>Xj z{J-M@IyBJjNJ-C@XElpZXb{vI-HjXwrL7h&DWGMsN53N3Ao+Cq*xL>l7Zpiit% zft$q=VgV{1%I9n5S6Qs*SCq8gmejpfIIo8q-KES+jN~++?Q-O`Af37fNt7W@8(05v z7&DEcKlvez66_tR`o8k03{UmsFTWAS%9COja zP`6)>v%&$~6Der<{sBAURUl_$AjRT?uy0zGl2ubn&COj*?gDz02<3GU2;@cfOQ7X2 z<0~TXqG8&Egby79xy3^xw|&QA@&1I9zynFY;U@3=$J-~_w3q`gRQbUee4 zqMI~4Z0%|F$U^*b`b|Qe^e>YulwxBqXqcFEsjqX%WYiAy_Xp)&`mOI!PrEA;Tjhy$ zL()ALd%L15G!H;=(sEQ4feeP8c6HwfaUc)o`)Ye`TE+bGu62eEjSQ?)oq-u^>Z}Lf zhuJYX?U-zc?O5UYL{=`Mh@1~V0y`4d*lxS(s)&hp3>-xZOF4VnyrchXB2IxlM#}lN z`o+|DN~T<}&wCV`;U8*^D{Wv^tX>Ac%3FRCKM!=CdR);{x&o84ZxWA+Xy&^i=q7aI ziU9vHyTf-M`LuvSsb0Q5bTc|@|$EMZ&+o11YOK zA^j?&`=e}?9bB`2hO>mr73`%cJX=zW&Hf=6E67(_byx|z4uElKNI<|sajXIDBvVu^ z>#h96@=h3JeBJ8pZ74RapjLX6HAQXlQ;~NLWZhU@K_AlRx`nko!vvV?iQQ_H2`G9$ zsM(dN$kYVO?0*A+(#K*yjveQ2qIAW`s9Z$a|L@ns;HhcDtvTXTs_u4}ajhM`)+O9$ zXZUXVuF&21Mj6wLO!R4{`ZTjGv>)k4#`GUe^k_6XjdsZVpw@r9Ab78j|DLG-{sKv# SHq6(is10i!ZA*UgO86%=uK;BL literal 0 HcmV?d00001 diff --git a/img/logos/OAuth2_Proxy_horizontal.png b/img/logos/OAuth2_Proxy_horizontal.png new file mode 100644 index 0000000000000000000000000000000000000000..1020c52db79ad511ad06af09328b65b8653e7cdc GIT binary patch literal 110827 zcmeFZi9gic`#(M?k}MNN)}oSBl#snelx$H^w!v-5*a~B3q#}vB?Yk1nuFTjOQc79M zzAIZ~%f9Gv{^Ab*}4qJ+I}w^hi@(nQJehm) z@uA2QC`mjQiSb{qgYL%zwfHj-yzaMDEx-kCtXZ#QHG5>zVCTK|W_a_u8@yu_||Ne}6|9>KYKK@S&2q^wf z3;(ADL<7k9KP>$JM+*z(L2M`#W+6IDPE{z5Y4%lu#M`CObZ;b-{uxsY>qtD4Qh*5J zrq()?Gd9&O6OX84#>JnxcJO3@4PCew2+gN74=kJa$L(C_5 zwq}(bMxtt2gX6e_V&{p}IRWuIoF&#=`D<_6!o9n{3_WHq{~KkG?uW_vopaO#n@AjQ zdHmuE>V2kwx%*E#+e(S8B~!?upS8tt+|^FphAS7*$sf3bOxZgbL*!qS;8d2OX z%|=2hIwfx2kYBvdJseFKY~}Z}iD_RQkuhT4nk#b%Sw-%#IKk#+xGzD>nVRiQkQ4Di z*k9RuVi2YETy7-zppHkVX0TZvbBr~lDUwWb~NMBMU&fYgwOredASOb z^^{+FMXRdI)UmfT(Pr??mhBdAA}Nqdatb!V&q}b4<<-YiCd7-|Y?x2*QP##s_ye-~ zWB|Ti#5COecsA{;Z~eHa<8*KskMIA_RzmGT zq}0qz!7{t2TMgf6M&X9;aJ_ji-C1*WD~(c3fYaiw6f^eP0&@4rVUpnPr(6{;RtfZQ=K6++bGjqyph%B(?&Yp^}M;Y zKKJnnO0&)LzO`$Z&7l3(IeYvNO*pqYj^7r!A>%-UDoL8dJv)A*otImlvJ%M_Ic-~^ z#V@NRr@kgCjveWL)h)x12qS1>V8fMhQ-=n#YdPIo%G~|#-(%S!`D2)Gq1U+T_DQQH~o(zz5M>Fwjhfm`+%nM%k1D%zJwk)<9iO8vQyJ)_EJtIy^ z4s|rI=b^Pw@_TTr=?Kb7s6H&Rl-H|~j>gb$W*O;mXHKFPD~EfI#ys6hviBpWak<(^ z7%qK4NQx+t7wmFN)~O*q=g8UAez?>a)!VI>J~p zs7S>wU(k9%?Ld_^&$gr$X8{aeyOcwVazFIX)~9I*i@dszVMNhh{L zScUU%j)#{3*rL=BHFU@MlV>YDsZjL;Psb(7$w5Y8J7r!QE3(pA*eqJBD8O=@Bu9l( z_ECQrs2F92D*xoN|gOI;+&*a@==@7Da0wCqOLuX#QjiJ4X=u z$q`U%v7rA zL9JIdy51aAO%UHA?mjgHiRA!*$2(dwGAdk-xo@Z?(3u%+H-{+TevY$V@ym*=qdV`1 zxeceFarLrgN$Q7|#UF5QqiXrOwzz#t0MU<5fN1|I!@Yi(@?{3gbi38{bN`&=RcoDp zM_m86Yo=GP@c!DH4_m-peG0(s6TGPT%$E>cw+m-m95m08ZC#8%tklm}+BPowg4o2+ zol#UVF(^)q+0nkbVZNm$24uTQ%OVLsW_F=utT0xyN_y`%EfJ;8te20zwM7{Y;JCBj z84et__dO*){M1G)MkH2{^7K>W$RYrZGxrGGSv)0+7fDxm-LbdVS{uzJj7q2GL^(=H z<4f5Vw)BRBCwr8;fj|Y7=_rrS?FRkNo;HXvB?v#K_Gmq|ZjXL^TlfyAxPL)rc^i&X z*fw11yP2!a%n3j1aB+&=64gOwa^{5ke(Hrd74_=4{EfyNrE_^<+j(4WHWE4$$MxH2 zMQXm!)S63_yN@tap2Xiqc5JpPl2G2>DwJG8#P!)x@42NMOC0sHYPpk`v7V)I=AJpRg#2M zV%ZaMiLa+AXH*RZ+q^mt(L6UNJPG1gouW-dlcJTV$qR|2vqIr*9`)3lbMcSRAYI5_ zDw3JX$kAlSK4R2Uvu#%C<5;m6g+feZ7PywcKQiN`+uBt>c^(6>U#IL6Neg}~dKsNL z7)A)TjeO=_mJ%*N2)nZVn|H)Tjf7HlZYF^RIFYU?t2u=QN&es<_{%`#vM&f?lAm|X zT_B7{clbWuW++_7H?Py-Vf0Vn^uqg2UDKJhEqp2=1f&Y*i4aN_#)<{{Ycjg%sI}T& zAkO^r{K@YnHgwF~Rf<>~Xhf`A;G`*`5Kf-O{L>fSdFePE_PjV|hspCyKEje$O~c@1 zYAcdkq);BiECQ}bKNa(Ed$MUHKceL1^{&m}mcwzqv3V!ai{1BPMc1U*Nrv)> zs6JocqX1HImE{mW@MT&>Gh_7JD%oQ{d$Mdkh&9z9Fc317~r@**x4Y6D)_}!^w z$1pAFJ6t6+kO0NYJ#LpTVD5S3zr~V0QLuSijDO4Yw~l9e7{3;DTKA)7)I*^boqQ37 zjIrqdOnn4XU7TNt_f))LPtW8&LvkUzm{oqKhKj&g(fUUFk;{Jxj)Oz~llO4G# zI%=q>a~RO=3Cdp%=M5kKE8vt0EZ$eEh+Vx`pPPfrkE%`JK8Tup4e`F`Xy>DM!(n%; zaD#GNk(Hb#xrl$|w9A=zZ{^Iyf`4v_q)cyI?cUYbOxoB^U-^5gUZe!_x+U8c$M+SKR#vgRVijHxhThEOvRG5PJ z2iC4m^CYL=JW?jbP-*4&uJ5Lx_f;?`c`?Psa^-09>`HzaEo{+*1T4cZhyUrpkd(>AQ+J#myvDN;;etB^gEvU@`XcLi~?LjaX1K)M`zz2kwTI+Sq6=M|XX_Y%+b@``BS~&Zi z>=GRc2Vhiy0!58s$>BYIq2Hq1v%X2+BNW$Kd+8ugH9%s=fz~suk-KBuyeuGZPda~s zB4QF`s(5-U2+A+SfAKioN(r?UxHZ!th6>ayNhl78taY>Xoc3eUw=0sUpK6jv6 zBi*mMReimLsmta%uc_JbY)9E9FAkLGA+=UR#i}7+`q7Zyegj+cng1T{3_t+G|Ks@( z*JtkLrC6O7a9#uC@Y?Kr*X%*{?1o`xiq`TkDe~d3LYO0cgcERn?T9MQ_+Z-Q8q^YR zrLYV2>S_sHNx(&k$HjAt0^zt)I!XTae1vTFm^^l$-Cs2gY z5&ZO1+K1VjH)&8kRWMEd{q7iMX^Pkwdqf1VBCm4Ze1)f4bQqA$5v+ByZuQPiwf|T< z2ds_hgWNTUE=bN=)&R*p<3=-c2N%MX)!pArm_DdoQK76#i)6Yq%>Z_$Xjy&Po56R= zrEa;uS`$U#7g#67M6^}-cvk-L4Dhdw7NI=j4ow8S4`A?2vSWzWa-Z$t+xsdyY!DH~ zbV?>m0wb7JBjcS6J37A%NfP)dIz+7qz;jdxc0~@p3}x#2JTNf#7=T!owzeOI|9-m& z$CVpb82_m-c+da9cLhNP3Y?r5ixr$O)#9D0xuuBJAn-vY;sFT#;3wqaXb>_Z#4j;< zg#vmPN#M)2B=A=NpZ!$cF^4?jrg<>2KRidTXXNq}e)y!TOd9e$N;%o&dC-RYH^*_a z`&haO%qjWzH63a5z9>|RKu^BmP5SsyKvGXW1+zKYu!oBU5>N7QLt}!*JPT0~ExZVl zFhz(x{l|T=@qr3I-mwF`wtN_e@aN=9C~{re7Mv~Q>4Sxme}#UF^Yf&_N5e6>Cw)(3 z?9e#xW#nEMRm=V#4GscQ`gp2T-rE2&k8++P zO0bg*8}sZClravxr5fnWOk_TO7~l~oE`jbW$efV_hx)H0o&ucZ2>eFbdHtLr?F+u) z<+5;sx6c#71j_5+UO$H_+`O-dS=)5SR2Z`@Wh-*IlbDl&4K}r@r77+w1Wk#GWXd&z z|Dv+@p!L>8{eqe7n%3LC47C#YC>lf|Edl&JB%i?<-qhpDtk&IG$eKxoS}j_{_+inV zuet%WSZrHfDL_+~{7y+62{^G#Ep zB55EH5(yv>dgJ5?n)suCo6@J9TUne4vK2FY zd5HYwqyPER2leEf-IrC@I%o$$#m-kNXvB=)XoEoo&{(p znQVQPco(p}qoqaZVje9@Qwl7hYfK3auaKHz-D_&@Lr2Gv0YAfRMJU6pL8fFzs8}0v)QheCU;|b%|bD8h$9uhog|6s4Xb;FzBcxajH0mC)P~XqX;2c6h}Bn zJ9E@tWrWnctHxAiq_TeN@clsRm{S1#pyvBx`O-(0d>TIkIlm%52elvbjNkF9D^(K5 zyy1kuI<|^hOduEpsmR#TS*{-)&$Q&`;q+F{p-`f{=-k0Q#NaF&&G6sPIsU7FNH`IP zICD7DH|dE1b0{y#JQ1i3e*L?w<;{$J#{as{2OwsW<@vPPeo`gp_41nOmP#6w*wN+WofI> zWx23GShTs0Nd0H*g2DxV6=Id>4QBa*!gDTxmg7W(hA_)NhM#fgtPK^>_4h(0l`?;U z@(jmOaHk~b6T05VD%;vjwg@G!;(tO5z&maA7z*`D6^fMKZ$Cv9^WCq{tsJso-Fy)5 z0||-fPRP%ke0#fF_Im(N`H?YNw1j_h?o)aLJCvvY6%I-z{5hl}mh5Qp6~h8;BORD= z6%qfeQ6oWTiH288g^tO5lI#az2~?XqkuZqfGjvZD%%FbuWD49W&Rpe&ZhOoRUrAdn z6~6L0@sb#`j2tU-AmT5^Y$s5X|E8tb)QP#>VDZ{d$=SG0;O zZO$f*>g+F!5V|+0gK-TT3}Yu?r@jhXE^WUbZV__K%~I(8{ayQV=%dbF+WF`yeVFl? z=S}raM!nw>99}vEsbBY$w|{Qnl(iyTuVJI#T)(hD+oDx3CD z#KWf^1R!;MWZkLGGvT47Bb6ty?>8^pPn{na;LR!?Vg{5(4d%i9R+NjD>+Xuz7h*L=wd09H zEYPqzb~P>Cm)k_lW_hIKcEGet#$!qwN>}{5I4WK>UcQ00H9oyEq@dkpt}=$j}9zk-}wWl)G_oT}DSX5-+A={&+)Xp*8(E$X&oU)4=IHRHm>o@^cB6C6S} z>Y9!W`sB%*u-M>bY_)(sv^z2g*L3s>KUH4|bK5Pbc9l2KzI$sAL1Yh*;B$p|PV4r5^tO+@#okRAk8;&j?a&ATJxRC+ zJD-*wC;Pxg@1o9xns#WlfS%Z8i};O&lD77t5mgibqR_u9>av=yD{@O-bUpn-oCZZY0*9^9Zc`-~ z9dH?So)hAGwJJ-V{u9y70SWE48^cEx?BasVDk#r9M$B^_ zz7F(%>)%F95^m&uA!`LNIrwWk3jg(Uy`c?$e6Vf7k8OKW-w^28lCIiI;^{+5z;mMgHsP|k~=Jl z-lZH76u7m8l{h#|!FBlom%ZrDe9wmuP9j3;a)Rkb5k?WXMX82JnaE6V?l^A!&Vmtn z2Gb63qMY3+IhjqD<116nQThs^R+U(k-+rBS7eDSn!cwqW z5C%^fB^OySpP1-;mTZ-p$#eSRk}G+F8-H`NAyY0WMi#J?BUJNAlbuqM*mHpny?z#W z!)bA*uY1G+;C*x8q;jF7R>E{`hOc_HN>6UxtaHG0{Ie@g1Xgq^`nSiJd#)n8Ye&Zt zMh6z0H6+uL;h~7pmqInZRN0i<=RPh_fI#@Dl_XuO#47i(+7BPnrx;dlhbpJMNz_j(BCyq5Y-%%{N(Vu+sIVDZz z*baiB@9wxWB0qG&zvw3{Txxb};hVuAy)`wZ;3i=J(}AjK>6aD9(pR+d=$M0n26+2A z01aprC&E7TxWmAeIirAiscA$_s8$N??k}Mg-Md8kepAs}cv(w-;5Jrz2)6JI86C~B zX))f}`K{#Z4$2i62R|aqB_~3N%pgP7@#>Y7Bg}pU;EZ@a7ovVq2>eJ}rnGrb%s+r4 z+7o;yWE*+Bg|dL08>zAYaeYeQdi2KGc16`mo?q&tB8Ze`8V5BjPX#uJDE;=EdBtCAq~eXGJ&1*jQD}zmqwo*yab%fMoCfT(eeWWy#kR! z3q}0Ez$s1=D!E8H$iLO9*na$bg>TA{dRij1dGK^soSG#TT(ETP6Gt^LtQd-i zxq*jaFj@v`{3b>Q>=UL;Sq4nj25`h+#OfNxojEZK&9rSyF)w0wS*lTN><>2H1+lEw zLv!ju^og#Rlq11(#KVYhPU{z4%ih+uITJ6x8xDf^I6HNWpV;j1yiBnQC}^1G79>(6 zEf6)(e{y`fveYhM+8%?YWa+dMGTUi?=0hmEhrROqBtLE&T+5+`LIia-WF@y5-!V)r zI^_wfCXb(cLRwL7W6Bi-MkoDOl1n*<;A7^{)cXlaRSfP0nl^94Kn)^vc_1EnU=qP_ zZbzG&ZRNKeDIlI1zlN7Xcm=gru(|oFVhJIc0Wrp3@D&01{e1q%7~^|YhTY(thrZ&? zg#I3r0CBWI43RcVs3wUj3%Z>c8;A{GsEF)oZ$yFC%Ms8rZ$COcTuL_=`Yh8p7ut)j&WEy?Ej8E|YNEE7>A3%BT8DuCyYS$(R?i+$8BgRzcx; zLCw0LLxu%Jhd!CW!kDMBtRh{PwL|G>^eCx!g8(9fV#Lyeq5%I=1mK8e@mDW7IdP-2 zue%@kYZbwnxJ)`-W>^vo3Rr@j)_{_Y6-#QKTy}|FyQahHPT^D8?Es?|d|$`;IK?Vs zNKO7=^vK}wV57gwgkaxS`9b=@_y{l(GVoz&LmC$oSb8o+sHUGP6YPPR1?LcO(UFCQLUSzYVA{MDE=Cfr+X)yU7R(-ulGD7}24v&91(A<1OF?LAEL^k#>^se=` z8{(VMFjI%DzW!#m!C?ulSit06nSA8m-R*nZweW+x_4WK& zk+Y+08`%b5dfI-WI>wvAxE_~W)RF5=S@cC@32lxd*yE1}W&pwA4*}P<)8_D-bQ&r| z(r*QmN@VImWU7iis04p=@KJZM>pe+kQ|c|B6Frka3!=MnlsyaybCNlW1F-lbpX(B^FJFz>E7r1gxKw!5? z&~{*XycD@bY0!5T$4l+VlB+?uKyG~R8)Ou-&$;pV>yNjrX+sGZTf`4%}+KAEsu*z7xL}5I5d7J&+?o z!oBEm=-i8;Slf2mS~{-BejlC>#Av&&I0gwZhmoPK_cFMe}v z6!4TYR8fsMreOakGV)5T*X7}zwL)Y?xu>I}qWon#>4kq?-pJEJ7-f67U>?Ix_O)4v z`qk*)DhGy%-DMiEQ2X0S$`OzGK&WTj*2=3&MsS5?z}?;G@-M6(qPlTj*_1dM7z?vB z5P4I%^^3Y$CEBhJWtcUOxk zOb?|$P4WlBJ_XMU^nY~0(!pT|0)z^PU$XoisLlsg^=7@>C}}>22!Kj~wzXqoq;uZ% z#3b1m9FJ3uC@5EDp*p*^h#K=UUM*FdK&PYzTN{dB9O*;0OX@eM^mUD(Xj8y+niK!d zocVhW`AZ-ovv?BjM=It7pO!&XAL3KU5HOkM6tx2QqFUD57L1v6(07g$AfDvi*Insr z89+I$z=0Cl!0>lw4p?7ovD(%6g)w*dilpUQJ+;5wGGIExua`mwk?))(7&rv{YK9Jz zSIUR4_w)DkdPL~OrWAD)F6|}n4Bay}aP_1RsB1Lm&kb7qnJqR|XKdRewK;`Ef=o8) z2TOYwq(bo*{(+B0xh8psT4>vd(JxBI+7~Ec+-LwG$jHW$P&!C8Efw18ipA*+^*Gt}No+Hr+(KynRl zCwFa5?5Z3P$K>3#ul=6WPLH@S=^nU7kGx$BN#ZSp*lM|@tj(z;IS`U|1X4AdJ@Jpo zM>_V5-rB((jQP@{mx8fH`jA%qbLqYMG40^)f8utI?BSf+@e9z9iTAYFT&_rio1gb}d?AAn^IjDb(|MC=l@e~{ z{sGi*0BZKP(Cvx)Bbw|1*0!PPL;N_zE?=ED?SlWx@Le2p1bPoVpS{x)#nAf5mg4(K z5)qGaCUIMgI{Vpqbo;D<{7YbfO zT|~(7QrCgn+F?n)Im{WFM&!{zQ=iiKTAHd9K+2dkp59eT)<>c;P;=yIg|`XA4SbtZ zb5cNSZjcg#)>Qw@vH-1pzR9#g(Ha&~jzk?$g>eRR8t%`YKToo@nd81bTtl?>X<;+V z#9uw>%J}n%hvhHb_Y;T6UL?lWlO&fP9U$tc_EGt^mS&84HV+O*p;J>f@B49_#o}HJLb}B zrC#wg-kS@PSjAi!b@d9hiG3a2fADnh?tZLB>7*0*3%0ggU~^*Ny(!L|a8RvM6- z2pRB!s@kFB0|cE>uT7R$HDwOy1;8g>SQd4YN=gS-_|xk0Phsv z2-;j()TI(jy7h@CSFrGcgk*7mzuX^rMW~2TC8|zNUA~i)CWh}JP*_Z3*S?q-gTY7G z1iKO>-wJ$)>Qsd~O8RHT!shn)b5N_bD5a&(lbRX!6gD$g5N0~%kqrZ{Fy)kL&&zm1 zY3$GnL4iE*gDw(r>Ndxx2JX_0F(17nOctTu?a?OBkFKc(1T{CV)zGVC`d_^jO=**5OZv1>r zN7>nPb27^13=mV;;ld3&7vR+Ro^ z_M}t5+MMWY>*>tHP^Z`yQ}81TU415!>?{V_Jmkky*U^E9?%wk*f}kJpsv}G zXD9jX{qz>LK_66SreR8vbP@Ti$l*l!K-#Dvhia=LNDf|yNWy1R2ceBtInn#mCM~@* z#uk}|j2Wo2!htxA6~{Wexk}j)Za}q=AlpDrMf`iJFGJw)gzKd9Nasy{ttG4H=Rs!) zL}M;@UuQ`O{BTgTex;<$HP&epF#X1Xg89ft5IxTi(rBdO=9CitAk*nz-Uv2hMYExd|6~A zbG1AtiN|Jmy1VNWH++E^hfup0oqcUc338nAE=LMo6~ur|SRhAtIXt4HSh>K?|8xjp5~r_Hx|fJ4-?wk_V^8j=~;r}QzT@3-O$|0JeaojgVz zGzLYsh`ug7qp{9r%j>`RKXOAOgLEN}wUs#DC7H!W8_VlJ2ss-&wgzvhvL$aEos7NtliOfl0Wpi#Ee?ylQo5WuB7h5 zSfG=ZE|EyEOD((ejM)l_-hnEBL-h0K8m&kK+A=4{NwB{Ags+Z%P6TwZ;GOYhlMkbk?Tunte`+67UA$$Ehzv1nOW7@=7W$;j1ON!=b`e#ppZ(c$^gb^4Gf$ItIEc$n4mWQdN zGYfLczP)N!i6I}L1aQs^(l)Sp;zZ zsy)F*UX~k@ENC$bugo|9g6pF{NPs0o?ID+vamtia&9f6MTmF|>7qQqB3Q((j|HIi{ zX^3_0g_M+v25xNxpa~_+f7rCwkMFk3y~#nQ@9+RhRuhsHnbd{($#lj^@+a^ia+QGj zm$`0=&aY66+|&$iVl$KR91rna9R+sq{R^if-^Dq=REYBGNjids0_5qB-?F2P#)fsO zfsy}W34gy8^O8&jdJ7M-p=bW*?**9K7=0n6VgT=4LxVO$sOB>_rk@#f*kp(Z2t$;% z5-SR=H3@;r`?(6x6YT!8|K1nSoAh@vlPvF0cXDd_ds>K5{Y|`q?Kf7k=kLK`%ZkPEH(Xk*0+XxUA8TAv2S%pbh5N;{bgbbtgjeU+KZ_G@;By z?$_f4=s_@V&J_k-Dpkd&=|f3eb$QUZ9Im4jVLz!tS}|wA z=`U72i#Bu@At#p&dUT-jB@+Su!&`3LzzWbl7UGd;HioptxL1(u4>b$@`v`PyDjtz! z8o6pf2Hp_S#z#6`!&esiQf)|f+~AG)dlgr52@dWA)3=b<0&SsPXXOj-z6@`L>-5zw zvX0J9fB$rSNXM+rg`wCr^!17vpb<7*fM)y5pB+h0Az=+ooeb{&d`;)@SLAUR4Gc(u zt8$KckmhLl)#AlAw&Zun4TAt^K#U(ZT_Ykc;q#r0#$itB_tzDzVU>1rPY!t;tLVb$ zc7(5PW$bCt1>`x;`H-ob*l;7e-rNCa*Hf&baIubD#&cF9oyaXqL^TQM{{ZavmtDeVZ146n+ z5Z~ZH-T`rqZfAbDTVC(JL_;nT+BPDnyA(rGvroHjDivcx4+i+t))vTazdjK^IduT^ z=Pr4_-h659VNLzmQM$G|w`orwDY&N#@Xwz=?ls{_>CybU1l#iSS+174y+>~U$lerx zHhy`=w9?|&2y(>)X4-Wf5|2EB+%z?)WRofoHEX~dI&PH*VzCJTzmW<}fG=I~0S{bn zwo%)7k6SO>;P*C3s)t9&R}u_#)y1&G7Dx2agXGMRE;GlK@VI6|_LdG|0r4(OC~^UF z*<9hU#|Hy>r79nbD;)9HbZpMdtvrh$dU_N8#|>ThE3r94jzR0ANH&K<&{pb1)_Slf zzj(0o*N2?j+b}Lb{gXk4K_z*JthencO~H6zh>XH(Iu?g%swhw(h1Aqa5WQx3?$`f( zoX(Ar(K*Qx#2v7nK_7Y;&PW~^%-_XzOmbY3aw^x35K{E|v4S3gts7Pc{`I327%iDC85J z3Q^fG!WoR{j2Q84+uD$rx5K{1^2KzEJ9FMPyj|Izyb2mlW?JZ7@2<*tS`QFpch_vz z4Shne2InWb%Rx$pArKd;%OD4v;t-MEm}u_(Fe|d|P~}}d)WXt1eB_0ri-kx$mnq9Jc;tM^(!tGKjF9TVyK?uPb2r`S!a?O}mwRrV9XN`xP!=mS=l6S|is7hkuE3 z*=Og!&N@t_Up}s}RLXf$nEWuEvVDZS=uE52G~BxiGezl|M7>F+kv0q2h-+I5c5xSw|0@ zD>pNFXDpx_{_W4#b({WGEj;pwZ!R~zXP9b- zU@@DresS4+$K<4^UbedC>Y2sY%WHM3)7?HvDA8?F!^7wD5;kU38E6J#gp!{uC$!FQ zyuHoIC`>*W<`U#Z_oPd0NA9i~PdQ9=#x0rgoPf6n@2mHg+}b&@SAEtlYUR50oWh1+ zvQZqb%MOmIby%F>lXUi%lUsLK=(jnNg_VPa*V3yHYgFHZ*qNEvmh21Lo9f~hqx0f; zoA8}Vaic`zyMOqN8(!B_)l6-bbGRKyH^|8(FXe;4fp%yhOGLhkRSPgyY zzkZjJ>xeRvSFne7qR+f(l*|qv(U@d(7*tL?&@_tlEUwIT&Q@jQTZ4}6_tyIJ*5#}3Nf$_0h**5B(+O2{ZSuELnEaVW znQBMU!{!r{3>g>WRit-zihm*AcxRo36#XdF4tQhmaAM=H9(AGPw1z9r&O;G8v_Zf= z)pwVNnlqn?S4aMjIb1Fasg}MGEB9!9Lvs8%TV!G7`}zSXbu1IM0wbZmWPn9-IxZR$ zayz@&&5JuvKN+bd?{ptH!L((>>2ocKnI?NB2_BdM*-&^>DbJbFpV=q9mL6MB5xv)p zXqc&JdU~Ra%H-_XEDyOm-A2qkM!JeJSE^gGW=u2S{ZwVE{^KfrZu9<_*VZhWbvNI& z`r3%AIrNj1!82lUVXVRq$3lyO_5mB-yqOQZvO=JHz9W`?G>g)il-? z+C%qx$$^FJEntrt($&N;0H;uZhu~EE(!09VHX6{?0M&}OC&9G^Ib{98QqWIl93x_&kso^Km#~r`6(+}%23fqQG znbh5!;!cT>yZ0_v9f716Qn~iy`kZ=*uOW>U5G$Oz)x2S8I!Wh}xf@g5JmQpHI>Ag8 zLI76{(+XIXE^QcbQjgWsKU+RdI@+dTE7x;{1cq7h5vVR08LlcDeW zr)-e7-3yXB|N3eOCXJW)fIs)@cX9f z)%gSU2VUgS5&9tJbCf;OFmV4g-`}*+Z`Am@cda*cXx*&OxbMMx^=!SO45Oy8?YDlZ z#M!cbJ)hcY&>m%E_(f#(GBmRSn425mika}yhB-t)~(yoA0izs1&uS33SWFe z;&Vu-gO_1~_QZ^W9WSBWeE17}w1!=3Xv@OdLZ;`2XVSX0xY}F!sq*_m4r#rUG8Urz zafbO_`W_-v%j@PAUhPldu9m|GNV3NkyRfFc;VF^)z=)Zf&T#q_8)p2ANasHf_a3Fn zx`pDsT6h_EgR~dp0k*_q#seBSFF0mzlaEfh`Sw)9UE%5SHSfBLTx&@+2lJg9Jt&kZyu2s+$}q$z z%b4)kCt4?bjWo?$I8^$t1Y}fbAnU=D{$A?raXnaCegM#^hy-0}#&XF$zg9jQy#%f( z7ph(Rj6@MtQNO*TvqkwdbPT*>UqpN@{qdy&jv|3p-0LLyA@M z2;R>SlN$cUwyeUK9{2W`dretiH>Y_c>EGNHiz`e5cLb*1^dL9P_-8Tk=cffVv^UmM zN1D77)NX%orD3KK(a)~6&jS0~-P~*W1WRD;*C%P;ect%X5W>KX{X6Z?6W-b_sTSHE zzwN_dR%BgQ$d;~uJKFr+WuM#v^C*o0mE$=Olkqg;3>gMYrwzuBoM=jTb0cQuo^@9K zJ_cx0d_-uSe@*mfk!@;d-O)E7%2#QKJC255Hmb{$wKwJ_Y5aVEBB`#owlwe}s2wQU zGaG6>@kJzo2M+&yj3Lv2f%Cq(bl2;Uw)<@uMXTRk)h!EE>&}g*=dYkphVKT%_eaOh zv~%hf^XK5KJH|?m%kPJ5W~6F z*>lGSV7?O8?H%@gulFV3pOn0{elR(MnW<-{x-(tJfxEdQDygm4KQh^0k{W(Yu>28z zk3Qw2{_*LX*%enX1t;|CpHHnrV}?bS{#rAp`9`<*lUr{UR2ZBRrtGAKi=`~wId?(c zwM*ycYb*^CldeXtKY3nV{CZ<*CRC!F58(ZrE!az!YY@ds6f4(1JY2#xEBmE=g~sLW zsobN(`q8VNuPpBg-3ZXO4MUmNwV$@+xW~Ce+{fWeoh#C%@lTc5Ra|OU6a8!KcR{Gu za-zCv@r`+s!0NZaAlUaZ&>DT$xtXK@(zqyG8F+;1ORz(oBwI4+(TJuzNCqUh?dk5Yq&Us+S|%w;#H zF}#h0|I8I;(tU6$yX^^Q&6!#HENW&WVrSe+?__t1y!{z>E0o`ZrdsoH;fb5Y&*5?r z;{6@7fTgmAj_t$6;zOeY#pPj_UCvu`!yEUzs#W@8{?)Pi4sCQ%x3}zu!t3i7Mte6- zCy(>d@lqQed2frQwidk!9`CHJ!hA3O;qI4mkgD!aJoPBeG4goGYjbmHiIQ7|bj#<2 zIJBNpD<58z@^GLgz%k#xR=*`&TWL$5N$7dO!lexN?}ANmyp}9qwA`!hGJralFSf=X z`n#LF7hP3idYK{qYwk>vyswP;!SB3We$sy1{z$E}&$Mo3^Ozs_S4%W6-XTc#(cYk% zUuLHvx*>^-c;39nw`gImi(9`>V$2!`+~m*biUqzvt`+Zd*3ojN+6+&X)*v(?T2fl|ZRUy3fA7hL)~cYUOq>XQ{ zb3~`ScXqxn|Kq8Kk&I_F+gD2=FR)py90;ANG;f%b^km$TO3PA{M{thyY@6}e8I!^} zWtG*g{CNcmHd1KXlggT@$nr4SLv{UMTzVGM#<;8=eu7t(&qTd?z}Xo9SLB#66PvNs zHNU3vjoX`9)RbXrYpIPCW)-*~pPD@>UTh8R|8nnD4{JB3U2WL3t3{?U_-%AW9u4On zeh`P0iNsbTWt8=#GE2r=?3aF2N`yn1P4CmS`>lPEP|3U}38-W@QzM-vj~{zVWP8-s z{1Q_0mevrre;jA%oZ0xRWA?$xPRO}qwA@%6yP*a^eTf7zi=Bz)-|3R{jmQ0hq}k%- zIF&ONmz75K;{uVcAls{z%)y=xI?e|Va&;FN#TSi(r#QKdny8=90pN;?;MbHmkX*;3 z?Ow$HxE{NTL)>nR4E8c+>;-Pc2tw0U!FnpHv0v+4ghvOsoAt+2j=^o^ks40sR;04m z-aqV-IgxL8x2#fVYjd)tQ2LU{d$uY}%5fV{@ zYU4mqqNJ9}B%Q&`9&J9Ko1qS6SBp2IBWaYK<%UZPrElxWyhy9}e(%zM;2^vU(O_~Y z<63HFsYSVX$rY!aG0UkWP@~HW9HWOfREM5@M*tR95_SQ0M6HeQ>_RphXQo(kQmq%g z^>E_vG^3rRAr`m z_AgG}5C4EP!uI~ZqDQc#W3LXx%yAY`sjDB@`Rw+TsA1(jP}}hkhq7l{%cMMU!|!f& zu9>PsGK9MjzeJ6$3)2#=b-Wrn_3B=>vv?3vmdqYA71K!`>&e*5$8IwWpuV+*MC zhioG|Ido#1!El(50P6US)U#m=;}?hNKm5>V%(>n0F5_*mjFJxUPQyf&vVntd!m5_5IOxSBnSkKLWV^@*s>>vRsv+i7unf zGi2PGLC;Q79C`UAD503cOmkq*}LRd)wZ!d*8qBV`px;+TLtvpRNDOj$#rT zZ6Y{hD?qWL`vMGuUTw5Xx`(u>BjqvFj<1)C-$f$9av1W~Jx&!rLrunnokoohnk{z( ztSKgDTG^}7VJ!W=U0zacJROY{WxZQxw)6KP3x^kDNz|fu=48&jnk-Ojw6xsLqRGe} zcG!40*8Abuc~{%PSP==ew`O-N9#3(Woa=jy?er;Dq(Pn4i!8x$_gW{fZ!BDtzCMAj zTl+k_wq`ur<6736D^_m(j{RXqNtTMgu;p2kL$`dGM0rL-Q=MZ^ScZWN9_=fd{*}8} zVxvn6{~uLf0aaz%wSDLk0ZBnY3`&uZ4iO}j77&qE1c5^%ol+v9A}HNb5(k7sH;RgM z9YRV3q*1#6{W$Z!@AuDIu32lAbDlePT>IK_pVF~Un04IE9Wlvl z=AiCxD{`p4LF9k4lIF?6NEkj;`^F`KE~HS3m6*Giv*jGMbZPGmnp4&`KO9~wWEV00 z0)|AT>1Uw-qJB1pY=WThwR1ghC2`?qE%hfCvcAqI>#o%20T(f)kAzwpIYbH++lvK) z?GOeNJgnbN-!TiZL>?Lr`967r#=_UW{^Rv~+&){&PmWpnCCppgGW!-&Dq8tZ-Kjab zSbm~Rt}4$c5KXhX-YDc@9Qva=C{HJ~hFKHak_CqOS2$cMKl$dKTZb^e*~LZ?Gx*YG z27|ugX)zF`h(z_Ko4vXo81O9 z7aqg9+S$2E*rIJG=ncq6xb*4NH6KdT_AMe@=Y6j@9;n+?<$jRoO2dI1ONPXhzC+|~ zp6EfMAq#)Fas7ULio`0|#slDFr0u8e36Wzz)X?7hOm%HLzv&esbRs?vLjSek#D?0i z=I7Lgfq9&btvX-DO-i2OBq+vj!kR-eS1QI`mQ^UO%q9tUB{_j5@P{?80M5ctodILe zs#da{E9J3ggFhNO(J{M9!dWpi?}CH7IgKW}>6|H_OK>%ZQ?B-~}pNDHzh#g#TWczGnV$FV#C4K*>_@usqq&(dZ72rl4oZOZxdgVlyPOC%F z#ZEk|+73a7Cy-ThOaDBYte#GB49EuOd?HN3Ww{loG(a7ItE}a|irLDj zBSFB%OST^eoeu8KF8GN7d`u_%aHtR{E3`;KvDmtH3|k3L$pMl#0~Uuuf-q!W;2tM| zpgF`9sj%F?ksIaT<;p(zR4M)MA%EJdn{sGtT?K!I_B@r;4a~;8*6z7U3D0Ac;(Yle zbGy`7j8!souAzg4{<0Qudm9RHlVV{>&UyDdx-tZauKr9K3rrGhMz4JcwSSn1bpQ^+ zlBDl8$GhXNxV+<@R={LT4t0QDWc;HM$-Cv$IaBlX(jplpH8c99y1S~L9Q$vhF1 zqfDHYll0sY>rXl$*LnW*W5Mi0$POX+W<(wyZTaqDDYwl_x0`$fpz#nwtZr13D^A6M z?BM{cid8WihP!K!oR{QmR17CoP$R(tk&Jq#xoxmANG!*%W;e>0#0o2o4ke?2B;|SZ!&)Mzh8#L$XSBkdm9=sG-XKL2@5n((P~J zCU@FJg&CYWw-AD7+(seOJi9;Ouz4Oz{Y!F+=G}p;TFyW_8~jI_72sE)2PUZzm~uts zdG$u&GDfl_J<1cck1w&8skrQ&R}DL?nSZzk>f4C^ne@$NMG|vF+wB>Wt=33l)=R$-AYb!`o@Ew z#ch?`OltPV`Kp>D-~G+J3>eOWnxqHHMz!#v;`iLH$NEdD$!9Vsq+HY-!HJc9fmp0- z&~dA*0}M#RrrCce4+qal^NKdYa!3aRXF3p?@96^oj?$`TwHeb5+I%{l+ayf6Ytfe( z)2n-Ue`1@(u0J)C>l4|24nb<6%%|XA6w-m?-^A^O)iN8y98U!$Tz58i%HM|l_!Ep3 zs;N8};qBjlwZNbc`Pzr-Mm5^xkN%R}(eGZ>bRaf|?KnaGaOF5#Xq&I+9)a&lGEimY z!5D;*pp+tqHaky(OTB7M6vAuO*VjlJF9TA|4}It<{a&_gbFY+92c2L+H*prOe3*0Y z;9z9`N4>+SM;9jVt^`l)-0M|_h;aPe`6t5{0jK)M4&-eyUl&jr|0+IFes9RQ86Bic zk$>J*DV%8tXo>Q^s;cD_DK$hX|0T$jOelA%1P6}1;ZV35iJxg3UzW|myh%()sQOxc zZV{R7HYKY>l6^VrLJE3ewRP`+36Kg z*}YkN*VCIoz#26uTl!yL3%9dm9f!5ZGZvOQ{;o&dRJXE-Mz%Zz%rQs5TS}=}icPqA zOh7AQ)$Rt|3>WjUg|_m*l~(=4^P zNx}p?k|&_?u}D@0KmTR&TW)X*PZr#c<9qr1XnZbB&b1x2ya8)lL+}zs02EKWoGW_r z>98xX`NJE+lh`)OS^w3SeWs z?!Z{wRGt@|$@c3L!kuRb0m^h-s3S7ls%?GUFDC|4F=H${fvRl}DeIcK4559*lVWop ze8G(;99ja4ZLE!9rQffE)ac|C8BuK2*w^$>fHQLG$&1%QKs@-*k%Q}d%8jyi06#@# zCLPX?-*D_B71K<%b2hkT`a@)!Xs{F4J*c=Q?2&GjP?&9H2TY!a2@HL1WP9}8jx2}& zd_YtwyM82uLyaodX^)%UQ#WEgF;5w2j4!;uoQ>2t^Ex$sjk7y^DYE73k7r)pJ2rBQ z)EyuN%2;chw(I`u=UkE0tM6ib4LA$P3eGmypEIyhT~CbZt-+JQjs7fZrVHVo^Bx=@ zYp*;5gPc+Rl?$7N*{t#cbGzfPH+k~~uvOjUfD7&l30(d^M7a}pRvAYlu|1vRsdzGm zMir+{+=3fP>*Af{GrIWbd%zD@9DUYq_EqaEh*>jHp5Nxq^6K01QmqPR4hVkmJK4px zeI_Yc16=X@H~xVpp&c98x3H@ub&S`g$uE8M+Bm4p#a@*VzV>L}apCwk1_C^$zmm2Q z6A6FGcap|bBe{NyYslJ=)`lqMn|SOh+3NjQB|J^01(olQv(_F_q&J=lAjXvujFuCitI{0l?$KDwi?Vh=#AFODS6XXBN(}C z#9m(Ffnl&{DgkUwY!e~5s9d@Ek6&%Rqol600wdf_fHQtugr} zi!pEle#fPCRyK_)BTURDcdlK$+?5Y#O^1pdCO7`F$d{nkvuI<*B?57@uY?N~7 zG8IQjWWRXib@3u*?+s}e5vyEalH?!S2La8g|06Y%59J8FKC*uWufCITsS{{3UOMpn9J&pOq+8$f-DSZPP zJv0Us1k!N0bDyxx3l^1#-L_4z=%{v*kFDc)tUF(AEH}2;gA_u?*=83-s#+;xjs42E z;1LJ+0biRjDw&4W?oU3)Qrav60^W>E1Z9D1%u(_bPVvWzp-F6-9H;a) zV=^(sOZV*F#-w$EX){m!v=;p#cK1Qrre5wU!PYhQl+ggZ3wPwYao;0SPnw@H*j?%p zpSZ>SCiN5C0e%JgX_ybw3%PqM!>%3T@Bw^&LUS?JH(n!~j}Pxom5JtgY45XKp%gNB z|FmUYxZAboXt#Ta#PaFC#`nhZkHZSnxjoxYz*cwrBFR#gi>u;ypB{W}kftcX+kdn2 zgpp`yk`rhnUOmxvC6L=Wk{9^bF3%ZqjCfC;pc=5CEF4QtpWse9_2E6ch*8P2#lvi? zqK;m^kH3B`Yp;lWtyY^V{JKXTbj=MUZotai_sc>Y$R!? zXUnu;JoQF`-8Vf8EljB_-F&~JkYh3R{PCZlhkxyaa*axU*16?vm&_p2e|U8TWsMYx zv9;)4ft6`NkFN=h6g^u)U66?jCs2ACALD#oJEurMYW3}l+5mJPMztNCknPP;Z;LU_ z9nVuRa9}D@dpu#-IqU%kXc3=>R;swaeILwq#|+4VhG6Ae-;v8#D8DIZCQoF?tPEX~ zdRxVedK3_Zi}P?<7pNe;mtD@iyaTui@bFY%B>RUjm#daaKGRl^GC~)w>Z{>Jf2buN_gmy z0x9!&ogA0=1wZ#oWm~Rfp#wgH&xr?(vxtX_`lVakf`?wHy4yAf;X)_%i%V^g15!m##r>DBRWc#lsai}n#*Gt8(ek#tq>Ef2u+ZzQ`hKqd=b2PJZq=Qe@!faB z7_txCrs$Q=l`y=ky&G;R7EkoRWBi@^F9Y`$HZu{!FXA;v08=gQl#T38kBl?wCnoIo zxpX-wgf4%%YGosQzZuY6b6*t_#bPZi6LCN7d8rUY0+2GAo?eJ2`u^ifli&5ULCz~ z_Oj^;=lM=SUSyR}gH3cQTP10Ea&^wz*46iH$SUowBa{f@~G9f z8q#78EUf#Zp<1%%l}t4hH_LT(U{*mD;_qu9gT`cob$tjy6ej>WwCG|sALY#Q@&Ag* z5Qgrguim!jx%ZZ`!Dx_{$P01O9B0o?s50Jlcmk^+GpI%HzOYqDCnpJY9jo$be5_Ko zrr#?ChY?4Q6<2yUvYW{j{h6-|Nb-Am`ypB4U2Mj`m2TapO(df+HhZg}@?xQa8L=y!Mn_wcgF!Yl>=pQmG@pUDjvg_Y0&Lf7i_AUw>>&Z=GmfBn@yX z57N^%Y_2zkCP$nB3Q-hO>gCezoW3?CY@v=+6NSfR4Ec6s3nF6T8mqfH7@4IuClZR_ zSV+>BrDmIC)Z0Lc6j{$wabJsvMJZ{x0PlBE5b@z*1f#^l;4YzEfgzRDKglszQ zF~{pKe#&(YyS!t6nQGob^MT3^h$!BK|ATe?o29Fm_c7Dm!SDW4D_w{JC@GOw{hT2xm+ zJhXKB=;PsMGHPS9Y`D&AP1n7@^<)2Gq~j}U%Brz7WuC@Ln|gbxKGA!AyVgLREpg+O zQvppR{7v>;Pry0j3I41Fx*Y~2OPNR`5})_ebRlNIv}>jJeL$JzfA~*b8QP&7Lc_s@N4{|`J^1W)Ld`LG!4r&06*oO< z7*4=6ZnaX~8q!fd_fqjbTyxlt(Ry)HS?DL5f28m(a}-$ZtpML>El-)D6wO^DK2f#I z&>tN|Lww$jY=Hu&jLj_IBK{~=Q~!z>7eVyF-45&`-MeH=^1IN<|B|GIeUviX3V+bq zLIR7R6WX^<_9-zfI*b?fm6$$Kp0mX(zj?V2XQ)D`)#diFc=JIEnkENhBoYi2q;an1 zBd!o?C1i8sMD0oPE>!)==AM?)Ch(2rRr)|B1`UqwuPx6Os~W+D8GisNxI@t!u|xF^ zXz;w_SPY{5DbCzkn{Wr?PW;p7gU`-duM3)z|4iabtajxJKu1KPM$jf1`lZsw`lwH6rheXDTiMOxiQlh7K^MD8E{x7LaR!co3=;|S)~=;9 zTu`W{@r1bbz69`uOvV4mqCWYR@w4u)hByD4#7KVRZc(IeO6&UI?HH-9zug|QDpkk! zxT-^B39YGQnL-~%)fBPG}6+>TO9W5GMOCw&m@7wUM!JhXdL*~(eb_p_3D z+xNyhC#RLy>Y4!)F>!-sP$;81d-fQt2X4ejpBG1Ie_5FViGpMfq_XTQGBAWv_wa2H zTkJz;0l?*tZn6KDDo93goGLQ}*sx^mkYc>((*p4Z~ zw?fLAiT9y9Z`BqY#CfiLc^BqUd&mc>PYIQ~p-VYltSU|>WH|qO2C`*pH$Ulu%}xi1 z@;0(s%VG1&`%gW8ne=b>ydH>{b|K^-01H!#{&{rYIL$g&8~Q%Gc$rSJ>9oaa{#btS zIetf%y;RibVtlJjRIYP-v@n$>Tc({u+b ziA^~nlnNX3XqT6v0^k`L}D4`@K`t;9ved#DqLoS>O=( zGHH9+IDsDWeEKLkFEY>CkqfIPWoneg!<_EeZ(;W=^kG&8(LvoyNd?}Ak~0o6)LRput4mFybdGi25Rxnxh~VpI-YF z2R!{Zq5{?!5sPi9#%xq%Jfvo7X$sb)w60x?W5!nQ2V8Sa)B5gshn>h)CkIdcCg<|) zxb-@-Yz0a>Hqjv0@7<$iv{HbRn?VSaZ!D=MPafwgpzm;mE7j?qt#*R(xZ4&>xD1$T z8s{2i$7GX$1WZZ&E4|jIw~uwhYs>^}G*Yf7Hg3(hy=6$@R>);@^)ynjY=3?0EX`c4 zZ~7ad2`}L$;gJ=mZ(%P-enO(OlylBo#B$QJ)G7h0XrED6p6e!51c8@m0wgDxzEFWp z|M6~7ZAppBq#x}UjcdK-9+?LT|4dt+{WPFpLLMTRt+g^&jQ1^+A>vHTSY2${WF zwD>8k`|@vTYeNr>0{%19$?4^3Vj@#R>&ic29HJx%uyqav=^Rd8x$vQMoOu7vgvOZ*WN)y1F9%zV?SVJGyPD;lh8Ua|5l`6JQOKpYw>c0 zmEHa|%K>)m3BVKsB+&9&+t(F+1yI57xDTkon?QNZF{sd_qFDNh)J+oQpMAT1=hjKy zR}f^$sCW!#jyz?`21$2YraEKEK4ae(qAx&NFGM zviV-=4UjXJ{NZ&Mf@$54*t-}0%3{7#py|~w!=u2CF(FJf|3zdiJNvear@ut!ba52> z>>42}L29YgoE{R(FNk>D|3#-S`|3$|IXACrKJaVky(n6-Mz66YewXDqz%HZ*N0ZKH zQE7F9$t;%7oW_QPI+TI3*{4za4T;mT^C7r?l8C4^=02WY$^fJy&j86?qe1|wVpYA5 zYM*G5Azv1?k_A900u-Q>p40*io{b_la_{WRX_FX(Zb{aZ|a zpIoN#YBFRVi;t!ITDQ-l{NF+WvF&o{Vsfc@@5WK;QyD@tooqi~=1SDfy!>u?sU^aB zB>C7XE~N7E^<}#@UT6IE@h^uE@d+ej?=Q7(ryNyO^KkUw`euc%YR=Kz@w<)uKA^Of znPvmkG5fBRcuhh)`_FNKNmb}AjR#Ino%gJF5>vmU6I$I!v-QbLW|LGH7q^qX#v0O^ z#(Tyt3Y*BcoWLkl4G!6-(;f4?CPaZiuSaTK_St$YlgH{ejaBRPnAE$=!6QR;XxpE< z;r-+FYTXI#4!jgldGO^)UNu+CmZ2 zhE$3?9NRG{>y-V+x?KNTnjcortcm0S8Ik03j$q{ZU>w5&dZ6P;+=WnII1s!#79}tM~gI zl|I0vC1w9Yx<`;Zaxu!;yn)d5&!B)3stCCcKQ}0tP;xOW8uuggjp%e7^UUtZyvr)# zh|*noa#~P}MdB_0%jE8H0{5&-!qmTYwGU+QY}@B(u5}eYka>&?5UD+7N`x}yvUZsJ zQJ*Se?AA4a&Yi>E=?b(>bit$c2VWte<&jYxHl=cRbLLBV`@j@}NR>UoAYT2k>LC zQJ-wsN0XDO!K%8yEPj;HV&9kh$LvK-IR7Z8;miv6uZ-+I||4_~WpSC^xhTgNOxJ|X5I zIeEmLc{=G}qjV*!tS4kCVdHUiMO#S*~6?=YwtBm)1LgtpOzbwMhDze;SW2w?isE`}VsZ=b8Yjr`?5P ztAIZ$+EJ37s^`EJQWV?zviV#(H;@>Pz_f>Vvzq~?jo>A7KOT^?^(BsY#=ot>I`CD8 zzjUELdpmiG@ha7s^yTxZrH~9=KH63%m(pRhO_cOAXR>+cROmLV$a z=?c{O?rQsP@x(uv%5f0xm7=6daH+9cICi_2q6uG?2rm9aUvik~qOu&bvb>T=GW3I6u!MNj{oljN+*0{&^nY-KaaTTJiRW( zK;tiuWWBJB%N*IAegZV@^C}cbP10nVH{G}iqn^**d?oNkV)oo)XrcV)= zzAZDB_>mauO6ctfCDfwAqaXYPC>*G+C;p|ze4!oh^Mk?Ng2UTCpBrm8%?*BOK}Y3K z8S5HSp!hwelZNgV@i}!?1P_L+c!b(Y&lTJzY>YtshI}>Isk~Q^xroF27mk=;*fpBF z_7*{6GL7SrSjbivC0dth*}iq*`!akVxD!U8r(4eF{%$Yd7ncW(pTBzCNNf6X`{P#l znR0KT1-WsE7Zx8sly@EnO#Fi@x@jS%LLtZJQJa6Xf%$tQXfL`Iccnw0>GYJaKBNg! z$jas`s;)IiEv!5S&~l-qrc7UCdE%sD*(szh=AVqljcS06_pT7|(sMszzeS!oy}8*Q z>FBx@!tf_~J6?r@4{Q9>p{FuCL!roit&SARYFH!pj=?MmKuscNU@dvO;$2+)~a=(cBQ<{d5 zsI5TX!*3y%iHs4kb>rR5nX??D?m>BWkpZuqc?{&ph6L-bcZ$)gkZiRWYF3w?TL|IqAWts)wX#w{bMRUnGI z*5QgQnn6cFPpyahtEVGcd;j+A42|~b!=5GNdO6${KcZx5NG?dEr(H0JkN4px!S zs?d<;41XGHYSY(kowh&TNZ<(F8YtDyZWeARu+Mz^GEl?OE_2(d)6K}QMK7qPLb{ds z#uQBD(!Z+p^l2j4w#Ig3yF_Q~B}7=PWRzbe)}}|WRMiuQ=N$~JZ=!V|3%!33eMTdd==6r%?`NaZ-do3 z35tVX-5YPWKSX%z@*LB`1S#>s`|gCG7kFKHpYwvtkVi~4eb)Ga>w8zl3{M? z+U6+1o7aWf!?n(jNRb3#HBDwHU5JwGEhMu(3;?~di@SD^M|`f-oZNo$Qd~b;uq|jV z@X8=J79ttk^F$FSLt*`+PpKeqb_+J{OmgB*U3p}Aj$q6=p=X@6iUu%4qNMIxLxBTO z!*L$402b`8&6Lu!x5$cp%A%m`>a5SDG(9L9bpwUZ5aHl$^ZjXP`U|F%6(Wl&E8r z+#?y@6G_DeBqjbztORd%?q4gD6*uiOCmr|SQvSfnwiH|fiX~bn(Mo|^&~2SrJ(pN8 zgYmbNWkRc(jl1x+B+K-W)wqY)p1I=mYlE9p5b^msaS6p5q`GYXSM>+pyq78>hLC&+U@!!4^ z*3L&3-u#^G5$SAWqI=}WD=SvXNzS|N`lPjl(M8g6{rwdpVzJKGS$1G#DpSq0klh#Y z)VwC_r>7+Gy6|Z!npGmwzXX&m-AwpLFz4p>p0Mj%ud)11*!p1`UQlz zHlNc?*!YW$#GH_LV=H0TOupE~M26|%!A@^foqPNVAs)|_!Hzd$wC0r$xc2me5L@E+ z-)klux(;@n{5w<4h|Xo@sH((42f-eK(>)Zwr;3{!fbs2Vsi(b5apwYK`Zyq0^yDul zz)q~*FZn#(PoYecUToAkn>g?)+d9eP+c*f)n8+-|APj8z^FOnHE%|&WV##U$Wq|dW zQ#ABue*`lnX%USc+$(#6n{&yR)9$RW($oW&aUPm1{c zp1_;7yR~5lRaLK?UmQshqL^YcMeL{z!>1IJS&7aVeOw&ge0l+yW@}4(sdm-^OnBpU zIO-YCHLAgjasOY2@ZYlh6tad>5o)$Y^jTjFKi?Hg`6U~n!tS6+XKWE6@NBNiNNwy!~rYzz;Db;u-QF3XWz@2?T zT4)Ljqw$2LpqF0+pWEiYB3Td4*62r6QZM1gF)o;@Y^!p7 z;V)vh;{P~o`A@?n>8`!}BQ-30w9nbF(fY&|76sdE>xGdZ*gV6X@q>&BWT3X#YtXaa z`FY!XhW3Bcd=vHMj_2i(GRo?&ZMOz23=(B^@8{eVtNn#{V%vF=Y2jlt*Tm(Mr=)iz z$$AZb(t)*b+cTu@J<#Mre~avfgj_znPw=ZxRbHH8S{+pUedP zbWIo0CK$isl>Rag4d%w=W_{^PjSYXz(S{Z!Up~Dr;!1wL@acA0wKEIb7`Flm61^Tv zVq*sHg^@bYa_E4wrM@&^hrGYlNQPvcuX-{<2B5%<|Nmxrs12%~7DHP+pP~tA2u5Vg zllqYreN;2c&!kMhL3yh2#^?Q=pQ1Rgl3^k>Hdc0Rk88t>*`}bi##D7dXZF{Gj0aY{ zi;9WbbwR&s;<`gn3B;}$))l`F;p6%3nu>6fPP<-lq;0wsnjQh9gV6V|wcFWPc!LP$q_nS%8zm(mWu z&ol-F3jH8+I9X`6$L({j@i3|?g**<>Fj7gtslk}kXof7!Mi%HfYNST4U0t(*YP>@_ z1xfgKnPhDYSAe2Jf!Y|$)V-(a?>j2adl#iZ4bWo%>-!46k-w_RTi9z`a}`pnMR+4Q zGjO-LUJyZZb8LcG|Bc>Di|y>+yG;XrEuhc+k)BnuwI>!@gix-GE72wFIczz^21z0{ z8hR@{leW-1F16P><}+Ci9zIv>26k;3k`{_AEp%CxLY^hpYH$CXgzn%INkmj4wP)KDiu#kO1yhB8O@Wqs;vrkoVE}0qa?$%e$aqX zd;PCXqXm-O2=fU`RbcV|U-alh?h_2AW}zA1f4wwbI$`fLMftKz5XKV(K=^S%L%B;F zx@^Dj6~I0gP(xyqif@lex|1*#03O575h=Q0$0Yskv?V7l1A zvkExGltAY0b%qU(l3ytabIi+}V zq>)ShWRUS0vF2j=^ZZV6ZTjKKgHI z(ckE<+Bn>f?f#T${jf4Z^Zl*zJXa338ka)%SvS#fjG{PzBH8%f1Mw3Q*BmaMgged1 zwmRRCeZC>~#RzuzXmi|BAG4WZl1UCO`bJG$y&|bgfX@c{&ky51p%5A@6k|l6df;s5 z1&ru|1oCEHdjM=Pa%5gg?zi+lQlgJsUSXY*oB<$SsKU6{bLBJrjN;qd!TelKx!3;0 za525fRWt9TJTvvt`oV*r*s-J^nwA^Y&p+w&LltM)vw5_9@xxT>mnahzQjCBrG&mFD zX7LMZMJ2!;k^xIN_BZF3wkkpO-z*znLwNnEkFM#eujV1JQgV8P<;J=Czqy8oN36hG zFh1x(uXx^uONV4TD)hRGtu=w^<~0$|KyDl)p1ZFmsPgwglh)H|$<9B<*V2Bex#-_? zkGviFfg9S?;Vnp=gq%#6U}7ZMiyl zk5F*ylB3P-2Xac=5L4t8$>bV!UJ!jN@%a1&I9KR5zLvAHK2fwCO7jCv5A?`;*OJIJ zi(iq@J(^~YSluX%dH&5WRb&^%;q!8|Jj)rUd#WlM2|K&x_m2X2zHO5N+gi;WPku!FlnHpyAM%?HViZU^X z%DI2??lM!o*v*Ds$9CmI*$s|H1W~2=fJr?KU5acw0oV4L+Zt&&l-(m8!;4RELt1iJ z4FVN^1|%n#*ljPV^m{{Q7Y6r?3{jNIY9jCz00mF>41b2uyp}w9m*I)plZ#L{^T31p z$)yV#rDw{2O$@NMD^r(QC2;j6o0zlDojKfvJeRFAB#AsFv@z;55#tAs8zh@p&{!CQ zW2Rk$>m<^19Lop&$Zmx2zslF^a#q>0H&N-oy&GU~9FtYJ3!!d;2wSUb+e@E5X^6*7 zh!g72-GC>t{_OpDS43pebU$AvwD;WfT|+MrjeYrsl}BweNh)U52A$I?85(}}5cIcl zw{aM5bO7J&p9cg_wJxWsl+$1UGVSEQtsFm2nNAm<7g|in@4%g_&OIBFsU95Q_*`PR zdwYo;A}tK=YE*|l9OsXcPf4Y>e<5nILdB0=7=OOh{EfALezgpyuN}*HZTGQ!emhPk z(WX89aU+DeljK}o{QcKNsV?E0WFHd-mOi2_KP$}p2ITLPg}FsZ-i+NNgeSte>4rVcn|W zz}n}-j!%2_D^J0$6a4x8X>nV;ajVlezrEpTbcV3}_|Js33E2X6P^g1VDf)Lx7iv3q z=4tG+K23XfO1%R8)Z`*;`5F_}B)|5ut%PO7ZynlyRQ?)^IEpavbz#K_aDMi^ zAV0*v0$(c^7v)1mk@Zc$sNdK|XMye~bGGEf+>A8XP*nbuR5H6K`k~La#P4FyV1lOE zeQWnMKi`siKE%54n<8Hk&1z7=xo?@7cOE?v4_@wKL&Lr{M|&Q5izP&)?wnYo6sC(U zn&Gg~ycUf^&ECRo*~yV&g}&5%^N1+v-wPaB+ox}g zE$@cO%U4t=sSeQ%O`v(2K`;4?*=7^_@NKZ-$Ik2X+s8vf#}j@SpGbs--`|47VC zwvq6G5uI_SE6baDKkanWrw=29HAJ5nkEtzda|;Swc_y6f_?)Tro^Gjz?SlCkM*zXpeUNb@XdyEMA^@ZqWVnM{n;jtKGZFS&%z! zRTRI;+#4ZDb6;ydCaHW=>#5PU@a0~eXJbs6Xgieuhvcj|UXMS=bE!SaaW6GgZg%z%BFZPEGjcVXx%TwP3nOXVhAS=~8m!=3@&B zH7gIgYn17O2-2u}g*W@iw?C?1)q3QLeTECe$lM|_XAcs6BN{Ps7oK_3eCM_+waV4% zF3}~rv*}YHh4ti2HCXvM8zeQZOZvche4lcb-EU&TntD@>Q=m1_zV1c?DW*g-PsR2U z$!#JjSToW7&X3I|lcVK{q}fFoQ3ABn(cEmG-_EmH#^WPDbOQD`Z)+e;9Z`;CSno)< zQk7222G(dwm}m3j3z9S{r?l#=c|2@CTfc*kW9l4xP^?4?L3=?L?Ru(?JFD~e5quYk z&bix_=o;$Pj(5In`@e{19 zz3DR}X5t9B+kuXSk?`DwKbYe|@4Z7Ak%pbcj_lzb6KfO7g$-|^(>cxIb>W*n3N9{^ zxs&PJiq>tjDSW8Lw*GOk3oaCxABIA$J0d}vEl=k5mv|zG;?yEaDn5M`7y9#Tkb)>& zV5NV&*l~BwRUz9o;L(WkLhdonOD#Rje=JGjaRIx zFax?5?|an+udD&6kC8+B(VKl=G+Tcz6vf-R164`T1>|dUNU(AtMg{Ye|Gib%gzHMR zr(O_FFRnki{PpjcQ(JH@^t*6l&p`EZ5(j05SLr48wGnmST^AC`)m-@Hmaw{i2g4ku z5{ye@<=hg!68t<{73RI6d2YBoC<+{WTWu3eEpi#gU-+}%rd0QPa}!;+>h5vjids$nH5!38+jh)&lT6d6p z_;m_Wq<&V_U2X!c$=B8Oy>3-^-fHmjE%!NUl*zGzJy)H{5Hg*!n`c#CrgS9!y9D-H zT>~8O{wTYhogXgM_jfLf?q1&bS1No{J`&R_MVH{$kk42cgLQ>wLDZA1AzNbh zAWo=QWohTDWx_IK4H&!K@v@{vrLB%bIC0wS%)zdwFV(#M=DW@FqRV=ey4)nV7pgf8 zv2*Bk&+Tk-!UNpA& znO(g}-aYbD-c;+z{S`svn2`_pxI`bTEu-&bmC6XG`W~msXqW|(OS7r9DrJ7vdthf| zP0D+HvnpHg`YNhGe|ZWkdWrsH=Xu7i!Ew6xTU|1!8xu*QYU}w-W>Jw0y;vpk8IN+G zoWe8b0i@avEn#8L1lD&E9A?Q}m!lFrlkcwCsljM5y#Q*t>bFDhy$jJ8nOvXu+t)soz% z=F2vN`~#e=m7I;PoL#kg?^&9#Bdaf^L=UtqH=ssT#16N1S0RgH$P zXLobIHXIos(!Jwxibcm##lKKOm<|Rcy`w~>QCagzNxT#oWHrt|JQPL7jn+9Ntx({E z=9 z{)JoXzcJt%h1i2`HepGUKQftY9=QF4>f$SMlw+3p4IXfpjfco-UZ3c{UJqP)Hb9&N zjpMoFLl0&aonLc3kCvunr<|NIy*EeDaIf$}o#|6K(wZt7#g3ESt=IGGPMTc~O1r^; zG8G>GiMrR(yD#&5cmH82mWbgT2`7(A9@bU>l;|AP9=MI<`&y5#Z^9MeXW>21+l z^Ol0w`D)XLTP+30YxO2%Z0qpNcTN59+mqLyJtJEX>X1dNjE(CW*H$pd4MhsPSHVN+ z)jqNJ;uO7eE?j{1owHW-=j)?SY`e~r7O5?Nugm-ZF|ECD&{OMQ9EO1#_Yc#z6hP44 zE`4pNIl#;P2GwUu@FMf03C5g|AH7BjpHPh#xE#FnmWgiVc~y3OrQ|N7m*c9FZN0fA zbe9;VN8W_3sk2F#ed$)O|8jZ5JAX^Tv|f%BLx{`X;?W3tNA34ONsupZ-)7~V;fHHy zGeB$Los_(_HLA?7m0LghPYr15RE>_{$2{yyA=HbcZgwTwB%2|e~MTa&DIZi9pm8wwrtWD|nZcGX=Gs@r2S27`Df}DUpD`Y>LRf_=C zes5XfR-Wlr8TL&+H`U`e82RN1DtHHnCNxf~-dMnga`uLUtwoJMD;2?hay-cY`bNRp zfK-=J5ON~^cD;2UFW{9w?01-WQh|ln#Ffa{-#O=F+wN&BHyv7=q!z--pf96PM$2UK z?eDhc(HaH@riw5ha$lg;U8r~>9@#e|oM{NjHg*E(r$_mFj94ekJ`p;7`3p-uGwb>I zTE+QsT=lb?q=|)*jkNy|d;&ceXqRQGNoVTsqBU zwwykk0l&>BELG{&3-}$L+`+!(ERMGpHf3Dg&*R@WnzDDk+5P(U-El{KcS;8P{9fTA z5hm|c>gH&v=T#Q=s$P{QS6@q4ZL__B7tK(nzMYBL9#+z9Sqmdpkr?+YknqZyE}Q!l z4EEL7T1=1WpVzq8;o&7eQMfBH)^cW6Q!h(mRCn@?7p+x&5@%X5Rs3jnLfko6jN>bo zi~N~Vg)0R=T;LbrJ++q~@_RIPgK)oW0B^~(vjk&))_j+SZc?y@5#R!+&!Q#ugoTd( z>;?(OzbB=5cT;>q)60EXiqY>6|KiVmd=x*`V}aItx*urgX8A9{^Ow8VTP?q6!po6y z&zL2o#eV}uk3vt(`lwze$Q5acu|Jmb#_;~cZ><5)-rX^ z-;^`zXI16aXmuA2HF0%J38qfUN1@<=2aP(kql9N3Si_?KaJ0JfH%=rfLB|EF^)Hdj z9Tdn{92#KriS>$Kuj^F10o1053Kacr5vJ3}^(7&)I2GQ9yuoO-px@DyUll4)uc7^p z!u|3~fciS{ROBV$elKz4Cn4x#O`)$3(N;aQb{!97BEMP+7EL_}q`iv#j6aEC z!D^1&_tO32fl2PhoJUxOzC?HsN^X8m{u%}QI}Q|@U>`fDw%ioqL^GNwd)T{PK`%#L zPJ)U{&O@)?y}2$C7Y{FiW=$qc$-RLDP(E{Yd-YRrLlBrI_pavHf#na*jCntJGRL5h zw^3?<`9RmZ&%#ru?@U=aKcz5BJt*zV2MZ(K1I)(jQvQ<2eQ&^ox#ls_{?cwtw@1||`&Pe5ZUs8WU=a3kncceXv@N{D0fOK~Yu5ig2h#phBbI``TC$?bdB(_(`*Rx=tm63T zW!)pS2EMn0oHOJM&WEI2o8WNo6C!_HljpNHqEGsu0!xqbuMs;oKGAaHhC^X^|IlaY zj4)WL0;OoHbpzgC{o>De3&!XzYu`+hm&+?gu?N{MDrfWGUY5OA{b8RK57pkhJN?kI zUv3kwc=@9b6lVR(2q6fi<^8*oVLFpIFiz5@nPLL138~NF>D%x->u%qiXRkbCLMJ!6 z%@{@e1~ZlSiK#E>8Mw5i`=nF15!+%S>3UShKltW7a)=(*Urw1F@OMw7io?Bx_p)_1 z)aXsPAq7QHWuQj+X`~sg$pBN(PekJ^Rm1n%`?0&lFY2LPyicr5nc_mNB9;&*G5l4{ zDi_%Qmx2iqeSsm7&G$4!kys8I&EUXtNQO9rF{2=dF;kVjhdX6hqPS<)E$BBIr3VSc zk=+BeXJUSfNc{G}N4dwXuYRJro~|5#PWI-kYz6+1H9w^2gSshVKT)hX8v)COJ&z9F zVd+CwZx-(J2bs#zwWqG$opEx+>Cb#y<7m}ep1^s82@G~$oMt!ZypKYyYwFed~KbpMRp>;H~-mtCy=4k>$ZttgLCpMH*> zZ@3jUVYV|dLljBhuS_3!{kFE}l2w3x-|p~M)trOlVa?xo_UAu~oPX#eqh>70=MCfL zxbAdB!oN)Gt&b%0ZZDWW#aZ+Tb?Ni<&q%fAZkg5>iT;CH#n7o8Lv=a?qnnoFxL0+n+TK01>>&9R}TuY zfjibWm|rOP@%6=5kimQWr%-7#7hAdXh@No3&Pyhl-Dr%b1;QG>dY9C%asZeDNH1zn zL4|?1Xu1Q!RiXvD3$5;Sa=9+g?6Bo1qy96bJ`*EaIk8y28z=P+yGO{!mg9NwQQbcd zEXB3@s&j;E?<^pv`rJbC`yAhj2jz;^USP=dAOrH-C<_;zrm*;a`RAS1WBKfa6IOAl z2^7Qcsmh;GmtRheAPV2Q614V_hXD0mtL4zr^eJ+nP1v)v{8ccR=jENfK;ki|=7WDE z+GxM3lba~XGAiph|7vz)o=w|2XBpA+Qy4h#(_00Cs75SPCcNil31UN9Bmh!l0g{Mz z@17+5yA;#w$_*1dzvP}<`>KBc7$T+E;m4*zwW9IuHys1wttLlGuqaj)IDY3Q;p|J$ z|E28L?Eu6Mh8DPcz;oU)tO3JJYORTdh5R2U1x{9|3}$d$5q*M{iB;M z2_+>23`$Z72?0?Il#rGVQDD>E9V#FqDXmDiu<1q#NvTaqNQ1zp8_w)&$_rR4qtawPQmkcu=%Z*YD~s*uwfprOz}`)8x*=Tl%O+eZZ2I! z+)zb{K$Oe9wzMOGE|Wro@&sfDeF#5JV5b+Y|sc@T7+Hg;a<oLdffA13fX(icFA zYrI2ylM4h|H*R}|^$nbMKDc;CLMHjNM15maO}8S_zn%d-Fn1c6-e)+ltWOkp{M3Lr zxX4A2BJ@In#{*&RO#!LVB98P)Z)&|XL4=e~fvX*r!}BBO%-w}9K-lF0uVXyevXd52 z{N$86D-UeKDuE8>0$^&NU>#r_Yi$N-jl~7`t=AJ5K98a^<~kJ3bt$x(C6Z~dFeg_W z&}&dRIt^C4bOjG)u6~4|L&2bK#DR;mGSm+J_x^GIeERm2>kMh_E+s%tN|y%Z`f&l2W!p@2XWW2eB!~?%i~XM^1)^3^B|sJ7LB$bu`vA71c;5~ z|IxlJB&TwOV>T@m2YjRD=H3%JpeK^(v;VS`L!W~y#DLxc6p0fDUD+u`MdzFtLhz;G zOSBjB&{rJrbx9;b;t8>fG|&S;2CbiI{K(ynyDam#|8)vN4;ItqN&-_#vv+6Or-7={ zBm{CzFg`TIdkT1w^^b5g(R1Y^d-FsxuN_WxLn^MI7S^^c6!(5z?zgYL@8!i{giaz6 zOo_6QI8_!J4b4L^nyAx;6J0noJ+Lixx9599K&SSN5;yObZJz9LD^g*vX}D|tsoC^P zjs;}OA&dkaSHsLuAb>RV>A^^7CnCUgMF8LTXP5zD@EYj&u-6B0M`WpX^VcglnzgZSBGfmgnN|0F>$PQ z*BqH|%Io@{0tgSw0;e~lK0%zy4Z`4i^ztp)*ZN02&t6S+^9}7WnL=z5leYcGDiX;d z7g`+j_AU8HTOfIZ#->BcLO$)X3V?-=@edzmft;SKcbJ+$`UANDI(ZP#(3SHf`ENgH zUb07-%C}h;S3F_23#MA!h-K{q|ebyAnd zNkDa@#U+aQC2~z|l?0|Q;JDIf2!DzvLkPCaO5|?THcJ!6V#5#=RX%ctg2(nzQDUj( zP|3I$EsxR)F;fN_8r%txH}o3H12vdqYOp3O+>i&7p&Avk_D@{I`~Y{$#nH_edi92( z$adV!z~^c~NW0>=Kj7q&FbcmGz_kqq&`dlm1YL;jv(|$)Isr0VMUz3kKaslT6kum1 z{C*_wT_Mk~(b;S`+rExih`^AWgrFm7P-`)R*w2M~Fc>$6wYNc})|vCfHvvZgJ&p!* zYR?oW!OJ9NN>`^5@L*6?84hK6T^2aL0|QxLp6m|9zdsoe!iru(isjeSCipn$I{I@M zP4@Ot>ANuwg=9eos~)eii!%J}0bBtTeUqgNySucAAPqbNgSa8PUm*D0z;aFtA~2ME z@v_*dStHLg|GSVfC{jkRcfB-Kw)eX3)G{tWQp|}KDc0Y~uGoKMKpXUQpQ_5%lN?rb z9n%RoNX`X*ls>)+XlE=C62<5+26HkngtG&X1^F+?ukGaEnXH%qk!o#Le>gN-`0_DRxnryD>N*B zplNwPWao)jgF2TAhGP%Ywh7GH3ZH+Ka9zx=b?>mgPgu7_#j1EI?^c#$cnO_xeos6Q zg?2z`-@bH+3)5tT1PLAEv{0S;AznF-AbM!hifEe<*7>CI=zavljoW5(?{_;MQ}| z=EZqZm(RNz^-L*u_0t!dAg+KS-Iai1f|@V^uZpu2suh#;bp|=MDB=>%+KUpf24xJ* zQ_)@e$owUxv<%%PSdn?U)JsaeG);jPDn0R%U~MuxLPGp&0jTQ)%E-Tn7>#@$YC_h( zvu{62zfkU-xXu|jp#sMPmlYZ( zr?_TmeyXMF8WU>-V=En)=@o-_*P}YN5x(}xm5lVtK+a>NB^59=6XfcroEk8EnF;tZ z#7IQWIgUBmek{g-`F=!5aPpYpr0U85g1w1HsWjGUeX6oshpfvKAVpw&0#NY|I11#? zK;?(8s6mrR^~`Nag_RLU@$h%a!=1pFA? zIL>J9G3tiJ(N%Dl*qMa&?;S;8Dq{2-2S|iS0rtzbjZxavV6OoB3`$sPCIFNwsJXnU zlQeB{Ar}+ANlxn8D|6C>+p=z6RVLQs+4IKn*>I&`p?*VxE}{89L@wAciI0$iq5`Q{ zH`ATn9bjnJB5bkz^9kBkL0u zeNiXjT{c|W@>wiB+ce_G<{ky?9REMZn-(gF@=$5^1xYi2HfM76vDN*f*e16;R}HZ( zxRa(v2h5YJb|1XK%h~R;V!rmEvRcQr8}=cke{vw$X9Z+(I<`WeX~M2 zU`PYF!MxL|9a81H7HtC&LKjDE5F+Z$Hu~R81Js&3bdbXYxL9z+jZ1 zBS>N8THIYuB|}%if8oYt&u?=}UzxcjxYTI9%0&ZXLtNx5JLRnb1dx*>z@H8qFhW+g zv6y|h_4>elYMcmWK#b`RNNtI4vVN7QpSPY;Rt90_-bb>|ogg|OHlq^he@u}atcy1+ zXMLyrX*Uuq~v9S5zvAi#T;sBXuO)UjA8l_TD&DmS8cHrN(LL zt64mGety*2TjTlHOLvr3aew;uF`AqLH-ghxx=0%KlrZ261v{IrT7n#~8)&n1O3lU) z^4RcGfMv=2Fw%Betn&GyWdG%q91#AQGYV3!@82qm!Li^o4t>}9=|%E{Ge>|xNshlZ zr{Kz+lR)fm#DNsb{%^f=JeibNm9#>DC|-#+ywkIwEHonb*|9bMpbg1`@C*W0{Z&Y_ z3?7Ay(xy5A>uH;}Pz>aJgXcnrQpk-=)|!W5&-mixx#CVl@rHx8pO(0Z`n>!z`qzuz zM#)(3nQryA0@jP9O@XPeyN+!^9uipyNdO)XT-AOu_}*|gYQ$P*!88E}vkVfJF_>9W zl*#cT^nQn8^)zsFYduw6s|t!3fsAE8ysFL*=b23iyOaSS|W-JX$9 z^qrvaGm@_3#0yt$69{Cg-w`8sOSf6Hw~=22AuIdgc(;+WSmDj6OG@zAn)2}VRy@V(D1Iudtg0FW^)4m#w)|0R@&bCvi@&=%8(JomJ*3mH4 zF#ffcWM>Ufy@@J)BhsIQqHq7Kwr_zvXqh6sDy4j?t$8Af<)CVJ!YMrnsak()uu)-_ zfc{*AG^=i&=*r$z<&?_Opd0P7-l7stTD=+Fgv%O0_3a>uh&Ab$$~ezarboVsEVkPi zKytw*xc=9AzWa&$Zlj~h%F4X4rPW!SU-Vx9Kf&fdoKA#XkH@F7MhHMn28Q# z0&^&l5ipLGCw*;+^1i@YLyvNwx(LFM2L}tcSCH+l$+&M(qtuN;k{yA8>v=7&?@LGy z=v*s}=%I|er+1t3u^|~+^ju73Jg7^X8l3@CayJ0EtiFx22|&Z|O*G|TLD{pY_&;~d z%VV3bIc(i0oUY}xn5!1BTwQ;L|0(1y-UEH&Q2F+Xm!mWyM7QH3G}*L0I%Z?oYV-A1ADf9xWSza#E3u^WZn5Rv}WLV**UyREJQi@PbW z1|$A}J}9c=(M279PQt>${MnG8FC+|519IpDB)5yjUu1HC8a0iduh?~rOB*0P@J#;t z084qpm2kSP6j3QgJ6sjjTu=?{)9YE^c`AERNoofcZ(2J?Gmp$E1Oh3Vo>KlYT+<1` zzK{s%G5#CVh^pvgo0{GCa!^C}oz+oSR0nWk@qQs_>3aG>6w&*!FT09J(9OVieb+&X z_UV)7JL9XIR}YOeI5tC?hiE9wYrY9I71MK*C`cl(70;+-?zHts)4c)G+#z}XiCZVK znl6q1rx4{LZ_*DsIC&My@;xmw$f@RzrDb;b){6KnK6%|Fw`yqde7x+mkPjAwUPxbE zuTjtb^|D5HU)=dVq(}{h!Qmt}AQcHMQx*dEE#35DGF*s?ceIJ~K{U9eD@DFp>y5o( zKD^RqQnmgm_5}|WUI~w_d?Z(?c+nOiLPmZ|FaY%pfv`KUKOU;2;U4HceFalhgqEob z?li)U+Visw@VEv6X8>5LMbV6UDuQIlUAu~a1MLo#8ig%YKDX-uMU*mkett%f9=$T$ zrMmPR9p^4W;1v*w=xH$wUr&l>zw&#VD>%B6tRTIoC1%GbP|o{yz-ugg8B9Y!YrCyd z9d|n}LW+Q{?n^=xz#PA`rtPZQv-y8CrC)7I>386Z99HL3)Ow0H;7##LuOh`L6q}=5 zbV3ii@ zal_Uw4)l837*7#Ba#n{KW-chsUQnu1Emu!;V+`h?K z?!HnfmD9RArk1|K)5xca!MA?g6p@`$9<^3uUg@i};_dVra=S>AJMU8iHq_ijx0pbe zMs(Kei_)q+cYrQdNBZr7a}39KzoFJWQu5{~#-uX+qAC1le))YhI%A|d{%{}ecfTVd zLzjci9GtQiuXL#&C0Z%`b*9x8{5K z?Ime~?{HNnOg=w%THRN*E4f7(J{81xYoy~dWehuY-myS{jVj!B>*`k`jY^iq6gwrG z{2J#Gcp*B0vBtDr_87g)9E`*$``aQ7lVWw~`$YX_&Mc*nPVb$sRg?|7U5sgVeb~eAQLYnHhHcH7j_dw3V^8Z{DjgqTczQjxe+0c#qt0WtU?N43()MoLKbZLHe88pVv zS`TmE+#RtZwk$8(eU?1yKCw4xFY6V{{&&|)s{5)4rAtCjdn$P%T*v*2jLYCCaf32s zkl>TB)Tn2Ev6Aul@dFbTVFl(x$XdKqd}uDYZ$tSks=c6TMz8Yn%cBn@DSLJt8K#vi zZX&^Z3f9jwDe;$MYZ*0D<%uO!ZPImn6%0;(}d!gBq^ zimWEnPDuGlZ!1jO>hZUJH>^|&F!_n#h6SVJzAE+X*+?r|Z!}e4CZe1!U*y}n=2IgD zFSFwX#b+G&NB>Pi=p1iW!q@_AVnV+6_Z)pDc(W<^F^NGcBWGtaT;SpK$7;@sDz=&y zW5#)yNNj5)t4H|zfKO|PXogE)>r?y_-$XHRFb?-@Kd*~HSX&*jdRyxkxGCF_tzVga zb=?{_+4oYqPXUnr3`=#T?(+QJKr(Y37*>RUJ;z|7e@mocWE{5DXIKN&R$;A!$ImZ_ zpI!7U+E9yIl~8QB^RpE-fj?@8HMgrF#gOm)IHi`seEQ_ptl1^W{@989D$RI9IqzmW zr7`Dhv*e8WB+j^BZt40u#`5fePn20U)Ix13rYFW!QLlYWEKyb1Y|jNJBcYdagKX+*MX->5F- zo4%JxtDhCg2@F{KL>HtIGPLsbGh5scd`(xux_%{inf8R`*vL~KgJx5?Z%pn{>-lqj zr`xlOb@<`kTo&Q2b+qx2wQWS?{gDQ1d9}xH9)13NGR~-?G@RYvcAwAIlFm|r*V4h3 zqh?ojy%|38yis0>#_(qFu-;tHks&kN-`|8ue~I%2_|56o_gw9q$%<>k1iE)5R$E+A z9h?QEdzB-Ol>6I)4G}_@yUI;UO*(n(t7@E{L{v8@lD|QDPja7mh<3V#rqp*zJdi-f}AJd zW=~&J$D89%rxFAHm3dB`I&r1)S`(UI&TzkXhIDti+#goz%!Qa$fkfGEyMJF7qX-p>o+`sKC#nYqfp6b??}FB)PxVm+I$) z6F6VJ2)Jo>T$NGcPFN7zC}nIZH-lJ^3p?I6@DK6`wDjwYyMZ0rgNM8=9B;OLD4H^| z1Izb2`N^#Vk#)oJkyeKizxY!`lHz|c$On=NZc#<MoZ_E&(%?K46B zll25Y^C&J6ecKDmRxcJx+%o{1awns-Je`QWTL1CvQZ2ScY9%+eM+%OGcPWcf60>n= zu+xz$)uf(#|AG%`GwTJ%r{-5bu>ILRiSyvFsj$&NE)^g@uh!OI_Ag#J2K(SPPMhd8 zGH2U?I}{?R3D?1?b-Vn60V|N@^7`MZl%lDm-ArN?EuC5F7jDH>wMY>4>W#rImzXEL z4WgfoFat+(lhbMlaDbVjXQwiu_2`^MFvDTLCjAX08o#v-Ou>t9$e7*aOdX97;=9 z&I{&st~#VS<*f9ER?P5vov|&HN}a*?AfGCztS5L|oG%U}AF^COvaeheVs3jz=EX1M)O zqXw*3*k5l*h%%Q=D{m4axeZQ)@0EJ~|AkOUeGhE!5h}nK6;c& ztx4^DJII94yB`L_e}X2D)UnqjMn6kG2|)T}6BaeHq)&||>muLEjKSZ1f04!b&GU71 zJzdkrQ7Qt@fasYwV`9=MfbRy+fq?n;e7U+-a}o*s^x#RgxFI3{ZdDPbH1NL%LNFWw zMcQ_E8?MC_eZNKcM9-aGW^qSI9_*W$qR?ao9hpI=sz97b*aVLTQTH2C`;unp{B}?m zu+!0X;k99vO)lDz*X{z-PA9I)X_dQ0)2<)q@IJ+~Fi6x`W7Cx4?#{=8$Z-W!03D?Y zzPAA$l1F&;_d!m}2N2=qp1f$_uLlP@#4;2k_FL< zSJ*#1I0|aJ7T%d$im3rX5kRlUru3TB{mj8LFRUoQc~@xtbswpY9vdvEV3_wHt$oCK3yw6P}HElOadl53~eq=-_ydr1vI;;sivq&c|CCx%xy zTukFK6*?PAlu|D@ICui8>4I*1S7(sYERpORfi;kcoK{Qpbca__M;!6j-eh^yQszOP zU(at#(3SDkscwzM1SWTI8eSck|L1@2uLB!95)*NttFm;bh+%JuW3xKWFpIbEAS2l` z4z(3gOfaZ>7Es}Im9d@cJKdyMN`(o>XDx7}ReHw)7n?76vld}vr7(s>#<{!D!hji| zp6TJtv(YAGS}n7yQ`1}x6s_wpd_K=j+i#_bjKobqdMQdLnJQ*mf9{wOUc zA}^LBP(O=dmDj&56mIslr`;*kc44_SXG7EVa8!}Th9c1#q=iPHwD2BA7L&Y!YQ$d$ zdq#jLZg}^dPU<_I%Jb2^U98R@)r>ms)}pl60zR;nN%C#f-tBwBiyIu>)>?f#_v{DD zyOS;3`=}3QHFC%c>hDA^B{KyfBv$Fblz=paMJg_+Y9+tS-K%-(p#s!=XL1{&4x66D z{#+=%JF=jwDZK<4XS!o_a>d@E8`1VsS8NgsDGjVPE5G#&^50pz;A)9!wj2h zX1D;C=7yreNOxqK&r;G?ROX+xbk`T{M~N}L6rMJweB-x(HB~!AQ{li{(e#C|hb+h# z;B{c93{F33T;KFOw~sFLf~@7zNrN3_+G9acF8L2X@p2nZzz(XC$mSGoO+wZrK8qI% zd=sCxA2H7wr&2T_z^0sg12=!rg#%QZy@M^-m0T|XguBHVFu5;;gTyl&&{5z!8zY5Q zmQPib4jtIWcK0Lu%F^1z&ZlfGSw-%Zz?;}LAawYBVWW&yK34$iZQ%)(@pjUy z&jGIq?zaISI2qtZrOjrm-$&4>mzC{ok6G9#rRDpmqUns6zn!Krk(bvz?fFdYSor-z z6HCX`?Z+vMqYUL2*enw655F(e5q&E_98$vFRC2Pg4leLy1ew*QK!%9zL-J@~u5`+| z`u8aIwhWjQs?(oT!ut}It4DM*1!nLLTA9azB@Bq#b@!Sr(XWcii@z(Ic(hpq8U@F@ zj})7+ySKJYG~apf8h_KMw+x^dFTsH=K6c3`QzY?>6?+f$cp!5YMc-?jQPdb~1}BIy zGI{1%fgUn&nU3KL)pCh&-?6Hd=8+^o;-71bC$3@o@#;TGE)uEK~F{I7G zHVBJ9FpM}|W^FRAtV|2D0j1EDw9byV=Aq(&&V=yy-qnJj(LuLQ?5M^*qMqGkwo4#t zLsUp@C3uy7k+3$ls*BS`H`eO8HCJg9gK;`_C%$z(hoTmwJBRP@8Xq|*HUME z4L1tS#9k}62%x}sJpS1lqr2cTc);6YYIil4O=3)cY5h}%3OXiK7+nZla0((&Poo~V zkm7?B*$^E>yq` ze@rn$VjLKC6olB5!ow6+WFkaG(T{Ax^g8;P@rDmuT}46qK2c$`wT#0V_R+CP8 zM_NejrO%ubfi2BR7=?ZBUD8r9mDZ7Cs4cr9(U)Ku!fa`$=DLGF5{lP+>$XH|EqnXT zafjb+rA^V_XK5IE`W|e$37R_1ulg|(rk&e0o z1HhK-I|WhE&ii@5o#DWCuT!p;NIZ|;!lc77HTm?8+Hi)}u5t(ZYHNS44?tRhm{imy zgQMadY|ohPz`pM-+BTkQDS5jj(K2e zxsPE$F#{!|(Co6gq*|w^7xB(O{HH{bp zTaQ8dB~EPj@4nJPKZgA6-!GD-k8TA&{7mfHG*u`h`GTm64FsqFN0hDlO(w0~fyfV| z;scv4KXaFHFqGOsD0ZvhHI|p)G1k_Z4(XsIswGCXt@MUuM(H6nY3Ep%lrYgNx?F% zr17|KWtsfd7OVl=iDxg+-B&?!_%6ZAsdZ5)?5vjJ`q~vU15>Oi*GRTi5E8XVCdo~& zuxIV=yaws=;Fyj3j^;fWlk^L4R2#Qq?^Ozft$KHVX8ZAWPP9Yif%3iGGETUffMdS= zV(_JX#z_DxIqo(%#rGh+lJ2W__Pj`bP#rlmQq_bQSiGv}b3B3D7U&+ypa=q`f%;ls zzgWf`&I1S6Zx;-CQq4s>qu4Gn1yKlZQAJXDjO2J);xBUtGbk&q0yoHW0YG{MTuP36 z#2~Xu`Hevr*@;nkkdl6KTopi+t$TtImT5cTaq40kfUwVI0|>s;kpp9;dh^!V{?Tpb zCF_HGhre_HFcfZro7@z}Bz{QmC}T~LBlxfzq8ZorbsjihYl~qMl`MH&>-3RiZ<09g zqRcRjq~%4W)ay$wXX95+{(vZk3D1u+Q5(lN_U?3+_WmKMKfE$<6yd@CAs5;Q0)N0- z)+*X9|Bx{lWQs4*rbv2za|#4rg-3xCi+6yFnzl1766B7{8KSK<>Gk77kaW~$Wk?Uw ztnqH0DlHm$dV>Hv$Z|#z0^KP3y)0L=SY%?3Vpp3o9hRy9`S4UyH>_G+tDbLA9vWQU zM0|c?(O(@O>N!;f_Wy}TB7g3F?R8#|fe7pKG1|?WS<`pi^33wIGX8I=G1r)K(l}u* z(J~H9UXuNeT>paI8=jMeplGx1tpRz%i*Y5nPb^&N#|CX%2PVh5w-8&O;UX}fgG+ih z6G$*7rrgd%GF}`=?e~-n@=8XSwWT*Lzm9L(K1dQ0?S0Q&FO^ftVTzYluGrMmWi4h+>N5i!m9HM4{}whTa4I zdq_R5(e##r?n|#CG@?}s+`1906EhOABY4K$91MUx`TA0{-@1Q2@Y_tnE%7w{bZRO* zuXSb^&YyH!;SNr$bd$q6o5Rd1vmY*-`G&Z834Ia{9tt=y{DBVN#g%Bgd{~{|SZIrS z1Tqr&UBg(FSv+D*wbXWr%|usJ@s2{u`F(3KB+YGZtBj8-3Sw7|>! z?@#Zx5Wjte9_0uF=Ru7?9hU~IB!u$?Eqe@Ks*42stX zOYgS-=ubFcKj~2<=CnBeQ24qa{z>9;3pp%Lj;zC*C|WRf!AM*rp4eg+#rSvj;iA4K zDgOKlyuqWh(sg`k=A>eaA?%@od<#Bok#-tkM+C$NY+%Xd?Yi41%J>*D&t>3!Z{~*4 z1*w2A)nJ?KfU}O z*ANGTuESTGEHyr#^)uW9yCQQ_C7c=Uo$73BMs%iXt8(F02|X92&J^B@!$9~3K#0p@ zVB1ZHZQbnFx(WX07*WqVqOsBMAw=0sJhhS@)Qo{jKwMP=* zKbO$G%C}fbmBHA?_7yGmHCQkXaB<%KSwFC{$~TIK`bT14lO$ zQnbt$0b#vAMM9-cy?56#5#O$Nk)u9mO}{4yeL0O)O&c?hLuY1SQFA%7W!UA@=-^-F zTAC+0lF}czjAnFAo}23aOtK%$N&h7KBqjC6`UM;w!`s4i0i{%{fub)y)2m%E$v7RC zVxMriQsJPk<2Zl!;=+Wz<5jPX_bszV-p%Oi1kg{a697Cj&O$voPjr!8w^_uHy@NYH zyK7`L(7$%J)~xaHG<~xtME?b{g_BTPI`DjFm`6(^<$W!7^t&Iu-z#DLSBvLA7#yER24O9)n=$FZFc{*0+M;sUj=|?SFAO%IozoHX z!eBW7X`}@Q8y^1a@%eE{FND(qT#;_FVA^{=Ihfx=LE`Lxl>}EB{Tu7~+lGOE;}sGQ z5p#OYrBFr#zZBzbnO+RFa@-8)0QgDN|%rIMN6@Xq&D|HB<$ zFa-?+_3GT2r$*vtR^BpJX)%>zJf1*O0QV(&HVkV$MD}u?MBLYS>aYH9{631%*FNrU z2Ucrpkzaxea6kY14Mxv`MuJ5we3M}6CTi1B;Cq`T0RWbuhzpVt%O zG+)d)a~>kd2ThvF^X@Jj9JSXZ-Pyua=M#_a1wU%@w@xmbESc_(XN8#QIj@2eKKN*s zxxEMd+;!VwkSFzUpf8pBKYf821c0`(x;vch$w|6yItZ;VtMvRwV4#cf-)MqM_v_Uq zxNDjwf6jGPPgy>)_3VXGNY1MfeCooJ5t%yZFn^iVh>+PRFzv^B$CL(~6c%J_fF93NuB!XFMJZjilp-YJk(4pMcYKL#vD7S9)9 zDB3}Sen8Js)0`#$(=)Ko1A5=EpLqGd)Xl)Ft~dX^ejE0IuAy=jQUBi}Dhq%#X|(oh zhC{W$esD)h{>ufxyphKHk1)M^+YR#$Hgo;Fi~N%8Ef|Ldr1=mpZW}>G1gH8StO@== z9Q6?fISxAhR&MbBH+;H?s7*bjV`12n$F1dL%bV(IZ6yhhx|i~H6fit5so=s>;Pq$m z#Yz%XpR^93sYx>lzY24=h~ycH`6=h#nY~_<#iMc=%SS;Ndi`?+m?I2lVGj)v5?(~r z(Mn@xBMv3x-;!n%6)w<1m6d{X`bLLkp+9_RvNUlY6zN^zt4hJK)R^1K_hy_=><$I4 z1@L?aDU6mwVF0(GA62vLm8ylg4NJL$8uH?3mV{nj=soWB8XDviq+^fPI))Z9+QKz3 zHSN`^HMKJiwGk^ni{K#4IshUeWaZnr6k@3%y?=q?p?>tL>{*3c#HxJvQYQtZAf;>T z_?-q`*%e!}>q1R@p&Wu~IjKafl5@^QMs1drU?z9@>n6R>vUA_vTXs;f2aXVLqDpoO zR=gf_)-T;GcGPuFrDuSC9k@S-sCYIE{hQ+Vw~P3uEy`dLo(h%uM{UM`hPcpYgHkW# zT!Q;73WxGbN9qw4L#;_O1t7B`h@fmF*i~_nD%jrD?-ytZ4eIFhLDVyD$XN`DheU5Doar7Pl*>ffpz65aptLMB z0K9`90U*eb7kFTMs4pv3b;M&a-B3+F2VkJ9U;j-7H&_^Ja4^4<=~3irhR`gaZNjvN zJ)xKt=9_d`$LEuaUQUtavK~}(9QpZbN_`k{6C4JE)v2H#xSAQY$>0g?x`&m3RX_Hh zfoq~yS?5G<)aDbpksS=Dyn5`yQ`V97NThOjl2H)qnDhn1^>v)kPPckiQ@N3G45sP) zj|569inaqNQUN~<*7*}mpHzC3^A6@9f@djU+-&90EWF{ea3S>x+!s#wNL_*67*qij zUVXvCA>kayWKBj3;A+OvLLBvt6&jMy(tj2a6=HL=Jr&Q#RcpO!jU&D0GZLz1Y6(;m zBGG7BejojXPg#E11n|{_!Z1Ac>@7;m07#TrU-F&@7)5wdwyvC9De?xEFw}(0KbVw? zmXlo#*PL#dVi`QQ!nV+U2o-=`dE~-V*Pr^R;y(g7u0XP3w;J%h7o=}|g2CLa-&(v_ zK&AzKV*0~wY9`c8pE=b@iV%I?G*Dp8|D-))giykW9Spif1{|@2ey#wj*QI4Wy7NC& z2S&pC^C3u_=ljBx7^0Cd&99OTGzVIk=~B5?Lo;bIbxnt%6soA#Z!W9VrS==;L7k-Z z^+(ti&|8#i6MRE<;Aq1k>eDZKK-v>2e|)sS3zYx`j#`3^M;EJ39{sv4a6UF zCX_=>`Gf;W!DlxoR85Crd{{{7goeRw%pW!)(}*d+1-#lISb~23#OeIC#=p{Ca*qTi zq^ZcsOveemr@N#FZ&vF~1J}<%RPk{GR2f*2m2*X6A}bAro}#9#UnuYKLFN61`9CyJ zdZcYh!Vmm=w6;R`_JFkGSa4A8Ac2;;&kL|=#~e&t*h(~0BseevJgb^y9$z2%(-`E~ zDY(0B+baKLn7i##5-@hyY97{l%lHxJ93rvbWHAjhGIw;Jo=-7dyvC;teQ#iD*^AxK z`8$Vg_h~O+Sjtz`u6Yb^t-xw*?t^m0V7(H+9(f&sSs>b1Cut=wm%>6dvw58~uXx7g zpM_2=S6NkWu#A;NZCZ6NbxmQ+G1E?3{2HRyzU0d1Q^8}nPNHAH>s1BS<_;I?gn8+S{3B~25ud&e{MTiK7)Ldlhtw`*@*PUIM zcrez|RJFo6S9|X!L;}GFF8Nqs*|7VDE6-t4*_|Ft^m1=Lbbzf3(HprZDVMRbLq)rQ zP;y#%h)G_&d|q)w;Wlg8rN^fk5y_%-7~Yh=7JwYJW!!npPJ5Jt0rREz=IDJ`>=a@} zGXZQm{kBroKQ&X8tUPfJHKlRD_1z6dm^B85(D~Q27rWOdvHwYTb|9C9JEuv49Yl#< z#%YApgXC@Dc8L9Y@e@8_;i}~noya2{HSUqyf|(OJN2r7fE@6b+7_@47f4Hj?u&t^d zPJFEWvJ?rjsz97{l$KBVC;VUWXD<0nfC{STR1nT%cAjxMnwpXd}Tu`TZBO z?u`*5sW>jBiTw#cVKNjE?49FLiYS!UHPF+miXMgMGUg4NoeR$TGjYjvQyasCEM;L0k1{vu z8(!mHDB2lBUe!mt$iUfacc&3$50a0Ci=kR5#_XojR9s1?u3+O2I}z|eWhg>XTH03? zy&mbEPcrf@$v6QQ$PG{d7nD$bt=Ib+g~SK=9Xu334Qju~W?ntFD19gZBYqa)uhtuR z4ywfhi&Ym{OWOB(>|7y$W7oqtz}%oeegnUTDrN$g&h6(VsxTjlk@l*bo00)+HA5d( zqLbR9kwfRbdQkl8I#xyVE2QH>^L$QTMpXF)3^IBSNWQ?ed{L2imj|OW-*9f8Otvxf zV0Ef?F98N5Y~&jR1_*cvpStAV1v3xwanOIVWP~-$xQUu#O-czevZIRP#_Ryb3Z*^Q(UxI!{&Ltim z^om69eqF}UCg3Wj;Q2%s=iy)JK`WGgWw?u_{rR$^rqqM0fOM=`CKpIZ#^0(OCa?85 zb2EA5LTd0(ZU<3Ly<6BN2K`7V>yj@Y>l^Ooc`iZouUcz5i2;2-y36(VS9;X9bDe8Q zSSYjzyg(eA&(UL_$Bdmqv?gPjz9AHJv}bgN_-MofBLYEb#EJwe;*nk_RIvABS3|2C z8b;8Nas5?0M`cZ5+BIgGbpO?sx=9aHbR2g4t!7edS_c_RKKx*1QoBCVh{SM;02uNk z;2{=m6V;7@Y0D>zia-s#k#Wh_jbQ(AZT&kmgS`R3mG)|Orbcf>lwJ^<|K_0Qd`484 zDxrzWRhkgdGZ+WU_F1sAR2jZ$z%QB_5;~%E`fYKT> zAJav#UR`g)bk(mdAxd`AfXpD&oTN~e%oZcDDS)g=!jp76A9ytIg6|E!iop(_L}R`e zTO$}w1xedOWo^?!=RCelUAe5qE{(yay>mb&opg0_k~$HlnV7?+56JBd5mM>yw9wUcl=&^l*hp1a@oinT0PI~e zAS_ZPaSnTa5*D&z^hAT{Gv3{_$ua7G{>gZ-m2URQW}EmHRNVt=u^P~@y`U+sf!_|Z{@wyJWe;X*03*Kn^_$=iCUuq0kp^$X`by3|L~IyL zaPDdI?=m1XJAhcJ?_V+ReSeO#vpPx|X3z$ILlcnPRR!8N&%ElBjShz32dMh>l|}!Q zqq%x}1!hU~=%oF@@l;9YxVFd?pfJRgKk)E0+_#vxNbD==<3M?9l)H8#uJ`#_?d+z% zRLWdpH@?&pA?2SPa~>5$*}oGRPR@9{7Vk)od;HnyVpjes;w{0mFx*w?H0y!xt7$Nb zUbm8y&XIkrO?(?e5K7Pcw?gc(TnInEK1B7rI(T3DqUrI9%5t>$Lf_Nj#clP5#jgRO ziQ(5&a0Ec znTKL%258t1BrB}cAZ@_WT`t;*L$J5r$zK#fTKnwsU{GNC%Q0dp4 zA1o%hK|G25)s7(A%!)PXVw6xmUK5P21F%b=u$Dgz2*HO#n+SkZ$ z@iw`+)?7+NL*6WK(vrygjsmrd=TjF7u!?s+x8M8aPEo=l&Gag2?n8-j?#~EXfA*DK z$+j3}uYSkh_qxqQhBvx8^X-jp?(a>TRo=eC*@gxb{CeO>h&x1#dLeF@m_)<_a;mHv z{34f*mZ=SZrEVD9e)UK+Gc96wQa&27(->L2-S`DD)w=(3?xZxgX;gI_cVyyg6!}vZ zyQmZ#p{JbIYNz7b%vRgtFK#IRbjKo_xwWwUs#ipt( zgjK-AhU57JvOz1l!Nv07l>}fBkeFhDqn=jH4vV^0i1ik-3My}umLWBzmuz~Q+~+)o z%ZS#WaYw%k0wi4Ud?Vjxlym4PTc5kXW4*^pve3LAt)xLZDI&SB(j!s-+^<~d9R=@8 zF{hjPY{y-|Z|U<1oGJ2f+W;A)i%H6Oh?XM#V3I?W#t<#XuYS;z=KrP`t)EjLZ2Env z$Y@vn>HeIf+<_%g@xe1szq&K!pOdPLTv|LS?bZIT>B5wMaLU-MwkoRW-keaS*BhhJ zOFKF^snRjC$-jx^47T?FC1FxPw!ANlpvCCY2Nacu0fFCOGezqCce2P-G9^o6l-F)j zo%EX8tO_nT2%B0eF>3+mR7l#HQWKpYJmeQ&-kB#bq0$+vMz`{SCTsX<`y&{|m0lxc zYVu5yc0Z?4jmX7QxqB(AFU(54Hk?D!Jvn?pdr}Q#)q<-l#;&d(FXLZF^K`>w;L1p| zmVWj8Lc<+ZZ~zmpCr1W(t01FR^)HVbA$GisF}+&()K9K1i*)Q~lgGyVd?V5AM6@ul zoT^G<^iug}^*v$4h*twXE+S~hBdAYJr~TW(dJgb7f&(lpBb>c-&ovf5&97!SFz8@3 zpEK}&MTlG>O((w>wX7wDS9slBKiILRa|!TF6wKJ0S0dcW!*_eSk6G@G{7xzX*PyvM zDYrv9_Lr%qw(V%H>Vh#68;;4j#5GT*PEjURdVEj4me7aMav4HaLpC}&SFmA4Fu=_; zqBTS76|AEPl@?0=NZj)!tZ--jx%F>{T zkhIxXkvmYj@tI(xpwws}?C#86vKx=-Sof=w?A67l=PxnDM z77v^SM+?llUr(=&aY7o^AaMvMJR}DME0xA{KCiSsj+WhJ=d$>n{RyvePGT{)vzA`s zNq+L)z3;$7`Xa7}J?caEP^-7mc8nIu`1|KX6p|TQBf}n`$pPo`O+7bp7o+1CIXtb= zv}HiMa4?a<3Isg1KpLPqhW{4O5sM7rM9i?z`ax8Wjn!IvHN0Yjlt8MDp zIOoEmHs5Zslp;@@_oM8(8uKdKM0Zl&PO5nju6SzN_WqP$!rkY-+bwz*;ii?pFuj%< zNHZX|hENy9g%JW4C6}%HR3lb7TrLh7Rt*&o$P1ZBwP10%%7ey;Z+f(P48Y&}>N4fv zkR-1IUfLzSzqEJHBwYp#yoU5|d&MeCss^r>>~c+V962(}F_qr3PxmufMGoegsj_s6 z?o0~2Cr}KXtO94X{B-^^>Q%U0%cDjH&gNyA7Lug$WG`I|VL=ZTW=`q(ITGOf5DnuU zMr3#dhnlOGvdKzG6aH?8%a78V{EwgvF^rGcqJ{KwUX72xDzxQ_+Vi$hi2oWandcBe2lG_b`2A%RNl`k7? z$ff7k#SgCx9sRj-XfLcYhtM7z^2#awN!VZfm3S-@ta!vjeeccS7E84v!! ztx=8Bf~`i%nZ2gh#td?c+p>WK?m9UPU^N&t!H<7}NZ|1AUgC4q_0R|iTbi18Pqy9H zU}+jOFC+^szN+eK7uiiPs=2Ij%Y6qaT%rW3+A}Tk)WRzYYai^F{gYdpU*~Md1=b#* zofK8cYF=~;w{z~O!{2<{T@D#n%%9PLtAVo~Y`{4o9ZO7>&j-BFmz)B_>*FGcR3JHw zrm!V&v8jhdRp#l5kVox^f=h+cG~!a;eyzQa_%?&}u`1W5zyJY50e=3@9i@BbWpdy+ zx#;Tr%WCa+^S18_hOjWts2GEjV2vCNU_M&tQ;2#am(ZT0^Ehn?#feuwiXKq1B5v2B zw@D}Jo!q0wo6QQkQL>GmrZ>{ZnLEn;*{6|*T)OOj3iUDeV!1WgDrY0!{H7-HWY{{! z_3ffvv(6`%-sB1}R_E9mT9|lf+?051Xb+|itUTUd&YK~1k&tIgnnz}`uohUpq67xM zaunGuvM~kBBp;O5aA>8#5uL-~(X|uezjG?~jtds1$vjQ!O6>AKa~KZAOVK9BE{8mO zv4ngby|-f9Z8j7=V@|3x#Hcg3WzINx)AuFJ#}?C=pW_VVl`&`phIWTZ<7?H-ZULXb zT-%KUwQQYc#^|Y0^26ijIfYf~EoWJMMK?nRgLS>R7AVfL*2A~n9U1eb*9e=={gU(U z7TXqrYitpsqSk$_(adkZo)Gu5Vu)@{ievBs7L1N)S_mJQieG|}!si}~PVH@XM9w^n zTj@s#x31LuGn>`+9J0dnsL7}e4cqWcfKl?Qo<48F79u!|xr%H5Xr85E;qMxw2%VB= zm_W9p&g2CxutSCetf~3^YpWOY0QgzOAiyHcgvKMO!-uvoV-2_?IXLJ+j?-Fm`0#ow zLcR1cCtqgNke@G4Y3Y4q2UBm+ zp_BBM|BI`)42W{;-iHSiDG4PdMGh(;r8LqaGK4Ucbg6WABN9guFhGz-8lF=Xsvr`M)3hCUf8S-Yc$kt!uCS`!3HAF>DcB+bnVYF#YfNe`*|JsFNf8 zBDFRV#?q*ccq(o6+|MsHGe|k}ukl^a63HrwGu+I#@@`Agfma@lGm1yaj2V$7Ww%=e zbeIsoK~0ksS#}E%lQs=jvb5Yu_T`J}cp-3VxNwIaVVn*=JOFYRos61_$&tf()0v(J zSXV}b6L=^BwVHiQ<_E=Su>8Wd*F?Fie#^}!UY65RzBb%fWpMuqvb*8VDbvnj6+Uqo^!p)k<;)@#IsHz)reS*2C1RjeUDfm+qevhSGGaCT^*rJ#u)Pv&hx7kwdNi8eYmlV(brufz&fXL- zLKWE+`Q+K{J1AW+aDEDDDXzz>D48wn_UgLV84~;pHngImFU%3L4^Zjr(tme-pl&B?x z5ok!kx&<`-2@8g~^{6QH<1)-QcUH27LE10=sVI|ZtBZ`ea9|LtK9aa`_*cz8&F#hn zDA|PqdH$;Z$4O(Kqm`y|jw>dcSO>anco zN1}ubD;T6|Tcj6~>mU^~FBg)^rf>dK)yCaCITdOMHK!JXnzS~!0M)+Sm1 zmyq|JBF8k&?LYiI$=~&6sfas1D!dwJ|UZeND=u+~UJHI8Lcy0B3@q)(@8XKx*$y_Et*z3!dyU_9c)^@4kwDx!Zht=vmE3o0( zzpKNC3fA^?3pRBM%Df?9ejZ52WCu*1HE5H+7+*VkdY+dU&Ld!eu2i5CU zgu*>(jn(rA3zz|halBT0{~lYTn`OHk_Dy5sm&0yb>ug?7&A+T4cKLx1{3! zU!|Fw&kvh$^Gh5I+cwhA4`kksU_KUq-cWKYaOP&D^0V?tui@ktk*w>IB~B{#s17}< zWadK19%lJS5q$jU!U~a%-X`g_2fIx_qP8Z88i?&Dic*OLE;!Ci-*6y9U^~W+%<@g{ z>DEs8oPK+tyJ_llN89%^6aH!cHU7ey%*UDMKz3ibHI8TO1=UZ}B9|s%EI?7G&S;0H z7A|wI>f^$Qyw3@ll$|1?dCI{y*6Wv$=pTi?uxH`n2{5D-;C|BFV`~Okk*pRciIG*$oO{DBpLfXqn2B~S&=SzH zoa7j>Ys+av6mtwC5YY$y0geylsopdA|J_|YWn+Gd46t2WsKE%0T}wt|-=qjgPsH6v zNRc14%0_IBu4aPeiVGiijoXLtz3ey?@6JyiY#xo2G(DW08C@J8qc13MH>9?SEciTb z7Tv*q!dJ(Ro|8DgQ`?i~`8LDJ&R)ak;=^J+i3%-F-xF{4g_h;$0OSKS`^Y;vv3y^O zXA&Mzh!p;+`>et7Q&2Ob=mHzR!G!l=?G}OqA@vS2Y~ec?p|d%SF>;*%Z%y8LQU3f7 z9ewKyusN)UKYlOkW zk7g1h*#FYZ(HfFNS32bm4rXNB2_Xk1cjhzko$r*TA ze0bTJx}pU}NDp9ry5)hG`4!-Jb!)-2`P>)R`oPb~jJk&tM^kZx% zjHJT%Ow)a5YwBqG$0kM1MVUuun+<377>vKaT>w2M%U|@s{%mjNcWEg9{MeDmKgJo`o>1)svid5Eh{T!_d_IZts- zTf>XqmPL$gue|Urs?$@|a48ly2A{-M^iWwuyQ`a$?Ms=COb=HAvEqVon*I4LJ|UbK z-IiaWY(BI<#1l}4oK)o2u9_yUIY+|Tn>E{E5(F!Uf^-7)Jk3F>a9&|M_|g*2$A|S5 zUM-Qm`=@yupA(qvB~RXw_pUY^Dr0^Xp5-2uNFLp|Ut#O(fteTbKXRwfcgGT#WLSBM zRmudk!je*q$P-Z#giQK1DA#-)ZMMI6XhgDXaoXD1HDj;YmwW%LOyKmU-kafCa*1-* z29yrJy<*IlU~qttYFpRyVb7oQ}_DJ3;7g{(R|yI9A>>w4~P)t zFbtaPlJAx;FpTzU67H+#Y#@O8ReV5icrjhm(>=_Z@;@d!D>&NrKka?xJaI_)K5gcB zeWt8v7K*Qcm6!F7qbs`|5y7p9NDbB5kxb|6M ze&4mna-hmd^5iIYt-9e?L*&S&SMsbYAuaz6=pmjLwcgD=Z=W};{VlgP&dcav&!LY_ zK76G8Z_Q0B4YR*hhu|PLTsPrpkL}wpgjhb#E&Qzj?|MpunekgSzxq+~;2lqm|JjKD zZvAC?q^a^1a$V=yj^wHxngk14mzbXX0o zalj?>x$cV|5A`WuXpS*`xtm0=M_K{JEnA@x=~&@ZmR+9QN&W_LqQRkLiezLw zT9>c!{ASob+IQlj-k;XGcpiok{COMu<_gd6@plH%!TAhslY#|_LM>ctnPMBm2_dQd^3<99}oXTsB^-e zVX=LB#2*J z$+=rPm+w7;H=E5Lub-~=Dl&(Sn96E@#QKn1s>~{E z^Q6OL3%TG5VA=vI1eK5LLk%|dOQVN%O@SRT_ao@Kr)v53<%iPSk>nM48|8h6`I=`70rMxR_#NL}WPCL@w?d77SitB5ct6dbPutwJ!z_n-mzOaY!oHAkE~^m8#%)+*Hm2!Z%+jok z++zeaYk^&y_0C5VIPjKz>?BgnfGr@+6A$MTz{&UTW*oL6`{av$f^?i0%5paCu4@ck z+&}&j8y8rz&E>7ri+U-zY*fVHrfV@Ke!OxSS9OWaf6tEQ_;S6KpF9a8<0X+%)Yi!~ z%*oKryDUkM{DrIaxfQo?gom+F;ulw0o!KoJi!Si1^H-1#; z@B0WQTFI9Y|I}^zS^cgz+)7|7$5g48cr8I_;JoNbc{OiFFrLxkRp=ISU9D{^W>m_r zrJFIZ<=)TIyXzI!Y@MLdKvRBtJkmrmNh0Ksqdefbj&ZjSKHKp>o-tW!@U=c&8`6;V z{cbR>f4Udn%XJ&dZw(6{ch}FsQ@8!P7O&h?eYJ9S$3CH?^<~R>+Z&Z`IB^9LTs7?+ zm4di%+n+LKQ%q!D=ZWf#Uh@HyRUTQg_a@ifztZK9E4;ESF6tYIIPf-^bb z+OD~CUeG)aU_L^b2MmwfRg)1F82sJN<;4|f&6>XQAgWM(PjBlj(|kdWCX!tcCvgd{ zVUNd2zVQvYS=_C=e{FrSFG9~djxu=}mx_N~y1JBCT3{{aCy#?D4cnx^Ixp$dOILBK$K%@A5_uCL-WHkbLQa9JE#C_64(nJKoRn-iNlu)4Be~*shCF zEH>C-y@Kl&c*S7G`dVI~HKMj)jNi7!R&0HKcHD6NoTK#kWeJaKm4eky_^svVN3GEH z<=P&z8Fz^0UeT&MpZNJNKfC>FVn*PWKYsMy6>VMZqW)Xdw5po4kPV&$jR?Pao)cY% ztM`gIrpG$rgP(oT?0y!tro(eq>wkqbY)$}!VTfMEM&5*Xzo&-A0y)c>VcHL3X2Q*= zxaXi7nKYdF|DqRtBDb zrt|B!+iK(Pt<^KLAe@A2)GbR-7LU93H>}F2a)rH5rc=yJ^r#!>Mi=d-3GOr;d}$oY z&l$yhtSMbN0ttD_l+~yWi0`GoVtn4)ezM6pnRK+x+j~|iWlJzyI~ZKdaBwmeq9Up3 zZq&)Nr1Bxd%j<=6rIy3*4@>NFi65p5z7+pv^ddD?BF3X8PzB{iN-!)(csSAhhjKJM z;6!nFn`=}q+(ELw$KT5~#}ccs=}~|}W^|R?wnr2ze$dTZU&|H4SLYP`eD3Pxpk3$U z-jCAswej*3yafez!KTC;TpsLY?nV=w$0s9IuQtr9I)|`9vxsMT$L_$l__RloP8<{L z*ehp=j*bz9n~qAMB)H**&1p}@f>T)?kSB(tol9DlVfP%aOL&~sIiNSzdB;BRrtDhT zH6GW&Qh;9}q&gw8t1LFN*=DZMAp)(}_jofN$+C>7p}a7h2DHTQQ9hG_-WX*}*|*d* zs&6yj*zhkcnJLjw%XBSu2IDXG^nL7|WM$_Y9S@0!Wo2y`VW!+Gb=3f(gB@b`nrEkc z(IAoRtIF$*!)OwYiMw~S2bWiel1W61l#SNn&Z>QiK}v#z*a3xc+F& zbZ)!SZQ5YRR4ELPX4|elFLAA1U6*f6<<&QIaf$l)k=$=HL;yALVWn2tkHJK%RxuZ- z^8K{;aXAu3+nEjMT}-T-AzW06Y{46NPGP0Ss9C+C4){ujd&)x7N4# z0X!zXn;D}nKAwh~oD`Wh?RWj&$lh2o$)8=@YpTX$5x@r&aP};El<+N!K;GC4f`H^w^_QmDSH?oui!4keKFR42X zjF8i;rv8dzi^cD1(i2}WJQgWA^QKYC>QwJQhxXT3Q1^;9>U`*zI7{M$(^!3eka2_Q z?1o2F`C>2iqe-YQCB;%$?f#Y@xnM9F$4ftSmh3A*c z5|jj5=T{^Mxj6qul3pXgFVo*>+yC6By>i^ObytEO;1NVO7CyN=ufjn_7C?e~Co2sdv930iouMPEBiauQ^a2*37|7Gavb6_YBAocTe}Gvegq8*-|mwv*~J& zRiWE>)QQnmoEI9q(m9oHNWE7|MK2tJTQjkdMX5+Kii>c7`&|=WK!(k4p7_PwdJJyT zD$Xqjxh3A57?1l}(}#ooH0!y&{4wd+a1H?>&H4>)+uUl%ExcYX2Io>-lzHb&klzo@ z7+rd+?|G{4p5P`QmUj>Berx)GdQL&a-*DZ(Jw~5*KaY0cSKoJc*aqrD&x!rpp`;?- z8NM+BCX;Kj@}BYi^(DvGVP&9;WUhb_5SE9u0$YPq?)pCrVw@$V@YfMdT^7)ahv)D^ zkhM$G=h=^$KIy$k6hSi!ENg^C{m5&6o_(iXm?j=w-P8B|dj(In3k#AMU-U-ARd>Av zrh^-Y&v%cjE+Vi8c!d=OZVgZO#`Ddhu=`tj;OwX$W}xm_fW z4@}6^LmONG06Sn;;1k_2vI0=}UPuJ4YFsA4tiAe6Hn;A%Uj!@$_5FeT)w{pVGJGSH z+GC%FMqGAkPd3Mk{BlA&KyMN~IrVuE_fD9I##cNA_IeJ70_Sz_qZZszXZX7Fg z%p}d!GF-3{wjI7QV?bqWmd=k;4p>;nVya6uueg{K_T$55-a|tRXDQxdu{Phf`$!vL6Fahi5M0_<{OnAz}VXxm@-<(_S_wpOl%ifc?!< z^*5X2dh@Ez3R5rrK5dUL4eFkvGscFmV7BH-gV^wd#rA$N=9c#IjhI6h0&LOf^GN3W`Glfs#%%2qhXNA(bf>Lop0CI=(Y%q^gzs9MI#nG$0lzm zuyZfH#`%>_2{(iqS>nVkNyvJH^~;0{P%?@XPySw0NPXDA$86@MwtN>o;V*C*Nqm`5 ztp2*Y(XEw}Li*bXsaE)QXGmr|90c7i9AgR6seoc{ zB$XJKYwf?rZ7Y%c2i){1kgTN%R-KE=sJgMmn^F0?=0PLICo3|fzuCIFz%iR4glkp8 z=amAc%>8R(gJJy%&;4ni)ZU{vuQwMI*$b%3d+o=~$LW!4)z^Ip5UPB00zF|H)(+ne z>-sbZ;<-MxN+#s|%M5N8?H($+TMm#sg{6R_jTaiT_a#c*#O>>YnVk*wKhq98E*Yy$ z$*L{XW0p)U-8OSuCXg)GmrmVK+nPj|zd`9@%KCBjmU7aIJ=lwg5UN7h2X4~63h?9k zwZIXww)i~G_ps9li*PTP2T8s2DoCRrjsyB(#>w0r@lZw~od6)CX-2b%nZSJ`igcp1#{oQQ7WBzk|*1cndb4 zl?7!+%t}TdUHhzZ*gT&Vyu{h)ZQ+o zm3|y;&U_Lq5kFb2Oyh(?-~b; zzz`euli@@~Kxdy#_K7XhQQ9KhtWUv}pR$bG-dR9iqu=v(zT)>c0w%9dWRk33B&AdO z3PonN2aC_-)?iv=3qr{u5c5_;LjChx&6dD|O**+1jEwUgOa--G&e-T^G`7Cm{M|kR z4_yr+Kdq`M)!8)_1bCnjjxOL{w9YFp`9NySZxc#h4;O;~72A_&H!F;_u(#C`E7f1r zqW2Cy9*tj`C)L=)O^jTRGPT6Xu}Y^jS|DxDu#l+|XwX(1NB8|wQ}=;30_?UX$y}Mr z^d}tbw`&#HRoV_`k98GFVlnGQs3=y}V6pMwP+-8%yj0q++t?~SH4UL3l}O%PGWo<- zFk_$J{;$xVlM8Ep9HSoW5Mu|Na&vQTD)9SaL_?bvew{r7) z-y5%}o$(RA4CHi&jA zb~lphyo7q>Njbf*NM)6JpL$X+%R%m!*!RSo7dIhOz*UnFZfb}6zQaMQYk!zj`tzg1 z-B$(H01-e1(~OU9Sh|}%;N#3%jjeLw#B}4syeC{59wf8J>q{hOMj_;hP0U1Hj=(dwTO3LLZx9$D zWI1+*pyLkIUn2{Usqx`bm{4ZRM1gHG2P-j_pcu~*OtO=C*+`2OuADyQ(zpfOqf>@F zQVHYhCS{yYM7@mMM$@T0<#R7iBloOF5;3@Pu$S-Dy%p^iV6;7fyQpTFe|0Thv(Zp( zTJbCKl$A3?4x@w1B+pzODA00-lg~Jy-VgZ(ahUAvGvn#{%xTuU6bURvWezmx_FHNg zbdKPb;i7*g7!rYSh(!xI3Sp@B>dzj=Q(R#a?2LT%w)r-0WWtxu!0K6j_oU>nPE0~a zHzSrl%!IUB5gqwx_Pz7hP~-df_T_I0CQ)33)DSeA3Fw0j`jQ4e=GI0P%nSt%Cz;%gR41 z_cXm9`54_EKVd78$y+`DD#EmxNmSNJMh`D|0(rw;5+f8oqKj1m*_Eb$?+(u&?8owv(B`O?2J(fL=E#Q#D zFFv7V@K7&v8_wy!rX7%xHsjj-st`^2K9)hW`As^d5D>!asluP%R?9k8X2FZgY}60$ zZ5O1EVE*{l(2;u?8GzPx8Y8Ono~PGDp=kr3 zFLQWfB8<;~C%e;J^(qmxJfQSbv#PqPCi1ry;FqNx*%IVBHmZO}Uzi%rR=E+hi6sNj z9#DZk70{=!Wmd{xt|dV@lp~2c_PM^kprr0sdwoEOdg;A~cak2%F2@)%o>qF|XY1!L zK__~uIU0srxdPU;KEnup=7vGunv;93V%Kdo9s6o4s{${I^b+(GSaC+JjYf zMC`3)&3i}Dl$)XjZ}yr>RbCCej2GhIg{SD2{NPv01+Hdjb=5m#&xiAUiQ;xSN9}QLG-`BX7He5;- z74QtR%#`wpRok#vR+}$B`@VBK)CUJ)3>6zq&inYY>ca2Hlj+%z?oV=$2uwB>!wDwctRMm746(P9ng8_-Gsi$90D$b}DD_OJ*GG8loM)NW2D0qD)ETx~)s! z*Q`c=3`Z*)z)4LDxTud?ss6x7cH}y-MyVEX;ZDI{TuYSJ|F110dZ%0Y>qh_LryO|5 zxQ&l{S=Gje0^_%~MduL0%E`~DEDvPnh6-TJ*{L$(lIVFT8R~ z@w{~7>|N}yD`0=UQx3@$FPiA*9YG4Q7~6%^5p} zT{(JX5Ckn^t_tYzPMGJiyHw459C6lv=tLu`dn;p~BWSZWMSJumZYkjR=HW#ou?W=n zaJfaLswYLG3SOFFOD3rWu8s25UH537w&uovI=m}+uz0%Qf_$3C=InZnvTRq8p zix+?7`3_$r73#qgLksGM!`;GV|7t`Gd}AC98ih%JZ-<z*BTtaQE>DtOMFwG*c%-ASiR+yDG=8L%0y8fSq9pGUsCMPHa9WonWXC8~}aXR;r}lUQb8x z&{EbeP_x3hZusFG3(ng6(NHa%7i0<{-%G^#e|AL^Y>f)8*-5zxHMBC-=?9{xwnxTR z3q!yUBdkizho66BJ1k{DYa@Vt*;oh9BOA&|?Q2PFUVD?1x6)`#}AdaHf{`HEQzq z<;E*kYp%N#$uaYrKfI*RshMUqqLQ}ju}%{Kr&l`DkLXJEft?EO978teZmIzGzXip( z9mKU&en#RrM7)$3keGqG!*_%r!y_Ete|m9FvjeA)M{jSuLj7fAXap+nEzoha1I>Nk zFHxDrbsrHUi!v!#5r}rU6!uB(6K6QVs<{Taaq`*vlXWv3Y+eLcF+k##9|6H1Y1IN%*gD+m7Fabnq$)Ai`6M-V@~0CuaXV z;0>+1`XnX{p5kI6&BiT-EM5@=!2BpiwaAi><_p)e0w}i`;=wiZ--l0Nwin5=4I6|! zX3p4yij0mPHU5ul&-c51cDDI7zj+Ow0u^Wshy7&_!*92uRGaX)?==Wz+tpodyukA6Uu-)6 z>KzIhh;$`oWKhcRUPg{xb=Ive0O;qCl(cB~#J1%9bI;AX@W8zj7gHtH8h0Ld>x3&_ z#{4T^AdbC&arQ)3W4GX}Zs7`)J_M;N4=Qc-uLea*RtqjS4+F`8bpE*tut+^a2Hd+J zT3g(uE@o4a>kwp0^AEA74_U9d-|+71KUgj;N@K_Z)9y6sM!njau0!on0r%=l3hx3V z178Kc%`Hl3bD2Jm`xx6uV;r?wX(T}JG##OXz1{6Yzx8~n0mNu&w{r|c7yB~&nf`m- z0(oquSSjq?7S}OKhN_y3{d<-6Vf1M*doS__kQW%9jHR5L*eNUcp4~e#m7%QJ0Xsts%^2PO3m*n9 z!`bUfVZAoG?5_LVx?^sU@_dLd3lG@qiC8|-@E?Oi>DRyAqZo%$z3~NMAs>g;82{!~ z`wKXJ=`+O2t_7j8WKzNZ?uDJ~diEKN`v3^p@rEs_yjey$ISy1Kb_k_0wBy{CuY$bD z?(uf?D;;@9TEFykJN>Y#fw7zH8S!&oq?};V*e$xemH8|Y`BWAo;1T9$ubR5#&JuLe za)!IQ^}o)Brlp;Y0FIzgC&c40)lRRBa90GPHayU&@x=o7gf<>h&3-Z%~=(60j&iQ67gRV#h`B1_q7LvX$8|-OSJ>!gBVt1T42SC@q5B z|1`9qB!!-*$4K&b2`J0TjqTup+mL-k;|nFNiWcvItIsmn%u6ZR*7sMv9f>O4xQ%S; zM7>1Tb+LdpTNv1!`wCp~_?du(ZSRG;FJoj%X20KZvTHagOkqmw`I2%@4+!Y^-D-ZJ zDs1VWV-1y}gP|3BX&LB?OrJx)#32bu_`6b2RJQ8q5tp0^X~`wC{<^oBN8`HEa=BT~ z?InuQGh$@iN1hCCKB_|8hyzxW)t)JvE!&hr^f(A;9e_A^r@QWFY=b8MqM5rqe6gIr z?nMaJJ%iBuE|Gp({8r6X84uy`dyk0DIq|tLafZt@$4Z?@ztc!@AqR8F3VHKDYT96K zy0Z!8-bVCie}@~P6gY@kxHg+spiF=H?$>zPfaE@?BCV5ZkKhyk#VF@u^8>c3KRm&P zx9HYDLG7gXB*1jg+{$=_a=&4XZY-XUP$&>+*uL7Pq3Fmko$vYZSHm{XeR=0;!-jeD zZHwiv7F#+nSN8+lDKI$bQk-@~$Dr0g!xT!+M8~tQf@vXZ{%6a0uep98W8udUq%wvr zE7`1ktLEbebbbju+QAMw@AoU9^xRcif4&)4#;}}b%HCSnymx9aK3#WQ$0xqixI8vu z0NzysGVKT7;t7(pZ*yj7Jbd;B`)!qedaBXag|+`h3!XEGxq=<7HCqbRu_A;eYK_nf zh}kRxCbf5OtFJ|*Gl(91+;iN2lUZ`q)~9Brf$CeiP23xU+VNuzy$mZj2rDR8W^+BZ zC;nalD-fZ?E6T=Z6S2|+*fh1ScV|vJ+3zv`YX9W%fj2}b8f|!3x>Z%usAQ~eu_q~F zcB?W=o(st#dNas@sH!G*t*fQGJ(hB-Kp**AQ#yDJKz^94e6P+agQvsyGyjLnjx4kr})4EZeg34=^fx@jRdqa23(fU zyDXt8fpDlo5`OC<1JLz>-*D(rXYh5A$)B|93MMK&@(P$D9y7EdyIh9hA}_@F1UN2t zUz01IXd@C`V8|>=RIC0+0wWz@dt%^^FRR@?8k>qTNgIF?mgO z8goGJ0iBvkp;?o7cq+NEMJmYOt$orFf4N&!+m}w~{M1c27EwoHhBD1&<hKcLG8{?4ls;Cj-CFo ziZy_wCwaeOus!v+evvDbUo5dSDrp756UJ_(S1XQ$52Ktjj>cI`m6TIAR_5gI_oyHp z(*l+V5mM5yl?tBf((F`^RA7joN-FT09^w~Se$mSl{M!Lv-8Xm|r;LEWECf^C0xAG; z7~FdNyi2DjhaAW^)vFN$u{=;Aj)gii4LfP`MJ(nq^rxbrSQIZ&|C(o1-$?o?gEIQE z6dq!>3j%b9)tEl7I2NN{$O1E!;GsT0I*b1=547SJ>N=f<@LU6H>JcATK!cqs$vqPm zxCpE$#W%((WU=}CNS?Nx?392XH+5d)gus6{{G@rC@ z%WeajW#h7FegKXV{UeTEvA3JtCu`sX0Z96Ym}}3HF6DI6Km#otDt@aFuv!eaDMe4V zDkB^=JD*OexLUjDCw_yicG%9kij(4ovt*mg24g<0vIs)6W4hr3?SLo#m?B{zdlXEr zsKUmYA&qBQncb`oc5w*31|f?jBgK6xzy5!*w->bx;v$H6&ck3wY@_{Kpy1bpVQh;6 zbV`lOqdbqfMgQdPxvc2HGJES~0(&YmE75}P+I7bWo9-p+A>^vQhn=;#$QKc8^zlqW zQMy0?(FgbJhYnF3(nc)0tKW3`9&W-jXb)xY^gU`O`wyLBM*cL7uA2nLXJjZ-nc*N( z?82xtUl!(Eh3i}hkwl$Qlrp9+Q7&Xp?UxBcI~Zf@MSt-{x&bu+--lzs*sNyf?R&0Gm?g`P(d~`bc-N)dIGsHYj(O-0{g_|E@+q3^6W6g_JzfTIE02!+@5TXeLXb>;d zf1kpXv~N@QLRSts&Om}teg4)jd8HQUPf8D$hT~->Z5Kx0H>YpUC2L&A|A;)eC>r^n zFRX(}!h~B-pD#r#4TE}Q^+%uDti~VXWw4=F*zft*roMV$P!E!;0w`*3{E-V}KTyUi z!7_{phcV>pEZ;jZ?k2V9(gxYoNY=mk1e_0Bq4nUDe~^%`#V)6nwY}7+!@*Kpo{SoF zybPTy7@NuNVsuUg+jOkb{ZaiUh`H$_XTqLg*c6-yS*w z3@tbY_&q7VdGQ`bAR;Y&J0tz-O2*ezj*;jk>&z5#3iCX6;Zmcou}M0kxA5nX%k$Y- z=Uf8kyvCrEZ$mjKaa_8%oq2iomB63g;@6$7(PpxLQ|{4T{6ZoBr;4zsiX(b5W=sI^ z25@DD_B)OKs_PoQELzyt=#RSZ6O1e1(am@n*fBbM0>e7;g_SRyCC|RL0UHjhk)#M9ft>n<0R6&iRRW#=h0^ zO^EXVwU8)vk9Fy3ecXh1e)gLmwkDc6#G9+={zb1pE0Cu!KEhg(x)8vg>{e4bs-H$o zO8KLY&mnlL4JrAB5+~J&{g4WCWxh>86`eTmP+>|j)ibGS1M0q8OMPA}Jjb_)WTH_T zNNIQ~+%-?v`Zb;`Nt@qH@J)*dC>w?rsAUKy+UWdvx7QwG>&xe$#MuwSj@T+y$)QK9 zG>5=N7vHr|9$Xs3O|cYTO|m`&wiT3OX65uaOZOEi^sSrAc|w`kTTW=-^-df{U5;8! zXgbhoJ~+9Zk$vX|z$F=v@czM4!X{i2eFTo6@Z?UJ9X4?S-p`U{&WeV?G9ZwG^|Td5 zfR7|&O$c=Kh_w7tyY* z8`Ze*BCKI?R*%ryd3X@8Ja4l#OL2Az z&)4P{j5*7WyyQJHkr`bFUF?2jQJdn$?@&9Z=Mb~a1choJbx@lx(1R&)RazY@V0TqDq+e9BO1n4J>9xsXQTu&Oq?*UN zLx$nQjWc1|ch7AyTuKg$4<>OUk@Jlj?5%5&C*D`xDQ=nA_QZh`(Ewd|dB|msAGoh- zUKdJXArOb^Vp?ivi63M8WvAbD=`*Q;woc1bF2@EV$YXd2W6EgiBpn7(+!^-#HQk(N zna)&ZUb?yjzXcvTSCld9aeE}UXp0(ZWksnRl9?*Kla-&z4=SrV30#Ei@g7Rg>!%`Pq}dH6S;BE+jBD0)@T6a@+m2>`GW(E^HXoaPw3BuAfT|5ip|vWwxuS zQbur8C2d9`%?8fN15nu$Z?^WGdorrR&Qu+F6Mvl4_Y*n&4FW>7g0jH9c?OJgLlF8! zc+?N9U=SfJ-)tR~o2g8=?Kwc`@CvAf&0(PK+L9Q zc9&s=sMQb7At$5f$le8a9eb!FGx%1-k=wp2(y98I|#B?d{%eY*Swtx`8gdW&O7b);0LOxoPJv?|9E?ZZz&q?zfQrAIGibFaQtL zHHJ3ymTq{^Fh{RLHf>Mu9W)md_drXzR$%BXY=TB_4mmCs{7 zy4F@I>=ISZ@x<2rkhTGT`U)@OB_8Lj`(WO1R3_?EW;Y?()*{7h;6KMJx_>NJ7l#V{ zbDZJ#WGOh6+s)#0jh0dR?97N1EjG8FA>Z(44EnL`HvE(4yp&1hrkK4_E`sWsm8!lc zHR^5HOgZTBwxY8F$RWqi3`o9)RlYL>5a`{}^(zVc3 zBzK_Gr>nNeV#2Ii26zodJnLK(^7ZQJCGeyo!3yxCDF8wlU|o+qon@41)FWMto_7Kw zrhagyq2oa9hx*qR7j=|uuL~vH4@m$QrCR-mJDPBjqp+l)M@Us6Yuk;S@L7ALHmbE` zgc6x4RQH?iH%)aUr&B(3lC-ayts_xZeeecNG;e(5#!|SGC6mtPV!a!G0X`Z=kF8i$ zr>s&sy&=xW_8ZG+0H!J{FO|*AfN_7huZHD70^G7KWk;~GIO{8j0H^4EJr#@qax#7k zVxZZs`&^5Ba0nSaEHy=NUKI|{!~i4z5!>P9 zsO&ybsNKCrTPY0uZf+d3jt(jGW3e)avzs9#$?%z#@R^xkdz9q1A9aLWM<7VGS2HaW zksKLox?=!MgB$!GYR-!S^*8IQ$++amh2XIutmBPeuDwZp5oufFd1C?)81Ng&ky z`W)avF+!YCs=f=K9z{L7^c~9uH8l_3amKaBqN)Fo=^;#Jk8S*qx|a%-fB=tzV+5RF z)Cyw|D*H$?LaZoJ*-CJlqR+ZuiM@3djkD0Fo|D+&-m^+4oJ`Dy7C7W^mr9>P>TG}L zWn?tMSS%Obk3@rPkQ?sBuvOE;2!!3{m4OG#49dcTtwalb|6y_8q+>xzlzsNNbLZHt zi|{b|U^w5=YjS;6%?c-cwWeUf;hVNBS(KTGd+uFez!&xXbT&OcwZ>i#jp(O4@G;_< z-#upi^uD+A^6(O65VVZ@2@Ahdml+tZ)L&rD1QA=(p+Tz9`0OMosQ#q+H2ve-_uJWEOQSzH7&JC9xw;}Eta#)hr>cB)NXVMZ{ZQ$t0V~3=Pjq> zCo=J;cm79Kv9{m>$sLtnj;oDD*rkd&4d_fGbft_K2t;Tm%dAgsiMdhb&d<*Ecp9Ly zD2=F24|b(6oo<~=7KDtrVj`u~M4k@`{eY~x95iAEcMegi{;gr#=Dd9l91^J$Fj~%= z_}0|Nv7kC|zp3zK46l2}iNfNFsBVbLoO9R1n>Qz?UEGh4Kvij`jFm4!%$yi>Yto#! zPIVIrt=Ao2)8Sd=e^L1t#oL0hjAMWd$Y)d*!=IM@VMzGEy%Le9i9!@+pIK_3IMF1c zs!tg*_ne)$LgSI8&T31B8^5%+s+)aCKlB^2`IAP{S%Yr;)x|jhT`cfPd%enOzR-ki zlDpMXT4Z5su)V&W=A!?R$Cau_Gk)7u*l8J2YidpLzg0f&bwl*dk3L7ahSyNf1FVy* zJiE@fxvY~oSt7p7>#tm)4syD+)cXZS%h>E`i}QHYGA$Lcua~MhxHqbOPD1%;9zosA zD+>FbHZFK4Tksq!pr6UV_VZf>X!rg_Cij^o!2O^I#7zwd$$GAiShB>8Q``o~!Z-#| zq@&Y~x(|Woc0aGRJWTrw)R>#r?bnT+u3*q$k^PrK}{_FiBdg~}n6=_iz?IFJjh)~d^aSwk%>D#C!N`Np=+ zKqI>w?tiBmS6PqH1oxVB2S+NRW8K;1tem7QJmG`8=KI*!|4Q%>_uEfncs9cZ zUkk^`$8*a&M5_y>q24VTL6hLxP>;=$|F1{m$n91S*pkEE5M&|5gTt=t3y_!AXg~s= zP8m-!EEe3*k6-0YgZF|@Ku*T6bXGU7LV-1%B&=$0xpTbJtC(wKHa zI^rOdmIh^GbT-J2TQBys{?o%*17YJipYlH$Necc~XSA!q1TgoGC%6dJH}74HtZnA) zRA1FECd6Ad-PP3DXKmZ5+&s|hNiBZ!TC7o=IeN(%7fuU=wTfFu$dIpj?74md&R+xK zv#zJJtn!dHc6B|WHE|1<2kuud`j?=Q&g&J$1TV;)RMW==S+QCN)hxkdQk#v526AJ1 zTX2($jtzJ`865@IRV{Pa1o6|8G%P%Bp&0|>$k+lh#taKCq6(v^a5bVfXd%FWC5xJI zju&_PeMve7unJ?DlE15M4~<8&8jj^aW9>%%^rr^4T5u*Ff~Uq#y4qHM^qjz^1x@m`kVH}B5zupUfCWTz==Td(}(=0YR`f{@Sf z#4_j+hIix^F4tcO1`ZX{{oW))bJ0d9bI^g9GaMr3+o6@$GFVUsLBWf0!Nk$m=MkzE z<;SN~#`Mx$#0B{yqpn;=ci!vIKJkpIxwa7Dz=qa|jpQ2>8j`RMcE_u|sVvl^?OLk= zr)dCQkXTJjrXJBz=KgBoV17;toyMj9f_0t-+k)W`9Jp{#n|C^9hQ5X@^Dgvui)s> z8>0+*h}g5Q#j9fJQe_dAq^e2w9kI03 zt7AW95g3ho$QjOXT76)}DQ2_R%DK0 zo4w%9q_k;nym#Ib_qilExN}sGBWc?yVV3J2O3QoD)>GI7lKGlz#tN;JN{-ogxj#iV z&Ts^bRqv>7AFN;mIh!BG0bGFWjvz)2x&-l7=I=BQI92SxhzFvAUsN zp2)byy9%L)r2Cy)uw9~JI3N!JA)&M0F`|&2nK1N@&w;gXWjMg3!l1qD6>fHGJ=%%_ zyFy!6rbkrczSBh^IsFfeUS}|z!&3Ufd=R%BGw%`o)~V0!ZdEsK=-V0G$FK|%MHUto z1siTfRZWbr8oRijeENepsnHhV@>N9rUFwC&)ZGLlQ-o0e-CCr3ni$2i3|VoiUGQ%NXsN7gZ`$bZBZ(h`^C7`U!RYn9loR7k$l+;a47oWQU)8mu zFm>NHnR_nSfn6~%&W)@5ly1otcDtZjM_hbI*yzTgwjxAOEW$wIQ_T%}tM}9nkSa1m|MkX`ht?^C~8wWsK* zc~!s>dAF*Hs`DqVDzyeMQQ*+Up@tR0^q94?CB= zEH-;GFTk#2Hkhk!jA5gJedt}Zub+l9>7|GpV?A29g~gq^*8&zizWM*k0d(=fI!1#> zPaZ17#)&3>K^v0*Mqqk#_g@SOe5b`QP&-!V>3%pTT=>U%Z?D1!-g=jg4Y&lJy)$<8 zbVScgA*O9`iQ z%jkg1k4wgrv@ZjLPkmdQ&A;}+{#kLg{k03Kagwd>LpQ;%O0HH;2e;`Sx#*Gi%<!S8Lj7X@lkntQrJoc= zx3ki=f?LJJW>=0>>%Tasee^{>S6dX_AJErGOr^nI=GT^KTd zj5p-y_mWya+RoDpcYkNvJn&9W`yi&5Te{@|iv8FDKP9zS9Iw01YFh%SPyQg|d6mN{ z$;i!?%DD}Ejw@>a_e~e@c!8SdvCRH*O&K2XNOey11<#?21Xo>H}|``*LN5DcaGZpKHT*z5x?F&D|Ow87p5 zE17B#OP_c>vMaWCPLRNfW4?G~Q#F^q)a#~K%e4j^CRhiuQUAV(f6uUtE9BI#cZqfwGI(MOXX|Fe|Vp9xCe%X3s*T#34NDi*Cz~#+GgdppEghGEcGwfEO1_? zybVdmf0Qf!f_ZC|MqbENdaUVIU6vwe+J2>AI!hdq5Zp9J8joKw8SD0#seD9Z+9@+5 zt1lLwX-;Cl1D@@oJ3Q8t;AxQz@<1s9z26~WVB)bOHv8{-mH9#X3CO6C(YqJ$6j^&F zx?ZEd%(cSia72K8`{Gk=EpY4y#+3QaGH-)7c6 zSA*Ssyic*)rdO~G15OLi9^Z{UJ~aauWPIj}E7x&TEVEpDcRQ(S&yXA8$F*m1vy~?+ z?YFv5q9ZyGrjT~&YofiL05;>?44;~SGq~$Eay(-Q5co1&f5BO4BIq1>-y&!SEC*j& zT3c=z2wEvx^O|RQr{CTLC`!a2Mo=7WB|WC!B>b%#H*rvCiKVGGLSm*?cuyIhO2^`= z1zI3p8|3{Wc~a_VQ;_)Ayk9yX(cDFBg!$CW%;Wfhx`8UyENGn#N;Pdu?aI`y=daaYPqzr72Rf(CP46L z8mwa6hRt3DE}wJI&Z(3rVfkA$4tNh4#k~8=PLhg;bN&lTcN!v|nst&`o12mrEHCFs zgOKF;FN*^fi~)zftSL(UP#VOU=ddUC%@|`}-s3Otm;bQvy{e_ZnhTDOXB+3;A5LM{ zI7Df?yT)8x2-fC%7`b1LXJK4-o6PRimw{^iwz{j)(alFX~h zgBGJbJJK&2aMtfw-vO@5Fvl3U+v4Rt^LylfA=>eN0xoduw>{lKgx4|+BHQW<+D`~$qS@BBYlj}ET!>4%vSiKw>PUpG%;NK7d=+BxK zN4lD&nuRbwK3U6IQ|nXi*gG&u-D7$1-00C|Ftn5Q-3|!D&8)8$W%6z|$)B!K8nSEt z@bYxk*CXVHHdW2Wr};D=i{*u>`1IMw!I6Uh^voIuJ`#NH>y`Z`_ns#eOB5kMsfz0- zmUxw^#WqALj4P2Zr@gRJ_eQD1#{EJds?`~GbX@7cMqpPQjmAm z-#zAo1wm3OC^mI71VymiGPGGwy09MY%OHlo%iOa`Mnkvh1%5cm8wXuYh%~$IYZRMb zzSuZ&Xy^jAb8bzCIUFKdL_z6YUKW0^oZuVqRpeYaO zt}DLJkcVdp*yOy~Av(i86x(USSa>5*|E3=t_f_S8FjS}c@c4P!>)Y3O)5E2vlY zsnl8GBOcr*qH<^o<@@H(#4Ix1^HMr3?r%h9`78w)x}7&-xo+NMWGYcoKEXal6S-N} z#lrfV?c*z<+FF~F#W++qCr=2g3NtfaF(z77ig=z9%YD;Wo0zZvQ(pN&fqr?9;mA4r zPn9EcH3GX`=I{qj8H#&pgnWQCnkSG7TN#+ERUCgsQmr`xS*Sn?6=8f!$M7gf{_3aH zVVe7SeQK-Y@tc-Amqc5l9yW_q8?i48VCrti+;EJ;V75c#mg1BT@Rac44X)t&=YsZD zhZ@JY0CCHt%F34d+T~fN`sMBseMOHc=GDa!B?y>EGtAqccsBw^S3vsZk9>PKtBRN@y&422Zodb8U2fwCbK}#OB*D9XQcvmN8jF2wZJH;djU2A%@4<8Y``3kQvqp zt7ogzOBU%Km;FS7R%Qh}P>yi*ezdc;4*Q$Un2e&EdzBn(mv&fQHe#m4VlPX4JsdU% zPe!$Dcg#$!7YxH3@G*Z6eHFm8lp_mcxTcd!dDC~8aK5|7Xlciwyn)~Ni;tzY3g`uv9|m= zzztHUB=r^rbKeasEWF*A<$3l67u_$~&O`U7YAYHVVNS8wZQlMo zX2}94%QHN%vVN1iEQ0&y_fic`z^?i!oFA}gJ8Tv;)9nfnyDoajYf@J)A&+*`2*rd+ zd;g1Y*18uyB(zJuC;mb0>Ox#Z4i{Y3X$~8X1jAmk ziNDlMwH8%{eH$W8n`Y3AWhDv@6-=_$-Ew{rG4tHEH(bC=ykQ7PPP8ihK&NtwM-Hw67bwcbb5SD)?@TRbL9gpwQJh<(wCOS zSEc1r*&s^k#fPWA@-==dCs^qo~@U{Y+EwW^dlEm0PvqcFK(&pQei6cf3?BmRu}Dfy}`TNFpY=!53wJnb#D zOW&k2zdE-zoKMsBKwxE>P+HQp8=@utIt^2dy+cwVmKj{Vr0uif7?U;}E>pzy<(8Im zsbH^x>Z~`r+yeK2A!g22{-%@0Ih(4xxaWFsb~RWDjT7EXg?3=)uZg}R8afoD;qq4s z3se})`u+Nr4*7q7k{MHo9#~HD2w@$M-42<~b3VW>d7s z?3jyQg3PzzGhq5@?eEeTzuhi1*OtEgHJ{NG9vaOFMeMDS1O_=^GF(1gvDyG z8iB^_KC^rs>HaJ-C$%H{uj+nb#A%8&$B(G%Hw>xIopzT=>T4s-U&3$tAef@=dut?I z%5dc={|T=*e1diucx~33$uUEx)Oyz5FWasBzQIGIIpRZtQGFmo=EC40(cy)=(tK4d zQ_%d1Qyp@uN^@)xYLM*-*>70+k=>trRMx>=1Hje3n|u50YU%wt>Cz%C+~}_4P8PqW zrRZp=&d1spiMaN}`erdj)$kJ^I1D2bHk8@GD*U4l{DX!njKDEpBF@b`CFBX{)@#!z zHWuA6($kFRf5F|fO&911no5fUhHGrQl%V5Hc-pjA-5yPHkS=>bazAYss#C)l)n(2w zkfseMb37cdOaP(>zTiP9L~ z+&7yoYPfB4p##{?*`WL&>$-&hqth1`76D^7j?fhf`G*Z{96cyWN7&L$+f8;ddZuGR@$~)qu(KF_I_4HcRGTz zp8M-6$oOMm{-gt8*Zo(vgEsUPu?6j=O)qSOnZyz6MV5!jXKXGJ7@r>x0=2GS!CiX9 zDU>=fDci(50edat7)sPXue2tqgq*)K@^V>O7T%=c+c}!~YwpYVru?QTd5OES54zz$ zMten$c^I%)iU+`A4mjg(l~n83LWS36j^(~fXci%|1HE66En<(&1HtQS*G_mZcS#^# zkE{sQXd#i49Q z)I^y9L5Kvn`uf@r4KM@ha%Wv^JUQZ8q*FQsqOmJrp{bM8t>`_c`!lvc|7q-8&{}%^ z+EU+4_?lxL82rHf0MvpP=Hhjhz}YaSLd@Jx0uKg9Wbl_{P7ua@c#OO3LPIdo25Fp! z*>wW-*()9WK@Q!+!kd%eIA1?vJrkh^1W zwKRU&Nhq}~C#zG%;{9dEjlBS=)~dFhEb{+J)NVa9nW(+lK|XA__Uh8qieH?>(ofPD zeJx}?=|llN^nb05bq|;uJ7W4R8uo)rwevSvIIfxOUYN7-!$shGvfcz7r6JPKJnvwD zgK-P_ynsSK?FM~`XN3{mHMqK6?2XNkN2>LBz5kK^8vh0DdrmYCd8b@2*4cpVPCWw> za8`l$`-u;I?RGhPk07@~IN0^kFNB~;bMbb0-`oV@lJt}i#te|I@vm=y2^B|SB*c?o zHu%ouxn}m9^teacf1QFcEw!6#;EjE!Ta~*^8n{~9YqHW0ZV=-op8KwewQe@Pc_LZ1 z$w>AA^c#w08Lwq3l@79qEI#&S=>&dQEyXjySic@nghH{6uSFl-oMuq z2QM6d+@=-f)~^FI;Bq_K$h9>c9B$|>AaTo2Cn5880kYk2HJHP_A3beNZE0|`Q!6W( z*KkfW_OB=VSo#?A_`DREFy#M6US8VLbJBuCz2?LJbm3al<370*^*!I;@KNWmqySTe zlSSZ8k_v-G^1Po*YoNiQ-z zwKi3Lx9Hdf0Zy^)0s-awQs{_ULq2ScKDPuo)eDuudOv`aw$v?yp?mcl+Cydg4ey6k z%?us2vA8uE#yYGuW`OvD@!FUBPPpQyefDhU#FW@4yJ6(uF~R0H;r2*R-7i=q{(P;h-k zhDhjYvz$KVSNuJII!qS|uZ#2KNoSxt1h=MfmLb2k0L%MLWs6=!gI0!>r$xJ`#i=ly z@krwHD#UcRCiaCb{9+wwlS`|QtG9Wbxbkf4Cy!MNs2^#f|KC5i@|sF#s$`qkO@X_Z zj6~4l*zAnu(yTWJs8be9C0qU?Y4V!;v8!}MW`AU2y#fA;wUYwoYGnn^-1Ka*X6ak< zIN%`c4=O}Fa>`JKR{xcM#+9?b2N^YRh!Woq@X23uM7n|={=TV@Qz#AFo`ib*TAeL= zR7v#CzcNaNunG1oF%n`bh1|CMW555KXg_vnX6@}&o2L`ccN z0P!4e--+yie+z)dEJ^?3)SqmnPA7rT|1pZK=-r7_>tByiD6ZSakl(cbKNfy zRH7aS*QDu@Gz^lIWKnQfWNJqaS50%+-* z#q8dIe+PZ~z;k3G7m2~l<%^Y-9UJrsYUAie0v4=j8fEDb3z!U940yZHxo_-<9KTO^ z!twTe)Tp;DF63bhn?%D6l!^rcUQFZEcAnJTQZ74O4QBM-X>TTex|FYH(+!4Aq)D>P^AnHzTQr3a@VEImpH; z@PC&Vz|%tH2<#~b;kp6(lnp++Sp*IXXh5}-sn%73VMm41)+!0l0Fz@d-O1UaoO^Rg z@@K~D1He9l`tQ3NkWc0LG^8@*^M4Yq&KoP7%5#0$vIqTr&h{gR5%-g72wRqkRN~n{ z1_VyOX%?S!0`5}PZwl-uOuzP90aVm;AjKv znujCRKk7T4@F_t@aPu!J=4JDdLy!B3kRgP{pnGbE)E`fj1Gw7dkKAxt2K}wP?i<-A z@AFf_SUC{ahCic%)8}sGnXw2y=U&*noU2osis*&}zsqA1)Z_N;tT!WaVBeJ^nz5|{ zIRT8b4b+T$tT&tgoQ--y9OG@X6|W%DT>q4YNo2$rxv9Nyfu z6uY(5JrNE6x0V-c@T zoS@R!YDZ%rNk{j~Yh+FOVNt#{NE?6mL3~l0733;NsBP!MY|)Wj%CfUh#UiODt2&Wt zQ%~(Xi2r~>=R!4aCf`Dx(j1eaY*rxT=IL z5}B!|s_gzcENckpnJPmUNmPp>N}+ZJT9Lq7r(c?hp;G$0ZB^mRr$yzR)Q+^gnFdSv zRgUdm@Re>arMeY}|8m9Luhfc!O%m3tH0-@=rKJf@5gGg7gFDSbPkyrV%=ewS4|(Jy zWUn#YO_}kP@huIfOy{W@l?BkkU(L^ihnj>i2_x^>>yacK;qoj0LWkCdjU?Klq@tsb z!^?V;-}S6Y_)qEP-6jOXSe+SRKI!;h553MlkGr;Fdab(`o8YR!=$J zR_ol{d;S>wuOnm@_k#b=H2Px0aXaq_dBPXX(2tZVvrN{VnC~Y*uHR zFZ){u2Tvq(SeO$-yB+B{`_zT1>Akt{0BWPUswDO!CS`TtTimIPI(*}yKV;qh zEv<6}D9PRp$C$XT4~H+jF}ePd_1e2O)E&(S4pF_Kc~gll6(jWjtjYJ9-8!&t zM+4r!B(HHw{_KVcR*p^z-5Zy0b_{^+2Vqnr3xWtg?zaI>oa%uc08TNE>fTIrSvsXX ztaaFNA8R0-3erkUFi24)zlyij%VrTX#3ki?D@qrIYPQOuv-*z)7K%@EE{TT~x1n}0 zd$z&qM>wnbg#sxcVHed*VU$~jd=3k!7{^^n1>0550)&==TNh{m@s)_apE@LLn7adR zJisVlxs{i4{@&NrP}wG#b<(m%{3NjYY!?p90p7@jku5EO&rEQJuFxj!0HkE7oo2Ko zslo(XcZcUeE11X&hn7r1r5IsDDlrxF#x=e~Q$T6ge?>oDYzV%8p5Rfm;4hcg^bB+b1CyCehY4CoPJEFaoP#bOe&4Vd7Q$j0iD@u^vF;*cXF zrUIbagnc3-+db+$B-eN@TmQ+8p1Rh-2{2yVKm;(?y&5 z?jy)er9=Ml5eo3KLBP>k9h67HM!6*NmKx{31 z=xy^rN6HYEykT5MX`GCLVF%*7*K~EiP^s463;@$RzpOoZ>wukJ0(O|%*@?-r)S0c9 zigcuC6H!x1_`I%E%#CKn#?O|OYd)>(ct^w4>}+DI^?t*p?$<|f_(KJ zdmI`6C|kn zHXxbgPN=Df#SL+(cz<$GyGI4eOMry0t=waIp4+AsZiB{{br%wi%Ki#jHXT$QkP-rl zv>Ca?Lg1N?fZ64aIE2urrzy4=lTg2r*SeNI)s{fQ(J5*3{E$WhX2 zDkpWt5D}%~jJEV=b*aVX(~z|KEtO}r)RTmfskh7lvOG^>3Kbe(Yu5QA%Z_3o%QG|j zQVY%F;GmE&0oNcqljLR_x3_XU6ih1Ij6qZYI~;HSME148cWcrx1=F=$EU*)bqO1m$ z>y$nSeI2UTVVesj@@wHyIk22WI86Q`65pO`vAEmY<^vrf92fE%knBpyD$KT?%8BZ3SJN8F zXP2gj{L|j&bYTR_?2Y^0BXEqkaee-U08~$Pjixz48fiFqJE{`;--x|S3Ew9TY{)7GL*Q&>?ef&1}Z95^#n z#O$IegDv?^KtCiwep`!3vWA*h4XnllQb7*9AxV_O{Tz{&nhAMy%J9{vL4K&$f8sf( zS#s&-DPA>Cbe|OllY=6()L-}0?i+(;@-~KQ^ngK`xvGyG6!1cj%+ zl)gxw7#CHjRoV1iegJMmyK4GFV2peoNw_k@%mpMcXNGB@@r);vW&-;7p`~KoN1dzF zR2c{^c>|a?teF49XGf~4`+=&PU3pl*+*CfC#4!WmO)_%s!Bb^?;}-XCA(eRlf@;{V zTURS+?g|~ANJa>|70@5C5)fu|{>!BR{z~jW3&i*UYM?_WniEj;$M99} zG^Y_acyz&S`YR&&7+C2%Yc$XYWY5RxY6f--HTl5$bL*_XHKM-L%#Zzp6pjjL=>=h& zIX*X(D!xcvo|Vr%-Chbk2A6c%$+gd>CW6yVqJk1SksQg6jX1Rb1e{gS#~WrPXOP~O zwZycNL261f5Tj+r1!uuSbKX#89$Al~R08paXg#0mo{O!bgzFG=3; zla@qE?2oer-|3U;&K_KsTdwQ(nq&E3VY3U_X8!1DZs+{~)7s0*n@IG-Dhwd0&5)>o zZ~HkAc5O{xY*z_*M3;3*-J3X~UV32uSk@!zh5=s)87pFQt~H13ULsmCTv~U0T=xKj zB&jHp@Snkri5^E(lQcN&aZ#=$0@e#wz&e>-Fjep^2zWap2NTjizAO{sagyF~RpxzE)>}ve$D0a*j)|h6KhV0njtUfMk~2 zC3;wvI|c?s;o&T|^JS2ga=woF)(66$0Bf$>0_81~EcIkk-sgQ`#p@&wzH}ijKcli* z3nD%MXZ=Q?my`mhengT zLGL8EhM-q-qxNicrKL=d1}|h z09Lc)vFv~3k4z#>K_9UlOo0@HHNarp^_HJUa^Jo6q5383e{$a~u-3))Q^Jkh-&4&p zNK_TroA+PY;xTg@ya9!ekI z6PBS$6=e7sg$MoSFjF3t`F9Q$wt(9|s&gWf<@kW9P(k{}h^*Zj8aASBqXS?r*sZ>#dOdpU6*I`^&yHM# zv^1syqHHqU!Kl?8PL1WU*ADD`rIOj=hsZS=X z=gCMsL+nFeHypcgo&tBVUGPxy0;AYA^yUJl9B|jIeu@Eb`==e%!l1H_XT6!cSwTx9 zSkvyWFs9OWh*R5fj+d#hwivKFAQ+YavLUgI28cfA129$k-@K(2FS}gO6-xmI~YfH^H;zN4%FD#!6Eq*OIE5^*4EEA1)91w30TLSys zJhzOf5_}iP$#+EEZ*L{l{z3&Vu>t8lr#+IiRTx_GdmnNni+fO;Z4H8+N$$xOPawp- zwM4~^(7*@q-&yT+9fX4Zhtw%$jKGxgw-$<(r!M@ScW@d2wk#t6Y{la-hR^R%Ir-yG zKLwx9_=h&~z#BnZW^X>@w`ZuYe=D~z6kcpBCG1rCJq=d4|7(vg=wAfuUD}SqFSuZw z;5FFu1e>0AnpNHX>jNTN4m^7F=q?ji7y>(%MhuslZ<>!~Z(Rnt>6={wZHH}AP(!$a z!0};a!^Mb!<9J~kYTSsEj2a!LFgu*lS3gC}@iX7k6|Nb&+~ z_Q&1`c#z?}6bzpE+;uc*McUbz8RSmnuV}VAxK^psN-K3`bcJF||I>kv(b2 zg+qH#F!G0+WYn?_kELnJ4Ef`h4qjn2cQ*)|Oef5THfuZMDq$+K5*q_i1v3_{2g^Aj zPi>6WOw9Ki9>4K55J+J;yoKzj_GfY$u-L&>AloFo*@67afNDT$z|(^7!KWVK`%Vi% z6!o*@MZCvU{M?(rH5I7jp{7B=07Cx`9i3MVzGbVT)tVi17& z`}OCK3jg|KX4aT?dK7+*j_;?$Fl=ZFks-kT!zLBmsz_Y&O{`Bh?3IQmos2@25|@;wuL%j!^u^mni+P^edk=qUu(2|v1mKLvIM zb4u-mfh1(E7^e83rNV5c!T=nhaPk7!sy9?AM(tM!!9LB41fgU&rmNuCV^r|Y1bz2APrzMleH#YEIYLqT zK86z+u&`oYm17mts%BpxZ}1G#ei&9*py32wYyIK%d~h=sbH3HctdB)d{$C67FjXFP z0bAxW6*gTc!OpHyBSoNtI~aDecp8WDkM4!0j&hyQp7IphEn?pHy*EhckE#(X6&0LV zg9||?o3TwN2)CQn#Y;Q3tij4s#TPed$axAh``Y;+&``ENn6_U9s7&5N^gO5?jH{ir zM7F;gG##hBC6lSX` z+@7d$Kch#T4bP#xbKkm$p2|L}wHkx+SeG_nd%qqSsP6xm9m;=s=p`h_DlDad)|_$|hI&GF2B+bCq#^(be1|1ZEdPR!2XtU6jFF^6OZYGt+{Oz4Gbe4exT zKb)&zgZ{svk$QgQzupzMd>l%Cy#Z3G%Ft5qI_9sW9R---{CZ2rw}w(sY8tAULO}=^ zuHl}U8`2er|8l_yw8UCDcv9ziVVgq$2Hqlp6d5)Y+vK;9RayH#1xcu&8We;lS4ezt z917E)_dKp|>))ny{O!3nSwGMzT^Y_e51^O5ucK|4c*&F+9p?aYgr#QEmJKBimU}SE zO^nW+4?Lhl33Xed@#cW}Snq)~1lBr6H@|~a!{WaNKf;jKY^DNZ2TwmO-<0koQyC^g zPo$Z~$g}cCULa@fW(+%ITlVH>Fm0$jhJ{Guyocs4elZ|k;ex_`6FtTXLytB2vud?(JLJjQIhGo=C?~?2$#+(acf0FvL)ZoNjCx;ae1`x2fwdHB-UQcd%|E zH2a&sA082^M8oXOq$Q7){t7u>^VgmibAX`o>?4xy7qPiKyVsPi;fk>A^IJ9(&4271 z20P30fVLy$r9&Vm+iSM(4ii%|nf&Lp_D`|QBa!reU@(*0Z*t%-nec!`I*Q?lXyy~Y z(xAl9$ci)j1%4NPXfUI$wruJ=+4Dc;mx9({!ELR@VoY;F3iPEJyt}W3z)#W2q6^v5g_9j4Rd(VV7*6Iiu=lQ=<+uS8MzQSZ37r53UWRE6>XM2s@QSqfV>b=Nc5RP%-JfH z`{fLhh+8{PszcF%jPHw}wPzgQY+zNV8nJg-WpK6V-lI=No}#tDDcIGEti#DsK~?=?wixQaoI2SE3j$nnTyPe14!3dMQ}RUnZ;pCu%B zFuvjmW~LphxU;FbF`hP2oy&In$cQ+`xnJrz%(_Zn>d0#}-1q|%S~)?iX!a0El}nMw zJnn&Uw)B%9_xx5PUFdUxnkRvVTX|5S_|uAxP7nG@N_FJR=?L%$GNO-V_AM`=K}1{= zo4-&Nr3rRRW6-OMY7^zeT|JMTmTN(7lMjFo znbUjA$@X2~1zzVb%c>vwFj;2ky{!U4ATrDS^f{cI9{1H321F1}Ftey}o$SQBt(m+Z z<`k+DhF{TV83xp(%ZC71XfRa4b4+Hh4s_TSSqM2l%Lg#D$@_*~CgrP@z?s+XC)O)r zh~9ukKw>NTO_ppEQ+*vb5t7+1!U_OUBl{NiV24vqPwrxhuW$wUTk3~S9uZF-}q>c z2+YU;@x2}SxWG~_hm!mHmzL*_n{WB0;rYysosDI351Ok)nauPW zL!rkv#l6gb;7xGmM?eNDATyB_F1F5MHHWNcOWDjhVIEH&-kK8{l-bo)K!T{&!k2DzZ=e za=|x{zxv1`$ewWBGnlbc`y^b~t7s79?&zy2yvzIhGN1y@CB3iXDBOfz@gY>?%#5bS%n2*j8eksLZ>flKT4-E zcbY&>A{gIFAn5+={N{Z)xlj8mb?YITMj#{_f@>2_D}rdq<={Q3Wt(kHyB;rbn9a&> zu%Q(I-Sio~w-IbEU;){vrMx~62rlQ@T>cu0X-G0)0x!rd8`C(@=lm{qz72{|`PNW~ zB0Kc;C!+T3bHDg9%shCD3*!Lg=ud=RkF{XeOJFcTkR=a3dTM{Vdc#ys`C)380w1BR zI5wB3_nM}JJ$p8a7QuocF&SSU|C4D}E~kR6cMK@xui8a1>L&CjB}Q$OTV{gs_3lr2 z-nZF-UbvFlCI*M?`hFF(Ui*991_gT|91QltIxW^lM#kk-9>#}HIslDzzWBnbxdt@r zO}Am^y=kCH+1o(u^tB$fqhkbov4R#NujNzFumT+Jb^5iK4XutJN0|roeFgA^Nj<$^ zK(hfKdWQ!t7-|O7`Z5erNcbThHtJL8llvZbahUlfwMuVv<_?QL!OdXYOoJzh?nlRJ z@Wrq#3wABriIGRlcRY2m0Q2AZm&_UZpw0Q}SlY+hmIB(|pB2fSSTO3rm#`9axj3w* zQKc@vXOTL!zY;-0lgHaLZK_S4d8I($ASBnV^ z{-4ueHm+7=P{hy=Y4^qV4n8Qry&M4zRD3bM;ew100-0q*6U? z5G(V%B4p~)cMZ!zZH+p<;26k>SRSMZHgQ|Z6^9gfJBT@usekUs15Z#b5Epq?rbL=b zYqcU2Mx)R2GMIyoBu~py!gl|%@PY-<)Fc?bC5_2Wj{s(h)Kr1DV~cX)|Mmk8$#Pup z?IX7DPRSifzTUG|Actqs=qxAo-YyjcEWRl#A6DF}1G3ShRwS_A6UOp0boDhHVHY#3 zKu6wd&;Mqv>!g6OI`~(krIGVjo|<~JbCc7AKjJjZ+&2zVj|rn`a7PDaF|r3poZ2z zUpTuK+RAz=^3wqPnMyCX;Nk z-S@<8kl@?oq%5rM$b5CfX2Wv? zuLAb8{0~`E-M;)F%h2lYmHb~W0!q*q08jb(W15n^?c^JKzt6}WBrmdV3~CYFXYdJ_ zGEH`Er%D!=rpqG!t;5<$ zoqHcmPp^DnkrIY*9 zH5z=>CN5kkTE>D+)C$<>2crr>2k|jLNU6Fh0!8lpPt3HHOwhf>J)otJNMFtBb?J>h z9h@s@?_@muyCV!8az7tV?HAB!c&PfQdbXRH#sYBMqg)o)dKGBf!oq2i;x~H6Z|n7u z4W$kaLDahgNcrb~m(`Z7>rt%?bFBa%lfzk2pIQYe|FY}7K8`pnnL5e!DYb(8l?0FT zIr1?*zn8-^FMiX=N!PJZ&`>u@lz8*r!P_NsA8~3awx%0O!$l8LsZqqIQ?MzQh0t@R zT&%%U>gNdzrdaV{CSFRS{Of+Erj3~hL1vP8C7TK)Pqg>$u!56dVw6%M(CWUkM9(^K zOh&|5|6U>GI(2IQ6fjXJd8*(Ehm{|dR^9@c_!INb?=`hNQry5z!6j(UxAflrbpCRn z3$6$OIqlt-;NNYM$f8wT&Trb4G<@}U!@+Dw9>M!W6ofa0kOG%JLQ0uR2qm%#b|mSp zUyFj`@3KTS#AqLr4!VI#X&bX+{qTI)85L}(?$r3%vOgwXD*~L=@>DSvcd1J%&U`0K zt^X{*e@_94GE$I*(BP*4`Hcq4ph4x^5O(93YVV(#+FG&+qh-uk(C#-Ex61pY*Nw5@ z;#tJ0^-mv&hLNzn#KR6V3f{_Q!o!RE0|0gcvc&XdhU1*W0KjNy+2Wl4j%gb4W`3)f zL#R*#9Y%653_2V4MFykZz|DE|WP)A#HR@1&8zMFzHi~Oc+b$FcRIF zF7A!L_Q9q&Oi@NSt{C;|n_n$5cxW%czl^_f(fCaOgU*4}BtQ}&v2>(Sq#T7Xf)OabBsFGFvAoH}40h@1*u z9GGhk{rRv*4*N$Ssjx{|Q|~SQ_~30HW)eBF!ub6#Rh5;=Cbk8=5>vas?P(|A_2=Gg z%;z~mgYF`Lc}zND-+L50nkI*ZR>D(cC^sU8eFTL2RayPz#9s;&LGlcP1r&>I+95YA zXB-D&e;kSZa}B@DdT_Rt0{n$bB!cHr^yB(B?FmM|Sa`Dao4T66@lZOcJHLIhHL%YTq$lb)Ad zns)@rUb?tZLl)7BhdOZf+WT`NW_X!x5x$#(-=5x|4(2aJi8geuTjhV%9@7Jg6U+oa zi!>}w@2~lp5Z>X4jI$*-<;?E8nbJ*lpQj)8v?*%;6-swlU&avjB>0n(Iy~P8vGaE+ z7V$08VqPI4ZpJ?Pc1iPd&9_fcTpPnOMlnjqElh6_h?ok^o0A2swV-J+;eB47S9)zeo1&nL(oSno8A_q#_nbJd3LVD$LG_OeI+7w+_g4jwq^7^4RHoVz44xx~k^a^J zRURJ9w7v;Rcm#B&-ygY;^)I6jjfx0fwji}}(~w>3D>{fk8Y%lOsy9?F{n3-_a8L-N z0kUPpQmoMs8=&(l0NYmuX;rY$bQrBu*b8#lOzF9xHbA)8bsxRnem!EoP&_by6QOUy zUC*AU%L8}C?Z4faS5JDz#Y{=D`M!E%E4`h+3GsVaT>K!KT=xMgV!yaP_VMLEPwC*# zQQVH<3Pp06pK5y{IlJZOs!p5u?;03YWB`Q#cG;cCQIJc^E)r|V$)v&134`?4+1q>@ z5+2VZi24a`uo0t*?6gqg>B5M#7HJPHk{eSA{#7jC1scqvC`8Yju|H>DWC@QG!bw!s z``ytiz;77g48H4yXhwb?`GvA%N-o-eM}8ky*%+6|q(#2WSYX$*5i?mDAQGzpFvf?R zNv3CW>03Qy26?9gG@F8(s1U-AF@JLRO146|-&4l9D;pDvjtA+~0&%X8F5&A`V*8HA zmt5qb!{lrF-5{P~Ea2mkVsn8|UFDDGiN23&7>h2Hg?AhYWGz_u{0v{R_30*}+{0U5 z=Qm@`xrrai943B}8;B0`3XmD*G5r&4@Z_Pro?4;9CA6LPLS3nu7-G?dt@-UO@FvAe zT!2dhu;(y!2Pzs}4uo2mc~v>vi!=`DT49`9IsqhS-%1RDq|%y>@Yj-XlDOCg>JQF^ zTok4TM4%`F%lCYk9!h6G+o`t2Lvm^3uz>o0VWln`YL6dko;?RhyGiayw1{OX{8?p*UQ+)zhZu*(K6UFfNKk2H$Kg}vqvQXty(|A}`q<(FD3k(%wpB`eEK=k=BQ~Oh zx=;ZrS`?0TVF@ash)5QfY9lJkm-XQj6w3*sR6(n?7(zgkK#NZ!dQcyrVF`ppMJsBK zHi$fS2)sMde1rW1`cvm8NG3D)-nny^&zNWspyUJRNI1J zl9oqUVZtdc^tKYm&qQ2~H=_gnER+a@=4}ty@~OsQHF=G(2(mBGD+PgB7EJ!<)X)M@uOC!vT1BJT+eULgTm3gClXLasbv%aXB zRbPMxX(K4?IrzHGw~Yc7S1{>z6bi3q#`c;;iG-FtXnLDkY{rgmWL4|@jS{5;MuU_~ zUFg!szh)^5oTBM?Cw_jD+KEHyY zn|*Q-Wv+4hNPWNc^L~Z0RHjln1IF~;;n(M|e%Z&NG4)0zFR=h~KtMG5lRK+WyVI@V zx$|;aN=nFU(GFtJPWs~3^Xa2J;~%11NiQ{Iid7&ET+hZFX+z zfyAbJyqHwq6QOA=LA2Kj>Zd=b+b;8rAvJA2-o|zVzk5Pu+ytKm&_Ko#Nl~BCdafJv zXc#CtYm;E(=N0&T-kb$fYYh9DS&c>A1W}fFuGBSh`xM6$S`O8NYdh1b1#reEVnxNN z;{7={_6D?ON%pS5dAq(bhxEULvWL`8y-K}3V`msc)h%w34T$Y7;-A~6vw%18T$22 zDjb<#D1MP$%`Uz;bLSx_v+UpCWPNqj=%-g4Lez@$b+;77-m^T!1GN5V!*sHbF_~kc zsTZ@9Azqy_@9r=&Zaq=Nq>Qy6Ayk*Y2|nVG_^Q(D(N=I$aLG97VQCCl1w>tc*NfQQ zJT3h7Nt>~aHm=Ld7E5)*o4!b`-0|eOj{jV&5Sg-i_J#>#wa+hh8k``?!STGzR!l#w zsvCGR+G#SDJ9^@*bf7;Pkgc(?sLaOIZr80ZXhn$`g-`m=xc+`Fvu$h(;Gu7uKB?;Q zX1ux=Z*@7oBei>Zm2aek^DM&r!5Ik8PDlLD(IaCv^@cchwQ#BDW=$&>MC?E{{Ja8h z&YllTyIN*$`{*Fi7(uW05oSDeR9*ZHS2+e2+E9bzD`x}=3jDls<13bUWh8DXYMXM@ zph?7Q?8Fk%+v<3Z)7@3dlCT25s_^(dM`lG=;Z&wgnxuW*tm9AQJ>^G<%v+{3mqafnt_BKcw**V`hv~=7qm6@=U?yxt1g^)BHdNHtFdKcQI@JR>0c?sxw~%0HTlO0 zo`|=kgw>WnBz6HAhY^5oqNU)YI4*Q9N5(RHFt|L)omLgU;=>YQbAowmf#k?c#%M<; z85W=vY!T!Oxg2=i<&FpgOn@E*gB4`viXqoETOaBAxkUe{xt`uFm|Z258KLNK|2SMs z>GNjx^!Dj{DgnTrPp+v3t_4A|EDY>s3zG*LoRBgNZ(Lz4=`X@(!CogkU<(EW=n};i zh}q~E#%Oc2#>Xf1EgTyW!f`bqL3ZkhfZ0k*BtI)?tKe~eF?5m5#SXJ?Er2AMN>(BF zellF!T`jU) z_4LywsBtehOyI!=&wXzl+3QOz0$g`VwyHcGcq>(BBKs_fYr}4DBbBm`kNGDg&guxO zE7}e>l%r|~_WuJ%2+Byas#%8lI}T-ODP20!Q5lBpGe=bwZKiD7P}0fZQY9=7K$;AS z`Y^;Y)<|}7T`h{1I51#a*anjHt;Mk@TA?qn!4^`F zHVvAflxh%%DXC_%E_nMqLf0=%?I_6QSeRR&l%d~dgdg%WoHj~V%`NuJqt>^9`clRl1wOAfu}|BSdV#b)w>9N14s2Px;idEc7~Lx$gC3uLLK| zJRK4R>&x-6W+k>e!)jUkjSf|gF%cy7r&3U43A_sMU1O%>ov6v=he}75RD6P#_QL#P zfx%=T4qQeFC!<;z9R+?;2bQ|h4J9|}g2J^bxnT$-#jo?hXs}axM#q;*dqj0S5iQBC z#+g+Xxsq~QtN_*_^M(`L8hG2%QGV}L>q`=z#Nw3!T|^q3%p-GAW=9C4P%8^G34C_o zLWD3&(OovnFdfq#Q*6)2noljFQDi+I7|G3ncmLsMmQHmP6uVL^G@nGncyAkV9MA~F z{BCPT$28Y(Zx@>qxd#%bhaRFGBzx@9_vi)mj_M~J`F_{SMJ5_KH{gLVLvhC1NPq(- z;4zc{#)I;N$vz|X-X=Xh_dU+@+S6Fxox_fX@z7kHVxVNddBa0rl>{%N$R-$yf@q1w zB2v6ec%B>3L}wh#Z;MQRxNr^g7MK=AxA+p-r)NK&uf!EVzgf{z*DF)aU+$57Bg|Bs zng5YtDxw{42*L}n7Vz38{}7o-|*8efjIuo{yz5Cul5zizK#4b((Kfi!gn!IUcQ2QK^l&R+`!B zn9)j-ZjZAmR0wtsC?Ef?NFuqxTQ1$L3JzE<%xHDg-^!rxOjPP6aG1^I)}(Rezux8# zh%d&jgD`*`YXkNmXl$L8bd$iOYNY@1s)=c9@BA-_rVU9q_DaOa7)r>884J1n?C-Z- z%8?zbjR&W(Yd(oOp=6vwpzxxNz4g0`2ujkMa7wc(rQS1JYW+)m2+18W4V!Zm$q#yT zEL%6wx%c)5uiU~5HVRpXlW+MQ3o>#PN5 z8eh*;v7Cc97-{Xp`3a&iz|PFv9?9VDJ2G&nhB{F*J|Zj5zW4Cj(2A>(mgjZPQXmK_ z>K}_EMS+TNECHvnO1n;^R$X{{eJp?C;HQP7$GP6Oe9Fazx;w0zjy1L`h6Z25^0!2d z|C9VFZ3$kmNo`-ZlhMZF&wbl52a}ox9z>n=FGBcG+vE>Q_WpTHy?BjX2zYpzlo0+{ z4!77CzlOh-VjyHv^L_Cb5ivBORWHP})jE$}l->%_Or|q0|9wf^x%OAuth2_Proxy_logo_v3 \ No newline at end of file diff --git a/img/logos/OAuth2_Proxy_icon.png b/img/logos/OAuth2_Proxy_icon.png new file mode 100644 index 0000000000000000000000000000000000000000..720f4ce367043774a480fc634d9cafb6dc499c4b GIT binary patch literal 47842 zcmeFZcRbba`v?BA6CpEMZAC^T)v-&Gke#hzXJs5CoT7xHcO`olb|lm3!g)(u@DHo!MRRWikv@q2(D}bo^+S+-i1vAPWB-&{Vz;~SK&tralN!sr&L~E3m!AM7qjq`35^n9`NKf54-AcQ1w0RaJ19t3y%xo?>jZ|k2Q zj&;(<8^~n`HiNp4*yy$egs++f*G??=tSZY26=y4^6*lU-F++!pd_lPyl<2Rw5-3z{m}_8B_B^As^6t{6 z_vxa?yAXu)FyQIq;MKAxem=6}c!uS{<77b9%h;ZN0mu#!E!gE$<4=3`3 zE)#>OwZ-`=h!z&H_U%6te{KEkDFp=C5Qpta58qBNm%-2E3d=j6Q>ME^1zYl>;5)ji zk^Z@_!VvewpZNNjM(dbD;})^ug-JRjK^`4^WX<}cEP}58$U~UUg>DjESo*MPJr^gE zP_eLY^NQ)$&Sy8x6Wke)%laTaSC&a<(zRS9J@rx9%QN4e zG9x4I;H~>C%{2T9t|Mf>+pqQx;Y<;nB$z;rzrA|R<+zHvdLiRBMrHq~|`_AgoT;x;DEK5TX-!6pU zh<-L|ueJ~s3c=g6tJUirzzv%*aUx4-jJbNccNQ5O1qGp>d{W_4LXBkI&pwk92H98H zZzWcZqFE3hbZSDhlTe9hgK5E8MCyzX+X$zW1XAn-)a@KT^nWHQP<57PNXvl z-6knR1eb=1+__2w54|N%hdTwR#{~%rg;$&NwtD9=s~wPLdAoCj4rdCs#0jzX(|vq| zh$8+c0T1&`>KNqC0UQe=imLGu)yd=DiispWV$0RYfKZS4u;4BWKG=zHer24;=u?|_0M#_I^l1+3f$ko3cA1~EHy+XDBTse% zhleuq^K=;u=rVfP?U-4y8N1hNzkq|VyqT4YaE-I*C_25X#N7)yZ|X~^4ZR@p%!f_RLgoqE@R4ZtRvJ0!%GNZcudsHKCQ_=uj6r;!!2T02w?#22Yxen&*WGsR zPxqF&|B%?ih}W6=k%cWK(SDi=YmaliKKVSTyq~V|IzYkh!2zr4Tl*I~Et&-i*?MBL z-8$NUH`f{duh_#G4f!bzcXT_1Du--%8fl_Ck?4b9bHSrCE>ibacFpK~kRGVD+Vw5g zEF}*CN&Pj>o3F+>bSZjQi@uZ%C*s7F&6K~;6t?ky*6t9 zQDrZC?A+eYA%$z}Q4ys}EjFcT3ybuKs5VTlcsPI4l1=dJtW&Mjqjq0X&Yp=t!S}Yz zf4Xl8i1_f1((1eDa1j9BMun^hO1UYW&&Po9nTUn%8wE(l@EC8e{f;7AC2Mc~J`Ea# z#%%CD8j6=a8~sxcOFHZ}-f2FZPyDh1kYTn&sIX!M`l55ir@4yE}xF+E+|yx*ajn=lo1U)WljCND6hM ziMvNJ$WJtgzr6fIuj6wY{zvkYjUV(3!HVCXI_U1uk4~DeV;#a?2piR6V^ed7iHCCY z^SZK*p1MD$^z@0y#~7}(7YeF6*l-H+3lgfD+<{xe{9N;D8h(%)=1b47a;TZYs-?8z zR4u|Y5xbo?_OA!7_t=@{?7zdZj}0Pfpw5ra3@MN9&(iq0M!Y^SmlV3reBcFohaeBD zQFaU@YIqwpsPdPlTPWdv9-DCq&gbj$*69-Y+{RqECb&yY4yFH~I5p^OWJa*9tsk!S zOVop7btZo~)FfcY2e!sMGAp6fn6r>_-W7ge@Hd&a(i#v%p6>Hu$tVe*8`Mz1sKr{p zxfgm(rb+`iE&|UZ317n~p03Py>Z9`QllsE8`EKV>cc?V$FdgYIz&3Sv+h;8C7SHDo z79VCUd2vb*D!A#^t52O|1eMl7C2Kc&;FgEPfZ5!ImCsp8!Da({kgQ!@_Dr>>PM#d4 ztvJaJehN8^kkCNRcJP*XN(*a5u-gr!QX5LR$0m(zBa43gqcnFi8=aaW@RLyU+G4<~ zIi)Q7t@`VGen`%#?=1Cy%Wg829J<4j@eBm*)D550wWmEW>HgXTSx8J0DcIfUNICkR z+B_&gk8=kg$a;GT-^n`~rD%%50F8-DNV)>Bn+l46#P)tgO0mv-cPRsbm45ZsoaSob zeG!ChKa3q|ukL?jD%YLw$uAv|N#5B{M>;@v=f#lbD!HE#SH)e;K)|D!;|^bWE=A5s zk)01W^zfN~{Af)kc?uItw~2X=MJ6=Co|2H9BZZPoB$G-@oJ2|vIKG3h~_Q`(2 zMB}MMl+&N!XY)rPzH133?vhN*UwoUfahlqS?9=tq^%iVYt?2sXqBrd(SiZCIIB3S7 z>zrYUCzo-QkCYzFzof=q1q;hv0P48jS}8DaZUQ8(pS z-Zs6)_tWk3vbT1- zfHb%i1!;B&A}V0*L(*#x$Y;w3G0fTYY9CODv}41}Xy`Bi`$__#D}Ds^J7 zN6^VVxGG5(q)iApfmB$t71r zv$uvn9Ek)EUpj9rIXB(&)BHg;J(9}jjY}GP>|4N!nVExt^Er4oVhFxYs(kG}Y>@iR zyvy^O^)(DaVDWORvX{Q%n0mgK<^||N3uzpOGAdbJ-meI(4C)!xb$-A*@tNP*bo^M}>C!S&8w@C_1AZA+Wo zF+hhij`J-$c87Avgn}qTtwMUZ$Gt4Oy3XkH4Sm1CUkFmgRgZm&$Kpi6Og?JnW|m$z zU|0yHz7kGJeK{?X!2*b2lMX1vI{}sjz;u61NaU_LlF7p%~`oIbqe)YCVSHSN#c2FAU6U~!|shqXGP z^0TU4%YUn{@4-z0L<%2@KCOv)`}y&~d}tl$Smi0Uo)9vvBHeFm8C&(kHHI03hYfF> zZ=i~3%6ofp&pDKaF;<2VL_XRG8xYM7%L{1jE*Ep0H;1l37>Qb6fOC*8O{S}4$;3QS zn7cVKq4a)*cv(dTj-aOBdoLN+C3l?+>hD4ZVWXQmn8d08fx3aRr*w$jL}^N*(3}I} z4gug@c53IK(_!ecXq@jz%;Baz7D+e;V})R|<*SZPXIQT`>2wBI{Nnzh4tWB(;z{jki|V3k`79WdhoEOOti+4X&jFyQTiVWuW^6jkrf=M#1IKcO>m(2C_zBWRs@b;DCA9mqtDzYy`YHcSqCaYMo^>m= z3&418>z6K0zc&hah=duM_#u#yY{|>|FBL zMd%S+%$4OK3F=ujnH|Kt_vK~F{_!1F`sG#}U7p$`*y{cX*)kKY-IX=-j4)kd2LHxC z^hT&?7i`!QP6odSZ4QnTEm-w~!r{>T8EB*j7%UGBvMHAg#C~O@STg6+TQBj{(05u| z-4taT6e~Dm`q$_#h`*#|?5IdRA5=bPkR)?JkyYD8hF=IAUHx8t;kWOS` zWChTKAS7f;GvK&>6(4;OK`uTz@X9ph{Cr4Kqa$4)6dIkz#%?F?(%2+7>~wu;cKbod&hsN7q~vD#ba(!ISY7l^?A%RIh5Up3^0D8*xbBGeb|SYBxJ%27Ze}rxgWmp0s%eKo z=dY#t<~pHW4=jT>#_ond+$fNkaVa?(#c8_S6m!5+aTR*~tB?uivW^a2eatcdQT#xY!My@PCOCDvE{XlT3Ou{aE@%2x1mcpcSgCa{7r1ghnWDtU=N^ z^KgHj?tHyVo!GCJN23&)FtV;1*pV-cQTU;g9GR#AZ9N3o(XR&*3Vwz9(F_>V8nQr7FH{=>%oBXdNml~GE6Y#ZLL?K7~a3dB>J>OvgL5_Q0@_b7BZYE6G52|Hv!{n+)DxJ{Q*nt}uvL_0QGNUIiTGXGx6fmHG8-Y_U2KQD4mUCu>{(JmUCD$h zChbl^W6B$!2=;#=dpwNl&D+MZ>;bTSYWm%z=hEV1>v}~#N+V+?=H`VFm9n}ocCP~g z{vR)xo6Tq%%vO8UDmG!zxwWV~?1d zW4kttd5&6EVBA{vS?oI~LEOI|of6r&aYMh}1}5o2M4htS>?aRuw}SkyFo!foLOg=D z3HSkl0tdYpziWFgC}kjW8DB-X_jxub#xcRR@>d`ev0wGI4XgokU8xbgm_iT<)Pu#+ zkWUeZj~i2URjT(}oMjl4C+ofOvu^LTrC?EE0 zh+iZPhYW@lfhP8`+FJ+n6*!pAkqUSps%M3h3Fm-qX9>wuOmLNiL>qiJ;W_GYb<>h{ zXg@eGNf1<$a{fN8P4rFyjDLa%mU}d+&u`WA9`@p+G&12JbSc;dDL(r=0T!eOpyS@~ z_VRJlz}j=y!3O&0^=prKhPrpVmqImc{TgWaTn=x?M16FBH73Hn-zP$pt8%zwJJN*} z@c@T9{jY{P`p_`LVk_>+mWlC6Y22_eW`LDTxRDLL$uDxtmE-7;GBLB6k&HbnPzi%e zTH&9%YTxk;_!UfCYq_SBf&^ZAh4FdbxS^M}iH<)H8p2df-WLU>5X;8L#xF>#0Lj2x zC-;QhBF{u+oi2{;GhE-GnARi@sIUPdF3v7azg8!KF*KED{>&qUyn zAZFgMx-~d`{ywBTH4A7CIvDT}=Nh8739L2k2uIlD{tb-n90$S{-zlD!%n95`+ND;2-OG``7avr}3_eq)t>-}rC zI@{d8t#nj*bS>-7CuMn`giF|~Pu@ne9I5kN01Z5;fOh&|CsiV9Oo>`n`2l>_@|g^S zHDHpzv1iS)?ooC)OdAnh^CM?wh8b5kr?kFYuohtJyZsivHwqZn4o{!!jAA$o81FP- zBuAX^N|D+2$w~v`T8e6 zsj58NquwxD$|L^gE}Ub})%YnJY~4enF`PhaZS#(?EAiGgukRpcLdC8C<;=|A#DAka zFbZAi@o*K{8yZ+Ab+B0%j@$Kr!}nqFOn`AM+t9TS;pF*?Cs@}pGpqlW-v8gy!XO5x z?q|`_Y#pqeyc+~|y$$(oK~uToh!GCO!J}wdndHys1lM=yG52@Y(HJIj`nFw3hni?* zHgJ9<&I}=W;Q_Wf)Q1VZpDq3^T*SgYf1qB(RP z8E<>Gu2*y}I-KmO4{FhWuX?qpn-Ps(ONL7)YE50w1m8K5z5Y@_6{{|>s#>aQ@5B17yW zydFtlbw}z??PXV;fMy?p{1Tt2b;i)L(=QAMjfjHx#`}R8cc3ZrqeZF7&yHY`_nA$2 z&rl8Q4mfpyx4sYLoz&G4+(ttcs?9_G5peO-9D6rN{^-)dv>(X*;yyDEEckG)}6KPXqgoyDe>He2?+xq{x|^#{k4e2F<+h9tE}wPzA+Bn(YS{ zyIpd_b2_&%Sc4g0QJ;PrWdK8DbCoxs7!-OqTDA z`b0++Zz|Kip!v4P^l;E)^koYFy_c;E zIYz;Q(M4KenYo`~mMp`6s=_X=lA%Z(`B&q}w=DlD7E$=#saJZN_~_ZhnE|O8m!AzT zzb=#Xz5>AAV-)S{JAzIaKp;U9GM%QXU;N!0I!$pemN>&x{VX4DJH>8$$PJIy?IEFX z?^K6cSKf9er!{7id{c*{_jGKJ5qZuyiB8%QtOGOT`NTgDJJh!e*;^lDJfx$6HH-@q zqn1pZwp@A!`a&iki=LA5pvu`&Q{hZ-#O8hrD^VL>%U}}qcX}|F=d+=BvwNHMdq(@i zKrwHa$ud@4QUm)G&b@&KyhZZEy~`vqR3pcSEGC+2fDJ8@o?KQe&3yv12EkKQZ`-uT z&!?Ope)Mdr>g#Z7{tlwHHaU2Zdi@F;EF|prIuIA@`U4qce1D2Jft}xPLsA76=&y@DAlls!DrREX{mEzX|B< zJLdH?SZ3VXt-td)I()<@*9;)h?q5v}05>_kfO;6gGP_B3vI(zaV8;r*j~<~Dy=yg( zu(!NH(f@qtrJa;s<)l+tzT^f``vD=<=AjDtjOy~8yaqTWA}=NN%8S~xsls)U_jE|m z^a_3}VpQPmBfFPfc@BIG*V4*LEqFu?P~9n$*%wasv4Pf+(NJF^*|?|M&3nuQXzbHI zadp``r-pVp6l*yDYi#WOg|FrdK8q(GxctgFqgS32i-w6`aM#+L(-)9qxm9+mW-0L! zw%T2_r?F1jG!VobBAEU9`Mwcj82xy4BFrSdG%>RqI551N z_u1F~b<-OdP$P$#m~~V?jU@n*t6da(%H-X{1JusnBJiDp*7yWTE+TtTi zt{$W9f=ncpOJ6FP@YnnS=AD3k0oVyCQ1t|^A8T$$2~pS`)a@?UVq z)to1-uf(XnkZ^M#!83u>D{xXh?{cu2csh3c8W2FRdv`t1&5H|TH^U$MHkj(qclILb z^ZQn#cB=+wcSz1X+n7Pzzo#Uq)+`Wx>K?w=MK4>e35;YNL2?UPbE~3H;*drus9@V3 z>3?>WKL?#5^Vj}o{~lh~2cw7)ptnua;7;;ryOgv1xjvYY0JtQLqgYbvhdKdX z^vE>F-RkeW1%3+WYRCUp^l>bdbC=BC#*wV6F8TJ0pAx8mJBW$N z{?nDIqfs;45_DSeuK)J`8ltdMIg=-x+-Vd8-VbnBaYC8rw}a5;y;R@jIaijLDG%eC z?28`@3OWNWbD{w&A$ia7z$ZVWfU+Y{u6kEkFA;U1?bui7ltA=Ap^p1G&{^C-bKwnn zufa-8j1V4ZuLYIT{t48nzJ%>Qfg6gXzjAd?CPv=myNP`5xTZti9l5>iyC~Z{xBx`> zH5X2mSQ8u`+~=v5mtQbGQQ>j>pV+AjE~U@MbALhxInzJeXoWslEgmZ^%+D*! zIvSGrvt9HN^ErJ3Xja^>)N%?TQU-R83^|vu68YnXRl9E`uUrVrjA86dC8U1Wv`id- z?f+4;$Mi#w5gZtrvizL~dxyK_PI@$}8|lu}@2E!Gq{i(R94wbgNN$|o2YqsV?XBl{ zH5bm7#4YazO1o$Dn)DFeTdKJO3u%&fjvjr;Lau21cI!9Nw>U3FVsr@%Nnpj zLP=2gMBj!=ZcuyxCe~D*77%=k6ag6#S<`hGST^EhNEFD#6fEo#g6s^hy@ zoYx?bMD3}7Q>i#r6DMtWnzaO&=kvOIXYlQQm6C}uDA(RAYb?%$q#Nmvrp!Ue?iv)J ztG@7pVSA#zwTQ#_?s=z^du-+=cR)9vPdTJvFKw-8)5huZ4Pkh&>i%TEj}AD+qiTv= z|BJ;v_`tIZ9HrpV+0cEl;cW#ew1+e35K_wj1em_SPdRiCOEo0y2QfcHz3$0x&0bo2{Yc1l^MKc{ zTRt80^pKEa--4dFo2$T9_ZE#Jy?Lo^*SkMZJGohM5V=f-g9P2Qf3eZKMQ z)Z9-3ypnYoZ966B7Z3qxAWXxc$yIKB*A?{ zDZ3ZFP2)sMICx3zO<7q~)x zH*|_4q(=NmtUPgXAg3JKnw=l}b+<}%W3jv z0{{Dhcb0_Pq~kU)_t@q9&_QbZZ1*gEqh-qg}C@V0q$C&#w>QF=SQ6Hag8ONahqk8?3}23(vZ=+*zEIT# z{zEPY*U)1jo!l+?#lb5k{Rey|>u>K(!=sZI=ZkO5Hf)^pS`Y}$?S|*^%=u|Ae9Nx4 zUE74|H(pB=a8-NfvPa~)ppsrz4&HJ(^S&kGFJH|C6aR20>>hJ)=tqh!HzCeBdr z(mp!-?6P zP*MWk?2qJX12q|$tZv%7;E2B;i@Q2wB7&5j6H;9@Dfq`TLpp>22fhs`I=|1ZwM?V@ zU2AEByRjeGgxI53l|J6AiZ9(ikr_@NJd`_R(%%lHxPFPq=bUa#07#2<+h-SYDjRo# zr6~3FDBLDoei$7$$>Z^I3Q`7{Rsn(kOyG(5ElJd@hS1QvCpfVWm0D3=AroW!(8i?7 zxXKk(r4_2mauc$dLhw-NG8W{ErnFac$219_ryDmo;#y|`&uUxp&}NvKoBc^8UwF%r zwp|gI$PW|hyf$;iXti5mF;O?K!8!6qGv_tw+b;6YjD#F4_W4YfkPMcOJmWh9JegVwf>v36d=xW51SBn)Jf^n&4P-QtkL>#@*T8i-|4IHtQWmG zi`{nCpGl#vi8Je)*(#J@Sp!PPI}on&@uo9Y+~)2H4eFyf-(KT^+D|u`%1t166sr+Ah-`p>_L8il z9N7{APJO1lDmi4(aTKQNKZ3GH6+5pom}bq54k^A!oSqEff!SK#W3>1anm3~hJ$yG?)O4{=agVS&;3|& z!Q)d;J0oG)VqAw&8x~~oN9&P<^pNu6%GpIg4J!35s1Ay*^I62{?AbWduh=XQP8N)k zp!Tw>{0+FkDF98~!p)V(?f{rEkEpTG^>GMo2?Adxt>-zU9%kZ$67yfpMzU&9m44s$ zaqpRj%KPkyW|3m%)Z&nF?bZq>kB9p8GyzR7z;M*#`=-C-jD4G_y9&9h9gjR{QR)~m zQfxM&ZbRiv;M%51Xx?B^jP&NTaXQwpf|rlNod5oy=Kh<~CLHrW_dC#Bu3l=V+-(o+6&ayNqG(9TPz>4HCTc0&y(J>$|E z(!3 zr&?SZKj=+LTz3DzQykm;(nj9I*>!VMS4hl%ZnV-owqzj(Ou!Y1#l^U~$PdqEp6SQY_`v-l6;JHpPIwRKJ03N*FHB*;a4tbfWLdypcye zq3}~Sa4t=QgrYqF{g1YL3JDe*=S<>xA5Q3!(#nN5Z>MYO%YrVR-jXD$qA_Q3%Yt`u z>m)GIf-_0@3go4t4n!QE^eqiOa!!MK-ro4PJ8l<(r2YZc<6e7a1B%$MD${PP=%{~9 z`nxN_ON?VspQk$AzStB`lt1jFZ^jY&hBHe54re}*BXdzXZM0k!%9Fwg^#PfVYQsIu zR4%uB-X9B38P`l|lhQI)_ottWtI;OFbc3OdL65IX0b8vepnYGl_Uf-ImmVS5_G>9URiWIp%g&c%Fdf|s z$KQaXzH)!{42^3XHArbVV2}!@#|5;XLJ)D!8p!CzOj$lwp>(Y5J@VR593sQXmz(j+ zgNlbhgjqEF3i7`1j8&n$EK1z+w1TKm_dqqe{JmDBOr#5yeFrf}8n{eNxCt<@epPmP zAW4PNux1%Nr2W&-xE9oIYdEJzVI|UJB48SN#?7!a&hOITsZ|Uf+FGOZ&~D9VzuHqQ zfeYiByHDk|})H6>sfhSdWK3+V&vBKHfYP+5ae9Y=X`taMM(lM(3Ji?7N z=(d;Ff3&@5BPTa9f($u;U%2cR2PjY#Ymaf?yOklNQ0>%BS`W3wa{81f~(Z7PqBa)#DCd#{fGOi(t_`k;KP?l zL$+_WUMWEqi1`i?jm4s)^BM4^KhL4M;m^*>6GyB_GQxzd;A4bL+zO z+O}<|{>o=10{+(JiWxyG$08)K8~NaKwYd~qXQ`5lTN`50(YEWl1}R%c^{#5uD$jl6 z0$<4t9>o)lx|>W>Z)wL8>Ku)$;7vyEY3_O_aQ=FTFLN(^m*eV=XnhGez3f6Qh%_TX z+}(O9dXe(xHVcvgw^Y`sr3W6Wz{U0LxIoczgYUh6TJn}&5bCt97vDn>OTqyU!F&vy zQ#(O!%f*d}t3o?(^Y)UpB13%=uWE#oH=dr0qfKpNM|Z6X`yWU>XKq|e+dLOzT+<_@ zK}~xIsi;LYM;z{lmmdRwRB#|xzgP3QFBp$qL?95ju5 zq6u{!0Gh4eSj~mx(2v1~FZM+^G~zc7Lp3?Ylo`Z%^UCiK_e=5!5{!nK-|Q1oheyX0 z(UkKCExzzaG6odw;;e2O&XIX_=z+^8YqsU7U+hSO;;<$w{dW5L<_)ifyoR31RO33( z0RF}&&FNmUrRdA$bVA+uSj5DI_hN6~+#XK!hdx!cu4`ibnJv_$vjGOY+ZCq0p+GO0 zg*CMEu*m*3ebP|y8`V0a-|%OHVqn9I>DaI3koPQ%o`iin=bRbT%}T^v-j=N!&J5oV z3})p50Ios4GqKb93hw6&*N?2B9}aU8)^tfjZh@#Zsifo-deHj-7OdHSgF8MD`|z8p z?bkFbE304i%&EK#JbFBZ8P52@`1^pXr7uAG)cCiYC~7@TaSQMNCsazHHB`1F=8%X& zSUNH28Q#D0`R(|Ja4Ah-C>1rF8nU*Gv~A2o;ZPB>Izc0nWF^CSi_!$Tf zGnx~K+-&s_I^as-^PD`Opso%N&tyt#U# zmzExa;!GFtS=&`_6JFLYF~TJ4#% zdX)Zc{@|hbT~~F(0mU;=Z__NU61UkDD9sc4-U;{T-Z+W?ON+Iiv|Uvg?10=)A?Oqk0|H7H`{@ zjN8ozT+Gcnc#6Ir)1Wd%AKc%~z4>W&P@D;qspq9MTWgvgFU7cE z`E^P4{>P}d%}}cXX}b$3)>I#aXHx`s8h+*c~28WyN| z@&3|$FZSgd{MC4+Ci_)u?b^LEVh{uh;RJT+OyePSXsIZUvJB`%3jA3~BLu%S-0bjz z+n?>z4N}jA;#{}YKAl+$D2jzQ_I!G1N^ zx$7%o$$#tHq{!EIsGE4b6yPrM3pM>7H&T}!PL3`S)lxU~;bo8n6&+hgZFCy75zoR_ z30Acs?$=}hNhdP(60__Nm16eScO~Wi<7zv>U2Z4!^8TQ3tAGHuH=EC~uSZ}|WJl6Z z76M6zu;cvPy)?3QsUcOmvGGbp$whuet^xHzuI8r0*BY5qW;7HZ9i?6oNQfT$wtoCw zvMNXS8;Vgn=SWvP{b26&6JeFfg2}nSp{-x>{P|BEYVi25YB%?)65az5T6;5spZ%pC?7gTdY4uAZ*Yxm~+=Ti6mxz?|(xap@odPWG| zHC;Znwpa0-?U2D1{Iwe5sofStt+9DZraWldCQxTtjGs(ZqV&0C+q^Ka?40Os&LswO z#ylYeEBiozLu7houFkm}3tf7*CGwlFsP|gzyW5S`n729{#Npx*|2y?dqY+|y8+-GO zw?4LQiLCvxIqu*+{0sgr`4Q6vxPjPy3s8J>Yh-v`%wzek`n1h!=b!!sYhT4Sdhlyq z4XVqM>MshpU31eV9(IZThf&6>WkU!MPHEk75~!JGs47LCYftj8y9Pbvg9m(U zrPz$2DJzK?su|vJTZoYq93y$;ae|4&dnjDLHmco}c6Yx9`r=LckBC!PZ8>@kD&N%b zQUxe{d~-M4YT0SVP|4V9-)Dk*55DSI)XNd`>5!Z$uNvKyJMc-2IpF=xL*eASXX_6m z^b6tj^e&jKIwg=l9iX2vnR*#ZOM`HiU7XM*#wc?{pgK035X`h@d;E>Zn&U?H8Msu~ zyToRSy%*oC`&ql2mcH@(n+$__HB(-M@4(<~TfxY0bYI;wr-j0dO!Y|hdp#Ist|*|6 z>-rs(xk+A)4B9;=vzfCtKfG0yhJAW#iHAb3{$WJjQ#sk0x|^%I=z>dGr@_`mSRzZ0 zBBw!_JQcvXFuX<1t`=0L{36|>ruVuX^@a}q&6RHFc*kFNAB4(Zpb`h;qL z*}LcJC$0IIXRc>T^l6Yn>W*K5O8k3{ZE?SDP2IS3IAA!f@F_K;X!3rXMdyTmb?W_0 zGh!)iFDtRgY&w}Xb^Vm;o)oAivwdo@4MItO)6%G1z(>g!{aQ9w^N4TmST>Wsi=+_U zHO1w*j{@5~^Gy04;cp=e@C3POEsZMezZFT_qXB0k z@^`nM<=SCS5A)q@Cgu{EGzHRdC;w}dSzll_=qxo2!;4NV2jH-oR{2H$TrbAs+cM28 zNcGI1;Q!A4-YgFN1wmwoC%WM2vJij%15(gXp6%xHw<5+fjFfysmzrj4{m1zbhd-?` z;jvjZ-*PXbwN66)k-XYfP9z46VT9DFD?kur2~+^w2+F(&?kfT@Ie^D5dRWCB{qowr|{J!UMWR z0NrBCzVdH~<vS!1>9`lTyz&Rd#OL>8o-BYi3cd7Q7eRjIP z;+GDSR~#>MIJjaT5H_X_LveX8KuDWuaFd#idnU@1{d$n=dNR|n+_xZv-H*1?oYv_5 zhM)byRc&iMmi&z#nrI_dYfO2Vd(?eep)`YTT2Ty|=H|z%-EIn7U7FYE?W%V3W6nMP zn6R;Px;)@usl^AGgRp844Y_p{mi+n5Q)oin!sE9lDLJs#b32w)9cMGClFg*`zEp{V z=gIKD*u10!Q2cC^eST~BC{u_nG~4wqa0WqlsxnyO_Wlikbz@%6^$9da99ii4o4*A; zUc~bn8WKNMVXdl!#WsK1P6vp$mXD?bpGM_{seeL< zrzq9ADOwFzmc2$=t8er*ErY5wwj64W236O4MOReM!>Yo3+u~}Ty~dZH0YcY{-GzeY zfI2lQD$#YHPlGU;&ydfVV6cr{%RGIO5oy?ag9QT(hIt)rCXW6hUXk8Eu?AsoEfG~T$ysEo;p*mo$53(%{?qM5M0Be zbHJwox7k%;-Kn~|zKwfHv~+opH01R=49pt(M~BT+dmgGP(W&YQ-pD#~+Go{`=Vfn*pK9=5t`zo2gmFo{_P#1OX^wg0;;V&?deCy#w z@b|sSl$-xDZ}z>g*uxGkL&G4wYD0@+DjLihN#IeGDtT0|;}Bqf9rGDttKBK#@B#qF z(bOv!q7AgR(;F@5_y1X{#&_Uq@ma6vpS5|Kn4R0xA&sj%k1i`yDvn?6 z%9>2&s(}1r)YOx6{ecnmMYPJGmTKG!VOMo_yLN#o?ADU+)rqGn2D?8Qo@jm(PA2ktp&7!2bkDON zGlkbDqQc2CUpzAFgIBh)u12Z?x46h+I|bvu#ZAhVRX65U4Mb1%^kXOJf|FZ%8qKQZ zPmd15n)uVdH;qx@u2lcaeb+W=!@sKw^;^Y4bMT9@KgP95Aq3 zdFP+J@#$vOjiSJzW5l+m8s|~xi?`w`$0HwiKw~vC)QEUyBTsYN4bG!6VV6K181@PL z08fsgXP_$n3H6U^(ZC18c297L027l~2HRK8R2}Z>bg6}BAKNxKK|{EsprLe90OyiG zC~(CHh5TX~Mo`9!U_uJf)}WRgu79)b3~vG3Vk->Bkv$K3UV(X3Uk^;&t&VYutV#}i ziPA*>J0j#tLP(Pfl{%TLu4$SVj-2mLvL#XoM4H{W+ENjRL| z@1vTElEEP$1ScNf|ISX~Q5v?rPvQ7_zI$@TV25xfpL}v!XXWWkn!u7rR#%fidkzYt zg#7x+I+`UV6RXYz&fwo*32%xnXbaz29wjib5+jTuS^qzry?H#;?-w{aEh<#Xl1kAg zWQ|HCOH{H8gOIH#WX(RdEJ+d}J44xbWgW{X+U!|U7_^8XgV4wr?s>n*=X-zmzV2VQ zKR&OIc|Ysf&w0*s9?WJSiII>kGu2fHCwy}torx4NjL5Lul0g$XQeWPMX$OasxsST8JznK_JN@6Zqf)S6d2-I*g*pL5wIDW(?n|+l z^IiCZhn+zNjIiz^_@^OEh~YpSmOyF_#UqNFxSTsqFKJJ^Rv6*;{YI$!SG_j%p?JBK z*`_?RAT3w=b^4DBDywr~d2YvP>;|7L+s;9YejY}_~G`r zAy1v)Z#p1whLMnqxxDO5I>RxdcFa!#c8Q6da-e4V z5JRJ0PPpMg_2n!eJcE%qgD^6yK5KWCR;K9h&r^Pyid3zv5DH4l7|FY=!{M=?70bx7 zo^p!R$b73xf^_>RtCbYuL|~#`6kJ}tOgiIOlk@g!+qilyKB$X+l+ji2HO+0XZb~!4 zY(&wS^Y6(DK5LOqwtp%MBkx6cfFSESPXhR_05?|RDyja5FD>h#@+uuvxnZ&s3kV{ z3XnKP4j|{4FboL%)jBYsEvQNptL%zYk{YkzZqzCC6KiS}|W0!YU?>;&@daU0;bFn?0;cSGimQ{wHh0;C?fuybHGZw-P} z9vE{wjHyAuTeM{01_Vy7ud5E0Jq@9N?V5?M6Mi@+oyuxcL8SRr&=R#7U%4%$d&_A; z$M+FJ<5rRpa|RROtkyaU5Vy>aq1a^5dSDYiPGG6Q8p2Ge%n7y=X@8j?Bb*0YB$lfn zV5!`a!y#SMRWD8*L4d-*qWMp7>nyO?&Nq}88>)E1_e|VC^5~tD$$Y3~fC)IM%9GAT z@W00ixm%~B%4w@6VxZt zzKk~{v}+*Dj8RC`YYR^5hE-~48CN2`F}lw!kH>b^n=m$%ZlXxlR;0S*A=W4+KoMxM zDL?;7AO&wq9gbC`X39~y=`X>DfVG=slQwA_aRmt+3sD7xS>p1xB(-GLLX{=>w>P;w zW#;qft-xT46g^7NAHy6o+`V7!1E^ev-a8$1$=sFW_pN!6=8Wbz>;jW=wKI$4T!y8Q4(| zHKo3J8v+yD#bPT?E-9|VywNpt?0!r^f=Y^OKV!?Bc_m4Hdt9mNgsl$=VfT5$QBsIk zYuOw^*$~ZZaCJZrCA<_Zoe8-bt9+PaofOq0t@4?|SxBPS(0!?L8=jNRv&y#tF2g54 zr2<&5c~W$Kjs}5Sg#7CuLR{-q%@min=Y*)Mmbd!r_2nAql+ZHc@{(NnAUOlssk(uY z+}T7MYC@N+Q<&|*160h6rYujAxi9vsO_-(^rT6P3GWh#r&y;C;W|wSUXT9$O()7qqr!^#2{8o z*v=r+o-3p?(pz$XgnvNY4P<;xAeHhu3BQ5*rLOw5Teofk>KVczpwoN5>*-($(^Y~B zNN%t0A4iZ5jeTS{@vA`a<#V4Iu$sNB5=1Z#ijiQ>z;$b^Z^kS(mS>nZC3rU>5~-F5 z|CUlf&K)B^>b2*PorbWwfUo59PV~#!_D@2$v)Bod*a3kfHh4n>Q5dzD-sq?0Irq{R zV3S?+uMDL!dQ>H&R)xB|7P~}Td&Q7BnA?yo^Cpw#X~-bb6n>jK(l!a+jqno#>jAoe z>&z9W7Y@lhK|Q+^sdL)mh(y5Dsdt-x_+mo^URsTb0%gF$^;ZRjd#TR}YZmQ4nXn_3 zLI`dVdM2JLJvDzY%9{5GD_LL>A8i;_R!b}}-F z>504IKYxuL3s#{zug{yJ+~)UzV1Fb&FYW-rkxdh(Wk#oU@{Qi&c{Dz6&ptxGeaxvb z-uaJE8vyaHM05|<=m?Nv6shAu9LP@rJ^Ue*<0R!{c~j%-DtFXXMXByQ{6yy1rG~hY zn1Fi_tA!s`B97w)PrGVOF0WGq_uP@6w)Q(UHzv565i@rlM@Af7etYYY+h8-cEp|V; zs)~emQ5}?*#NJ5u?G_dTX?vV}{KCN$q&cR}r2CMg&ap@xb5FOi)gXIt=8P zTxnBqB%Og+uOjs{sNp?%sK|+bda4U&=cH50u0(Brt&*7bpbiz4=8Mr=yfp|VYNRtN zeUNno|KefZOjXcfEF|!i(VsdXXnhrec*=N`tDS^E1KQ;FXVUfqG*u#z+prL#j#HtY zmL#LY&OXgK+;0JT9n7*Mh@Hn!&?XkDtR!7tDbJH;-Oa^x&U*Pv=Ec4i;{M`?tS9^&#p4xr;|;p+A0vT4npl>C8~po zh|Z1r*!QyNK#Sqbq^ZiVy>((ju0+|hLb}~9C?}ZLNB?>E@DVJd04ZV#|Ki3DO{lVv z46+=Oi`Z9F$72^X(1}Y$Cav@Zg&2(t_b4?SePL?7n5I6>gbvhy^JKC>-}Piyvy6w~ zkiG!4yW@$XSiUBe>rwTW`li>+$Zw5f9}g&Bs&9KF3a1gs4;YLRtefcszw5|826btF zJ$g>;ILTm&9BV3qG-$lsYp?6mSFMSv*?^a_Yy|(REdn7z(1$lAR*2jVSHi)DYPwI8 z;Dt4|CPRiTQ1#tOt72otQ1oNt>GRtO)$lQWDSTz0ilZOW!hACrrbEt`dRq(Qq~(!c z8o%};9ts4z-IWhlDb%;I{N|i>ydcg%Qlndx>=WQ-uI?h#(v3oWGw{wDV(*(RN(z@^ z8;NrlOdqe|Af$?Qx8R3Zh0vmkVF6RT{Zv z-Cs2Z!v+!Cu}8h`CnA4UCuQceRc;Xg)lu?9{x{fCy-e22ju1ckNZz70S*han6@t|| zRqY)KYrfo>ox849wJ;iB09hOdjgPKTQl|#J`HmMg zW-v~2TZ?;^8QKaXd4bLA;N|`&tR#aUWKPp#NWVt*yRkmI-}4f{6F~mPm}japx;92L zGy`;V=Icjl)WW~UTnL3>ClA7|A7~{YzhFAF;2^=_@yZCw5*Ykm+(d&cgXIIBt}|KG zw=Q23d4`ps5b*Y{m@D6g44Ul){F`u;JQB{sUkB8`T}H*1$VbgQZXL#i7&Xa(u6jf% zDWS9NEjy`27}?LD|Hg-T@u+P1;QZ6HIG&+I553R8)vU`*j3N8~dm0wd=0Qu`D2oL! zdIWs>Dzx}tDQ$C=V21cAJ;so`7{ln3p%iI`cZ89!yt$L)xMLkw&Fehy)06Ul%zyv? zF+VCqF(Uuf?uG~!3P}vayHJP)@UQEe{{j5}V+l~U3Elqx&tZt)6cNZa{_$PQ>FYRc z_Bn`7n*28!n^${sk+l@5SPT^Ol(wp+rC4q(ykcPLVYqU=N`EiA16ZQx&WiR=VX?Bz z-m)U^Px$LQJpy>hWq~LQu$!gh(>6yM3ll2I7IW`LIRjL9?oGgX31G$CwPCI2nO0u* zgSQ~IFbd8ntX{kfTpjFG-5Fkm94nZ}Ap0s?7!lJjS`&r8dEoEHb7bO;{q!nuM?~Py z!m!oBtWW;Hq*3Fgy#~iz&F%w_0~W{U#5oOx=~ZeOYmkzNd3SN5L(T15Z%jO$&0HOZ zj6nDl!eqM%O-VkmZyfjb%Eb{B4j-6F7QPPT!-&TcAmZOiN2&0k#fN+C?+y@*FQCSZ z!nG?r1aZXGKMc)4MkIKn{w9N{?rQvxS}hQ2ZP?EsmwL5+_ZFW`5ZNx$VeTg)L3Q zqw6NqheNJ>_hFRK|ArI-N?!^_>DqiF$mw^#{>S1Mg#R63VJt>+h{fw*C#aEiqPtc7 zjj^<#*D4v4m2(eJn%pM+x2t~Q{kDcfW1moJ4VcO_McuoA3blPJqJ#}lP6Sy|ltq)T z2@zdJj0>4T(A%UZyL>^zg;35j=6tixrGh44cPJ6HP^pQ+C|0X}@oMZY0^bhJmU6B? zXt)S-Rtcg?CiObIxh%OAY*7Ilmozdka3Zp6h-;M=L$!u1LjxR`*$>rnpZ z5IWTKecl|juq9zs?4OwEdo~S;!q^nVq`byWP_6^6r2c|7G~jkHM`agoZDBw%-MANR-92Z zMX@2l`@mOuU2JGq#%fX@lF~pwLwqq+rQRGt!zck;!qf zlvq3Ai3+3{MntW7wxY{-ks;z5b$ab%$}gQhvQ-Q+1;Bb*loXr(HaM~O&%s16?PE=;gXNimXl5{OqcMUb$#vZxn;Z=mWn_MVhpld(u1gpdcCJjxSrW|&6b}WXozVvKicJ8 zg7+NQn6X+il^}?af7~&>xx0H@b&Mu>=WUcpXR=X34JdfXOp2L&3l_4L&Imiwu+$sa z>eFbZIYbmyM08O@zt~dh=j2VQQngZ=u# z5*Z`(i{$mol6S*hEx?LfrBd-Ctj-B>B_j79lii5w&q4*@v!=SxpqMu>uz;+sIfECf zb2A5QGick6X%MCuFcY&Co_GYNzG$JIJUJPKwqZo3$w}KVTkJ$8j!UnYc#fgUJ!>*= zJXL8wE}*)Dbd&d7?th%*v|FY2hz6u}JVIrod48p?Db@0fG+B;4j^T{N=vHZT@0#g( zt%8Z6Ox&t?j2?7s3YmgrAuKFJm=~!c~&T%5p*5JF4S-<s4F-hujIX_jX9j}m(Q!NTQ@tD}dSH!LrZB+E&l0py!r{+R8 zkB+&CS>FrSQ$9g{cWm(_Dy~|eohnc6HJ1b#&bDqaUyuIN^o2kFnRnu~nuF^;;21a; zHw&!tA+l9IjEBH4Lr~?YwCoI_9F6Z?dtr$R<+B<(x(~b)pQ;g{77sG<=)K9xu$CP? z`_&r+54%<|_Iou>Pc)|2#03I+)$98cS8dtxqQL6JqU4KL`~I8s3p3%#r#?w61Ta3Y zA;^eUY~FjzJ0`JXrCzoL6G!FR(yS)U}5 zzwa7Q_hyiR;9|B^{I|OTmHpijC2?>R5UKk=7Cdn`EWfLs6SQ9Kb#Zo6wRO8w&!T;= zN(BFHRd5g2*)SS}SMRuKh*kA%h>OH9(0#RqIT8)U+8ly_18Ju>7!@GS#tfeu!4Frj zGpHmcUQb*qOpba&2w^H4U#QQ4G)u?@!$J>Rv2S5g;1i6jLGVZe{qU^v7`olF#PST2 z3|vOE_kD(m+~|6F#~9!?l@g-5Tz(7ZgmRzyF~`0U%Mkq>x>fCQ{P|0YyB!4~=oD0S{q%#OJAuZR$>0~l1 zi8bDJlQd0P1zB$Z`KoPWLN9xt>V)a$9t!f4glJWe>2zlHP(gDSi6M*A_1p$0?unZ~ z>V?9bb zd(PI_CbneaPBKufP|Y}g*zWx-rXVg4MtXZUZ4Y5RdhZjLyX7jdD}+H})fkq-Kap!Y zq7D!QNL>-DpHSI)$UtYp4>_Y}(-b&#?muN1drM}*LF1)SHamfP-N*pDACm3Z*l1-0g;GTS3!yp8qP@$f*gsey&0vlgP zS;xAkcrE>_ydk{@r%Ob|I|ud3msb2rI+^o0NtjFOao?)LVtRgle?h+Yx8n$I)VrtC zx#^b3uJ}@J!D;lJ>6x@T`C6R!Pcig6=rEgeBR_M7gfnnu5Rd=sp_TTonoBD)K z$@kb!L9Py*dOXnB?NLuL4$^&8Ni>!n8Iffk<|D*FBTS5Ww``XlETD%Hi>$98KcBD0 z0{Jo*y*yO=ZTw>>*@rr z0}O$92X&6MY>&@m`^gISl=#!vuy9p)S-cPa*Um$tE52bNYt4CHm`E!j{;gQMd>g_M zg`sPE#FK3kwau1io7e>AEvG8Ic=wpD{%9ykGap$aLzZArG2CLyzC>K^TQjDIu6b(9 z`p+im9yq)AOCGb29pPznYhcCHUZn|-6s=&BHMaMPyV3@GvOr~dSlPg$-= zS10~UCSLQMXIo1jSdAx+@BBr;&9}3q4f)Im@#qo}c{!fmDVxw$e^-$j_I0FaI6r?f zHP38o%i>~*@8Ye=de(1Yz4oM;K&r8WILxO87&?=OV94Y2LGdkSg8dMN4rFwlT8?QN zZdLyf?>}BuAiqkfD&XNEj#b_spagjk@i0}#aaXo86)M!0av5eo{GI~Jwqc=XX;e>A z_a8iLDX1#j?=ZA$$aP4jkVoMNnkBoFKA#On$NrSqcFDdlNah1iZ}IMAf1o7U3m@$8 zdJ;w1HhZt^X#JC#hQh>_q9FLI!6tQr?m!x8EdWs$Jl>O>>t!y!*P4|d9rCcL<`sC) zD)VQS_IFo4e{80;m#h>gCwxRZsIt?B*tXS_Nn$^+k9xo zgMIRA^pcv;L=i(UC9{tdb<#hL26MovY&Pi}!u9T0ELD@XKlVFy?W=rV1HH)DdsxaI zQfl@Tf-Lz+39diWCwV*J?gShd)=oy`fG8B5?vaeU1Kg&K?UN=b`co~%2;ow&MMU((}I5P4Uh#(hn6@efl8rO@3;<@q~$D0MnS z^9p05rLMl`x4eg60G+UjBD+*IsM4T%v|E3P;3S}D(;(s0zpgs;iHiEXPY#GCdqrBm z2E7z@NUQ|1w{3PDQR8>*EJ*lTIB0F>#B%!!&_zN1WExXJta>Nz6pG4jFvlae3iv$f zlAXV{4H6MQAQE$C4@aG@2y94mPoXCL2#}Z+IrL^#lLJT-g9M+6VaKl;#t@bre*>F` zJfJLBSSP9e->)!lSqM8omNL5W$?!M||0R&{GwT}3A zK;DIK-j(ABqff{e=Gtq@^j%Wohh5jMe$SE0Ce_3u!If3YNAcj$;zRt9n6b80JCfh9 zB14>(`}Gy_i*L9bG=lRT)Fmk20OCSB;Pfk zMt+ZO?C3Ln(ViXR$*yRJ@52&qg9+~AEg&lzq}?~q#5#cZTdW&@X%2Sr-WTO}DRZO2 zkQF8WZ0SyLS85huU?*f6fCx(zR{gk8r~C?S7~!|q{pjx}xp8Q+#t0#Kk01-_dJ-f6 z$PKiB+#K{O4_?>jZ!%Bymz|UdC#6;>xKgQGLz;=eN;zpDu;_5M;POQrn_F z-;M@tD4fs_%4_mXVZSH?zd(n0l(Y*IY!l&vA6u5_=7|&5BF}yp{hmqlA^zU%XZW^x z!Yk6fcE*cZ3!>ZbS$P*?2UT5KgiBpYVfcZGim`#;Gx{WsBUKx@cS~LL9=>T$eNF2? zS<9(@`CET`Y3tnOeXvKlup#O4Xevw@lX?keuY- zT!vuH5adV7E&~4f+QM;rq0C47^jiY4(XKs|8>Gif1mAWaWs~7HvzBpooD*VqkZqJ!DhkP3(S()kLR)u*FK?6`~Sl^ z_{TvO7YSibIE2dqVr;TJVKbWB*~CoRm-Qdp??&X@4f>o1v1nYjlg$zAgH5tPR1zv-H3Q*( zO9_x4i8uSs<4_BSX0L@FLk>8VRp0-oU({$t|7u1WRow&O@BkIn?Ib1&k`yYyB~{7` z2sapU>KqfepGGxAHryDzpj0?`zr=6?$uJGSc5;(lDOj|*`I9^ud_D-~j-r_BnR6c% z#)`hW1dUXDe%ODue< z>hWIQRTl#{A_`-e3Q&6}3QQ<5r;+VGHmeWN^jUtt$(SYbfeg?nHyr;cQ4=-;$^73s zMIoj6z%&q}{Js>+PAfnRbA-pxX&s=SUQzw?r3iaUf=jJbv3>lo zD-p>k-DPwVl<#+tJu_Hf{y;3!xcsZQ;UW$~-YwKC#8#mQ+eCg2f|=&`9C?q)%CGxV z-h2S(V8!yw?z))oKhmhlX8&$bPbpLR#{LflqVSD9`N)&y!#Cq#!{_qwtGNjoR{_J2 zaUT7=AmQKNs>%ZYRhrp7tye2w5IPaml`r&`nf;p=SA!&lZ!1pNP0%ewBm>^l|F>B5 z|7oziLglTMs;^6*c^8siJ&em*Z8Ecb1v2{;ar=*T&x34$o6vvy{g*+532C(h6wqx{ zLbb$H=a3U^6Q=+Mb-l{s>b1IcAV;WkvL4Z#VEKaC+4-JT-}eigoE|j**Msiglyh>- zPa~KT58fo3679tZqXHP+NTKR0dzdNo2h! zXV`VKy%^q6w~FK(+9uk;MT(uQ*bE7f+cC&x53D87+ATz|6)I20);9Vw1yj^uPqnj@ z+$C#07E0!L6+e*`y2wATCN1 zINN+G|EGcS0wgga=Y95qBit|Id4Cc%2A7v!x++q~RCbU=^{m)Ia`W=gp4Mtax0eiG zAba^wSNQ*Iu%7r^wDJZa&1!c*r+tg>Wmq5F0AK^JdHkvdhyO9- zSFrqNW~Gvr^kePzjGy0+t34}?#M65ZUD$CdQ>AThg52Y?X&c`C2oXIq6zU-2-Rux) zzI5zwSVP!(0hYJRtd9shf-IL(!t1c9N#|)2KPj(itan^?6nbo!2^>lGaf=6?2{gTEn$xR1h#UT&Ie2b)MdeTBoXJnTzL9b1r z)4n8iO~w>>Hm1@t`vzQTlod8x`8l#m0}6)blP;+){(MSJZTF%5U&$SlB6?YZW#(>Q z1FbBGyOFO_!%7GeUejk>2zLd*c{%WfB{^VTRO?ytJp82$c=y}bdg7;~XYE+ALhXNzmP_m1dFy5fOFzMTaz}?Ie^@+SAw-4B zpjzaE3ezs_W@N9FbItMzMH1zMU5b+=JR$TK}ZFaG(Plgh&aZE*MKjEG)H z+g;dSz;Xmr!B3E1| z!H-}?NVmFuaP&@qw7+${+Rg%X`wA z1F`b8FcS;R)SUYKoa9);Aw}xfmPH<1g{`e@*{ssiu;2dGcQuEkr^|81(l=k*o@qd> z?c&&})C?#V>E!=i5K7VEi;C3w`ePpBqeh1-`#a>#Y0m&)+0$NY(re4{WO58&ZKW5g zDBfKP`7@>7874$!VkdNJi|EOISon55m*r+6;J6=BV;fvytow<$*VZW#;Z8B}|7VC?_6e*~= z;qz0-@{bz&V)VKp3tPUYf}3GwGN zmc1yf#;bDc-Aq43q)~tS&|~~*GxtarAzUu~weFjp?`JV>(!DWmwFx=CbHv2%FG9^oQ*!2K~lm(>UTTUn(aG8G7e6gUbSbea;vVBS8=|H+*w zH++LtulC}EoIsiO;<27k0oPFD$4oOd!;6YA8g<|kb);cMdl{mw>4MoqiRUtCK4Z%f zYsb#WZ9+!0pKZX=@qvEb^TWnScCO$Ry<^0Vg}F*rz50e3NO|)aTd|1=$#+r)lA%XU zs*Q&qAbZUm6mQvp5mf20-(k$5Y?#p5(b17YKbN0GnAY%pMsA|D-;wBLW%XG2=P~{b zM^l;$yLZK5wPcO9rn2^pD5JhM%eMBmV!CvO==<+Fc^u-vlFhL+=j@r+TDq!g@DzaC zE#(APJTXPyt$TVW6;b$Hr}M^+_H)>T32l zW$mzGE(^6+%rGL1O6@pUW5Zood2pt4?X6jDCFuqGPE5cNJq^+?Y^S7eA(S43Qdxqm z{LnG=@zgO>1C9Dq&YacPc(~MvSEfDI*|ERnt^dq$Tr1R$L zSJM^q3U~Q`ylv%#u!8`Shjs{u)fK;eVJuBVds-}mW;wRPcC)Em=0e9`BU@VBAon(9 zP5yJ;^9>RLBmT5M)m`tQPRDf@UKUaWiyahQZBPI{7ylvjSsYGyUxr}$g6Jk+O`0akA(yshj*NV8V>5U zO|EYP`?y&3KlW*@{?_UVH(OQjq}@d>$Q-i6>dLp*{V^OJ-lRy~xfg1|3T09E$zSTB zNLWGX7wXTCk)60<|3A0azEq@%`NFz>7Vj9s-&)?QC8|9gig1Cd{MJ@l-fzbA-HqB7P&xN$yuvk=#k(;VEk%3FC2iG2xSjNO6??hKzXez zVZ0LL;oSgf`S~y`%zbpwZv2LuW2%|UqV(DV+%v*I2|BZigqw1#* z?&{!l!+B@UghzmPzB)${Lw*DA;T%PToW7n&Z>9U{>GdER3tN8XB-ixxzg&Qr$9$F@ zT0W&tFwJQxVc2NaIQ^3dq*ouhU87YqE;u1%-?}Bh<{f&;duPE_wYlRM5=zSpeLv$KdMhY@G6^hksdcXLTh z1I1^cdRk@1f(nr7^}gOI4(0nbUrc4zMyCt_yRY8hhDjP*FbevvH9cDuseWD4JKNg+ z4tNPxMgQCC!&%&$Mg`%GHy`cp6t=9H9(F)qpf#LC^0?8&7TvCY8 z%_1%r$cvBdC*se7aU!e#A-48gFI2#y9iuA2%vNT ztg^zEzO>Zc`&usJ+6+=^O|-#H_QUnVvNNWIn=nxkV5R}UN0QDeiZhdNmSFJ+j`9s# z4;|ku@&yztNx;!$t4o|$Cyk5{LCRT(#n3Af|Haav-r!L3SykvoAk1~{qimEz z&d|M)aYHCExAs$RdbJr=+xpk&yrxi5IqMCR{Vwic1FFm-c^-#YvxmqpP+V81NmbswPnZE!8IY@vvhx&x1?sn+TXG6=4()DDkDE{ z@P0J+KC@c)7Sa^8Ex~mrXGoszZD}m!+Vj`QNK43<{3q&_dpF&TzC1o2Gb5XYNL&#; zjrwS>(KPiMC=WNR1m(?&yuY-sSTsBt3=Mel6;QAJ8?kMRr#&707o!l(;*!ytYRXQa z8ZhGn|7EhBx5Z7@SzBM8)uasAP>Hm~PTJ>rWJ~E(P`IMzEjN0UvV$qI*sgL~OY^mK z4#Y02^*@~D`twoLD*-LPl+||Ps+ITh&-cEbv51uJ)`YxwmnhsJ($2C(mrl4MGy;hT ztQGZfa?Q;&oIzm9VlIPd>kUr3)oT5|{>#9{?$qA>2_K>Ddq9T2#lS&A(T?G&{%+e1 zoyuKsml{#-3r2mtTC9mK2BI-10VU5Qm?`=^6ZfYp${{Ry*zO?3OP;^v9FFU-j z_i9@?k>t{u(p5i>jJctD{;XMGVXyg147Dm6>}eJae13FDRgfy{I8S?%;%%{6AP}D2FmsWRh3? zLawrDso$uc3X4T)nnDXtsKHx9kiGlfs8Wpt#|M zgtVs#?*0aiN{e}i7P^3+!gKLgLJ!_5C`z!A8OE=L6Vt|(IN_MNOAV`A<)JL!x-waz zOX2q^RoF!szx^seVd`>UZvhCGj&Rg`)d?gnx5~@oz41z&G{iQ&kcP12L4(taJ&F&6 zHEOu8Or#|mzSDja^UTI$Lg=*&|Gysje?Pny>XJc4rn+QUhy_0fB~OH2Ls1$wg!w{INoxVyeDHZyo}Wi5-n8!v z>i@0|FCO#I1&a8OcD;|f&p(U8Cc22HbjjW;E6fPCp=zjM4}&NrH-RY75Sk`r#*PA3 zO`8En(#d5n#65u41YE_Nu55_>bNz56$D^`(_Xek55yG0xyk8jXENv+;!p&q-c0-r4 zjl>F88g*dMh{ZG442xR26Geul%P4FvchbO!;u~4~MA0|^=a-ZdRswh-54cVwG{(2m z(Y!moAJl%(TX2H;?+9D_&CQRK@$`0hl;n;U0@FEEprwC#OMM<-*P~g3OML>FGtS0p zzzEYieb2&PD3pL^Xo}Ur3A8>HR$*TKgW9aT4^h1>z4-cbbo_|x~Y3WdGjnrY2HTKw`DyJxr%pMAFltv6PK^p z0Q+J4Rx3ejvNNb;+YGTiUv1T0^%gCu&WhAG&E+^|El;i9HU-2jUW-_R zLkrbUz_EXbtMNJh3(9@|PM?5a2!U}qX;6uNA18k4_wV0r`-Id*O3#XAYE4N)H9FCy zsIpF?TI<~5!F&CQX|;8;bvF*JeETy4^;PEN&#cjjwDGl9a3e#(;A5I#YFE8B&}-jz zGw#_5EgjWXhq?Q8zNBLMWA zS`((Fplh@a;JKW(z$3a!;n)le-rqxRZgrsI*9Og-(LO0%2f(HhipyCoj+*~l0EF(l z0bUkhDoFA^owYEi*wLt^9Q18Wg6Tuo_(-bw-VQ)JX2*iY^)Fpz@*dMYnfF zM8rhrP!<9mr3*Iqr8VEf0^cL-yS1NyG!Xa1C%0z&n?q(&Gfm%!Q8>E<~MeIgTXksCt?~0Ley5BzHiI2<=$D${b%#n zEskl2G9*Bn(C245%(ivd=5^X<{1ZT6wgef*3VimQ(E?c?I!5)6lm6vGXd&!JvSP=> z5N_>UppJsMZ-bs$pKa8wO_pF%l{*l2n#}`UqpM0xUQ$fk3D)c*#|;$4i4KAM>|ybA z>e3q&P1-vI6$a;vli>*(rMcY3I#?=;K{Tt6@Pw zCx2n5aXF}pePqvL${rVe(`Gg#@d87ErDX+fk=EMb;9{oeQT%eBmLUI^$9(8zx1shi z+3V*90fm&fUr;Mn{o$aM>c7o1Dl6$o-_bn~iQ+D2LtYYSiKv!_g5Xd!bh@1O5o^|} zZ7lU_QU)?MFr(h!vxyekUKTyc1{L0q^UId~Zf1iGLlqW%ouW2}-*Uk?4#K@6sOulE zbH17~m3U1GNp*CJxWnw}wrKF`o>A9xLu-YJ4*SoJ|GYI#^AeG9m-Nav#hxmx=8|Fi z1_7iY!8G&X;f33hFRZ~^!;I?k_qC)n7b|&6WXO1wVY_s&r_prD4BN?PfwopU7Da4r z54%#0AuPxiB8tVLQ*xFx8YNQWawK;sdQdV;v+`Bi!Ft3r{*(N4J0#^n&zlFDiIBie zz1BT_+SVGr1Xx}!YU5^-^=s8lOhRKU8k9o7Hb+MZ%lVtcFd=`W(UE4-S}2o7O;xLI z{P8DmHYGx#dsUTA=C!Bhn)O)F4JuIFzZb9R+`Uq;NgW;!*cxWvVa${& z%lKBwQuqw1z0PlC3=eXqZUt?ZJk6nZ@pfrZqH`-aUzn(88||#3jrLiq!1D;t%JnKL zu%{PMs}>WmIv`xA{|nw?LyUA?z~wc|+IfeIx38fiumqLsUQO)pO!9P}Cc-{}@yYy-Q#91KkivqgU4NRK zTl$K?Enf<4FofbAcs!T;Gu6S%9|GZ>l#uSU4`~w~NO~Tj*mklnwtMQ0ST9n?`>Zpk z_0@@v-nSfIYu|MIF38XGwFPqt;|j}FW7@eRjngnheJi}i@~qv{Quw33$Pr`_6G^Gn z#>8V&5U2{8xdaueJJg#wl9IrphobJ_ULJhnbM1?pCp-CL9}n#M%AXI@m@oQ{)5Zx z1S#E+&u!&@zi;J%&yCN^Pgi%c$k1k#gDk@MPIVoILB!G~hPmCd@tn&lV54KYHh^+c ziYj5L-IEit)4%(qqQ@_*`o^S0?y_72qvj6J-`6*%-kY+ung~Q4rft8Tqu_C5y)Y;b zuh61aF=Qc$Ogd0?RXbT_s_cu}CY!GrLY{V;M#gC=6(W-SDWPo4w1onrz$KJQKpaBKU~aSFcY(+fkZB2sQHqgZf@m4n`30)n09QKlAkK}~ zr=`r^AA$HR9Jkud#|ea_Vk;z})@bTwp)%{^WE6$jMYfadxS<%MeFW8s4n5O8#W)L}c!LYZV z!ujP#T5n62o1({_{L!SuOmslcU>)4hNZzxIDd;l=PS;WOH=F2N z!m6(zLefOY)|TxD5mvxI=qj3!q?j|xym)pp+-6MbIr(oqN;zGD;~ogZkbR%jvS46ZN@C-gc-Q ziK;M6F`6u{<*1NcfX9I3zNiZw~TgMHqHC)AL#^Xfvr*C+bCEz3?oZ_bRLZ}XI4hxfhb4E1h2gPsUx)3J^uPP%4#%Q;_usePNSXZXuCNhaQOrr7WhadQO-l`Lt zC6|b}k9ePkN<#z$e|F=BR83O|@M?vc-^#74@Jw8@VuS~iS&id&4n+8;zqj-s)O;PT z8>yqp12c@n3{bs(=%K(booTTDf7WtCD{uRp(YJX*wpMcL2SU=|mABjc)LQwlQ98NV z06qtFfB`6+wU9q5ya-Q+BN82?Wsh;0`HP>%QEBf5zC$C0$mWJhah3*a5E0)#H(&bz ziCV~$)%Fv0#k@^Qj8cIFIg}3{g$D|?y@@pLIc6{eFNKMGYSvgn3-Ge_IWP%i3pk|IpkWOu2P9tyGQT;W*7Y43J8H zz0>aCr&iaR1T?nx=d^3UDd52X47Xpt4<!8Vzd%g`4ap3nMnxWO3ZNyKJH45hAVr&qwAj-lb}_A z&_h|^4!yL-1$9b-%&=M%Bvw@`qIa9t))Mud%}n$kFP| zwxLdY@Oj_>H=rxk3Xak+7$Vyc(OFDHGo*GIar-_7^7%ci>^t%Pld~y-1UoWCj_@$) zcR?fN#QGU5du?-EsBR)9xQ6b+_ZFY!8#h%pKvu#jw2|s-u$J;R&x!3g=^J}hgzuZ2 zFUW`6B2FICD{SGqJA~fILO-=5w<--6w~jQ2?t;(SApPSvQ}_;EPhp|L6{q5Br`>3q z{=V%q6MYf}VKU51Zrbp`h0&S<--fepAm({BeVD4Bs(4hJ(o`rPE6hY&^@ofQ6XrU5 zwU!}wbyE{;aetYi+iAJ4qBn4ABotBs2bhNhe9nR80Y;SvJb%v9EI>Hl?tciu)ggn8 z)R93Dk8r4XUj`mx75yGV5_eqHeY>j;WI@!k{5%h2i4j|rnnGu79~D)ZDvj|AQfnIR>0x03e)joT2RfxHtQEM3;QGXX9% z59#{+shzCzJ%+3v9`&VgxPvU~fQhfcYs47fFe3ffmm1ntK}t@4}6Gu=MwX57QI*63{hpz-P^y+M1&~rH;9VDnAONJd5oPyZ7%YLZ$&B?A2yA zzJNQ^MJ99aV2T9O?z)n90`FE7kOej>ZW}6Dum%hH27D&C5}G(+#VI<=srQzd4x!a2#j82>g z6X(^_e17DMV_v;5-C~_-J9);(e|p7Fu@CWqbOoG<(bUn>L(mtAZ!__ir2NoY%3y<4 z^}?!L_s`U`l`J2TFrKtBul#)U)-S4FJM@#_+DH{<9b!`FwsXf%Nah-`6IhsRyy`4J$FngYj9 z7iugaZ&|A!VEWZ@1e@>zRy9hWNu6hoD*)TkN%%gk0zvk&o7v`HaObJ*6JmflF1mCG zpqLoFvXN@XJd|-$ozS$=@UKfzOy%0}8$@@$V;(ATgSzVRCA1@@dykVW;3RlD^`88< z>*{s5*U+Hx9E|8v0}} z>#&wdj4(5TcuB7NG{2#_woHgnAz2_@D)8=m)V5)RA8{v-`*MWehBhC98|nJ?qm+7y z1-RCD{mV$!@7i4lZbUXLTfM!^W_I=voW=hvRSZDQw1MbK98wERt*?ttmRG9N3hy?jmv6&LJ zVNtS+gFta`+mDqBJ-CL0-kbsy?cvDRLdD0OLe+uy(j?~m3Iwj5{=o#MtU~Cvp_!lc zjR*f6b`9m-T{n`yW0<%bS)Qws-hE!yAxGC(oj-DWBth<_!Dki77+4&gVFuAwv~7rb zQ{hp;!OPgmP+=m=LUh+bZ^1xnRWT`|;USYOEUfMN(ESye`?LsHnNYZ1#{0Xz#F(Ji z?tJc(@O2(Mvn#4(yByk;jUFEoptt6%pMWV618BQX&Gq;$d*YVn#Lj)Q&wpuZ{?@V=&lSKzp;1Z{`3HdAOD zsm4In;1Yfa9;IszjMA&hx_~f|FrGIYZ=~pWQ%r{8d26_xuXJVejK^OMy+6=*Rsl&Y z3Z`+4&%*iyA8UGihRk1P;vM+cm~FcsqP26MNlAD-7yF%x5VptVO$IRMx6LzDch1*Ptrpma6`UmxC8GQ3 z8THYfLsutuZX2GNITc8)Z=k=0@x_|o^!mCn?6tayfk^Gd+E4SKB^DmlrtMzivTu{DB_>P6SSt+~L&?ZkKIi>>zpu|<@p=C? zbMO1ybI-l^?C*0K_#mhyz$o%849~~*I5ttzN3hJnTKaaF_1>d0vyc06a3dQWH9lKl zkhHqk-B^+~gH<0=7HG!5_bOb|Yp8mpYV*{FaaXEb{p-Mx9V7gQOPggLWq<;;r-(BP zz0cG?$~|(GU$v5THA`zuf(4;){bH73led}2k$#X&T96ZxmwC7NEO#xXdvf<_xCXle z%2!OnjrSx+22fW=CScd;fjomID?+K<*xs#QLk;PFXInQOPNC@Gc+H>4Bc0MNIM zyUYqtt^u0TTY;vEQu5(nCJdUquLJ>3h{iEt$iVp*NMKA$J2)&IW+E z=FMS8T-;_)z-g6VQ5U8Z1t=sppzhPS{sz^cnwk#w<-s3)PN19HrT!OF46!0NFNT7e zRg$Vp`UmT2GBr>=6f)|0u&Ls1J6+-s9J#%d`@&vhJUjDy0*<}!iN4ml0=4kLXZ4Zz z`cA&{@#Q5T(5m{7T#JBRYetD=k~aYAtczvL3b%;6|31_!dsU9E0cZcxCCYTXQl`j- z!3!@p_zH}|_o)O2&~{_rbhl1Ka*odBdV`fChJ|n^{LIr@BFnNjBtf3CmP|3*u=kjm zN0&J87gcN4F_y&cs-HWjNT%Au-n5lT*@iylSM9+Bmg7WhQsKSn&3Ih{mgUpTaPWK% zT}>yBS`IC#Rsc1u;Cp5r*H=q6o9j9&WZ@Hy#4-@ru31iHtqFx->~@DN@I->)B)6O) zcua^7D13thvM6r|cnxiW4PVb_kIh~dqWq`+?6YSmL%|O>jo{`7>Bkdpco^o-@!9WS zgYS~2h$@J&6u#LEN%%({qmaDMN--bF-cE4iAA~F=#epqFk$dtS+D!M~S_@9 z2tSBz#>?Kbo(4;J_a8Vx25a}EaxB|*y17>I=`p`b8xwF%aZJ2j^ouOr6J}2O`~q4_lD{JSJFk zfcv_Gqj~0osow)lrubnBO~#Y+xSYaSdn*eLp55kqDb@kfi<}!94Yny-L$kH|+LY~@ zW{}m3JNx|k>OQCa%hs3fo;am#BQz7m#Is=+c9X~ZcQ^TCUY&>g4}gim*6ZL{yE|`Z z>H~l~>UL@6PuT}||AwjPNOo{I`R`?0xt*A4P_pZ?x)C_tjoj_?^)y(-u}c!0Nr55YGdlNL%t|C&9h*&_3KPbzXJ-O01Piu0u!#N+Ydeq#ZTtRKdwB}p zN`tpni{EssT?-PI6$veu!3Cpn_h4A!r(~@uMyBqyrm+I z8U=V+=lOkuqO7Z_kVF@(vdz5rCeJo^z$UG(lOJ|80l>+B2uV!#5ag|+3D8zu!QW`W`5?-e0}- zu51J7CrT@ViwPxd#v!_#7fXROp~Do#9l-FD@gb}UV#-^3!QR&|Ee&Lb;0d~7R_?JVa7JE-VO73TeP#%Koy~^2YyajJElv{&W z1+@mt68urHs#$#ebN)HFT+uOKH9%w4D5{65LnhI(-66r70A0s358WW+!8+ZHp60n+ zdoMXl_xdFSQ$6IrxAjBC?CM+1@cl?R4gA4D3PY{kpFJoCUv6UH=B_gFs>B)HFwVQS z&SQkC(s+xt`E#(sBImj{ihxeH%ahCYN6QX1Mjdd33oz9ueY`}xs(p95 zO=6co-}^%r!lF)=IYHXh?mt~M28zYA2{j-Q%&q=<r73WbdTyZcrY%*^)V~`S^TooxgxYJ$$4Oxv$ zb_GU{io5%2Kz#M>2LX8%##8u^|8OPgVkFPDwfW4%(K+wKkc<`rY|nt+_jq534n?{m zrL!5aV4_2}fyrfGksDsD05>i=_-m`edvd3Ah}hJ8pZ&$@M7l zto;iE0$KxduQV#RDJn>|NXOe*7^x<8kBB?-q#0YFOw^>}xLe@N(bkiFylM!q>xu`1 z>dE$Uy4xYzM|pQ;4t2n`FTDZy$}TzWbN367)?DI=VVz8324?rpgbwSIa^us9M?Y*~ ztOXKGs?oh?StEKB5v%>=&)boaTY5x3&K?<$(YJYNZX~)a@Of^R)kXi$Q?? zd&B)_-W$#*SIow@2OQanI$%~o;MM5U6?r(IsD8~A)G&kf<|q2P+uP1GmW3!>t>|t? zIxwrCt>*v8j_>w9GVt>{>^X(>+)JiC)spu!1mIf*Jjo13QN1V+>WxP2tcCdr*-=G$ zU)OGd7SOUuF$9h}>zGZe=pYX1L3ARcRR80_XY~c@>qr>ct=*c>t86x&^Hy7n7!k%j z11qZX93rFk$BfOsJ*;2|CU-v$Glsjc9pSKf7;1;5)=R#lkJm?q$mT_H4hkgcJke*Y zN)G16MY6Bx4htf!Ez`Y}EnyoE*r(n}^41L!z^rEKesEB4p@&xfvCHXCnk|6(UnH|@ zoU}r@x7+A_xb>hFYN>qm_)M&-@oAMM&PkxDziVfS`)`fSR<$1&GLi*6Mq4^VGO>Bc zGcNQJF9UtX0;%zErq!ugyjH1dLBu))M^~!Y(64%ZtG~XHDXjZ?Ed0Fsy>0FxckI<% zMNjVL4i3U^^B1v$?12a5@x`(WA2-&57;z4fP4*UHZ40~KRi>9;X( z?!Zx`*X>%dul$FXna6t|hCJ3!#+u8y)-Idt;GR}@W6J;(9uk)kl#>e-3h1>WlqlQ} zQ%1f}G>@H?WOqKYAFdB`Pm7P@HfB6tg-8cM5+o?C&XcM5v3oL+wSCbTeT8LXLMB1U z#pl(&c>RmIwG?Xtctq;^6XmAO*EyHq>-;O8tfCTNA$Ccc7X-5OSmGj5)!ch95VcY6 zbbR@CPi`d~!72%%rc@?gam%G0)Ax1HRQX6>OyteLlJZ>lpXXM_>TS&9BQZD&O$62{ z)(UQ(L!aZmTR)1vtS5t_sO|FcI;ZX8pQrvuDpUi=;1;QnN8ey)xNN6CF0NGiaj#!= zuu4r39c=F&Fkhb`uoiq1iDh=L$5)@K*=)k)6US5pkQq2heJkVrM94Lj31fj2ZGp9B zYza%MU4BuW;!xiB}u;h`(?_rT3V4 zs^50^LZ3|vG|%KP5vq4|)@)Z$+HaQY*q)QS5DSVTQWHijhVPGMt0zIb@TQ07o%VDx zLrkTLvv1=tBM1?q-z5kBT&%B?9eWr%#@kCZ^#6@Wfeq!o-4;de!@Fm{dtwV#s_;Y~ zb%Pykux-%7{oAl=?)L%kty|7FL$vYc)u;f9xZ5`ep-D#_oDbYtj=a~(oaVgz=+r;+ zoqaFx`~^+=VE?w&XpJSr)O&0yqGtY_+cE#?cd_8q2IxJxb-=FJx;-zoASX4ht1ZZH zCDPq+I;K4Lx~9I0RI%LOXy_y0%8IS#<=~A`Uf2rM5ZBdc7n7n;#X$s6o~R->t9ceB z*6w5JVf595JTt?M=r4d3N_nFt9D1lv27n z#B?x3YNkezi5X%?nYoz;;eajoF3>A!4baQl{qy-t0|@~P@gW>L2N=#%y`xOW73L>! zcB0U%L;igJ-@u(DVVb$}xtiw*(<#qZWm<)nx+)^732b03I9(TkJ*Vev&Lnqm1%lA1 z8PoA~f0B1e_zG$iXmVPz1)c$0!d4ExSEh=PMuj-_7k*6cy~aWQARDM^6=6!!(^K7V!AT<|;$d?5B!enl#cb#g=Upa_n4xuGRwemU5NBMYa zD=?va%UVi9rNToh<-$JneMF-yHZk<1g~K#a*>g}0xB$}uXsd^%mWU2Il`22G8{e>P zXib_Vwa}OuCRJGD`$wu+kO|ROq-QeMx{jz3JhbzyaFgxKt2|>`R=^vs{w4HFs$)V{ zDTM#yrghtDpq7g%8v`;}mKm!t7ppc$R*@v>y`YEbt9_9y|dAzkz(D4t>ia&~QEfzNQ>IuS}wzN>Uzk4Lm z1He)B1YyxjbTIkpQ}aWW9zjDNN4|d!Qs5UpzR=R_eT@_L2*>yf0|u63uua>69gAnQ zY%^tXmBKF>4kohvxwRFK9a^mUuP&(Q^+j=@_A=~r&~$9cKOMSv#`;R*78s@es~OKoD>as9Wc$~BQ(WrtSNdwoAeyEbN43O@3n2=Sn0leE zy{kCT?WCawUdPeGZ?nww4Gn33rv*>@P1!fBq>jki$BUr^5EazZaXTFxWaF5ZOr;tW z9>(0LmwV{w1Y?Fqn?JxhS!10-qBF981P_jZy)hCsttBXxn{Yf|^H1V^c@OTR-u7;Z z|1?9Y2$N6Trg39hp|g|GHIke8&HT=f+JN~9)ri1Q4$^W3as*vtk2)mGZ@h>5n!ft% z!81bBviJ7TzclyTTmDwE98gMm*y*3WeDJdk*N+t;y& z1t#=}05e}JrB`1BZBP<+-GZ<+ni_mbIVhnix8f-~X+d6Sv5n_UU)gBQ)|wdwHqH5qkyT zuO2-{u}ix1{B@bnl`-DfiF3=-ZQm-XQ!)7qwLzATG%RRNQwLW3>N=Rfv5ON!{aay8 zgkw)d1tUztwyUK~vXuwhDRyOy7y$DL^PB1EgLa++)o!U!T}PA zD}U=C=CN@yqCqekHCe);SIbxpf97j(pX#|a{)MQ8u-J;g$elXdDt%w#Nc8xIaq`S- zL8B)Cz%sgEiFXor01<9I3PeMgoKm%%sc|AO40+&I=lSmX)Dgz+#Gx-(=Y7zTbu;QY zq|X3QYJxJg#*Q)Hl8mGI$Q}x*kPOJ1xr0NjTae~o3OQKswHGz0BDAd$0ND!OXS@`e zLM}w61dN7tc_2Du>(3Bm`auWMHmpOWeXW>LTWXvz=l&A`q=Q|3M^_e@yC*vAv_Bj9 z*IB`btUVM6b3BO^K#<6WM@i)`vK}9u3zMofymTLz^mOmJ!J9W{$tv&XvbyXlaU7Zi#|H9&{Q3WAS65T| zXIX$|8?SM)esjeY2m=DELqXI6vlQ2kDWil`N3ouh0FaOj07+sR7H>6AGsXPt-k2~3 zmb%x1SvCRqAh)gM!w)p0rXzw#|7Zxzz7_2WC=f*ISQTzkywEh`u4oUKf!NW=CrQ<5 zI*dn$kCvm4Z^BebB8ZLYD@LX#EezyqOP(x5T+p8Uk^s@?|#1 z{iGTUDXX8@5|z&kCM*{Z&sUp^qC^qw?G-QR)uKaD(@cDA0HO+DIPD6|(hT!ZPb#Tg zN6&OPKkuAFS&a0-!`(R;yu&8$3qg|0HWv?^`Jo!|d$EA(@EuZ!F_joy0edx*thDgc zPHS)}c+~UXg6W$9Z=e-YX+YrIGNVL+_TP!L2B^hvx~0 z-{J_RVK##El{}V1g#&b&H$;IpoVVY5GTTlF>NDpt)Vk%iDLD5WQUL-ROj5-<88U z>EH-t?OUWj?l<9o4o+V9UaApHX*=ILAzg K#<_<{5&r{1W>;hY literal 0 HcmV?d00001 diff --git a/img/logos/OAuth2_Proxy_icon.svg b/img/logos/OAuth2_Proxy_icon.svg new file mode 100644 index 00000000..5b0837f9 --- /dev/null +++ b/img/logos/OAuth2_Proxy_icon.svg @@ -0,0 +1 @@ +OAuth2_Proxy_logo_v3 \ No newline at end of file diff --git a/img/logos/OAuth2_Proxy_vertical.png b/img/logos/OAuth2_Proxy_vertical.png new file mode 100644 index 0000000000000000000000000000000000000000..994cd0b7c99d028b24e93dc43b82c31180bc8ec1 GIT binary patch literal 56575 zcmdqJbySqy7eD#{GK7?XAfbRtr@&B(fQTZEFm#R51JZ&tQi_78baxB`jM807qjaYr z2&kZdG~Dy>e(!Is`_EnL{(IlG-ZlE1+GodS@3YT7zSPpVPf5;94nYv*1LeC9A?O?i zf)G`t2=Jv{WqBU_kU1+GxE1fDmILxSvcynSj&N7}G4&%ddPUftTg^=BUn{TOWTX?;$~ z+IMl+b#ZAahY(Q59_Ca-1%4qHQb0Kb5ndRDf6iUS5r7}ky9Pwyhvo$y-Vi$tniBlT zv$ryXpFsH#B=~`X{{J;FdZYRhB%h3U|HmGMD%v>GEYU}KtiL{$+_-tW=;Xj?@rQ2| z7AsRffBF}NLLEkC+pq;7FGqbjD1#ukIu}>hZ$Akj%HS?93FXA&uT_HqrPhs=gL`a0 z@)tb`Q`-`qe-z_wWLSUwJGLZ%Z0JTI`8O0?ixU}E*N%PuCCpp>u_j8Ja9$Dbl}@3$ z&xj%-fQW%ebdXExGP^e<*I{8cu{a~kLHzN5dFuh4~AmT?& z_Ano3H9^KjK=|_23<9b5^N2tU;FGf*A#))Ag=t8H5o~*fwjV10CSE-unsO=d6+CN# zVVNn3xF>S}6u6E@kq5ewVW7Q93(?z@wzvs|!Rv;^`Q=zQDtS&EfrSWDsXnSAkt+bt(By>#eVEIwF}AfAn1s;Q}Bq4`+!SCZnn_JhhM8E2Dym) zgs;I+m@!BaBfuAkxZ6bks;5btIx+;i2T5tyCw^Py_v*17nCBUUr}J zApQ{=&s%;Y=28a0o50>&z9f>uh<3b1T(SQ*xx<{Mv=1($fy28MF7-y+@*~51UPXUG zOH+0#Jl_-_)ZK@$ju1HjvCbGnae-!sP1n7&)A~(k&RWmbbYtG>XS;Iey?#72bu6>0 zq?B(2{7ihnlG>ZKAQNSSHPvuh{-<+M?K{HhgLP}_gviQvf>!vtluB|=rQ5qbhCt_OMz)*})gNbwab*5Al4Cl`Q52>=bB9dHKST)tCRmXK$u5 zmEEN4{fV)e=leqHs&QHtk>Y>zvU2@*8*=$ufGg||i-uNjF>AISe*Ym3CN&h53{z6x za@8PW<k2HAPcw#uRw%u06>nHj(Mp%4!%m28M zS#$v=sJ>es7%tZEGzq@iU@Ta+QHYdIw#%Q?3e~C4rk_l}5aF+bRf)ykQ%A`}VeJ!>@Z>P90^LuOpberkE~Du^1J6)IXh`QZdds zswXmlz$U}3?=UL{Z+XN#PaKL!JZ?;R|}47)(&u4zEjALRb{@2CEG zfnR;PUw-l(hd;^rS2z^V`@8$=D_y(Cmu|?D0I~&X2QBTKxDs532vpxmX!Rkauot#0 zg6aQjRMvdKMr!wwJtc^O)am23aspcbKJ(1Dxi75>DAdhXrcPsWr{8wT^iJXyuJ*qT=A#Tph{nZ4}EOJQHLvuv^5}zYfB5y$COvRzjBWy#+JR;VdTTn}O z9}FP_L&S0}P8$QzarBQRmewd%_mC=E%pr12Nc7M-b(?x%%A85rEDbg)_E3526Z!94 z>C060vX`U&`FK+W5+@o`pUBq@50W}UU)XU3G=l=hvH{k{K6H4s)!k;h&yk~JpNou5 zC6BK_dl7iVj|%Y~3$f$JQ7zv{Z3FSv%hS_CRCUh64|5~uDCJAZFo9;Yg94#}h|Z{a zYrETpHXZ8W+4{16r}AGx+bok>JN3h!_bu;c==!10G}8jpF3kUg%L%;i8xU>Zn}j|J z=B!R@A2rIrv>-7@m0U zFkdH|z}B48`K}=zPT1D`Vq`+^<(W zki{eFQLw2*6Lcow5uKwJqW+JB)G<*y@@2VwWELL=gTsfA^OIgvf5eLq|Me4ez5~59 zylHE`6FKt#89?-R z*gZ!Nd{c;IS;XOE{dFTMYY7?N^CX>jC*Aj&+afS!Yb>2%cm%0>j}E_CjvlurJ%Ol% znC@xXGe@_Z8f6ZZqJGEnnxvS(=<-{pQ!eB+l@&4sF`THB+sdf?E7raFB@%uX7apLpxV`i_GyPm!aKC15E@2eUG+uYg^>m|jz~T3z$;01Z)-OW z%qLv1A1AtgdJqux@AwP1uSa3b@FPq*}maHxcTKA|c%jv$UN z*2(Em{u$?ev7)M2Mg4LSk@<|Z5QU%q%>^DXbQ_hZmMMqYjZ80sh?HF0xubmqbczs0FY%-LpbU6 z_>b|o*_oLsZqYlQ%?1gUBF6B0jGh@#8ffVLM_WI{Q%Fje~;{S|D>2QjewVmqAnZlb6{EDJc`l zKLuU0x)HWuXVntPX+qa?2-tn@B&!w%tTh8<0G)~eQBh^>7K{PT7ZCG*cCf+Vo zt*1PHF0ki;Dp{Iswtr6#kk!^XXD-04Xaw`U{1~la+ zgJKAagBM|7Tn@<{91Tq z7Dw%75LwQih5~gS4RWJH32UZf1Zvsr_uh${_B% zJ!ElXP%mdhyt!#(t$B?*xNE%ffxH#vHp<>-a#ZZ3UBUjDXgmUnyWUq;D3?6#LOJUz zQDgIgU^^a<@K&B08jI3VE}H?A;OXts`YONjPG)6%4MFyc75-Y)8Ef!Ps=URtL;?{| zaxHS(&3MkOOx#MPx}O}GEk6Ky(M_f`R>ouP{(-Ony7OV}5CewWfCi$;wAuc@=b*$v z=ACvIa);jW;43tv@(Z|6zKcra_T{$- z5zzJvf=?r_R-Lbx2R$dnWI&^?EbJ7}_DKs$w#cb%g@Y#;j}VO?b#>Y;|Fz148oC5p z>j$>J-s|AS-{?Sya^r$t@A%@)X3|eS4PArg1%RfPo#6V1zCNJNZyR{J$P-P8rnKbq zgZ9hA$25_YkTb8W`Ici8rKOqyQR0IwyGks!cCHPx`x0!s8MRa0-OkF=83R^*_dIFl z%0COX9DC;DF{s(Z+r&yopL1?Yn*8roT##B0`dOW<@70_n1Z1nOS>zBkw5;alz)si7 z+}R8a@Gw$teWF4%83Fyc`=-d@*12FcQVcr)DwD7I`*@qNt~_oi!%fz7eDf-5VlRa_ zhz!GCkVZwTr%nV3=-MOaeov^$2ZwV=p()P|4=Ju4=15x~_Of{7xm{S3)D zi2eC+L_^wg?Y6>k;ug1EA~DU2Zf4S~aF+DjNmTcZBeNlhASc{*O4j?uzeh5xWRC2l zfDDm@*Hu2^%6sgwQ)_P!(4F;#2q&>~9H2=+n_BX=VHYK2nQzk;?ileL3PIwp%TDcC zdR>O1E6UG3%I9tie*-w3Ps<$F5r{T;o*1d=M`}-T0RerCfBtG`m`}G>CVEmm-7tt# z%aG{&XxYg08Nk4_FsZ)csPx`^R#Fl*3(mY#k)=>7?PxRMj%`u13t#Gtqc1U(0j&~D zKh@;RWg~a6_)xCU@;rxIL~d09L?J(;wXR|+=2=bFmc@LKbEx% zVjPzb2ln}qe)uPY8KF-~x49=Xu-*A`LF@_6y>7nDCB|rB7npO2k^zz6+5;`O=;zE$ zF$B<;f%o?7i@NB=GLCX((6rj6RpX8Pp699$1@@?7O63IhV#pjatXi3E70B(Mo;M%c z8*rDJv}YxT=I;b|?U{Mw_19LErW7)jTA8c!uAD>q{~?6RGq_{N|7R!8oO7(80Nxlh&c4hss^Ah74|57@va9!031^%1cw4sd<2x%y!+^OhY1$%rPrPS-{4 zxU{V3hfjJ`K;M+NO#KtA z$>Ns%u~!I%GCm@{Xgh1UrA($hg~8Kem7MJst`#8!me}QyDv(xDh*W3=sjG{(y$mdf zR{9adHsEuihtyP zd=B#zt;`9ab<16b)lnjf5Q>g`$HqtQFz?vPtW19LeOJWsB1oLMfic%8ubA=vGy?hy zg12r;`?W|->b$lAjYWP4vgCJ+n7lYHUqf*zZiNCgb>fLyOfMta+b<@hudoD1DRvx3IoP~KN7bIpzXUxL4HkmPt5PD z4S65K%vAgub7Kt}>4za`TQh0vZx&wiB$1ruK+TG>LFb3OMB6w7c|QTk9zE2K9oj}A zl(OMEE>j<-AqLm47Z60*a1EC!Nls~h^o-Dqn4v#By+$UT6`nQfZ2E@Z#4W78HQ&fE&~AtHmag{Scr)w zFom2d7K$H2ko0yUOk-OnzZw6|!UUW2xJ!AX9$5@Yk%!WZYNY`CM`>xfu@?|P8I+s| ziB%3kdVo+7K&{z;S{rg~tcn*r8-ew;x3GC4N*IVFxLvz5p_@5^0}Kj$)u%gNFRJh_N~Gs#09sYA0GCuLu$1sOJihFcm@6AYhU9`>|%TFq< z#gTS>_G_)ou9Z5S=X_uetLhtAl)b<5`%YX4(vmmUZkBg`jSMI(X?8}lb#X>b+;%iR z>}O7eFX#3U07Zy2Kc|^Xb}95HDW4H>^3Z`Vvb+d_>LXHupoR`Ke^$6pTJqm zYMBFBP@j?aC5lWk3@N{(e|LkV9z5Lza&m{?2CM4s)}u6oFx_OnY5OAsbmt*?7xE-t zJ4Jdl7{FcpW46zC>pjfLN4d>;Cpe#*Tf2L~0FkGp$W`+wBeVvoj~!vgeTp^8`kni= zQF`hD^(zjL2^?@>)Y7Qo1!QEnuZnHlTMmk()DF3h<9H1#3~FSixAaA$J}`^y=w@p{ zS@AHD5M)TSgq&Z({s;}MqBnW*&!YDa8*c)56pw0scS)po@S>>J-YS4)2LQ`~Y0A_V zay>^g-jFJ3D{~w+n)ffzE$!c$v=B5uNlxk@aGv9wqn5x_6rdmKj>bMrvp%xc8w}$i z3OD3KQ>wm4kk57Pk+Tjbr!(INbao7S1u`VB!##BqF?~&cPl(N zvTC&UOW!lJiRm&folt;{mu?6J<)?kOtUvoq{nbO1paN~`D}J!)T9f0c_9%W&c{#XulM zC3CxXn}RLBPgBnwXw~5r%lg5?C-y7Pza$tca{rg%KV+(sTU7$`qN=e8+|@Bu)OStO z+3Ke@g`gj!0AhQ6bF21|?)MB7*9TLQD%8H>F3vy@o;|U2TcRoKi*0Zg3aq5jF86gC zXEXrYD2SuZ9A@6iNp|^naw7np$ij1*B18Z3y{jj}f`H$_vw|@t4{Op_S0$Um^z4GO z)N8&Je%L32pg1S7MM~}Ev3{Te#mZK%z#fxX?5df-pzEs(s|{)-RAXD1@;d{}j#?&D z7NTaQ*tJ(`UzZe#LV>YS?J@!^!Kmc=-%L#FVDyhBgyaS6{`It}3HN}6g_$F3C_n9} zv#D|6lCY$Ygd71RueO@G_KHIIt4cd{8QEQfwrRkZV72@Twp=p<;JFI6osk_uZ5X>e z?p}3+Hj{^T=21lD4*rBtps$0ajPu?iFqi=;^7!jGwAoZ*$?B|{EFRnuIj?eHN-{et zJ!X4V4ccO@>hlf@;jKrQQEx;`dJ|r`b>e_T^&wUTnOkYCmvQ)ies-!+AZh>#@Uw#F}*MzfKYqk?l%)*Gm z^~)7qP_4{Doa&;dB5h?maFpZ-%n|x1b~%cw2_c3$neqg*%1Ec5;-R z-CaGv2YtN=kmO@dE;pOazr5MkHu%)I9xcN*D+ilP!>m?G)!-_OF@fs7he4U=Njmxc zoAmKqxCIkflxj6Tv*~2rDZrk1jH9+NqYqIuDXJ{=8?lq=R62wy@56@{lpg`@2vsdZ z%6;85_0PB*u?6;bYl;bh6o#R-pV}_5lbfm0a91D&a4b>OF+ipO+a2No6!ERv%9w5V zH+s^9a2fQ4>kw^PnQpx@pR<<;Lvi+9L6-=OMSJT-*F<1YT=gW26f?#5$TmvxB zvv6PD$x^22-c5R&LB!`VQNhc%u;8SS^aR+=!CGS;mE&*Ar=sPGe;8tsz1<&751;pY0BHOkF*1W|w`C zyc{I~V^wuIPzp2DNO7WEz(7D#EMIa3hGrJv#)^@D!a%Hy#jf?MeP$Tbq zpC>I+ymy5HNBb^R;;Q=poqPt#HL1%{<&HF_e(5@L^QJvZD#bZZd8l)>4Tn4d$4?YC zpIPTG0JhrZyU;`IVyk82xK}4WENE5ZwK#W2mXJ8YK4H;16}E||ukd**K&jEzC?r7O zw^(L~Jw&=SZdzj4WJw8yN@loCGXYXIIPBWcYoUiT5AbUns3tOuw*V#nKq_0zLR}K- zPZF>qr5IvQRe;T1AQ=rJ3KJY@I&0|&=oI@MhwY?P$hIBxbSAoSgef>Fe+We0j znvcPA#vEi$$_9tOeB~q z&L&gc_ZK0MXEiU*ynUeP@ps5vcjWZ2^fVpQCcUQj9)$Y?IW;PpVznZkg9k3&cMXPw zrHR>g0%dZ`Aex@`vC`$ep0%aZgJdUE$LUX6mo)Fg(FF@piGXO^v>bxQ8n3H+KN->L zng9>D6N|CFqL-tF!DStdWV&qa$oTbr;Zvj3qiv@--N|NYy@#RdPl~ze1u7K3Z##P_ z-PCO&#dxzj+IJQ@XdKc(pUVC;>g#^ROYiSHF?XQv`DO3Z6|>%bhrT&{EI#=hBu=&! zH55ZDZOR)iE`w{?deK zhW63wzt~RpP{uLR5-Fu6R3cspG@=gSMmm|J)RGz+8VCMV5#U_4KEL>sYvaR{fQO?b zP|LLMzk(-)Cx@y{*bRSlfXoDd*t1%Iy4pX-8>o?Aau{DSYt~`@7}tQpL+ zQl@*6O7;E1Q=VNdkldx`;l%BVdE2DrK=N9E`9@7ojd$Wpi{7Uno1!isXa3<#`13(s z``qUBNZZbqBy71W8Kyf%r}f|^(0I;a35UugrK6|e#d8rdu%N#K&6o}IJc z*Y11IMJwiUV(8q{t%+>o^QK0dQ~D!aU;XW(C|7FIm&ZvR3=%+uYVL&ZTY7E$-INBc z&g5#xDZYjABm z!pN{*hL4*U1a1B)$aX9X2biLo_DmO5qj5Rp$)C$t2Yl>86ooGG>pf$y;mfL($<<>*jqQ79Q=Ay#LVB z<}MWJ-f6Ws=vS8dmkZZ5_C6-zo=t%Ww8X7ppp*ExEqD5Xn?t#Of1&s!M>4uC@|vZh z!TZc@)gNtYX8Z5Oqt8Q~_d8pP!MZ`-I>U|jgbeKQh7UYJCKI=rs!BJy#G9YlI%on) z9{_lbD(Y_}J#O3AkW^y2rDh|_BJtB-KnE}^hnsj;?Agd_zCECn`#QffO19;F zK!AWOmzK-!@B2yBAKQ#XZUmHK8xMcA$7ek0D^*l>qhD^3(`0LQM!Kdlp7|Fv}$*L4?*t$E*4 zB&)Li6AC<9szc_aJ>D8>D#ivJJzi90$7k}xz7LCSpwQTiNX!Ct9!uBa-y!7ypqO*$ zKQ%X!?Z_*^?~iPVJ!=s#@GCnAMHjiV$8Qv>k0AGHMlIQo?{sBSy9#smK=Rg4Zu_|N zqu4ArmR6byHBJsT)xC&p3M7>bZ9r8C>5F`(6zvft6Ig;HzVd3o9|Css{Yv@N&#Ww8 zcF_&IDzOBD-tW5joJNp|G^6L@wNdH~Sf3`~mphea1+{E$bcAiqXu3H}SGzjeO&L&8 zPoTyu?-JAKRMD4a)Zyy-pauYQk!({N$R{GW_vo71=droASM?DL|TB)oo{RrsU zdWSkzTB6?EZ|k5&UE4(eUQzu%5FS%2#`5PKs~vwt-KghFvW zFGxp_AZPondqMb1i@Vg{9t!C1Sm{4%HwP(mQy2W>O_42?SNdj_&V;D3b6hwwo@^|$ zVkiN-8;p{gg6s`jJFG0WwHO`xu^82nh_$4Q5af;Tn~c^@0Nh~1ty$gG8u5lx~E};H10fKapJvzA*af zog(R9@f~wQXn%;%gTc+gtErZ-Wgaagh#FgRPTy_b^#B;jE?S6{)-+)EulA6Q#yBGYObUf5q zTazGBEVc_R#Q-@=W9@~ySXpMXOYZKq=J5z!Lyi3;mNUd+K$+U7=r(FEz#uJ#E&GyI z(5ZBm-bxpW&#Vmt;2;2pbe$Gf%W%BM6V;tmB-#e!rG9Wqm_19dBLZx_3U~lmY6_CdN_%eX5+Y(}`)asn=wfxd>*7!COB7 z;AQIXE4SC93wUKU>0)a9@au=dsVuOj;ND*kkH2M2VjW>+!^v3!Yx4ruW6mWk+}zwNeyLPBnU7EDkETaa$Rcno zm%jnbS~q}eLfuWmwk`cMd98i7X+`&MN&F7!In|p9;1KO8mViD8)+PJ&ybxy?#Y(FJ z^Rs&FO?s2c7RIc4R1n}t(fg*oT(IHwCrOVV>(H0ER<8_pS6%1B#DU77CKW%Nb|GM2 z8jNYjBJi~qXMlHE?Vt3MdaT|_&WkEV%-U#MBv6Bmn1|nWOt;v8AKLLepZC$aWia|f zr-FJe76Bcs>@2SAm_)KAJszS3MmD8_#owro)v-==<%&g~2Of!fNT#U(HrF>ZKu`@> ztfQNQk!2L6jgRdXAL_~o(&I&w{qo==u#t?IjQdpfe1*Kw_SAaE*WDr3I&mRhPYH9{}dPnR_gLIclvtDR|z= z%%DuZHHr9=T6>i!56A37Z!#!_v+sl9*ZF%_*_Oxq-D`QfDP01T0=)cfK+;w`YLE=w z_vkKLdk$cv)EL+?_0aqR!73Sq(r^;JGr#{QfpFF zuIRn>T7tkwuwtJ4+*AZ|07|^yW3E3U?63c6DigV*{>PuWP+qg3WFZEh=QGgs)*L=E zwrfLyZeWxzcZHHtQ(d{DP-v{)l5zwwp=cc=*SlUs6KzyF!YPkKj#|%ta z&81t@L3543fIU+Y5{SBg9eSJHN|<^^d4r+iAHku!KrNuLx69)=mRr+T-5hMOB-8=F z5jAXsw}9J{<;JZluL(9V9$8_r1d!2N1ht&Igz=;Qv|-}gB(*f|&uH2h2U^|pO3t}k zSU7=bJpYUYid%w}^8Gv;SpN!8%C_*GJf7h2o;VryEPa7{8`ry%@Od`}np`;lLh|co za{i5&DD|G+51Fg}Nsq7Ld5yPyDt#JB>aO8d<(W?|J~Q3bHXPZozO^@ zWml!rk{cuy*WmCZ!uN5{yYA)_-c41UPpAG+hzk_>1(?YXh1!J|x4sGspZ?bKSPU>L z28WKi4V&jqw{&IA^FZqUQoY+E$#Q0;rj`0(mj1|3QowB`mEdqmiYreBR^ix$aVxI6 z5`=yDJhg!$ecYelKs0^>B#&5Q_0z%8d;RG&9u-F8bGfFHku|IT4!I$5KOBv5h>jqYff zYgzj0g(Y^0_&n2rCWYd4aK(PMluh0nlb8Qej*cY38I7%x%&9rA;HpwnJl$w{Z{R|l zrHDbb*_fay3DgP)t@rpgB)zHy`2&n*_B2mFU{AKKnKr`LvBowMlvjilXTHVpzf7SdH=Xo`Qrz*IcmapzZPca^n>Iq ziYs6Aw~@05$|`W4j_O>^^q7ID)272MTga z!2O6EX=97L6CV^EE8bx}GQYq8qVK7-!+7Dr28#Wcv(o5(=kp=RF~%C~@_5p1i2Xh| zyXZlOByC8qeZfv*de7tmeP5*-u zy#AYYb!`N-4fo%M* zy}@!TCAM<}xf>ENb`6)PbHMTR=BDZ}Au&YH2`<~HZx?ag+@VO8baR+5I!vx@wQj5F zytAYcad89*_cveaTHUc&=v<$MpyhYVuh3kN)oqRauY4na=jGl4cbsD3;uGGSo2udlmmr>50LAOcG1S1A z-U0{u>jZ=(H+-%O1&8%;;u1BNoT_DmLkR*K6A~Z0&1Y40u(DWBSMc)HcU}`IAL@Hx z;HI=1uDgW4S9lfFJp<0kf&0GR4|X8>@Xem3_psH`HF$fIf7Exb_r8If$6Mo!sNj4o z1f?nmhp%&2r%Sa70?2d%2SOG{!4?3($MYkhSj;jzuBNtAF6AjmB^AMtoaS}B2hLj{ zk&s-O@VHHKt$7)gx_AvqlX1I-hXy)PwI=Z^3u<{1HQj~DomBeESIxTW&l34$7IHl6PSb!RyP&0yur48mZBVlDmaxSFI+bR>w& z0+|31)V8zm!eb6y@&;8aaCp61dM{Y*|Gas4l*!I+{^3Q9{ZQ0qc*lCqYY4m zg4zMuk)HRHud|+j>ln3m!emw2Q4@_Nr-D@ReHJKC6_(UjPtDX)2EYAUnf-~mhKWl` z8zaeC{~RNXk~({ALXaS_UXv2pT&j+ugqm4lbN{O8WgDgb3T7?FPG`8*?W6PCjSJW2 zjKd$X3==rMjD8n#V$(S6us4o!T<$_mGb+EmCIGRamlJ>+H!@|YhLGvK?dFk&cM$b!Q%V+ zaevs*Vd8(msQ$3=BOwp=TDu1-yC5>YJU&f%@VESqsk~L+ez`oj$nJ$LDF0MW+^gEE z>A=t9FJqIhSV)3dT{^(%hKYvG-PcB$;8tJSdbF=`u9?cG&)(=#QQ{ z*@V}TJ5u5JW!XXM$bxm23P6s4{2AnHrfx7C_cZBo2kft74?b_e%9PtUckmLd^U(A? zFS_s0E(qL{N5UbZVmO-&%P*Pz&rTqYhVw=sY@c3qZ<|h1n?USb0awGQ{%&UD3~=)U zClq#GN6s`~9DioCKeX0<`q2o*A27HpHsI;evml$CHF?pOe>h;pJ6+wXk7+Q2Ur-Bz z>fz833HZ}tp7dDpEDl|8uPeV}rEK6<+4M|I&B1B&*A)E- zA6h*u1Zh)7Ob!L^0;j)D;+tN-@l}M)%^_ie-YW0G`R7id5#AdO;2O66TI}?(-{Scj zX9a2s=Egj$GJNUhpxWJl)8BIGM~iHyyK6ZIPAR__ijN+ESmVGGwKL-cqKAZ@`yf%# zQ&^Wq@9W2~{rwoe+}ZsTwILp5abA~cjqM)W?(ua9I=?A*GPQPZ$0^nBM|-}9DyVOG zXyqn*GpH?zvdl2KTmcC)6?(AWiV}!JXGq`h`@5?I?c8I90 z1$RIOs1b$!`234&|Lbu9T=qh~i()~2CRswoHIKOlz~hStMmxTBe?l+8IttZ0R=9+` zvJLGH!7sDC?J3cPA5ekP!?sQB{xTk1A_s2&-muf_hH`6g{{xlq+usPRL5hVS=Uy<6 zf`ccxgAvp=&U}*p=X!%a8Kw~wCP)tI{&^7s?u4N7tB%aKsk|jnW7k`gO79k9rB&8J ztP2k*!t@qD2tk^E_{aj@Vl}?-F6G5N@Mas$G5w8+6#fJX!9h1iZGMa%xcl&4w58s; zjU!8$zN{IZ-Fb5pGuRQ1IMOb>?iozewhD9I1=rAB3(?LOl-RotJ19=KhU(&om9Z+50WDda7_~w z_%G3zE*j5u1)N7ANFbsHNdS^DXEfn?0DZ$fcxzBU6d_Z}^{bWy^#783gO%jMSNHUl z(d~+lTx-Mu6H-7Qpc&CBu1jcj0dS0fAOmrQ_c5c0Ea zdVuX~;l-=0g}>coRcl|543_P$!*gv0Uj2`ZS9%5V2L^`MVAcj!k)0(WIN-ln7-mI% z??;T#T@WrmSEBVzMkJbmZ9t&JwXmg#sLz1t`yh-{l!#o82(K#iQs;oX~wni=BUe5&Nox z@7p?^iC8;?qtiAQ4mcQX;|vN$APshMHw@tq9jpIMcKhsa26Q{ESeRV)kpC3jrMZX$ z$E*A4yid%@RWO-6{e>dT)h`*p)P!4;{wwU6iWC+|2c8;&vR=wqR!h2J4jvlPRhV?w zpMASgW!-f^J34+2$P9|7+c85K=p;llf?}w`vxPwRXB&&f1_$aZfrb~1;@>21gPyty zMHp`}%j!MATxawdbMIPpZqn{#e&n)Gj5*`LU8^U3v}Bk#@T>q(rW|C0Bgc?m@TkVa zPZ0wAOBW&aXlO|mJ&^fQMs2p@aGkQ0Lp%}#TP~eX&Dkh=Ei`XAv zC1QHmGHFbQea5~SXR4I`r{m466ijAmgKbICcF7B^po8VrZ_x{p?QdISu8iKT4-7jG z){lPm;xl40LzM9k;S~w^3RGV0!Uoz&GKxNL8_)HP7>+q1d7(RBih&T6s_tB589mqN ze5U2D=xf8YF(yFHt!I+#Y=sMyP$MqQV|=(SzHh2nJo7pGAGypZti6_x`LxiMeWqe=!GYz946&3pbTQkclt7TF#&> zy68pfRj^IEKhMv=mRl^UF9g41dv0KT9 z5k)&ng1?muKk9hVouqcRUh6;pF}id*zg@3GjS7TG@PH1kjIIor`Qm;z{u?+$J66Nn zZJ_c2>YQ|!iZFViH9eh_1uHM>Uqa&9`=G1@(s!ZXbST7;34J4us1CmZzARsG;VSA* zn(r+F0|S5GrNHQpo&%yy)Q7ps3$j9i-ATXCG&qC)!iEd#tW`najJ(El zrW;Va#O0{hM?VZ6{D&aClz`SiIL-9AxA=xdwIaBUJ0t%k6=5ScTKzgGcXvjEX$(?c zxM3o+RjkxMJwy7y(IKQ2_5!VbBb0SA1N7zI^nZoZU~Yk@>-9L8BCh96(6Sd z3@S5pFYsfoGPw4FqF2yh5=+o_c@Qy@`hpjpiY5i{TA2xKkO%dNFcgrR2;K*P|MWqg zmY&DG0OY~H33)hzPzP#`jinvMiAM<}##{jFwqCyL;}hH^_2@=NtRHvT*m=-nhgHD2 zeHnd_f4;7fI!@@(+t%Xtw-i=vqu?(21>?5@5FdjE1Q_Kq)b+u-EUotLfds;+CM?Y!C8! z^P*+*9+{vk(1Yp}rMP|J@@@aO9Bm+} zef%MnijN{Z*Edqkc67Uid057hIuW746|nKy?xFO2qEc)*4)A_-Rbr}}?ZfQS9Ry+%)n=e&6tJi`J1ZFzt1 ztvIv2|1VF~w`%{-s9wxWA}0N8BkX4nz=1d0%4Tb_+c&V}Y`M3n>^aIfKKStT6hsRR zNt!2LPm8@jW{jOb4`W{-=l;N(q7kh3*4L{stfIp!o8Vo7d>$NSgzgQzVLZ^SUy9B= zIjtB3b>bl9Y6oZ4U@1WDtS*nLgphpyt1%7#VgzQ`Tq|tXaggqvcM; z{}0jfJovZe7z%fmzoBAqPxp?2+w@s*CGfna_%aU%Zo=tIbr@QvN2zRs*TDOT%32E0 zJpokSz^}OhY6_kGWYCjv)>EGm;cNvI?3?p~K7c1aFvVGb4%Jrvrtnm>QkRra@zsGB z1Xa)A=YRjkK;W~xDTX?q3SxlrAD`_j17khvo)ZEPBF9Dyj*|jwY=hx#{O=zw=zWZw zHxw)5dhtRGbJf2Mw8$qUSs1~`he|)WCNQjB zy1c;a$*%neko;$!6EYdWij7_dX=dL=FsByw#cutDx+lw7l-QeR?3wRAJ3B!77hN>g zi`w6+0kpeY&+f^5A1sqWaY2%OLo&(|`vNBZqMHKv$WC;jE$I>9c|WM0se%I@+G1i~ z&2Rvse7rbmTi_l46M3_{6z%9adY31WA4R}8xcphtWB?}nqKk|K_!47XnzO6((BN?= z-0uFh^Gy_!$h2TC8gAoyWT4YqpQLi;bDWjH9YCVtkl-1^dDK7QxgK$eRK06WdcixX z@}KJ${ILB1`^8f39 z*JR3cn5#g=s_)J;*G4>iunUzxR)J`8^{3)Pr^be$u! z3NdgOo`3PXT(a}Q_RGeXGK>^M0YTrJn(1H2ysDk>v0M8YT$suq%*EKL!7x4%?Y8-w z0*~Y(?9JjLDECUxoZw{O{d50#@5HMCYJIAmicibJrmY$^cox~|KQJ5OGQqp>=Y}D9;}mkMzrn^`a`iJlud`w%5^w$AkvF=C{ya?t4r@nF zg?aeX&^XNt=FndY$6at3NX-6{QF@Uau$wj4Adnr`)rFr@-60+#hvQ~FTA^G0h}g{c z=K?Ix)V1b;2i@?=r{GW?Y21ekU=;L3_%ojCGht*QuQcw#4RoF4A2`I!5&Ya5eBEY5 z<5hRkzR?=RfhX-z4fsAU%FA$teu{8}6vJ@G1KyP3i|4_)=K}O%k1^!lwwok+Z4TKf_Zk|2GxO4~m0Ap-xaP;V}Ly_kfTb)_&zwb*=Lcy{**OKYzOR z3OtGhg7x(Ma07`9LGp4v+2y_hz6O@(TpG2qo5~^nhI&|hT zqjN&S&oj!E<`r__n4bC^(oyGejF`hAqjE*Fyp_6w2CXk2-`SEVY+I;~U}pl>s5OcH zeHFdWDd?5)pqypN_S@S#WEcjXg)8#l6W<8a_J+86S;~A_X%;cIkO%jmLQRFA9yAr+ zD79_@5pi5MjN=dAuT^02dDq*XY_KSX0b=J>-cexenS`cwbq$BEPm)(mgPAmL!6JM0 z{t;RM*%q4I-I}D^ldC%hzD0+8$(S?C7UJBq*Byez^UmT-=L(f8GBT1F3i9&sTnn=j zXG%~gVj@L=M2(8S{8#-y?!S7w=8Q(Gx4grZtWq4Dfr>%FmyCdX(~$S`MVpU+Tt*m1 z6JR5T7*%&B%dyXpk=;p_;GZRcPybu?wAv^Gv7i5}Y2O8i$#-QDbUdU+$I7i1(FUO#^n*Ou>1pblH9US0S!Y z87utn;M29~anNBxyssmQ9kgTYf>hLs(UE!uDtANsvhV6wg5BiEpVxg9g0!ni|M4}p zA~n)la@O}84BPKRkS_~GaW60bx=%N!EN|1VZz@J~lf~w{+wMcZ89+1x$HFrtuP|v+ z%?9Jik(rI$fO%&{(omb>+i4 z3=aPk%(ToMIc}MsuAk~3q7y<-GwqU2^C{DtPL5H9xbfR9RC!+T1)uP>-#92J9a8nb((19{seDD?Zlh?RGunI2iP%2?^pXG=@;eo{Fn zF}ngJ-BF(uLWUWn#9UFk)jIttufWqW0&9G;BhT@bsFxSlWSx{b(=7@JFH$%wrRs5^ z|Nmm|yThse!@rMNR{xNyY_|R_oyO%X~VX>ha zfJT4H=Il2Gj?4FygsE87(E;Yn#i_#m=_V2;5#E`n6UfEtyU(_TS@*uT0;XTsmK@rso)GQprc| z?r2+hPS*e7wh*GNXnBHql1g}u8}s0=OH zyHb|eqPvX*V)4qwE5}Mo*(7U#W-Pj*12a7}DM@kU7`as3 zfD@cEM)ul@Q*w|Z>RMiv@l`9NL#ERvOrn++lf4NLGp&H59Nc*8A3*d}3bV=zlml8H ztyjiZ^1TJnP^08N_`Buj~VH&l!gSFidnP=?4cJkk7Vn`i<7+c8`b|(qw)Kx$rZgGE8P*urwGAO;hd zL*bZh@xK)&LlP^>vUVTam6Jv@W;S5JYwG~q;&C*h(*x(mLd7x1|LcGN(G*dL)*wS& z6aK!pN6SH41UW((Hmo%!`(b}YYW3h$d*_4e%7`Ee0NCy}Ckx&m3!uCPde_U^=t1OM z?4&gPLZ{%sRQ6sDZBXBF=E>r9an+OQ6CJ$#^fVZm8qaLan_)!o-m6kLPQIDBI#fO_ zI=76}8*9oi;Kf}ar7i>9E1kPzz(JHBZbIX}jQ8(PKrdOeg$^P-#Xili0)rv5Y6}8d z=ddEne(q05rr7>Go?8ASS#Ou`YeOYm2Rhn5#5ZIht2KH1*LSaHv-kQ&ug`pXc3+II zc0pM6TIsUi|*a{K=$cW=kAM^yZDv8T8=JerlZ-!_Hs!<+>9-J2xAl>J!$7 zmbfkTW0+h&9}duMqc<2=%&?Z+YGnTxw9Jbf;U{=rdwW+u0mvN#dw? zy6vgd@RYxXvrEFCT_nv_?JE)TnRKQxWhzGQNR!t_DIkW%L44o7eckczQu-*aZSjbGZ78TW^f{8o=OJGa6+cgrvgCXU( zwJOCIp|B_Ki*8uQVg*1aCHKdKifR_P%v& z3M_pqXk9m8TG3`GC_hTW(6Xcm9I&x9VD z9q9ETa^<`KQ9ZN$>O}G1gG?CG9Df2*x9SU3C`OQEsM57Hbu5=b#7DlW zRVXN|CxFqZ8k?I#CAI}FW#o&T0uAAW$!0b_7|z64i$2*{SX9Df17HbM*v7&8M;(HY zfg=q?N+kUJj($a_kK_Kw6#dWf(u?#b$38tVWkXg@&6!b1D~e}Q$d ziC3xplfHU~x#~vlAVe^?>l;+mTt^NN5dx50RV&)ffHC^+a0vd5s?6#LH#Sb zj<*9@g5`@0AR{~-BSpMZL_za~!tu75by+MXhQ@jJk(~KJH#VdFJwnTe@p*YTSp}bi zrbQ=yIe-~P2vPGHj;5Vyl)I{33qz*A3Ov|k6YEz7f`Nh~7QFldnG;9x#2K1KJP*5p5W8v^HY%z`D;?xhgw`CGFXkc72!i-Tjp|(I{SJOU*yvp_ zkPi8Kk1|n1$J7@`7(D)GJE~IR^Ru!;(UFy3zc|rMC!1LZy@5xU%Z`3kB|4(+2mZ}C z?+3chgY>vFbagb1vQf^QqxQ`^+#V$>4+;+Oh2e`Ap0U{bC!;dh^tYVSJj25o8t3qe zWyXLsBusx)1K>qTa6tE#I!&q-f2e?degey}H+}v0r(vt)G;{ZeK(~X-d1-_zTfzNh zGE^>TpmTgDBBeKfl9yFix``9_=kneg8Ys7KO+jD6uLy%jo`DDl?aw>TQ=EDxB%BX4 zFCLw}Jhg`QY_4tZ)O`S3>Pm+pr5JAyTI5snZ_`~@?Q|ZrxLx|CQxLsJ_-J~;vZtEp z*~xgI*C&7XKh&`we=)oLw}pRbF?aYG5E^#-wK*Fy#f1?T*B2m+ml84O|e36DgE*?4UoqYS5M2M*5 zKS=X65=vv5F%7jUX1UwHRn20#8A~sTD>tLIg_dE^2J!L(tSP5IpV27<&tuYK&(bf) z5iW0*A5LtX^IgeRH3AN&(tQIC!}WjcT$_{>Fmbedzj=7Z_|NMQ5xGp@zS}+`h_;b8 zEoyi5v9DN!WFJIO`#T)J)_0iEqvV*=@=p<`aNU*&oK8FHEj#z;8(z3b(yced(ajN# z8Z69Lf3j`R8`HSI7Gbp(AwU+@-nmcfa$rsHZ+d6{Dd6`O=KC30wtqsA!^yq}e>!j3 zF5)$CUM$zYMLaNNKp;ZG*13yQ-%*lMN!X4HQGr#iZz8VzBNB)OJOV)9KN?D^k>gp72~f$i%I zqBemr0pkgo`BB43_*r45g(zLUJ;78?srvN6juA<7PGD(nXY-~NOx|2+&SYO z0D@iYizLXpS8%_mnc35iKgjNuk*I0G2}xsFL%8w8q~z^MFa}fHa1&-2@W}JQHE10c z!}=}_n(1Ss$xybuFMCGpyqU%NHNHEh>5~+bIZ6()W3EX3`LnbCD~L!TeQKlmHre$Z zFoyF8y&+0pne4mtTjIf!IPIbWPgJ&M%3Dz043DXZmhow2Ep9TW8g zb_yaAS$7KNZw1<#@B5!d;jAS>>d(PRyTkTgN{?f=9}w-uF%%3+6CrG~z^Wd%`53`z zs*iMsV-C?6^L9}VXUx0wZI=q zBFr|*U`-5!=aoJX8jO%KHTkn>9ELRw+%9vF|Al`=q|iZf%TMrrOPY85B$(72v!73q zan99zUM%IfiCY1dmvOUfSjuvrYdvW^DLR-xISx$mZgS1Ti#UE&M7{>F{b0n_<)h+h zk6B#W0C4_+x?F^wd8b*7Q=~8Mz55*J2_|s%=qJ;@1I8K;FXbO*`87^U?ZB#!+_?-P zG0WQ8%p23sCXxO6j*$)@<*$2uk=g=#L=B+rkedwp^G04|Su6=Bq}qW#_-N^g{nM2r zWDWZjDB&1srTDoX}ulN5CXS;9lyONoYfG{4Wt}~iKFDeT?p&1&;i;^eE+5p2SQHjx-l1E-yaO+ zOn`xtVq#o}V8?>|&PFrdcW;gKcvalDTZr!Ei2!LXf zYo7-y4tC1|Ui@Uo43}LG+;UygL1gjj=vSuwc9%vPNdjo;@t5u7?2^)YnIF6Ycr%M9 z9VBSP_|qNQOlxZjdc?^2C@O7y%ppS67`|~KTTp110(+@5_g12&PLo`&vL!5s8uye0V^;Sdzb1}Y#DsnBk4+0+*$xmEL&UF9>1O!UG}{8P+)fQtPWJDGbNZj=kY~#`UFTjrGylkZ0pC z9}$W)Ye+N)DR!p~K4X!U(MLwmj&bwmtf9dR;krS{HfIC)&w^V^s6{t=qH6)|F^ z@3o1tzGg=#@>}2Q2HSekuPzX`B#Q*~1+KJ+)0L6?f7h5mm$+L%KAWCj`Yead_IJHe zZVjV^d??YWv36y&IWMmKWNmawWP=j3hk~#VfkOSGx*w&5JZ>H6s+H|zf4&5=)$Nk> zn95dDJpGC|d1y{EB8%EP@nQt>jpX#{r}jm?ZDDUN7pobmj3P~i6)4`({71#P>DD{r zfx80&xCz-z2&eOg6|&|+IcJMmA*%Q%kIa9u3o~04kOV;N!O|fCewtNj?V`H+2?Um! zOCp7(J`WQmr0}u6oDN(VQ~XB_pIGQvj3B3Tmvv{ReqG2z*MXM(B0{I)L1i4Nse=NQ zE3J#RcK^A%x^)g8$o=9hBYoy>-oFR&TC`bX^Ur*3A0`b{mg>Em*F?jl!~tEEB?Mss zr=q}=_DXQ*Xe>459~GGRIKs!lAON6t{{v^KUTCz4Sov@X;Zt15!`Xq>z$;}SourbV zJYHZ2gGO%pK(#sn;o2;&^c#V43Hq~_JDs)kHB~~9J|EsT^zgg9WBM(bZ&UqQeFRcIVl5vfQ@#qs; z)9??^%XzNXgJD(PhoJ>pt7+PeV0!hj3c^`G2G%f8stfZtJEXR)#xvNH5=jY;J3e+S zY9c7m{FWKSFy|w2Ww!$Ha(lap;-kqy!9!@)gWy%YmQE~a)hGm^jxXQbctW(2WkOo! zZbibG&LO>1#t$YrkAD^S;bzz|On55TfZ$}%S7>zlLDWqy3DSn)!1l@9o-?<(C4 z&J6`9WO_fS@BbIM3H-Zz@@u{aH}S7z?aSvI+p@Tfmr%OWQX^X5=rSSH4JcGR0eb{& z?Mt6nZTvlvjFu9=^9qrL7?O(b)L!fF;7N6lj)dvg+?No^S&&AhgwpTh2x@>~evhx$7 z5+BS!i5ilh@Fdv%_y+Neg~$s}ek%{p)qAgvrps7TAcWjY8&d!mKp>*-Z5qf-^zyYN zXMh`o1+Lp7-H;nuxF7qW%M!=?11igM#E29OOy#okUz?$!PXh*e`U$OD$$yEj4CUtD zfACY!%R1o2G)QSmDH2K ziH!|SS@N*o+fleX#NtwVP3hF8XXby+%do`&x+aSp9|xn^pVr7&2j60~$NM~#-9P{E zDzSQ-)~ z6M-93t2-ynmBK%sK(JZ*1H^Ox!vf%Kq1JD**Deh{o1JTz4|xP#2wqMu6si2Yebp*f z^Kf4mMvo7slwsO5{&JVmQqvNIz@7CFO@4qyzD$_xF)wPM_$5=#8T1*rZI)t+|L&*( z!fEs`8j=IwV5#dYB*+b_?TrZ44;fJ8BSpfM*@bU95)>9WL<`Lh$PGN0)QxnrENjR2 z4CFt4OC}Vkgwh=Le>FriFQQlH|34mTmNy(jiIGprhaE@VB|lJX-b*s@ zAzk_nt!FIyqg6^_<2)R1CHYZn@x$edmo@-L)Ry*Tw9>BV-+N)R z(NEDm+KYcqqxfm{`L#rRd#f_`9|7Q9BqDXlGi^NIh+7L&GSH3bIfJ)ZL)RlJLq0v^4qNH^ zT4Vfi>+>)ny*oxqbd{((BGRQtw0REG@!0IBo2)#8hV8b8%k0liW;sD07{| z)6W*7$p0KZIHA@L-zPaC*yIPRl}kjL*@&wDc=Quo`+XkxC_|(avcBY-bJcY>7E3BR z5vOMk{bjHb4lCk$xx4t|0q0{4dVgO71u-SjXqW6SqyI5A_Z!d-)dT6gT&F-^P*cQ~ zRArTki=O$XK)Hb(3PMCuI1iW8pJ6ET$m+?G4zqQeP#MI8r_E39H*XGduQ^=`1E5H0 zimrQ#Rw&Cs$CUGEDz(jK;5JlC!J1sB&Vf%SA z=X41WRy61azm4}Hz!e$PjdDt1_0Usz98QW_^r}SD&7}hODc(%Kcu(DS`Lu#nHovE`H!wUy6eNt=LsaBiBV7X z{!g`VRad^;_dpuorUo8o;R8ea-b*_8_U^T#EoA2&c+(q7hqO%M2gqXPJre31$B8YU zA*Quz6RKqtwFtm`dvWAFu`x*tY!va{JIi(b$#iB4XpR|^p7kcv%nT2C$uhU{Y93ZYn z`OxNzJQG_`k&CgX9TP&PmhIg8P&Wge{P4*>r{*RrWL%T1Q5B@v4)_15Xd5SGA};=2j{{j%!JACa45y`9c3fv|T(mQ)n@gbzCRKx{dum6k!A@ShyA z)yJ`q$g+9*iFdq%*5izT5s-66<9vF`6b=_FCBS4w=oJUOy`UY&3i$?F zQd3BL-#a79DLLcI>;<^0Ea@;}Bq@0UWg?RMVn?i&NT4zYIPp$!TzWa8U(1l1JNmdm z!?&_(I>t&ORtwve{r6wwxfufCMlxNbdUU_RGE3+K%~(9Tr2o_z3H+KIwBLXK;F-0J z4(@oP!bblA^p_XFCQtWW5dpiuO&La%ihWf#UQ~gI0MvwP zYOA_QHo&IljI=9X9=Q9+f8QIs%n=rvUwqyk4xuQBN{8POemA*sL$k5JOXTd!%f;tU zU2=TxK!ln79Z!S^a-^ppnK-&B9*X1^oYNRz!XoXi=vZEa%qJJcQ&uCmaKrd4{^6NjN8<=RKkFc`1ro( z<}=LN+%{4gP&fKEdm6rU>&A^6*oZZcM|o6{#SG%F@7)GAac5c`nTFHMVVH#}AT6mT zA>FZmq1>2%;T!&?6ikP6K+PQEh&G{_}$YeUd1N9 zWRY*?7QjCm46GyH!LtLHwRSX!hJXoK{x1hroao-6C6H*kx)$0yH?@`Q`-@*of^B6! zv|km!`al8TKmUFLNR#o9rkfu0R=qWv$?&r&Df^N-enqtx@`E9;$9uQQo&x5zFiKVU zmKeFgI9d{+`uglt7Ox42CKNOVKR>90U)Z=f&MO9YM zEkvQEE!F7rZ~MI@Pb{i4Ao~z9ia`7}AVz9YNMCr$S_mEU9HR9n(infGT?ggzPt9mw zx{KEy@y*?w;VLkR@#Nuz78}GW%<7| zS0ySQ(%d9KXlF@|%g~P~q{3^0@|5b7jsa}bV7v0ZHJW?f(#-=8NLBnOpmN}#|Gfsk(!#Gd+k<09 z=b$e)*n7a@lUH1qbuZ=zkBeF`U(?zCv^eD8!U>p)2!3y*7yP>f-55wsj)^LWXleNa z#667P``-&iG-GXS^z0K=@)4FEpsKl?bLFmz!o)8gvTg9j}6ZmvaW zaw-J(WsHMuJhdBvBKhyN{u?vghfc3|>{)M6&7_I**1fKyxV!f1@7PYRy*Rdl0FlyS z^izAyAFZNIR12GBn$J}(71;*u;SoW6&kw|$-tHYgjmyg-byhPXs@1z;;m#V2o$K<# z!|Wwp90v=MDC8VAe3t)|Pfut5KI3}TcC78H^5_Q>z1Oeusa^*_bvWp%7;GM&RK79Y zNZaH5;$Xf4ixsPNg=Pbh{3%+Z(5`==^VMmTMI=9&G$5z){Vu%DR!k4VN0rh zqf1@}#ruGGFlaZ~d;tAQV)V z*h@=t>+iR(d$JbQr+2m!!oHF`M?OPU?3F)u;;QBp^#d~r^6k^^waelEsU-~ji4c`{7u7duLPF2uFF3gQ_EJO1Whd%-el~;!D}PC@R7}lfiS~b& zAKapBMG;{R6Pum!Lz))Up?kP2-^as+3VMqRi!}P;h_-5d6V2fiqSFVknYpl;GR&Ly zVP%;x*n&ELX|BB-=uq$~360^-ik>B6o7Q*jofq+B`zY@;qV87rs92s`tWCVozbhP~ zq{I&s=Y*wW_%Y29TL^?c-X+k{)SbQ?&ch!+j?D{(j&)gQ83rrtvpE}^LmtciI0vyA zH=?4F+=KkjhDXZ8$impyhz?fXTix!C==^u~&!}DS2ZGl}_g&Dojh`LRJ^rk`apk1s zx(DnSo=tuyz7vw5pWpyB(tMW9|FtqkdnODP6P!(1cl@d4{*U!Td%vH#^vsApptIWS zje;>YJyn{Kx*H^T0%`~Q&9nQ-bPRGHp`Fn;?iME-=guziHVX>cc+GyfZW;KG7YGM2 zBYxTiZP&_+=TP^-Js0FRukYVm@yep)A`Q~0KX{xgmux(|N9+NcbZN;V20je@2>A&?D7g)!{1(m z4`04nOZeDwzraq%K1YKEF~{YMaOzGjoZXVO@4T`~*Y*IWgHo>lnUV3+FinN5_Iww@ zm5lAO;A7TNF+Zj!bQW;KWs}YfgP-H?ZDOV81Pkn)A%deddS#76L}qYdU!6$jGeHm9 zxBZH2h(d79$Cq%isa|E$F+0Rcp}|+6vTmGKU)+iJN81a`_Jun=j(JT}qj1C<8MEhX}+p-YjY0sGKx zGAG3Q*m#`!9V_t|#)lUCuxdU0?$~V7sqR*XiX*rMlgJ&rlUY2Hbv20~pG%q|tuJoK zQ$@ffWt}Ltu81DLt4Y)kr;@_*-@jWdR>_!0Ij~xQm(-@AoQSQ7(J}nlBxkVsi9kq8 z5e-a81i3uYl&A^jT_dU8#HQzs9(RZdQdrJos|#`oa1iY8*G!||EPPl0j!DP9GWo+G zg#sz?h6yEAz`}0B%bfgNss05!5^|`Vz=0p{qJnzGk13Lhknw4hIx0uJ;ZsESI-|`# z=0Q}?P35|vHrz#0ezxMw<8kw5lvG4K%8*PPie)6!rrIngZ#2SJG_8MM$2SPKc)fIO zzLf4gO6nYiQ`${Jq4Um>RV8;Y^44W5Vui-FqJL8VT{#sNMc20%JFj{#2Ia@-?(}Pj zNC-_WL2h5gc7JduKUb%j9D2Wz-U>&~*IL0{bKTi@J%(-b*eYV#Zb8}GtyuiOmr^Mx zTXAR}*4Hn2w7$?Zn)w0L+-16 z4YjkvO$=A>B1k^1i7_~ltR)TJ;fa=Ps!^`u=1& z%?)L4HcF@wJ-Mh)JwnPs#FJ}c`X(7c06qx%{xAkzm?N3ww<$&_aF3F5u8PHtA8rGh z1a_Kyhjb{M3hwd~p2n4Dt&+sc>Whh5ex!>Bk0QSMVGMXnaZN9Et!t>-qGPbxI?AHv zgE?rG{~pi|t-Dgc9_qE0p&a#!_E8WYScd!Ak+$XxSiN(~x2zf2v>~>o{VK(7I9&YW zy~zS;7F5EcT3WEx!aE-3Bn;+#la7hEt%Y8k(3c?6CIhR%qE6{bA}mlxWzQjbPt@`n zm9_wkAh6?zTk`3z8R8+?HV<3P70*j`Fn!Ef^ov*>m?4sBWp#SfabV;jW~9`IK*7oC z43;-*2qz{Zc;U?tDI$8<8@-F0p7P?M-nctGPuWmy!531ML=7(sC#x`A)`qKsw9~N zLH(%nU8X-Coc(fi+BwLE>>=ZtTK`*`&j@{x0jHf9HC>4W%qYq3(R~t#rqV)y7(`fK zsItFZ#wmS`Vu(~?BPmWUgge-{vYU@gku`_{l1talUfPZe6Q}TyCU?Hjq(e(RqfY!2 zMKe%b^u{coNm$lM`BEDRj8k^LO07?4ntzm3^3G;(5i92UaJU#XdtI0xO`_OgBIl`~ zahRW3@FyOr%hvi5hlS2TZV+L7Qv6iKPnQ)g^%{p=uOoe}`R-mciA13@fFJB$!o^{A zU666fRX7H^O^NFk{7IchK>q z7UVE1U9PGReM7u;G;<0Kz|~VmlJ4`j6J^g+wb4VNd+x1=36~bB1dOVXvvdPC-;6`W zOzsfmLWQvqk=tSg!~NT_ZU$4^xKI6TDe0$cw(L=T_<_S=U{UTWz7Bh0iDxu(yg#0y zK=$WY;4*^Sj8XH{wcw91d`9#qmBaOZ@KxKYTlKd-%num_xj!_Q^j|d_?U%c%smvTE zHf^FzfP*qhAv>BW$A%!jfhc!^*v0{R7l9NOYCAoeq-AcCbWhavvxpraEu;8}$M5W! z-74;=w#SgOtDh~=SS_+87JcALqc7%H&3QUV8B*Q?6BDEb9!&E3%v3`19QsQSuW((m z#-#RivLpt1cr%`lv0$-ihZRITr+9;9R&gxVH18>LjqT-k3zh8G)B8OeQ#RD?JH5^SMdZn6^jYl@l;PMs&f((e!hRftlP4<*Z6rsx_ zX~w1KLf23!7B&j&Yk%^{S?1n6(VB>fS1F=XAcdKxf_hq~nR)nPNj&yKKTEX{GDjir z*oEowj__FaNHmG?a@>L6fD^m2g7vPrf-U}y$fzcr>KK{z{yyFj`<_CNfs;ll=|!{O zB8C1e#%zaP=P4^~V00WjOCl7X(v=oleLu!*BmjAD)cr-Ob62G1tz;?As_3+n`H761 z{C9e4q*<6LMQw2)$KfVlgI?Y=jM5P^`^6Dvs!uj^t-W)e?|Hu`Tb6Q8l)~ zlPbuudLzuwb_g*7RI2@Af_pST?pFhm&7zOqr-`q`+K^jN2m|^^fB3?o)!^t1f_ufL z82imbsg8gbZvV=9H1!7YG7C!<1npuWK2R(&7roFU&KET4$1$C@$Bsg%!1T>{Yt*V= zV?&}^sM}(i9}=-nry=S(RZ2rel=|^#ju`=&p9)KNR2Mad#SYE5$P5I`HlgpHg zX&NMRUK^4IDML|ox$D&1AQC?gf|vtQ1UKxF!lQpY>YB4gno^TcF_tT*$`mvLLg?01 zeIW)}=^Vr+c}{=erb3P{Y0w+^^83DtV$4u-65qlFLEwD2u$b!#%=w-8n8;|r?7o9y zb!<;Z>XTMdfI!3WI-wHUF*=f!E+yiKx40djWhjioyk;vFY_Wx|M$dC9TydWiED#P*9~b1F?Xi}z#+DK>{KGT% zv|W`LK^rqvhBX1OxmA>LE}D@2O6MZBXFB!F#S|&e8N|Xa?7J(`kUVlu@h#!ADKcAx z1;A|(LYJ%=By-9d#kFdn3Vl*w6Cr7&7|&nAo^Ecau1I}@>v!_u* z^af$UgU`&s@Fv8fD6&wI@!bm@nB)8ose!L{kdDO%B5e6PQg=_=&5e}4!X%t_o+^{O zst0dsgp`LDn3$V4v$bomeUi=p{*|NpwI;E|RBlS@L(ZALmDBJM*$nTqL18RKkMD#J zk_SQ4t-9(u*O}7Zxla*MnfR^6;ppQju5t z_7w*4cUig-6gf%S9n(!>9m61ISTO_HijDELH3zmCN7e2aDG3cFaeX9!21y}Mya1It zu2+X}RSZn`rKnEb>E6k&nJhY1a25UGwY?=OolKd zyt$8(sye4z}U~x(9m$2 zV#4X_U9%zI+*1y^Aho{m;N0h;%4Doh9GzV+HkOEUU@K)~%UqT!tjCF>he^9bD>Owh zis*XZv2cmGH}x8Nb;r1uE~^XF#{onF84x@*GCNhG%q99~wMq4Q)AQ}z<0-FAJ;6j| z6YPn{6@L5voYdB5_{A4~3jg@UL|;^-aD)hPs{>CWlB&kHZ7Mg8e?+E_j*bpbh%^c| z6-4#14m|Wy|D15zslUqdao%dHO#t_uGiT0hLTaMT46cduv?jp%hL2xY9Wrqqc3cca zCYqX?n@8QK<$Lp9LpsJsypV>UDR^y|Ft(%d)TvWr-b4a$`x$F@Oc|DWU%QWLjmf$_ zhOH^=AbpBjp=4^e6*kmKYS!>6`c3u5!_4B+QjXpx+O@=G#{4M9d)v&A8R_yEbf(-n zE-t_G^w3STtl40~Idi=$lgpGJ#ZT|0Thssc!{?p7YTchk$-ftl4;3>Wn_l%CpXChd zhBO*gc1Tt;&PRKa;;$_Kj=qT9od=rAQxe6n=FZ=)j3ZwPj?1N@Z+sfbc{A=;5Om`M zLLqwzZFgPzv;&0$+I!%BbuX9gPCNj>NT&Yw*9hGCs4F}bH9NROWmI5&PMt!c3c3*J zBF8p=js6yY8(H1EP`e@QhK+|-J&PAKor>(`3y+QHzqasWes&jUf3B&T_4*79p)`{c zz<0U8~a>l^(fv9s{Lp?=~nOsmFl;JHTp3wQtBLCjRI!Gh|-TK&kC6JCm-I{0vHOHaO0ONn2f^lmV-_ED1OCn zJJ0d8;fBC*4fg$=BgI_;Y!ZVIyyUy7A%9Z5x7=1cmH1?A_kqCX<5w-sPUiWi5oXF} zTe2SIxej`%TcjpWp@mgc09Gksu)Zy_jR%EvJTT#J8l^zgT^g5h{~>0Jc!3vKKN*-7 z8yRMvtm2Zao=@b2goK#)3SX%XWybuFC)K;qKIw1>baV)jNeZUK9=}pA+)|D>vy7yq z_5(Z`H}^vRq(o-;6^G%UDi#UP;8=GfeJi$VFI&M|_*9B|;!=&eB^7ti?tr3fG>SA> zlMwoOy=P;R_$B81MD4y)$&EXw5kW5XbH@44N?ATb7X%HB^}U{MO`jc2Gs>BglFO#B zt!XqP+>4e^uNIBcjM;GKJ~qW-oyZ(N8!WfYK0sY02ujhpn6K7(x#s58q;eiQ;m(di z>0D)tgi_WT1@o>Ckl+<4jM^tgs`)rneuqXqB0@F0WVvb<2`P0Lz4e-qT}d?}#G1{z zE_yFL=W2L4kDIS}s_=2XeL*!ymi;6qwFYwCrM)>=wIHl~Q3%9HXLXl*2BSM$| z=nU)l87=OgMex%tbIAW}xV-Tf1Rhp`feB!#ymFZSN!?(qRd+<+BWy3%9b!B)Bk1|$ z_p4V{7b|wE4*mpaYKb$^jC^l&ZG4%KYad&-eJWAEWpWP$1zuZNu3dll+M%qF#a>CN z#0R1M%v>U`vVy)WnJNPc0n~$b$RQD^N+KKJG7SXA3dZ7I*UI8nHfqFc|CK*7=~zdWY) zfwsA*HFT^;ow65)lzy<56aD9z7>i|)Q+*-|tL$~vpO`^7)YRf6Mp9%kHu9_dE z&*$)wLp2d(v0sWk%RF1`)JtmSxiRdFaVk69Wb{rLsGkCmE@M#@-`9;#3%$rPx2R7z zXUf&tYhQQeFr(JW^S^EynGPpaU|a!QMDlzmW2Q*x&a#T1UrS(4eXJY%W_QixE}@F0 zKyBiZ^V&dox$TYYOBYM4s=-IQi+B#?UgMFIClFRjzy3()TOB(5G^b*rFuV z*bt#zkBxS*YI$B7YL3y12*eP3eZdV^U<#)+#h!I)v>q8+8JNvrzyvlpZW z>M2@n1LM}1)MTzRCx#vB;(R|Ca+)Rej3std@(v=tmA%Lzqxa>jYGeJ_uBDe7DZvK; zxly+{n8jq-pdE;}nS!4NMra;2Z^qNod1Z=gePLnY9;Mm9Y>mY7G-%7_WQ)o5o!{p) zowWCqTHO)xWt2?(Rly(d`f`28?B!=tMVcvpc8PBHrSMJ25aNpCH?%TUI?TR==Na4A zT6K@*&&>JvUd5ajVc;`}l8v1oq9-!C3_e3yTA@v5FV(lOYKva%wqL3~PR0-e1)E1J zW)Y8A`6{D!*;uK#2K=%6syZwk*tedaABl|hr7Za~qs|j>DG4WBN|s8`R6$}pm>h2U z>G`!BJ1$}DO+J2E?T;+CjkQwJE~RUow%ISeky*=B={RQPXHZ(zI;;JPFmH_Xz=_i{ zElW1@H(gXU?PWiN!o5cYb%2kg`UZT1)gZ)Nl5o${G7`Nk?0$ZnVrGxZ3Oj}S7P;6N zCvyB_i%s0$nlFhkliE@r)Xs3c5`~_rPQv$}$fE|=j>kZ-kHhiFZHOQ<&-X_ za_9?1?z~to+*IXDCQ9N7Z^SWA$krGfnB0{;UsoK7d)LbZsb~aC#Ep7WI6$xLY0l|d#A~dPT1Yvr|9kvV&#*M2%cQx znjK#-K z6C_b>Jb4tK-)it23z|gse${Muj2uPs*CVnJ8&o;@HT7&15;$RneeO=ox3cGKP6hI( zEU^$hw7rrS6}cKtmUr><-?TB`#-M;0=4i~)OrgZAzWR^SVRhm~gu?kL_xU=;1D&da z{=zBTj|ckQscO}99a2;H0l23WACX;;)l+$Md1@%b=I8Ph<*qLu2PPqZ$v2(;3W{}+ z3-OAt(1}B}8hf}wwZbPq#Pl}W?|BQqvv{%`ta%9V$k)2I8O=W)UpcJ@{`dukLSSmHTMg>ZU6RY~+WxeHJ_9 zUgO5ayBeftYDbaAB?@T?dh-;ee+V+IJb*Zo2(-g5mR(G)w>aL{47h(sgp=PN$|n|E z?jI7QggrcEJg}hZbc#H03fFcrKR0`++wH*yVX6G0pTA0wFY(KZYxlf~KV3Y_5xk8M z3B7R2LX5EUG;2(ot5#_DX_M%M6q>I$`-&Vj2%cVWU!6)Fq-$UOTR5ZnVmJ8^TRnEh z+(St~Bd};8i~aYKQG!UZPlsRY;eLQ|qldp=#B>$H8?DDM_i^RjbbxpD@Jf`QiHvjR zmjB%X`KE`~(y^;wxdu*g3}c1r$+xd{nOsXA|Ii?{>04F~HPb>4P&+NM|C(bqF=*w{ zWMW{8=HD!@#>KMPgZ;x4J+w34UQ#9{DVEF$ZZXD{mM5_MtiP z|K71byTO+9apl55#r65$QgmN_2}%>~x%89Cc`ul)_;xUPH!N@aZjAky*=H|@dY3_~ z3>mQ}x4>X%tQ!TcOZOA-5-{4**QTw-7tHdw=MJn>R=(Wj;%~Lr{0@HmF zq@L3x!jm-&@p17z!-$w0AHuTcP-JZUs_i|L!{{GuXKb)gq+(nkuQ-Pu%(#FdtWbZkHa=TQ}6z{T>er z+%mp&b@qu*t=YBSfPg{4Yu9j1IaV$*2|adSEFY9DZdSD1yOyk4l*F;Rew=bcd&glT z$<1eW@74p&)^~<*O?ZxYjIbo?VU}-#54VS+x^K zk>c!X@^cMc?4%F^WL!pjM%c{9*+XM&4J~oUiU4=9(0;&5!DY|q#gmDcv3#jPbZ0h35aZo&M^R~1!)&86FSRs0yBmDaVj?Z}wq*-?iwR}csjQleu&wf`9 zz1!N|=5BO)D_6^CIK(^0=FTn^Lq_TMN)%K$$;v#8SR6ApeQjHPk-ja|Kj3>Nt&>(O z_6-^*zh$LDZ8J^g@WNXOkV2?GFMMuHQPJ-P%j*cMa_{WO6m?xc*gJj_R%3kMMKJl} zgPIm6gfA^Yw_xn5q50ufD&xZBNACDjJDC`CzKc=w477 zG5EAtDbbI@C>y=LJatYAdT(iG`jvI{daX}Vt`5tN-CjO}U~OxXR^ z>YC2jjm{3VoB7_ksh-liuu8~_G|WiE|1#3vd1!8taF9(S7s;h-BuWIYd~7(oVU4-B z_Hy@N4*h2a{rm7;hV~hTDcdK_%|or!+O_%gAEr#wM$1Gobdq+)5>;>us0OUhnCanD z^udRtG_B(==XXYnU*BU&y|NGP>BustC@NdAOK1_B)?gt_@r>ouiy(wi&FGo%#FWxYMGwbQ}Z4 z7%e?bqaE2)rmUA(pT0j$TH?iO(lLP#zJ3x%@g6;@H)}C!WC;2mOBa|ow&e7aqEA+9 zjN9b-StT0PV`IDeYHwP|13`-LC^9i>RnUE< zubwe~@ia<2*`v>QtdP9#!ynd^sSk>{BK^0ua#(-b*A1jW^>@v6TXVjI)K)7{K@GiJ z2Rilk45>u5H~@#+^eO*d<#RtMO3*{#G(0rlTJ7gaL~#DE_P+8j>MiPbKtLo#x)DT> zMjS$rQczKvp+Q1H1_lMBq){40ksKNYh8a2r0qGJYq+=LTL1GALsk_JXJpaOdbMJX` zK4;F49c!<>*4it+D`3n^vWOi(ihG!eIw$0m-@EzP$C;3%)sgHt+En24{8GJ6fMvZv zMDq7v?$K?0F4B#1!a@n27DX5s67DAxoWPKz1(tJJ(u%Wi#6rMT^ZqRmQ{#U zRWf6pjjR(hIaG*(nqC)BC-xcNHr(`3VEKKDdjE?>G_t((`Qr?$%4$oA#9$EWl&~DW ze55*;*j8=v8{~N8cfXsPdn_TyqbSyGNw<21IatACfWHLdF`VqZ-gsWT>OlVwP;ug0- zo7nq^#{{~R;_=V9pnZA9n#^kEE1+hY@iDdVp~v!;8x6_&p~19etqDIxhG z^G6___M=~{^FBn5n?~v4X-&07r)Rv)ViL9M$;~*bV8=&aBR68#mxNhHF)IliqONrt zEgLY+pBD)e1*qiH<(#=S{$WAT$v+dC{l^bYv z&qIEAo4s<54zPs&TKI?R_?^ps-Ew3p9~Pp~)yjX<#rlKidfECkXiIKAIEfT>s=v=W z?a6CG=a=M3y%B~{hkO{$*gjsGpSLS$53RsFto{7?cjy_f9i5JLk^LobG+j~s;?HD^ ze6D~*N{M2g6Mfh=ncJ@|CENm)#rI!>dwGzdt#ao|o`qHoqZ~rJJu0jgDqtazd_K`- zpuznqX59^hjvB?cM_w15^N>k4#gvewgzvMmvijNg*+hY)x|9H;SCbJ}OvD}d91zS+ z-w!)F!g|>?`HM(=RM$w$1J0VH(U|r&cbOV>LZ_YzWM$VdKf_5vLSoPPf=kl(ycHzF z9ldR54f?}L@)9=?IOIvHMPEhmT{2OSNe)vygrH1Vhd*IvV}WCib5na{z0V9o^$Hob zSFrW(W8cR6dlg2-dXOFQCwd-j*5qkQz(E-;LYNHYAn0BIX{&Yq3@V0}3A&eJ%I5DJ&__HfEB?c*jRahM>h!ug_L%yLj^VlIu=#TaQu| z$ZD@`M^%GRF`Y@b<5#@kws$Od4u!Fsp2zi0*@G!#wd=#Zb9-pl_DFxQUWo z4H{Fe=spfCh}0}c$Z3_z;@(tRK{#5??z z@CsRpGZu!(?#|86=VDWNMN=^kdJ&we9csOvZ*qPQUvRcT`je>K_8)M_IP|cxHT`h- z*mG<|Be<$=<4c=)RwiX?g>mv=B^bU>&FJ4oW^n|$|H^(4C53iGL%c!=ve;Y`!?bmVFR%2d?&F$i*`|Mxg(9

2z{Km3w;+L_qqoLO_t8Cd0Cz|;yK^ccAuvC^VP9T>BNmqg)~(? zk7cd`<(b|ShzpuCq0Ul5M!Cv$y;bzwM+b3dPuLz~V$Zf#U2$Gh5&ql7Jt28fl5Cc- zKHF{wezi9lSt0;#$+sk482~NFFpF~m;a))N44zSe9gmuKR`aZOA(}EBEW#pJQMM2N z>GfmWz~jcjJ~6FEM9n^p+%-lDwyp#W96tUug!Agf;TMRdqfq3_3(lEc?`$i&Ic`2K zR$pz5tS78{kFDDP*Dz$^tMbgcf>?^^_4nBhcP(u3uc7@Pb~~E#VuP?16rQO~!k~1| zVxN7*lSD5iOpu)t{uNl0N~trD5}N*pe~Jra9$owXg_>z$i=9euw05C)oDBMyzsNUy zJY3S*F9OrL{lV8Q^$)dxZ*#|IFMAs~$djjxc1EF~OlMT-(P(rC&`^~hWV0VAS(?IV z>GiG7>AfYt`jKJy9f0^ctWuY*`^n6o`W*?&-ny8T1Nr6eRmA=(JG=-iGuf9VBCON@ zammH|hdgEy$w$mV*9kGM#Pf8v&MAH?@n@;^*IWwva_T!37~Q)T9JW| z>71=a7qY&zwFhORIpAY3VI+b~sthQ!dNuvm+2Q7t&VSvI$6FIy4!L#=slKbrMH}F1 z>dt{`5=K5$&ec{VPkUl;kK*)~C@g)xkl)4Ra&owkZ?lGSz4C36Y}Zf@IOsO1ySIYu zDZcK)rykMcVIl$EbJy3`vb93BpN5eJYh8e&{ylu!0A$C|hg-pl*7Z*wGq0sZUxR3ybnNw@*SoAn3uPSL z5%puM;4GFImOOGMSW+`FegfGDB9~D)USQ8po`spCN(yJ(Yn6&@R9!n+P^`>G0`JpU z>JA4rY4kt^fgxYfvi=&?uJmD>e=WE^+$Bb2bWo)r_E!&JP^B?&g?DZug%rP%7=apB zBS50$lH6Ikh;UkyRaB^C<_AiN%JQ%I^k`>?&LaNcmz407OTZZbR8(DbDCQ@<#{)&9 z06WyCD>=QAJ@xQg(S@DICgZmhGoJ-hfp0nf`6@~#M(AL1rd*?&b#-4pf0nlZ9uPGA zH)!tbt8aGhU3zvn@Cng;OhPB#{)HcrFZuah2=5$JYZ>^=O}n2Azdi4FiBB4AMX-on zwP#hna5l$__i0yoieTaRNnyBEY{>^YmTAnv_q22@Ili(&26TCNmk0)B9Hm(*i|;xd zJVt)8)9J0(;#q&+(%KWbf(%0bv`l`g#=J**O#6nJX)36aJY1(@uj$tvQ5h)LQvEMRSE}imzi7=CAU_t$qiS`y z?yOI^CaYrubWWY@x?1R>wsSKW;x7$LInMa*#VDXQMXdI74vySwkC%a>%@_ZKakKYZ z=P1?U6~vRk_0^7AyY0&FnY>RJ*ZCtpPG8mIKXOagP=TF!v?r#F;u09hyA`QkXZ-$` z`=M>Q>6hZoxwA>y0l+P&;tbL1Z%x4^01TQiN@h3fycia+#OL-SQRjZuc_ zONr2O!TN7X!3^3!lk_Em7@bmtEUJP|z_xgx9@yj@;)+T`;Fd&oI2J!rO>GNbW2WOJ zhw3s4-86~foi`TSd{D==uiI$2n*;Ojs+E#f5pm{we}N2&_udgzqwNO~Q(=~;&@3`9 zgk@Hbvp_MD(;wY1so12@_gzO)=5?>z1VP3q|>fXm#zy;P6LpFcXs_CA~9^uDRg+iU4GrxlhG{bD*ijzsqutVw%z z1%DK4;W?9ycF3LgOfKJD%8ys;n3xn-Sc6ST__-MO7Aa(fFkFD!0MIeAfu@5%(x7jv zPh$pWg5uV-@b0y1EU6por*dfbRNt>J#4c7o8es*G+dcFZ7<*9WV-s(#T=N@8Hh->l z%Qt}`na63#Mc{j^rep=b!sEnUV0$({0=QfgFuwqYycC699>F?R}ubt+u6c67)Yf z9j%m5v_C|i$ql@7_>~KI4@U@F=YLbuF2dhDWlNcRD|+w3THuafX?lOIR=GyJhjD3 zF)$mM6~_RV{*!uk=(Wc|gmukbu^)_Tv`QIeSKk9a&a0@t(%SyLH?xazDbFfZ7B2)C z^{;6}4re?(l_W*ttAl*&8v6m=PL}EMfp*JS}|{ zW8!!F10)~L-zl_M^G4h#ofq;`)V|=y3=3U@Jx`n(nXpa2O0Qp!2!6!uBbi}R#yF|9 zZ+#-DGf5vom&V_7E3($^%HXYi;H3{Q_^F*Px~8(<;J>izb8#cA-z&>bGykFv&l|Uv z9QPoUL=cay_H`>e#gGfj0pro+UmwN1;}r73tbFX>+Gd-XImq?7oKQQan`l)$MhbmY zz-*bPD7?vW3nN@)=F9zRslNZuLZhR7$CvCjt=1`pdi2lwgC|CitQRrW1%dfpmenVU z)^VUM7D{X1Y%{H3?S9`vt~@6=w&4uQ_T-}t4;7YuQ}Kszi|ofH9l%dv`tC^(Eeg$k zj|?Z&eLf)h>40MKXZN3;E{Xn3IfnZ+{*zZ`V>fy-5fEC)8S9uQ({60pxNn+gerwjw|AmmNBho@5N?P{ZN4_eJ4dqDAbZPJhZAFc{FB zhwRNpw7Ce=dL^?s;t_5#H`*PhcDS5*con0uwcnZw4?w@*nNqPX?H>+{x%=@H3i%{h zbiYWkCGLZ92<>gO(^5fNMFcdtB!v!x(~vB2pYi^6^Hl?B4&Lm~4>+TUaKT28Qcmd% z01kkxKbAxNoR41P!tOY5!CY^%iPKMrUN9O-cpp$xjDI@88PDB?(s{By5dNp4c?n?J zT^cpw!|o`j9=TG#YZyb`u*#c2NZ2H3i2G zC%NCHj1eArjk=Q9?7fCEN3+YS^q$CXJ{~y_b=#Fbl5OCvR!wAnrB&JQG7-blc$xd{ zkx;9q5kF|D(##DO8*P%feEM#`$4t)^0!(p!~BtQwygO9c&s^9(F(@SeNyb1wTf-a6eyyFc$0}h%l9sPFLE-S;l zwt9MVW8v&G;OKoIIy}Ri+||pp)LU_U-{;6 zaQToCQfP&ic@7qM=c5oW_XFs6^8K{AH7R9NFDj*hnUBbYKqhVwKzses(V^k(d6rm9 zUO6cK?Nlc5@P;>PZlmJFg$_zHF0OC2JyA9{y>`JaMj_qzt116i@@&u&DQZP$xSlEo zDEz?nE<1`kuLu){L2VtH#{sFw8+Dm0Tcvum{cYA!6HLJU6QO?Oc;u@ko;RT(ESrd@ zmMdp&+aUo^x}I(or>_|I?$^ByYuB;V0L>rKaF9*Z?sxfU32)ru6>*E8$GK|G2@_&w zY1!{GI~h0w{l;cR0mkYJ6LQ$Z!#*_9fsXn@z3P?`1#JXn=^EYci)5M7O*UL0`F24# za4Zo&jzv|ZzOFSI@@M`vi*xq=nM*E`#gQ2|HZU*udAv1f9mlVtv9C~XuhZ)@Ki&_m z`awnBYyy0^wfaxCD+do&(%X}!JVd^mz}h~*2C1rr&1!+QQvOVF1Jq$&VWh3IhIt;9rnb8>)|A;bW)Rq5Z< zWgUg^6{S|X&hc8@I>RxKCDa9;Waa)^b_ov(q7}lJm}d{7=X@tXM63h5@}|uDu8oI~ znzn(Po0BWT-%4~CQ*A*)OtQux8tWMkc*A6`6{#ax-C%AdYor~W{3$5gyQ#TELs-$O zv)K#$<|kb8sr-=w@=s%iB+7L@sMbwqPX3*1tNA_8XGJDTnrQf0eR@^s4yB zMkBlFT}rLUWIZNF3`CildoDPe3RGRwxmQ^djz)@_%nyOKo)aAQ`YedDQisL|!$&~F z-D-Qi%203K_vH5`)>t^$mvQuYDQ8Y^6XNJ*q{rpn2C%eBr?9_Rl<|R+L;X4Hjvsq% z)qeLR8zqAxm)rngIZ01SS@^T)R9XCmwzD@@?2FGsZzQZzHU>tvw5TI3Km>$!*rgQz zK5nUm4*D8i`f>Le)0V;x{AywXubpx)R|Hm9(+Jv#z7iWi2fTeUSBvHba$QbQ7&0>u zH_%6HUrBb`{j1^9QXH@tSiMI2OQERENf0LR(ORuZ`swLXl<|Zm$QKF07C1$E#5c(E zrmkpQ`EMXw0lZg-92yabY#Axmw(NjS1$kFquEUJ6T%eCp!#v|TPIlLW8Akc^kLX!_ z$i-jA-VbDWWm#}>vdAH{Fh3Qw?tcaClK%&3Rr}V1vaOWFVMS3_sh@#5$93){7d4^b zU?O8Vq#-tJuJBvTo8iIe%SDCX-N-H$dKT-kdkIGO@3sN+ovE#n-tMBicHO(h=fTE9 zDm2smOP$VGzef56rBB$gwQsOv+JbYBW)Ih@EiJLzt?_YPtBA~^u*~I0j~e|8|I+i7 zrrfGv6w-$F@J-zD{@{9-O#JKW7?Y=`s4^K%Z+@9KIcgk&l!2 z$~hklcuk{yv&V#Cdd=v0Yfu*EUQ|DSx|;!ckEVap#$BHezdVkwqYHG%7pGWQ-|k&9 z##wgOz7D1cR=nWM*6Ut76$No*{`p1Ahky4_Q+~U_78h1@jeaf?S~yPJQ5tmeWJ#tIGH6ThzkINskT%6zQKER zKp-QPDnX%+SzxiT>+efPRH~#%q?rDzP~bo7`tYw}Ap#&+f`>3D@&W%+ptjI-eP+m}Y0L2?>}8_$Sb z0RrdGF-L5X$(Tn=Wg}C%uw*qUxpz&Jdh zR98=jb<#f?PwXqU4m6#xv#8g*6^F?+`91I{0z{$RUc8D70y{)GO>W!*XUM(gA@BpyuYMrt6-z|vAj(0KuX#A>m4^Vw2C@wn|8?mX zpp6TF4}tW2D5KyjC`Oer5b=qKRYZTx$z}aA1wcIoXrrj=YGt!Mlkc>DOBYlE(1WGi zJQe}4M!~+I0&IBUD-9?3P8oc6i-sFuEU^=ReZoBMzu^l|k(@yN;qYDJq>OtRLae_B zh_ildJ@?nH+!V-hB<{Owc&}Z#)C)EU7Jq3j0|2zSNcIkYUh4Yym z&ogBHEoa=K{FXgv_?8JW!!J%^4}ov0E~|;OAm6FJ*+Ejo^g4wco=!gt{GTc>08OYT z2ue@Su7GH0a1K7XC6iax)3U&+dB!j7OE|2914;ztk1oO#M_we|U01q5p94Su2$)Hx z3bB0`C+l|~?PA@f`WOIY0T`TMo;!)XI-$)(gAD?p3eWxcFs@vWOI&tux3A-_HwH%q zY;wpB3X#^YZ!6$bFs%n$xChG2q{^@e9pEWGVtBhfJt+=E*-Nl0 z(n+iWm+kDP@lX{JcMAmy4ztsxCv%A6O%K2is$Q0E%738RbD;zED6Fz(}!6RkP1nK&hCj zAXu0{lrajU-gI(Q4X#>n0{CU&uhH)s3=qD-T44T8m`Krt`M-UG6h^5M1ES>Cy8tNn z`BZopmzF<5Yy`+m9Cy{DWyY1*gwhCrOi1O96WjmIO3o-SK{j6u7<)ac9&}Wjs)1@B z0Y3c_x$qf2baWb3pPYd|?f)l9zyg?o>~B8DpD+;x$)RSko;iDVR_ru664V&&Rii6+ zdRT}^v)hjD9KAsh37&|uKlr_HKq+_TJuQB!yf=oiZ@9Ux&IQS40cz#*<{rM(8XV5y(KX z4mb||p(=pcdiJcxb-9iAHaVL<$sqZS^ZF;(lS-(5YVQx-AT&9rdV74NTDJMLlDhPF z^)ooGM``)DqJB7BPt+lw&hkz@>B)cp_Go^uylEiR^qWoAn8$PbwAw=(d1l1 zw~F?A(^GA5P5oeIbe(N__g2fp?k@LR2KS)M1!1o?c;@ z{Q7N0-u))nc^wRiw>$Qz8iEP1tZh)MOc&Q$Ht^P-IBhT>O7bwy=$AoP%1l1b8|t0= zcPBnQk7+LQT8e}tKe81etA8zHkIdPkqc6@6wL1SiA-ApJ7=2Hg zFh9t1i|^m*&gZ1~>o-&dr5(b@ar;wZw#QG}zp)L|5_@7gNTZ+r4VNxi6@VURyv3@i2_U zyI!907g@Bt;4Y2sF*!Kgc`(LC&^@~Kx<2pr)e)#Sn{8Pcn&Y1i$QDkMY!Li&r41=R zz`gLzYbH7jsy)P`%QuC-Uvu#&{mX6vHMhi=EB7dl!{KO3D6`*tf9lq!eTK4I500ND zOto5>dep?jpks`OjjusZ8At-`Z}gvEOc58R$3yb=R^EL#5Z7ZEPN1VY+=jkPf|f;% z&9KERFGS;VI!$-1mEF?TpIy84)YQhKjq+7k9Ab=i7YxF52`7*|&Ebm{*SpJ@T4V6I zhLu=&Jo8ZPw|rae@3Hx!uw9J+PE{H<++i4qoh-gj{A zkp$gW)$|=SAL6?LpQ+=pDtEh+$}q~|2Im%l&Y}_4+3Yfx(nXVt=={MrrTV;XVYx5e zvrU-f_Nc9{{NVGq4Ihj11@WiiY83lcdCYpeneYndRwsn zf{~0`N8|QS5*h)P9{coJZ=I{3x7%9Cyn@Wxi!{Ww)|@9ZkFHbLdUq{s8pe#rQQ^GqfrF6I8NHp?U-RHH!&> z)*+w`G~{IxA4(x>ypMjS>#ek5A=-?_?TNy-Rb58jf)DFk)d(4%6sFR%bvE8Ew}}|h z$-J7rpjbKWq0A@sq|@U0Y56ChEXh?dbdjlL4IG9>TfI+7DV6aj!VHbclHKc;Rx~`@ z9b8$S4%m3Pd6sd$F>J_cfJ6 zY*r&&B3miN2D4t1Kr^S~08aCG$yt`v=SAtRX^q79w?Fu)*lC zf;#i+rJa+TjU!3hcW3(btBQ`j32)sRHl`WbSs!otC%ByW#IElqqsgCcd3$zmID6Az zs1L1UeZ@4Xrt8sP2OQXd(Q~)u+n0R=uE*g3kuGrD1cZ$YZd*D9#1l8SP6|^TSm>!G^kW=VB%Tz`^ceEwAgiuaXs%mv69Bq%*W;X))U(w(z`~w zGOmcTrrp%JUXX9$a$0~$YcRKtz=!4|(oFQp6IyVnc&$7{+DD(JgeuNTbf=W&L2Xtx z8vRpsk`Po(4O|2*97lRcRPb6Ks@wza?hy@(@-u?-}lnbop>QJXJelLx{q{ ztq0z2-F6XB#*XOyblDSlC%P;p(iIId5DVzprxh7kGK%oh>DLIG-leUt!b-t$41rO7 zLS5a!LvM+#-PGMA;#v1|7?#3ncOd3kLgY-!ha1?ekI4L$u}3tX_-kKG8@?NN?!7}L zi8OQ^7SiqG{qFrY*%ViS7h#hYf59I}32A?6i+h!kn2Ntc zyrZz8W2y3xq`Lw&Dpq&H1|N&m)iqxWS2_FQ z!92;uH|>R|_G^7XIUYS*YDNGq-7GHWwQhFunA*|xn-@&><2oDRVc{QP5lH8h@7m3` zPT1mnzX5VRxz>qtu4%GKFHq~r<#hj!n$b9^@&_38)9(HbZ*XJi4qtK>o-79p?*Gtl z+52`9bzU~FX4RND$Es^eNT|g-FT%NMy3YibrWq3~xo0%F$DiW*m}gI{TfcVsyU&dU ziwjrsCY@pc8_9z*gqp3wd% zkS^WnA80WW<$QU41SA3J8ETGMvvnQ0d}>~lTA+!Rm*B1QDh9$w=I7{QUfk9$<#tf! zN}0`*i54cu;&xY)yilYEz_E-=g+e_4+H^&n*S?OrU|-!})q4$PRx9n}LxU?{Fu94q zamAMT8E;sm#SNcUJ!)zFTQ$4>Nb+Ny6I`p&yB8gDf%vXny27G0g{V;Ljf6q*xy66E zvt*e=dUXX({`SZecKT%PVyh4D)vII-mvsbu8GB%TF=g1>yr&UoRd3H`0{xO7Tma0s z;a~16^^QtIT^CG-#WXEH>w2YZ+G_~n*y`^*DJeO;(JDQ$B7H~LD#HghvE}NX&Vy~%~)!X|xVVvhv5~fyaD{(gn zmFjUobfVEZF~-I5rTfUVs?Au?_O2S zPpTh1Z|weNTZL4bxJS@6t64r}Db~|9@+sRa-zH6w01w5$P~{Hfa&apfc;$v}nLXtR3b0Rju>yk`cJanYUh)x-ON5CK}=b=-=@~u?T0g0)aY3 z2A$cnrD$XBqCCIXu)fa1d}(9ji-&xDnsI!>#f_G@upq+sr;abH7$&nCjZcd4=E?DM z#v{dgVdtrXs;uN5rU4g5DWh7ioR#2=c!6Xds}%2i^v(T9t*AkQ-UMsK(N?C|GTy!> zfCn&b_8z%sm3q=kYr}~6xNJ1VZ(vFD6_nz1so{;wHY;7iEGc=SB#Re=cXM7i8?2N$ zw6m0Vxh`4Noh&cBc2F)X@l7{~JJHIf8v+0_UzZA^o~huIx7n*y#5GMnKU9XSJ`hXN zT2HDx85fB!ZGY6+sM0xHMMm^qMZ%uezORJ>Ho0d&#i7 zKLXu~JSYlm@amH4L5HLgU&R|sSOm?bK+rkt#1K|l8(-Q*;Gih$d~23BQ(#f^Diu&4 zjn6-_;7<{&UKm?l6A!9MaKZmkpp^lVkWJS_d;2y{wj};m@2^;qck3>zY>{Jg;Z%}# ztRO3>-4O@Edu@|e)jwi?oW8hKt^oDEcBr5~w1zb3KZ+vM*(wuFSgRRS{^8F9m5Frq zFnqN|xEldZs7zD}6ukXqX_7OCdqo%>r`42CUvQerqvl(P__Dw5U*sAnTAJ`J*7%jr9FD`tB4JpM@R%p@LS~C^B zFzxvSWUMsqo9y(j^VAqXLSU%UI5Q8ft;%e4faM#+Y^|C;-1Zk_HH6YWvTDz*H~OXT z0qr9sn~qB8^;9(rA`117eJwA^N#6jY}?~x@eh%=2|5k+$OoIux1lv->ulj=`H%A6 zI{qcpKa0^@00#2zidR0ysVjH7ecz&R6pN3=jj-~Fx%6@O{P50v5&XtVBd@DaHlE*T zgr=?eTcBsxHX>xk5U!(HTE|!KG}+MF78G$kO#!<9oAkAu_smHBN$9ILyqKR}c!|?y znnIukzkL53e_+^?`?Bsy73cLClx(QABzD=7^;Zmpa4Tjei~W)sQ&DD!YlP!&$5Cr?9YZLzEa{Cj@+xz z`}K9-xyC5l;-{Q8PFyvpaBHiJ<=dpe=?f#_s^1i}8$uiv7U&bg)Rbb1q%BYuSpu`D zXuf<74>aT&Oj>&NTQEt02-E1=Fvn+4+q+e_M@IWbU}S`1{7plvCr(3ECSeXP1R;(p z3-sV!VM?OU^zY97%@#d}QFlGG9mrdY)g^cI9d?mKvp%48BD6J*wm_{ChfAGn_BK4n z0&jTb-EV1WHJL23o$dk1QvT62k1~#W-jF2TEP)|r0xZICzCmR^jYCc??047~YZBlg zpaY@|5roROZs!YqXKd8n=*^GAEI<0)oPMn0`Co{RWLAycAUv%^+M&Foq)u+?e`l4t z1iV^M;p&C2zp2(YKPKAqk>hT_@w6-0S8VHSKa#oFN)ffa~;&_0{$ZBOL^9A_}6@>YihjFO5__rN;GMgSrwI$R8B{bJ3BCo1NQs zWm0-XzoGjzXhgg0QJcu1tc*ce%ey_Qb+H}sBN495A|ub4SjV08({R_5!$P2jB!x%Ux~Rzmx8Au?_W{rsX7G!N|@ z4Z2NpiTQKevVyoR2+&lpSGLZ6#di0*8=(@5Id53<-?;`g9WUaTs?pti`t5 zSJ;qI&7_c};u5o79=Zs0H9G^?g%G|s!1YT_>(S7k6t-QNh>m@Uzd?wpw(v7}UbY!! zJ4*D!Lm&o`9b5HeaZhTT%srfCnObfa*51CYtc!*R4-gm0W>v-W#Jq|})2H1*tJh|N zHy2SnYcuD8^E~Gb1O((=%Q!)|#wp@uI3=H!%R&QG4`l!^D;r~bPK?X{{8RYj@+4xv3C}c!0;Idr(SZy!q zGO68(LVS6&H&MaTzrQ!heZn{l*$0*iWT$_$KhE3osqJx5*HgufH;G8AAxF>NQ{bZ# z_H+rR0#7HKOd~29O#52mC1&bZa3nU3y27I6HXd6xZCbdnmmjApekwOzgdb>ft#?gK zXl?-Hd>3h@wqjC7`f=F*quLGaqudJFcXA98TVxFP(wS~L1Q@j^pwZIQ7kq%Uf-Ejq zF9k?p{Q}b$)awa5_Z5d7;P5aGJJT%$-V2`vJno-?B7_`TCi&dapHMy1;vR#GIs>Oa z>W0)>Yu-?`g|8lvb3m_dA%wP_R5rD6VkgQx2o%xDVxPa-HPoxO)wpA1!@uVgM({YctQBa;*~$Gruv4JF_u zhy1yQrIcis=($t4VD^~O^HFZc<7khY(=X|7S(7mfiafv~^8;Sk*q2FxG;`1wJBnO8 z3e%tQ##?7j2grEDHk^)HJiNDV^;u zTi*QY^9W@ypO2@^^GP=-jq2*jxh9Rt$CcC%JKmIHAd zi}b8#&1Pvs?WVHW6kT;5_sacf8je8W*eEzE$MKp~4PwEQL@AX>Gm&cHnbFoQ7eUO2 zL6ea?KCqXXT}NrS)UNDxKh~9V%Zr~-xjwHcrL@o%MKSWyXzEG7qD=Tptr#zGoDncWt8qRQ{C{AELu>c2}lM`aA{So1x1B< zsy(Q@Zwj+Lw8R(jbPJ0-ux1T>N+0$l50}G&-43iOS@~JlyiqF}8~7VEAZ7%I0J=y* zR1M07C2PN0Vjj-gmh&|^UzSf81`e=;1`BWyygXE8n(&C1%O^XCt*HbQ6RyGjppr$H z4@x`=ygOT_&J<}LAX6;k+^zGft*K>SU1-(oFIOaL|0~5Aez>>!@;BqSHBY0p{w29-LeoqVfDKC+n5-D*rR)5)@ z$wHcuzgdJ^$I>x9NZ;^i2tlNs3vv{)5uu&K-{C>CqYh*ab7aRa-?_VgtGT}&BSB6A zwA1eTD(PO;X7H~L86aCZKXR{RKz7usBcMzA7cOkNfJLFY*hZKotDhaiG~8v?!KzL* zhN{j>pMCuFVW~<5FKeJU-0C&GAG7r7#dpUnze0I|WxARdHTAaL z34L=<@UZ;7J)oGMM!e)~ORW{0jMS>}-&2E}-vQ1x2y>KZjlK9|2j=luu3<5d@r3!;U?opDQU{E|Ed49%!INcct0(@xWHElVJD+ zY|m=wAQyUvKb`aAFAu{mp#J{?%P9C;d+Q&diR-9c`tr@0FXprtFuX!`L=s%RqnBRB zehaz$AK~C~;n2#Gd@TQ~u#jn>X0mn8>w8Kixe8@h79wtQdEDu#j4Z@vf^M=!^eD>mTQ;S(}hd$H$!V>b}qp2tlBguhh= zp9o9Wkoov!ig}jP>W^IK33|SFe2i~*M58%u08BRoWrUNxd%;V4nFZM-tL=tK2%YyNwCE9Ltzsy)b1D! z9V`FwM<#Al&R$pG$r*e)EL#S6a9V?zF-V2g>bYsaE=~GlaN6eMeMdTG80QikcA$}hhKM4S7z2-$_Kv74 z#uyxmd&O!os@@Uo4Fnko_qJERRyw(IRuUY66IoKz{E8#|9AHnlMRg}&Tv@OBB~Yo| zoDJwDMSCP5Ce}m@`Zrn04Cmye8gWf6ztWiAv{C3 zRN%K6)hzBWd$pLy&d@=%KBwweaXz8?s0;jKGz7)FY>@mMM4E2-k5lLt@6OG@Kqn;D z!r!xADx*V11u;m)6f1c~)0d z=N@{%TiJ@a*}Yr-KG^5#P+bAxM6S_Q3IASy7b?ZKvo33VSigoq^LplN$H{Dnja_c> z)orhunLmFt$@^9*Gp98~hk9|&ba1ZyF6UlJMtLC{C}m}Oysl#? zgo$#5aTwbh_$#E>s5lg9WU^?F*_B3@U#|hupmSZ1dahX|_SVeuH!r*@z-@=5peS9g zyZS1cn7u-7+@&IuaE5QOyLqFM%hM*-G|Kkf+86jxB+)?oG*=NWxES1HAAa5T-u&Aj zaXdT4VH_&Z?#o=`7zOn?L8AHAS_cotBD|{Zyb(d@fyk|O52*+tpyReVy*;IuQ8CMFCPJ~a1AFevfrHMutCCyrcadPHSNRKKsh^n zLZrO{nK2)h{GVH;bz+Lt0I%X#ZGak3bzpARWZn z9OltG^kJnB`@8QO4S!01#z1`{ZGIE&8dTTC29vOu%xM&1&VGUO%qqcCNl5`N?a?!m z`%-3Tv=O*I*&9#KKXN+!0bECGIc>#Nc9AU}QR#^9MI1IvM0yu;Dr&qbA5TZRD)-VO zaGzY0Bgs!!!7k*$qY0NpTprr=MS$GqNR5!QtjzVRi<#V*&U9(&~Y zNZbp_d=T3tiZ@BeseF$zuLox|EEJkRR6tHIF<(5B{l1tseHYqm_NS}XosIfvP}%53 zZ03`8FI0{85FMT_LF>5TcFlGG@OMdF1)JZb$CC;=OdJcL?;cpl{n(kow|+_5i!>c? z1V)~ZiA>R7Hca&I7Y+nH@HXiN(hTCgg2fR>Zb$T zG|h31m3NjWNM2#u%Q#0@sRz%oy*Q)9&Fb^U7a@3QuER_$eQ&`rcI8cDM%U`$3x0y) zOx$q1OyWXKc?mb#Y0`CZ2*VI~5_2KQA&IgDm}}RLSHCAqW?q2IngP3+nYysyTWFd@ zw!)iWHDSv89mje7(pir8&i2dzfH@%iOJ-&{tEZKWDz_y|GIP@e|6C(QR@RyXtBQj- zmig*5?eTNny36xmfw8KbOpqU#&msX;aG}Ue2cbzBuUzP-JHZ~zEjA5q( zC49*<;tY5G{Uv9;Sg(7GV(p=L20#5V(h4-#xN*&bqci zYR(l;y;<8rG|3?GX$e_wx5SK{Qz>x<$~G1p1!!a>h=%JBE}ef2a+$!>HA?)@)yl zy+w0mix8*H{`_xy`Xp2-rWQ5yh@OXF7of(!u8;s2p|T2{&xvs zU~eG0x-Jgv2NwC#8(t3b_G24@_&!^_fvQX=~bd!g6!lC)9EdNQGx!p;r~awN)1?Vn)=;AAoK_S zt(13@P7)LHZ2fhmk&@37>x+9X}|K*HgaBmOJ YZm3jh@7~&pB$DF3hR&T5b(_%t16v24P5=M^ literal 0 HcmV?d00001 diff --git a/img/logos/OAuth2_Proxy_vertical.svg b/img/logos/OAuth2_Proxy_vertical.svg new file mode 100644 index 00000000..bf48ab0f --- /dev/null +++ b/img/logos/OAuth2_Proxy_vertical.svg @@ -0,0 +1 @@ +OAuth2_Proxy_logo_v3 \ No newline at end of file diff --git a/img/sign-in-page.png b/img/sign-in-page.png new file mode 100644 index 0000000000000000000000000000000000000000..06e095616d17bcf688afd1b123bedcffc3185db1 GIT binary patch literal 34914 zcmZ^}18^o$w>Fw&VoYo&Z*1GPZQHhO+n(6ACbn(czVn^)<5b;yyQ;fZ@3o%AUA@&2 z^0H!Z&{)twKtOO3;=+nRK)_%B=yOQ$f6sFBY{xQ6WWV%X=n2$A8X#OhlUd53U7R%AqtWB`CQ3>|^`>Vw|p>la&AuAfb! zxUb*cw0a9nhAqFcJ3YnT4+rj#8x&OR+XJj_G14b7Ty^V6^yEfKK7A66G{3!9d09JH zpatS5d7qb-FHG-q97EGaO5RK4yudLmJ%~TZHb4g%l-Mc4FdC|1VSSjf_^*wQFrEn> zf{k%!6c6!WmD^R3p-ur05${a2>H|?tQvsO$nRDMQ zp$$$s%}ao0vGcmo;e-m&v(a6@fhDj@94Itf zW$w~MxsK9qNu&Z^9jy9YG%E9SQlZXMMZ1hp8Hf5dF$iOT8@(uwaGPiIV{XW62+oj{ zPB_Vaj7l%y=@ZXj#{m1q#preGyD@%k_u{|!*UxAgZnBTPu&kGhQ%>0HI1W}5!GI=i zS+tVy6Y<(yl$i=aY=V$@PSA?LC`nB7C&ge=5AA32sF%+!YNt2Wp*4qGGI_^j?=7u& zTCc*dweW$?=`dzf=3578I@qpn>(-|Y!Zu6`h|L?_HsoV>L+jNJ(6tjA%qQ2leT){o z3iV1%?4n^QYWc;NE4yxj(0*lyaD|ND-Av#-Fn~<->+`dyy*VCtEo_5)QOXd$H9ENo z2T1GVWBU1S%hPKo6eI6@;g|`oPZuyU2JvkH!wto6gAOFU_R|E_0o2z3;cqq5Wk_V? zwmz$c4(n(tPe>I6W)H$k5FIT6P7b7!5B2EJPzTh~2h~Q{cnvRzukE#tplaIRz0pD*#4;0#m4PfQ<=cofx?ZW~UU=K$s3{oec6$e5JGA1Aq z$DI$7Cbaqsb?^U~FHa7>4qqa`AR@k-)dIoly~tLoM3G}lsWi2_?KWmIY=bl zZ~&69L}9YLCOL94jV1m#JZgZXa7j^Yk!%sAf|~qP`A7L^IpHF^QKu8H2P+%=&`}@18eq(+E6R~HsQ5-g9o?VU6CV&XS18;4gg-bIahN!XV7QqFkU=`uz zQe;+ytYDr9j+TzVj;M|>j&}E;_uBU`hc<_DV|?+odlt8X?krt2 zya;)Ld@;3yZhK;PI~3&P?i9%sRpcP#zZJ4e&GX%b83gJj^GU*yoFQw1F$Nq2S@!Vu zQ1`eks|FN72SygXo}dL3mPkBXlGB5cvH5QhE1%2Lsmx=K%K#bq_@f-GDua zrY|BWLNuZ`qCIdKF&NR4#*x;P=9Sivc9EV*_oZ)Suwwk6H)C31f@k9Er0uMIt_`dWrtQ{l+K$=Q+!oX>=j7%{cU$*>aX)mceEaxN zbq9U7ephEuYrChfNR>3yk zG(R$5F>f=!V=QdaWh`l|`&V)Ne1deMWt?_AV(jg2PKpoKU^8gK&iInBrOaJh4f1LyKdBW9R*!$Uw=aahH_ZKl^_K{xttt@Ctc;zwEAa zlZ;V|DON3Dt(mUAF7TE0(GC&|Dpsgqs2D3dtJWxalaLaolD~*tMz^8362Bt7!sn#q zgmAt-8|VP?2SO7?Bcs{Ygw_yM-)( z_i0LP*|yuV5i&clRkCU{thC9p`WTU2r5&jm%pKoe>KXYC3#t+78Eh*mJ^&sam93Hm zmaU#R#aqYa4J(6|o-3z$0zb$`KC)0?h zl$gjB%`M4=(dE=F>pJdY>4xbt^Ir76_u+l}^LG3p`%&?h^O$wFa!Yrg2R{qNj$DUf zj-ihCO8l3ooYS0Xm9ULBn0ko#(3IT9T;ALa!%W?KRliN$UG&vGSW?(vNU&JKSOo>8 zneGouCZ5OASrlR{2M!ZrC7u@22h%j~wJ5iYx4E}opt+#xK$-B@P?W?eptd;ni~B?A zSq^8GQ{DlA^VFk`ID?LZ=WUQMNGMJ5mO_9+PO(JsK`Ct>XMTO2V;;Ul4wsePn3ud!K!;cLFlqT}5ARUV~Ca%^Amo@AZ8E_5rhno*|ws7H3WA8-q#hlPr7<@-_#|^Kd*Wz~3 zyi=oEMe9-hz`-%^TTdz3yU&lmC9e&xJf1oBCYSq3#z^DGj7uJ$x54B7UHseZ zZr#@H1ma4x(dU}K^lJ?;Y&Citf`34%rN+ofnnZ?7;)Kc#PFaRh- zmz0GxxrIH%>QatEchD2iV_OiP6l_88PTG@6s2O>ojFm46M{G zRj!NAbzdEWnaK8}ZiF3**Fra1u366bw{2n_dm2Y7mpNBSyB8;B7qz$q=;T;K$dgEd zsL)}wAu^%x!kdv@2rk^59Hhi86nHtiN$z%h>;&%eBx|SfQj*f=cTEG2#eZZ`f3dTV=iwc=W1EWh$Q*!Kw94B0P&eU~uO*9RhCcf*%tGm&z5uO!}8J8M&j&n|m zsH7Uq)`=-4^+7uZ*v~7gZkVYc^iydho(@D@RFvz~x{+Z1O~5v$4IOviCy{ zgfDr44Z0&QMy3UjVG!&`co+p*#|x}B@rDxYOv9vWR-nB3u>BpRAu7$4AF z5?xH4iZzdG&~tb_WWRjuYo9I|V)4=|)bj5v3Zs>nPg;Yy&wRqWKYO&fue_&&7Kew0 zafDumMT9O9CNd!MrZ%LABwObxWqz zU8Nno6X!S8RMmK1$}TOM8pVp!o9Ol|B)u{GZcics3khi#(I``tBSQ(xxub$2=TUZT z)jr%Tkt}$4L(kRIt|rwrtlq0c71`&%`{S8o+pQ6_(7bzr$u`ZlZGmNtXO&_5wGF;w zXo=og?J4$9v(JKfZR+-HY-BGBE{va><>&HH<5+#g*ozZBL->o5Dfo%`aS88)AL6Iv)6>bo z=x~Bv_l_N{3N=~n>JP$u{e7bk%U#+zmVu6&k?G10(k#v&SXZGaefxBgOIX`f>qPGa z5IKbWMIuh65_!D>%;K$Lbp2T)SYysf?dkcy>%-6CUxcGH)6g~Uwl>##-01Ey?kBH| zZy~Q-pqrqoU@*bO!JZ*s!uCWDHhJbPY!6{Z%)D$&iwFJLT7FYYf|F15`1 zmK@YJR%lh2Rmj!+^y&8&Wbaiel+;&3HICI;6lBD3qu4~iI0h&^4fsz z^m(R!ro(Z>g~Mgb$;=MYdDYqOK)YhvY28=drQO{=EjYT%M7bHectctf`}BeJM*T|u ziUAQ1AQULpk3l$(pPP*`Al$p(yFi2|YAm8I!YtewN*?tbg&OgR=F7@YqtC?17S4P0 z{;B@u_S=<|kKLK6gtVEQhKA>|PAYU8aZXzLII3#j`UK}YySeCKG#95g!|QsepF7Pv zC8>%`4JH((7Cnd4<XSljwSE`mgx&dHfrpoOsp)w7Rnu1JF1?g*=^5{<(%Bki5ECdTi11G8aMQ( zzt26VT+25M`j65VA|Wo ziEjJAb;Y24s+jqpKERQ)5Cka^y(bXC*{tgPz~(?qyC8!6(B%Z}^s(2AddYS z@(|blW%?l0gc-zK060wkYk8bx2%P{t0el7ZWcqOw)DTLc`z{$kZB&TeK<^y*Y0{}g zG&L#m!|%#KnvohpOjWuJA`KP}Y!AF#kUWuqGIjxd5@n@vg%;$ca2sVw<<@ezik(^E z1;qv3l7$lN;?@#;<2rr!k<;ndq>6Nn7?0>9AS!Gt>?~|94lgb->N1=Yx0;L11nzt8 zi>@tikV(VV+JcS0AxOU%dgtNc?21o{^r*bN*7pEuXHA(d{=%+TQreC)EU6HUHmnP$3elaAVlzUqmhjZ(3L z`a|S|GU%X!8Nb+ky`;F*-lD9whXD3&KiLbXua#yyXsLIqSNu`m=Nj3c_qu1xZij;* zyBV2^t1qL8A9jAACV#M7AO!-LMSsFNFgyZKKmfHotYx3fEk+j@3<9`eNO4Pd9uO)& zoIKwnrbtMl2uIPp{E7m;KJ6-Q570~z>g?GmVKgKu7*phH4=9BFcN-xiPlKwX#Jy%0 zD7{xE{X&j`S;qDq; zS)HC7=3&{>g)^=)74t;1a5L=NB)dAxP^)OWe;x?u7O#H&f;dW|E3PX+D?WfHGnq6? zY#?<)ijz1hl7@9+7YqTHmkO1GzV?4xXIkmxF)-K@+x}_EkyZ#9!gv)UGhIO4Lpn!z92TL_1pc~ z@x?mHZ1T>#zng|#*o>eHgpun(ufow`(M;0d>%9AZ*{}JT^T&}VuFQi72L{XkMIC^> z|MBbZcr8%OE+U4|G7m6PFmr*AJd!fVRw$|bVfczfx!@wuB+y4+>)hq3(5Xf=@-dVu zgco*MXs4X1X>$6n7<; z7Kj&f7+D!j8b>Q;9A+&=9%gT|f2V%(EW@5=f>1FD)A z8x}mYoSPkb-iz;_Zw_GmpsJt`!Kr~b2|H+Qmrc57-)F z7>!n^SiFZRmcK@0e%iZQZH|=H>BrJ06@qI?jyurh4Ud8I!v*K*SS{;fYKa%HSb*9K zHc~dVmg5$VW~ME?b}h%9GvJzseWCViEgsKqVxPOO#9z0&0}p2f{Rv%ag0&OdpT3oB zsbAN3pi9MDi|sE=_$7Q`GI?1Z%v@Y?ZCml3wve{ln0iFmJjFabW?g~y`IbAR;*TK%izmn%PcDgE49@#*0}@7B57mmBwf$+cCJ&v(FxO~8H8HnzU#pg?KxeWKgP$C^jS$0Htq zH4Ly_-P`HboU6uAEdTjxJMR3nvO~U}`cL%IyJ0DsrR!E8AP`UsWp!tD8EH-?3=T6Y`!e}@S`K-}(}|417XX9EIv8*5u9PIn%n|B~SRNB^gpj)>sDM4YX7h}31| z354t%O$bZOcTG%^V*x3^NN3VgQor^OM5z&7P z{h#Z<{WNj6_`jBHo&Hx?{{p1@4~LF{mY(ka3+8NL`u_v_59hyO{}tDNo8$hEGER95 zcN1$3VGA1*Tc>}n@iH>8a{rf^{}<=~I{H75>i-wX!oc`Hk^h79Kal_Ngj3GZ!sK6) z{*ww`25!3lSKI%R=cfBlp8iMP{<|pu)%ve0ywKcq|EI#d(AH@b=|DjIKoY_N%I?6I z-7xyeOF69H#*7kefK8Baas-$_boE(C+Co)xwo|ltFikk+@%U07F zVlPua9}gOXpR&9JMUkFEJ72+K1;21%seM_3x5WDd^=o1Y#wb2usG~_Cq^AV>gh`)c z1idgJfOTSzIcuR2-~l?(i7_tTE<+$$YJS%@{YX_I@zpaZ?GzlPOn6K%XfF2HHoh*lmZ> z=QCHxo732pkJE<~;Jw(7 zSV4OB>8K@&z;bEFTl1C=6JZ2k^VEq%qk88zUgfsP5~W$>Moar>ze$kIpGu(cu5G*( zr+RGSvs6k+(V1!F)9-=)N}zpcXMCz7ix3w_5Qv&ge9Tdf9nwd7StH_o^daI)44Q=E z)g_+NMgy|}%(@XQ@MQIQW`z7C1`_e&8FjkIntWss3eJUsbzC5;r{#@`#5*edb7vS?`>{vAuYt)ItUyG=f$BKM9vuu^ z>4s4sefoqnk935T;6Kzsr7jCwM9+|@Pbw9Qb@J>yQ|D9Yi%%CWu5Rq5p41uFHt5|U zl+J$28$&VLKS6h?f&RtF3k5NWS_qU>&R_}^nn2GI{m8A@@bTBz>h7Cc@{X*)>m|2s z7oXNqTj?5p1gN zPEYR3d|QbNBeFzfv0#HdcK{@XFd-lS9%T5pynt9bK=FDAeVJ@3FBKf$=vN@X8b3nT zI5%EAkEa^O5k7dV@Y>+dB$AE!8p7T?$^rj?!h{D0_T3SKWlDN*HNH=9;=U1v=bDLm zRw@<=d#c?S0zD`!uu#4R0Rfen!x)2imk*cg)n>rM$Fqo`#pi7%>^s20aulGS;rS(S z7MPo=op30|(d^{0{f@c#AN7=I3vKf z8**1#I5?(2*-RS~dU6A5+Wyi5zNr-BN%aH)!GH9*-yV*3Qa#jocjJpemNAJm-Up7T zGl_sEQtY&P+%!`FFmra5;eFck@B`8{Z(d%K6$#kU(P~pCxJ!&W}j604El@Z-KQcQ2kbVs6kMWY9@M-)E%yw`0IiujY{xeVuhClzD>1IUF7(BE^?vueW0n0d!TKpO8Et0 zM39&JT^pRv#ez*J(E8iCwX-roh+C3w0poWz|GPvQ#QA33?&75P?)xkiL$R-iQ!jI$ z`4)~6j9W@T{|4jw6-fDRGw&Q^pzMmke$V-7R1bX9KEYtcXqefeP-^_nRmEc`#2P)# z_D_&#uz1B<7a$_Q1|YGL`4rUh8+sN-=~f;{*N`9ahdPcHLS(IxAX6lr@2|}=)tpe6 z$$%Mg_VG>Nw0bJhsL^OQa!(83UY_4z3(A>KIoM*~ zYy`+MKE@wHL-xM&T#8pO-i+w14?S;7Li*-O{uB!%UYg?9yD{JIR0MIaX5Zw+B z$+9iG06ZIrIWm(e8IMJvs28UE%y4~?daXYgD;_M-@$*Hzn{J^hi-8C&%Z{fZT`&m; zth4AMLS6qHi~*+k0pZ5rhbfJC_$+P-je)SpLzuUUg9Q(;WD&~LyCMfg^=!{8@k zZW?M1xJ^g#*v!*y=A(T>;m50lV787J2ysPdxd&NNykH{esTiFZDWXx}<+*jhUkzzo z!ZpRWkwCpKyDASCINPp0(M{)t7Yj79dP^6s_c<04x`;&n;8B2Z_$>*Zc`k>Pn}8z} zk^1%6ZGnhA^NrTRg?CkDAgSjGlDx=f9KEF65n0QhzR$OpgBiNs=$p?6H~W*ER<3@5 zZ_ks`lh!x~uzuqfA(zBHkylLw@hfO(0w|m&ZgT`c*59gHlAu)@90TJoq24#RZO;pu z;?mMWmy6|T9KXj?g(@E(IL99{^qsDEO6g7;@Lb&|h$_uD=I`DLCAmIwYNr5DjQx@) zFqBq;00{>0rxJbw{>|OGs@$@sCX|U(nn9--p16xzw*A`J7#r;Wd>RmDAOVSC#WGwZ zO?bLeyRfbFZ)!?&Pj+kbqqqA~m1A;%^6??ZVqhr@dx=j8kP}TdHtFnehn2Wz)7hnc zmg-b&#JDIglLT}z$;wnHZOsN0*NpLr3ZBmPXX65d9HdO7QA`hj;dvWugV!$K_ph6t zq#2L!t$NcdETnQ|68D(NUFu|1i}&nw^@Xp%bv4Y**jXq#+O(021rT1)Aw+s?QmuCB zcWdls&q$0-_=HO(_v-PeWQg1C4{V3;x08b_x9yR@klw;RL7m+BsJh!Ry=zm*Sw?|7 zvJ4Za4nC;76OB-0hC^5V5X~fhn^zQ?U*SsGOM6(>1RAkOSMu(tquJi&fNGk}{KvWFQ1H6-j%nLtb>+p z|23vUAtGGN=5G?zTJRv9y=qd4NuHl~@fF!@w4BZs2sO)jIh*TQ<(()gD&CIg{amtF zv({2<%c{E3Wa$V!MrfB>cdiao@lEeggMi8B7mf50q_LtiMya~2T3o%%tL z4$u+}=#U&C)pR+c*T`|qr@Lqgm89bB*PFzn=L6f+=R>ocW{e^mClCtm>yB9O1%V;FqCIQI_^b3Hy@FJBjWKi~_#+=Ci0P2sXcQ{WPh zGgd4B8gyzZ5ToBbP!UrJhe94OVDPygH?y9f@IG~QepwX(IswQ7J*ut;G8VrUS47}bDB5+SzwY~aJ9s{&=`yyBA zEl;*L-Ioi-Epqb{aW?VQJ#(gRm-+{Js4U$}EGl9#LxMu>ms%^QQgdDguU7ScW+h#S<>4LmC0)y- zR;Zbjbi--DHiY*hLzmd}Z>3|0C=}%lzrBoameUda5EJi2G;z*6YtD2{sF0C<-G$#J|cIGnV83NIpXIIP1@%#&w!bi1!38q4#a(K{=! zB3M+4T8r?p%alnH#MFu9Hb`$ox;cY(6oB}vFEoMGN{x#tO7kh#&*zN!N@?@LF|viB zT=G&NFiIR>53Jw&LSFpjTbgwXf0Fhf{Kjxk`_qSpYI+dAN8|$7+HwB+^eV`nB=zbi zxRUh3irb}&c6rcSiuDeSaSHD#5=qlpNes#6o zon}fiXc*QX;`LdftlUvtBQf`<#?5*T_}%K65Y?}-B^GmTYm9(;_^$I< z@9S|~3>r5AM?Cci^?I(nydXpls=ek-D*cObF8cl0lQkjzlW`6VuN%p(ml4L5m3sJ| z(V}5@7pU5(ryO+}FPAbmh96dCJ=lx1?eYQ7-Bqu^KiYxu$m&mB*Ttvfh7K(`k>_HX}# zR%M(~bBE0Wf_W&UxP$AbB$7N(+h&hqLrGg`I}MFCuOC>U)EJ3U{3|iL>nHp8sUxpz z7wl*p?&w`2P;5#{VS1kanF9_n9S$9hfChz8f4ToXx@yo0vrUfj5YlkYp<-&D_)3>) z^&2Wb*|TG+i>bt;6{c=CAmm}MBqK4|ukn^`ReB)JbSt#qW-_*m@5JEk{)o1NM^trb zRN85mOlG`Plrsa1fyJGbK)OPV6sDUXY`p%WsSs_VWbdJVNZ)7WZRh*h;E?x+%<}3_ zg=u16f%*G%4p-5IhE76ac62U}m*G|i+ZlvKP?lZpfC`ugu8O_O`tXg?em-2_F=`-X z6DC>yY6z%ly#MXk&d)W-OL6xLK0S~CG}_R($VvGV3}sGR;%r>{{ZDfS0GG^SWQak zg2N|?8(7EJr9iSFn`+lLkm@Wl(|JwU?PN)x-fT(1Q+!G%j1{jRT2Snb(DlVb{DvQ1R-e`Ji(p%M z0Oz=G$o8Dg+TWu36GDBaOVGtVOT3&w1pF=afQkhi$)09AbMD6W&u@KIJCNwr}bcHLX_uJ1J4 zjz5ek=sx}{dOUG$K%-I5L~h%^KJ8B|QxoR!?6~cD8jibSE7xAkLfu9(_2fntt56}k z{2-B&R9V#V4cTEK8cz5k$uxcXe5VKPRqUUfx$hQ{S3kqX-1YD2AF=EqIWR}>3~Xr~ z-xPf0wze@Z)OT`<93235@V=ad$g1Dv_@y;%7;Zd|pw}{VBMUFvp&Jd~u>xVb!y@(X z=U7_%zTfR4Z8p0vZicp{=Me6r?b$Ik7b@Ce{bP8Q>2ZD~fl zm-RlYBaR){>`>Dmyu#N+`{9-Kw-IIX&+CKfOlCNES%V1~9|*bct;Fu`_c+lPd9gVK zZ>K68SS<#S%x0kFeF+eo8&+c!5!x`Mr$kr79*YANw~^RX=7gyv+zC6qAGKl$FN(QJ zpR%FRueYHQZ2FT=D+_QkH4*oj%s#^pALQ16gp)@>rUpb08C83*yE)ie|5gMj8L4T` zy`aib1#)`@Kj_?lm2lEw?qqA_z5LvUW}Ow}YF3g)*6Dm^@%|~5061EfqTn5>%|_{D zV+RBOwy&3wy6;j0 zj>NIyJov&c6!7i5rUF`u20X9r*NvQ?oTx_h&^h!KZpu~12lY62THaB76cAEEjSrXL zEA1XB4q{C(e9sbJa$HfqW6H^^?NYzgmv#F;~F9F7~Wu}ks}_x$9)0Gt!|q0Z_SB! z3v#i-VNVz6imSphgZNeh){1$%|%=iM^Mk*4GwX!vQunOs+#o(vBE zuTj!X=4%)ELjLXAkv49l2Jl_}bCTDC%qj7md3&FOB6TyqM^@iF;!8nsQ$9OyYtEJ< zh1WfsP&?PbyyBOIJ9v}8A zkZk;~Xq6X?-oLlkdCZ<}c?fJNovf*YSn&-w1b)hpf&y-bf~QI#tV4ma9q*b5ydss6v!UeMu+=>1ut~ z!0sbXWK)gT{hnrO_x0FIw3zk{yHp8fV|aDN|LsRncJF)MXY!TCoafx%6Nqcc=-cK1 z^f>psp4YAFJr+!L$umh36r<3KBqm}>6e`1IBr?mJ?x<=z663f{5ATfMDaR#75EDB~ z>1N6M47i{ddW(DRymj``DW3psw zIP0D$bF)}MgCVi1H-4z{Xu8NHL^HQ>xdjG?8hHy06by#hf4ciCp<|-=b!4N>^p+fH z3(U$?6oJbH2ng+2LojcZb1?46iwZGb4b!RABg`5!$4G4 zNta2#&r#K4`zn}Ve*f0lY8l0x_ecSmhQ0n_&%?rA$Z51+;JT8Z40G08SGZY)=tPK3 z{2o}_aSE=js#n&-t)@*6pDi$OH=1(fzD;v0x1lXW=wps-P`%vu?4iT`>h<3c-K$^; zY4euG`hM)iC#E=2bfOvM!e3aX_tQ+i?FOOEVTV)OX#o+lz^mj^(Yx`_8FZFL-eW>- zyrFvSzAdf%v%X{rn zELSr;Q=1dMWtC@qZSDO69k*&Ef^zjei`!eXeiy5@B@#8S!#(YrhhnzxekZ6+Hc*?o z?qZ|Wp5`#@viWUPlC9)1zzQ2+8VN)Z=uKe~UmKP7!FJfaNVAVtoPeFSDZJv2)Go={ zW*q1Md+7CX)yrysS8JT>t1 ze%zmKnn-D*FON4B0dp7t%5)V`F(q}wiNJ7DlczJq>(W8xHxGdjW17Y~og5nJaj z2rY{n48LvC|&@L&|gNQ?fyo`7@)d7DWi zMbv4h8jd2)k0Ag1Dacy-`x`Ky<}QRHxUG)~?VMIc5W5I-h9XCL4GSv7j>kP>w7*SW z8{vo2CF={5;D#!9yba9Hi;Rls$2&=m$nK+pMcI7d2v*2Yw7ft^<{_8;>I2)>*2`pe zVFFUARy#r@I+cckKdexr>6X5*^;=1c_pkYj;WP=K@+848q&nqSXjaAALlbnIN^{r1 zI9ybNQu0Lk0KdXTDMpWg}_)UJ8N)Gun;r7!PRwe7OWiMJ&F z(PeVP{Do*e(1lcPrmo4+#@G_2+R^cWY&N zNnJ_emyTfNOE{FeFBW@dZ8q=Bn+#W@>?6C87^2&SLW$PutRIwCfh|k;VEE8_t(Udq zkr_hgZ5JfY7nksRR+ioD>{6`a(;hiV2yFsLKDUjt;uSJf1D9xKIWX-`ouLo7ITl{F#?WikUwbCfoV1yIy_E+uOq1Tx-8XItee!l3)n8|UzYpP+gh_-|0OdS+;|=XE5F z?Vo*^dAeWT-?ao=T)p(20>x6+9sT0VyOI8olg80L=-QA#%#GXY#{HZURa*0cCu%mL z{I07wYWgBl}>AKw_St5hhW&K0zo8OiM{t zFetr9!YK#pQ3St1g&1#>jRJWcmv>Dbm5gPQ^S|kb;xx$Tto1;%(?Bc#QN$3RD`eYu z_su@f{0rpoSh39*l;r+5Ar__>IAq#}b=nh#1_YD*4FfIrdk;{`mOGJ}n zf}qijA|Bvn?D8B60w<9#=wq@qU*3$zKjSpx()e#{VtptSr12(qsv=-#u#T$MP+p5F zIV8~C=1G&<@15c~DQKX9mGNe_KrKF-1vNevgciEk1>~>>!NW>3AH_?;Wd3#Qb)It; z;Y`iqy{j$&WnzUtRf!ihzVP{-%KiKeh9k&;z}K0|{vhTn{#zK&wz~^vTki?THoFnz zVTGP?f<#w-I!5%Nr&F zwP`-s3pMBdY3Oo$c*t1?Ux!UfG%lFYT;?k2o+k*K8$NKPy7Q?klSH^6ak_4pJxtED zoeF+FyEM*!B%HIj%-F9_GsChgJM@|AO~t{4NE_~AioMk~rRct)cCNqU*q^@_Fno(V z?HRt`1qi3p1a^%pmP*nYUM!8Lv<{_jfBxOW>Z~oqrTc_9hT0?k7k=TD90W;ruMCQ5 z+W|dC8+VlkZViWL7_v@sSxLLvP2a{b<(#z}BZ-8wNC@^)D-Qw(%M}%2D>xzy$1&6b z`!an-Qus~*-V7vlgxT5z_*;7`ad=nKA1Ym>D~)aB;<*Qw?67#suvjV@iM;4DbMLPa zkF{2!owW0Uz>Eq~j`IAOrMV*F$tK>-+r^g>vRU7|LA@OwS2x`+c$BtB&Y)n3@zy5W zbYuw~952S4XD^y+dT_UMu({Gm0OSTIfJp*9`j^2H_vpI{As4NZI}z08=qkwD76mkW zb*@!^47<{RfU)^zR;ZimMzxtYm4AY)OtY~?uyJ*Hf$6U zO^$_Q>k|b`78qYiA@1xKveLLOZk7kNh66%e5)exE8;8{ByCvES_?khO01|7NyIO>|u)f(Z)x zq_%TkR>1D7Jy44*&Qd=*Icp=3eGY{jve`*EhMvsc);EH6{OEQgn-?1}`|$t*78;ri z4GYR!$*jET#ebMM^mt$_lCq=Aem*e8`UXRF0uWcekdfjVl~sw{JQ<;;tIuvGQ30x% zv_#p0Cop6R$h2h@dj0m71X@Il&UUB7jEv1z8oD*`L#C1C6rS<~b5X8`U9*opd|ziG zYBwf95JsEn_1ek#$&Sz$$6`Hx-4-)5uHr4TQntoAY2URPAep%*MjD9kiidG-AYiq7 z!&pe)4|~0N8fU5NaPvb*re4J=6KaLPvp8Q;j7)brnrO-<^1ff3^z-Bw?Z>)uliwtN zCFf{SH~3y5)8KITQ)N+dmlhI;#p;~T7-?adi{AG*Tm2rgAQ()>X>3&nIGLFD1l}5= zq=d|KmJzGDW8W1^(opdYrTML#r5~h0hr@moRw$UHDKN>Dn7)Hb=H{q}1r)#zhhf<4 z+D+vTB2U5B=*p&@tEn? zC$^pQ&fYWod>8-ae|65u-Rjl7s=B(;c>1Y&TM{JA=Sx~IU>6rtuC+63ALxmkA#Ikl z0@9&hPeDZd7R<%Vz#7=#xcl$RTnR&nZwgp!Q`;}oU7f~E+>JVxq z4YkRWHiX}7nE8{Y5gwn3E}ws#*i8qa6WHClwYQO-)JeaDK}(5C^f*#|VB5C8CGDnQ zupMc_h^*L4vawOk4xNY^JSz7Nm*sD1w2}FCq=SEF*ufp3=t%OcxOw}Pv?t5at2FIV9#z+D^y5| z&%GxJDy#8yLcspiz-gPZtfq#=(@dqhqYoo;l^hom)O3BJgP@{7BOi1#$$N1L>Bn`8 zpYjOm?INLxj0V%yh-Qis3H{-z%{S9NFuqyKg0sA7FtAl@r1+w__IcXvOD>aH&`| z7!}iOE}qsSQ8Fvd5PpW|dtK!$;$N63>z8}K)BRXf6@0Eg;YEIF-BkO|*YSw6&&~hP z(=utF41fisnG23iBI4fbZGY+}vkndD7N6Jluw6cm)ISo_fK+WJhEKg(cFJ?O!~(AF z(>Z}pbUi`PZ#xmhfD7)fvCKoeT_Uja0w^9D*(rk7zAU(M_rNGdAv-Ce8Q~=$rhec? zCqj%41$BG4%itV^CR>%0-oHU{BX19fRvJIMC4q&(NHkpwC{Yz&Ziy@J9rbLgSq5oh z76+!aVv*=~w@x&JrqD@iHtMYHMwMx$auhdPe%2YL-m_bT8@Goir2@|UC9igAAGrh7 z@r!QAAwK^to_=27;hDdIR(kwK?XzYX>L+tiSLj{#ao(Lmuu`vn7{&v?Cd_)hVI0iz;45_zZWwA;l%P)iCyu_DpQe zd79Mqs|WOp*xF>0We|Z3Si*-u)jA-^qP@y%p6H51r923_xXUpM))?(G)oBH?APP{4 zB{BCQI`&O^?(Q88P>>)p*e4B43hH5_+``fFss|W~4!@R;GBGJoa!EgX#`qDvj7sTw za{XS*A8W9>XnA!D*40nF<4rsGRoQY%U<=YvaB~`;$aT%5y@|F@&LnBRKU(G*djf9F z^dS5AfNd*1k-@`EexF4wWoiwi7De@MTcqc&;f zHU^kD#1^6*&3il|n(ve7sRQLFwl-TES(-m_W|B|^eA#MX1C!MUoAYxP2L@)b0edj7 zCrI5jZk?iXqf~6VW?7dDf1;?40sn;V8N=_O0_BK^)4nWQ5)i--ypEV}aZbX}iH4DT z$)6(}7pn;>{$}9r03`l=H7&Tkg8_WX6kaZ#&*Jw{|4I+W9O6$u{k4-WJQk;>Hee30 z=>%p&auqW71+dJz5FS^E2}otToufX6*z9{P&m+0!{ES^(eB6=r1HM|t(#dQSd9iiI z2oHao(5mbLF&|4541mlq`5Xijb7F2W<-~%2-$B5@Nr0#kjj{I;)w~J;B#f;sX%@Swf{kRDc@qVLGO1gRFVgEF zGP1)|>R;9sfVnb`FvX-Z`K{^d8+$58$F#%B_h(f_BJnpHS;3)xr0C2SDUe$&GI~lO+6!`bvT&oNhx3 za+w~ZWt{r(Ofu3ws+=E|nbKy|;TE}*s=G6r_4uDe^JhYqGC?)ykeciS*hSEQVWT#X zyWkk(q099;Ne#TzBZy9wzUZ#DT3+acNW8$|V%@Hn1ttA6cJ!bfI*=6S$CuN@OFvEN zW**bwmFeN6TddMAHF_$ep$|t2pR_D!Q#D6{!6njYWwZ9mIbP3Y?yZ>7kI7XP^T_=@ zc%7r??%+IW-r|LK3Zu@36fYp6D1Zg_%8NZRA2Bs+j4!732_#U z*u%BIu9KL8jgU@v>rCk8Wf|e+Hk^{XkFH%5HFNjec|WOoFoEnZVNUSRzVbIi3a4v) zsFF~kck1jC_p1xo&(w)bq&-xo0$ra`Wo-!Od##`?TaIL`LHt7DjVq266W>T1y>Rlj zIGbtv1$-$bFaLe4oD>%KVN|2rH|;xu!4EAw4R8w6OYRr`icFLX19&86_^ggwP)R)` zbfk39>`+fA5Nfu*@I6#{Tp52vO9$I8(zyg8-@m~cY`AcHMpO$|fTYiG&ZsI$Im_(pt^rrqd(J$Z6|^c28weuZMBQ1$z< z-*_anjU^xP{UNEvl1^}iz?BQ&5abB zdksQ8Tp>GX%1&orwlRHmVZKLl>Hvl2;qT{p94{%{f|z!XjF}>aX0L?!DgZ@jpx1)% z)fdx&Iw^%Te3iGM}$s!8Ia3a#a$MAOtO$6xJJZZG!WV~aIe))SUzdR34~0jTz50 zFkjD5JBvIqu^i;;abCDk73o5*c-k;Rq27St7lxe?DTN3%2>diS;%3&+*j$M_SpcjF zM+{tO9xu@&?eO{JexUEW5gh3xtWbD3HL4X~nR5+#k9Zj?lV>K*TVY`HRVOi>i}-wt2QzifMU^1(gB#PQp)ch~Xb(H~RD zh_BtxcnTzVd66pX_;IgCfwO(vfPO_6L9c@?x;qKxCI{~q4w+YSe~x=WG!OPFm3q0^ z{|L_)$20hhcNf2u?=oUK*##VjrXDbCzHbypG5{Xao3Sj1Rd^h8L@)*{?)+Mu5EC9c z=XvZsR)u;ANh2ZT|0xc=xF-Baf{5|rgs8&*G@n*k4C%TigGk!GAon#<%$TGWcIMW* zjh@6ZP~Qk+*;}|V^X=dN)GDSb`(aP81X&C_JWxj;a0!%yP5dBVgJj_2c%|Ow&e_|)@_E|pi zqIo3I>WqG~M1Su9Fo4H#{R4YL;H7LE|7Rf%&`SH?wdXgXREob#ypuGd_HO!L8g~~0 z0kG(^3-*7Xp#cRVenVrNT95%OzW*@2yTmuof3L*<(!PTT^zt_a!B<+${}X+*%JUCf z^|u~%2%r(SnnV1WY_NaZ5PP>m{8U&H{(~gSm~dG z#6OzZks+`<9U?$MK>aS6|7BPYBQ`u$K(Bvp-#dQ^)!#tSreYn@L7SR5PqxdC&&8!0{S0sA|$Xu9_*J2gPvJz6CLmU z-;T>n4%%nE)8r;$FYv5kK8d#RJz2A7MgLzjPJM+8UEMKfS#BbDD+FE~VfgDQF#gYo z^fOiX*j#@Mt_R6X1@NCA^L84h|9Rm5tMh+|eKIE|Pz*JFcv(?#9%mA9D3<0(elb@P zT0D@UfMX?d(K@1{6Y+I^(mkNq`OQE-^jXWp#YaV+;WWn zWd@@GzFz;SW}Op(Jto>6+s|A|#lVKFdMCDiUV0p;T$dh~1A1YRz2P|%hgwbBub!K2 z`+c2%nmC1>w@4CXGb03b^t{_RS$kkod`vx4_sk<(@9oQ8#9Z?zJ>vmhIn5<#B>%R? zUW6{c*Dq6qi1#Iy{D_q9%wZyH?Jd+!+DM~p?u()7+&{&Zc3V#G|)a?M1&5P z4`)?mQbi_uxz50~n8z8`unUc*R5)l*rpGfPg<7<6iTJ3Z=s`b2Gcz^>dC6}+Ru7-Ji81TyE$LW-({ljFKVxv2Di6mbL`$2qsD8oD&qs@ zAM{><*YSI#AG*l)s&uw4)jMPim+0SN7YBXTZh)^BYd4m>e_HWCHB=b$AJ>k0hGGkMKnH-u#>yPrh|OhhP0$&{E7tfN8r~_D60l|F#88 zmJ{2xBqNX2i*;9g4IqEtjhU0SQQ^>o9eY&Rz;T|*M;MO6zk9lZ;$j@er+-@^t{BF(UWRGM(ZK-H)1UTqNdvZ9KGU&?yJ?WP*tZnKePIB&E7y_ zq8VJP`a9}GQaG~ef64GKz?=T0M#HKCWWcUe7=rT)Q(IDtuD$E7p$W9K?!2|lLFBqmgB+ufpZJ<;-(;x>yH#&yycc2=dN zYF;riW6AzPkMYRu<(Y_p2YY!}ERPF5I^U1Q8*g=Yi7F|2QDn5_=ZF6lg@!=z4kV4Y z4=*^y#gJu;3Ns8&5Ap!Sq4f0_5d+=8{?7D}Q4#baGJ%e-l!|jEWtKk`Zl>i@}A|{+>Bks%YI&{shW0uyp>9?dMd85{h4h!P8rGGyekxNzXkOlJ_ssD? zmUY<7sPs{_4FJT`FaY)+hT==E8Gxxx1A6+?GJM%gLwq2Vc#ZVKL2gX`$&lRt_w0rbJjx z!o~%b4ebN7x=z&!us^|vib|I?US3i;^Lbjw`Rdz|512~lOJ(DxE#iW4Z6$gVv2QPU z`H*A1%CCy)=uctyM_+08WlWnZGwO7kq^_$oKu^URkB`9{X6SE2^7xhU4TCHAt8((_ zedf%@yzR(1e?mt+SZZs#et_m za%;#Z*;xT^j=Mjvojwd$n!4b2w1;^u8r>{Nau_4hby1;p zvpQ`db+I}#u=58d&lRDENR{PrhaBa#ksPr@xGq1T1fTb+M=m7y<9Nhjkg~36;imH4 zY7(J5E?{OpHd}I`0X4&NO(Ra6ibHMs@VRi}>ON$(xd!HP+FBO;_boN3KiueGGdTNhv_Qun7}9~ibH7E zVscHIM6zV~hk17R_*<^=q1e*x!MV1gqQ*&MIh*;PV!-vCYEh`a=%GcEv_`iZ>qy0FmCKDRzEYNg%+V&I;bgyl zg3oi;rKIx2@_8J!-APqVe*na)zI_5bo__ zGUutsZ)6#%v<=xS+mS2|8c*l=c|8mN5|i%Zg6co#>V4}bDOrC%H>4SeUOcZt_Us%2 ziydt2M6<^y*n{tZztG+a%4CZvGwPOPDdlb4>~k^E2VYk2_?0i4fCKmFTtHVH+WMr# zrpQBmbrA}1E^8m}4hwJsC!OfaRlYD-A9-=}VrxK0ZN-Uvi(kp$P~FSTz6Q29ZLab7 z0>7|?;c=5uZoz;?oie$*{AiMJsH`%*qdY&7iyl$~9(OPoZDhOEj7xR?X`!;%TtQr> zk_YZ?TQ?wn9=+^W-^JGVkT21DhK>R(nx6+>5Lp$_5(4g`=~dBGDm~F}OgDP2I>0yQ z##QHYMih_NvJ=f%BVlgPs6X|B$9UgNfuB!SwQM>!EWu#`15T+wvUNaF1gaps?x%cM zZt{(`lB{@fZ!l1G(*t}`Q=^z27Hx&}1$fW(FIDfv_)yJj2OY{a#>Fii)J_p`U!qWT zc32thZZcADWe(_beR-gup=*5Rd4|-R0!%(uK#^K!UMh7qu8qs8eUtlsO_w^>8V28J@olS$?51=&g$DL{q|Qp2c+%ahBRB3QS;wNAWzYEBFC7(9WCkGi0? zP-mtd@jAIF+6ZULs#WF|errB7l5MvTy(?=vS*wgy1l(pfNwVUb!l@c*Uk>NZ7UBCW zaT1>B%!p&~WU%=lm*ziTbJfw`%2sxM#I2zk_{3V?VhV$HJ+PiJ_Ld_Zt&g^G&;`F>$!UjEF)ckU@Rz4l1UjX+w~Fd5i}vN^fg^|W7Y0?gRh zL?28GsfpF61@5dP@v+(JS$fA`id$$6ET)2W_c|%9Mu;HIic_xd-f9y=53NOR2aM*| zxb;2^#0v*{j`tR~RnyTdO$D36>q<_LoN%|^wbzZi8|8wpSeyF1uK22Qp_5BkTT42ra+@#wELI^m+rffQl#fO@S*kV z8=VO;z&eQ~)9^ixQb4Iwp{C})XTeNdo|)^^1;?c6#Ndc;1D;{}d9_7nOSsNpY@~0q zK%C;rNBmm9X^B$%69ZadFR}vqa_(wmt{Lbx^@!vSwLtVmM_p&+I|FIy98>An{bQDd zZKU}DPu9Vgv~zAA4_?uVv_4F9C5je?8rxaXia~?4V^u&tgZI)(|Cg`HP7`CfLruV> z%Z*=e-flpHR!f~sp0$-btucX>AxUs}y_#|@9>%QBmTEv!XV7T8D-a=3(22zzZ8QwW z^TznkHTH5!*U19z%cgBc1O=r%)5g^2Sq{(T?A?tMbIr)}#m+ zIA8q)BB^xTM0Z^NU5SJa+mUU*QtM!xqL@i(zPl=SQ@MUwrHvqFl636l_6Qk$oI!?< zHaN$fnW%u5=p}cZ_^KbTPq!}gxl&5vd+hUfj=AX4KGv_B6`Tsz;h^hkaqQ|@9R$mR zSjf~HenB@5SC7HwDO^6E!WI;fi{dgl0KZd^F~}&|34Nn#*uSDxzSPzHC{^|e@RNkMAu-0;oOv!eX2gDjZN zVRrM9cdVUhK3Vb=xb&c3eq%O)zd6fQe8B5fO%PQ0V|~QYbiENch>CR5t+tf4&1iz! zlx}|ekEp8*7WYU-@a!c{N~(xgo)JKaLLpHu-6=8~;JiSBXwhPL+|NXIYHE&?Va;Uyx$c(}A-lZAz5Dr)cRxkNNpKN#6=b zo>pgU#{h&o6v!py7D{=mZR0kvcppVYMQE|^7F)=4JkZs4Js?*(Yq#i67dv@17}NP&-A|L**mJ!a8NfSnYxF(yTJO}Bp}NNL8hN+U)wYsv z1)(=?r%sk>FZTUV61(fY#Iv5F407

3P_Ww^fTd3l*MLsnVxzGH*qOeop_y@fvd z5u9;nYWWCrrDdmWnjajstB`af+uM9r4(P?4U>Eb7hTqb;Y9N0yp4;<&CdN!X3uisi zc8K3x10{x2_p+Of16>v3+3HsAEi1;-ol`kbOdxb?V>bcPwz*9Gv)#*{)a6LIl$~m@ z>PZaV+4N6KF0HwDr}|u6wAT|oBi$*u^%cbd^6k7t{Pmet{a5F=n!{CGS=D~>gw-Oc zFCIuY8|3Ncum1L`uDt{sOx`U;hHC|po#zn;W9;yg<5&^s?9BeW>3X`>|!S`;3y?8GQ9%DHO@PZ@YC+n;3W!G+~`gemiT#zG1?dFEA;8i)q_ zZ*=b!oLy=CVqt)|Q|>|Zvo7q@t5REa8IzA)CO+xPDcJKy-ya=~~#oM$P+f zghDJ;A}evCNgt^%i^`j^H+>+yzkP3!-ajyKbG;+=+f*j@N=$vY7CW51LyEY_4CVE9 z(}Upi_Rv4#a~7R6!=8^~yZH!iwiO1;i_Z`P*}Vx22|tc1z>n<2$eXm>y-R&ts=2!u zG9Q{}+@rqLcZKtLrM!148pztfQ&L~bs{wxUet~_X#Hg#JzELu``H8`bo)uEi%aub; zBPH2g`$-!If7W@gnLQZxB77C1L5y5r;Hx0|5Hy`lcOF>R9QHfVvgu3p@p7bF%8Ml5 zjyHXW(kDL6S47%2|5fdgn)4gb7KL28!S7MKX_ar6H)Ae3KW4ag6U{5uSWemuPOAtn z6N$Fg-*n9rRZ`or1 zN!~FGGsSjtw2~>j)0^3ox8z9ObFE~L{q|lz8zQDoA4h))Jjv{{`&1(SD^^xpiDAk3 zJlG!zr-#IUg!j?zP>sW2#iqI(2LdEBsY;47_EIWL@={-cV@s}QX#4G$`P+xl2pi6} z)Yfv-1G}W4mFJ?<+T9uF^Ah=TJ=Ksymi<}j)4}$yi(Spmu_6(X!O8wv!&c57)n%^S zv!?57pOk~KLvk+PxT_L%78@M7IF#*p4A)b-0<{C7ENBls36S&PEG_B;;zzwV9qym1 z4{}Js4Ew}Mg>i0T;g`x}gCDbu_$`P(g4oibhcf!qJ|Vt$=k7k*`F~)o^v)G0F(5tYw z>b2)nL&LW0R|=%M_@=gcwupF&5>2>8SbbhFt~S3gd&@a(>s!G4*1FBg zTg_&(9+FDut%6)CRkB>4>!R{C@FeMdJmZAtRggQ5l1L8;o+?Q4YO0FOlf>0tx6MJ@ zGhdN_UHy89J%CMjY*4F6KP!mb^iG(KXUVdltuf4g6|7?V=2Vv35d(xvN1&GJg*JwjAyEofLPjnq;LY-#r#6U*_t`O}l^J!1ss%u=BLiLY>Zy19Jz2OC3 zkKKchp|q&=w_6+DkLUP&_QvpJ9UlT-AuzAtg_)a`-8V*k!GnXA*0&eUBwh`Tr|dpW zZc=kA0yzc?%OvkVr(S;bI)gsnb?HGFvAaNa64(s!gdz?2-i{qgr-!9{tQ8;ebzOZ} zejWNArJv0F>LeUy`BBt*uQ&4r{-FHi1L(uW2MYZDB47jEQ*d@*k&?fsu)3gz z;cYS8<4`@f=o$;>u8TpBmiBJS^*yV!M=QEcdcQwi?l1GB?<&#AQgy_^T}Oa>*^k>T zivm_){}5H{?%pxBQ^mBLVUzY&rm1ivwqjp7YC`t|cGx*8Gd0&q=nm5h|B*P?%HV84wL~IKgt5r4QHU#_iL7pMlO1X)L-Fj z+8W@Kq@N(1EVFvl;S;?_4Ky1iy>;>YX4yEp2o^sR##|lbH$4_+bAa&h0 z5j#M>)4eQbp@j!eY_4dl%1?0&KQ>7#K!X-z(sl66;?CeN%0kh#H)|^`0o95sxG9lo z=qAY?O~PuJ)NOu2ji&?O2RBfO+$p^pG)=jcf?v#%R^X{a+Ed+5e^}GatNa0{Ryv!G zc={S@+Cs|Dm_<0TLuKDwLP@&n>6%iF{0{&kEYrPREzMyPlfC@mtebat&&z>Q@h z-K*%`QmUqfpeq%e62sXVqDY`4)%VkS*sAE5>ZatE#(`$!8Xy)o~M(8;^sXtMN85$jE#V}1oc)@6?nDX4OF$k+K~$>MF} zQ}#6ayz!FJ7{{nv83+}_tt|z^kE(f=xu_|QKb+Nv*ng^%>{FbIEx-q1DwEl6O%bpq zsv$O}U>|;Jlr#2<5|&`MgNgTfQ1yCf#D03BatVH$+c>(3V)=6KZLeCj>2&6Gl6>(M zkVeQ|snsQalSgvuOfjRNt2F`ZbsU9g&<7*~m)l2+U4HjhL3iHsjTYaUvo-eQv%qNY zW5klW2KsZOv*2zKMD+ITE?&24q$Y&c()%2KR<{{fnMDna&{mm9cCgm-yoz;wy%s2( z;e3?hEB4z?@1RNU!v^tVsK4RxnG!=px3(lc=S)KIae=FjN#A|8ZPSsLoSf`H$lxmm z()fvk*Dx1H;V_E|LkRKL=&kOq9@C{z{VWK2Mr~n9rt5tSY|pc*r{wA9#k=0K9}jcf zUbXEhtm_T9Ao!j+>4oRp3NW0`XTr5*XV83Msg`it{U@9=s_(Ge>m^JZ`j_|^*<`Sd z9`Y+y<|B9Jp*Of(_q&Up9531aHy7m+7H(dp4`(;+YN~UI zYW0KRd`$?JE(zI&(N2}iF@am}VaU=iji!aoWqfNjRUVXU@1Peb8T}55^w$AAZZG1d zTEotWXtGBkEMUfm0)!HR`okT>O_q*+SGaxp^0w4w&Iq2Z}7c>;b{*8tj^(!Vi494`-0HvDdZottfZTkQxeuXc+j*q zq2c)&Ujltt_dP}pA-&W=WwpP))v~PI1%E;u8eNY-W#m)RJYUWu7KJ-LhNMmnY&Ja6 zk=Avb+uo~lE9ytnAKCRhl8UC+XveKYSr*CL#?@Dv{koyIH2Y{kz_tLjHLs-58@+K^ zFIGd#39`NALnm*uzOb7)pHmK624z4KszH>S_E<{OPaFMAp8`GahQ)d_M-a_9Ht?l# z%T`VMP~<^(d9$}H5QCy%rbm9&Vn^0$+26bhZCfd+ic`$Qg;*f$lK9c?gix+bW!2>s zwsVN@cn8BH&MzeX@)y%0Clm)(czj0DOLq5_ePqe;B8Zf$0rB_~((N3X*kd};Q!BYk zbGowc3?>Do3r#$+&L(^~uZL!1o#l2og?s@a&)S>i%mR+Hk#Iyo;c9-zZ zWehexIF8N~YTkE&FPNUY1KKttSQg<wq%mE^Bn8XTyT<|_qIBkf zr`uS=9AcP?ddsP~3@L z)OLDA+-uIjJ6zAF<{ILQTvMuYz8*Z$aq>o5c?zACc-xSVmUm{gZ60cr^09dFb^Ij$ zVz;2{m%#wKg9XHNF?e^Wwp)tu2>S7U4Af{Q*?4}&bHkKZ!DjQ0ZL*+$U(qtr(18VN z<<)_eUV$dGHA<+L_MY53S@{lyxHRm%P~@e(pz#4^|2?_X%4^4%q#QSx{|#_t)a7G! z8Td=|GE)I?yV%OM>n8rAbKMc^<^Qfz7z?8bAA9mgB%FX}svG|pK z^H>thG}Qkq!2xs>fAE{34AWmOR2tH6g@tEF82^^+U;s+k@o+5D{v+EZ{I(crno82& z5`;lO$>7zN+U$RHsX}1@5<)p$SNmTHyJ(jgM&^-Nvjc;o*pqXGvn6X_m|lP;A?#b-eI-ZYRd<3 zyA~=m^O~C2b?9qc{u@!5fWOVf`AA9o#rbs3AuU7xfHv`j1T*OW^2y|6WB^yDeK|rQ zJ7DO4EBFy!79g9omYo%` z7kXy&t+U<41569_JA5+Vto#2k2-AH)g&%in0XgjY6U_n1e6VL!4QFO&wYz#l@O{h* zeSi%9WGUUU4DyqH-l0#uj(b;PhiB^?vH6nMSeWqC|P8#&fH)Z%J`X0ByVaUQj(JCCAxl4L*gVzT*jM!y`c+J zj34^K46g%43DKJy>}(!PRx92|8@9plZw-JU`Vm5@vfj~80<`}dGYsI!-|R^S3U$2y za8b6ZTpp3L9?HyX$`a{tdCO#A@g854%^Nx)w>n!*6Uso3A*e*H(yO9KLU z$haOt1@vDX_zizEJz*r1{&chp!3_MjJAM@ zt#-xCfqQk8hn~~!W~)X)S&{6b2Pbf!DTy+cYM7oov7e^(Iqy;cyaZP z0P%o>DmApKD3wBeuLY(Xoa??j*D=d z;5vX=f4OT|ldby%Dm`lp^bLnko7;~~*Bu=ULNYe}v^Q3ccc4XevwNCprps_i`I3Q` z#?tGTan`wL_c=)07R83gld=`hzCB2uU$MI3KxAMl9d~3s^tUr9ueniS?NT3g71(gvz6rdCYKL+(t zC}S&jHn6r>=MC_!)Ty*$omglu&S^-xA=V7kLn#ZQg57)X>&SmSv~ksK)x4KRZXR2E zV()BjpG;>0Da@k9ax_}`XvQKB4Q{M%{~0YzCfPLn`s0Act!_;cu?Z*TlV1uRb^{vbI! zJv(byM+YG{ra4fp#AyPB30X$7i3)9ecUIh>7I?V_jWJ^>3$_(nWXB=CoW~*snOLh@ z_wA8-#xU@BPlH<`uzto5tokqoF8<<8n z-R&C--6X1pgk3eOokMLBxK=@w~08ZW$~)@>ZSpx@ltB#1}uEzk0wq$JtrrW zJUOzd^G|T_bAlx?W(UoQs8+Na&#HV>JZ$@~Kb_}4p7dvv@e9YmW3m-JB=;<;S|bWBx?J{dd$Rtvwy>$p5bpj zB&HzEXuuFuj#c;u7mRxx=f-`5Y%<2gnKd>fM zl@7DqARWJvj+^S^9b$CH$cfopm~#7O^!L`_3Gbs#W?{R&5CnLj@KxeF_$T$3v}4LF zz%NN;U=cUAa$T7fU+pvt9{nutULAj~P-#n3&o(>gE-`f=pl5_~@yv9RgVs=#HJWK{ zyEx_Ubc^NX-t%gPa!%VSS?A|06W-JkN4{Qw4D*ay08XsT|l zi7-`CO7VCmM$+KnUVzb2xMVuFiI9uRdy&QaQC1e(p1YORLeI$YeR$gi=Rz1E&u{N( zfn}rBC}})P(TZtE$^K?piTMt0*ONyWaXin{2xpfVrEiZ+WuxfwxQJes@@u?R72s;9 zN7<@B(AM%=&~Q(HL-(cCOTf|nGE>&Vz!6^E6U64==TPQb@K&A=`;mGh%=;&No@MU& zMQj|?)^B#{Ui^n~52CR-7RQ;ZqU4^o$(K9*IA}y6Lnbrg?YcW^(bF8#*yJIU4y|fB zVY}`6t;oH>XBq74>s^Z6LG$x6dlydFtZNUoj$u%nj#g?`nKYM*dr>P*05D?ri0@_Sn$!?%c!6?DMF@6si~>; z^liXThN*EHosHy{H%egJd!x5M)F$?E*Sy{EC*-(Nd>Fn(=7X)ngHP`-*dctz%&-b_ zZIZP70@*P#vu)_kh{P~Le8DTP)c*Jw7LetPeHz?~&Hh#v`qMY+6DutaK14oXvnCY0;m15kew4BlMAK)t22z7(H#*q-@K1`k@Pe?%>#4cj*KpCcmsv-kitFgN^ z%uvHwTK@&5y*-Te$~LxOASvhE5ht7{X(Wv7Sw;kXO2<9i z-Y$7tl>A-`NjD)l93(Ou!?*Tpn-cc@rO;Gk6V=br@u~JyQ*(N6sY~aO#$u+vX|~G| zVwx>4dK#uj}`OxgruUgkzLc4Ut%Ft0cLSYOx&j@=E}`xr#8V2KRs#Z ztYEqE-6MAi!HR3PPCMa$+_JhC`i(;5Wvt8N@bI*KrH(XOF-_1=#%rXH@S?R%*ZE2F zBeL1uXlWBwNug{pucT(;GIUid(yUOkL%iL^1$^3TG`P>DuzZ}K>KVjljL|5Mh}h}e z-xGI9?~!!GlsvOG+xXGJC?^&|faa${(qPTa_g~%>;_q$UrbOR=9Tn{_v4ow}DC(mJ z@QmZwz_nXb1`5$#MTo96$5f*~((efed&xe(wPhW83p5G-6el}scFb8^>JCCu(uS>= z#KT@x{V*Dr@0z#TZPhqLRSK3_Sl|lR{iOuyg$msN@k_UW>1c0LW{ae`|C{!WTk=qs z#q9Lbjxhl~JC|d2RH?xOI0Gv~aI9a*vr;&?w$K-}fH--Q4Fii~%G}quqCszqHd|zF zSUJL$YZR_^Ng4}89PHk{CCJ`l6q+IkS(@-e3$6NK;)Wl&X4)lComD{Ot(xNMHhBj& z#9#?8)$Zh+X>{RDVXQ{s*gb8uoG!ugIx7?N)6;uhMHR|z%Tm26n`5)5EbQF*8V*}6 zv%y|pf>Uz9#N5Uq{R&%iR;k5Bbg>~0W1_B9LEH~*=&XlsR6j9j#0Xij3=~8b?5ToO z*5ceb3apCVZlTBqw~{yeT8nby)G-Xizkadu1}EO~Mj^%~y)zlfi>d0^uMDYxZp6fw zys*N<_gcfce0f88jeB(US0w$>Z5{6p)iHV^`mTp->6veFW8ZBk@c4^Uw&~9P!C&?B!hZP8cEzF02x(f#5RT=UAb zQD<`Qa~vYKqXhBg*dzp*@31|Ig>=YM-kW*ews=2Af8H{V=X3nH%pL`4ErR_yN|mz0 zdb6JK?a<6}VBA=NTF`tV^Iu;RKIQECmPk7AiZJ* z_O}X~U?olZ*4plV5FP=cnXp=ujl%a84R1Ru90JXYAelwXr48Ygb%Vf!`PP;4ZZFXV zSF@0fMT1b+8Zbv7hss*fhJy_XU{l9|fFeD-Q!D=6p8l1U=zDEZlKrBHVo+wb=Mar2 z!xqj{*{Ut$Zt(H>;CB`B@;jih@enf*LyQ5v<1p=;+2EIlDo5%O8!|i=IK_L{RIZ)U zT=FfkvwP0m7n>%_M%t8`F@qf3`&F$Jd(XWiq-V|)Rf9AGALaYG7}_NMQV1qW+MpxC zT?f|18=P+L>or|pgj>T+#t>9mg!bL&tqUt*H+Klw_Xz{XWL~aj_EnALpw&qr#(Frg z8X=cSD0n5BRjZ2iL0@R%Y6pd#z8(%uyyvcLT`~4t3v^6045q>P1$g{LuYINBa|Nq} zyTn-$b*$Jsgt!TA4gC9@b)IiB6L(}~787U_l-NlmpdCd17rZ{NkE^PuaxF-}Br!tI zp?tctwgMtUQc7eM*LO%4i8*%r(=shiRV#Qy7Rfh~s|=Oyed!g`mb7OigZH(ky)Gru zmd>_B--`O9-H6sy25g+;xW}unf7Qe#)W&1uL=-apx-_u|8jR$@xLh>+I0IH`pys~0 z>{<*cgY~J*4j5N0!x2I6zDZuo^ObktzdqJp>@@vK@y0Y6%DFyC z?r$ZP6&>zk6BcxwEXGweekU^NKniLTU-%CG9az6Ol8uL>+dH&z^4SWOCduKRp*_;7zFttA%OtpUyu=|tHwkn z|9#I7`4tri@vSsXmO=F2_ksMzz(mi9%i`aEw+A%xFC`+#)m5IQ9Qda_pj|OQ!A?eO zO2mKO0};wAg9_i4S#b7a{FR#s*!!!R5R?8DS{mjT>Z2@EghBjQFGhgW5vzRRze1G} z0cw>Vp&0(B7a2fmYGlHHLcajiQfA38i1@452tX>;&se0tLX|}TYLyl$Mf|5%DnP0+ it0K`~q5mJoc*L)sJW-wJOiB9$_>&Nk6|NN23;18}QjNO+ literal 0 HcmV?d00001 diff --git a/index.html b/index.html new file mode 100644 index 00000000..0f6f08ac --- /dev/null +++ b/index.html @@ -0,0 +1,30 @@ + + + + + + +Welcome to OAuth2 Proxy | OAuth2 Proxy + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/main.08dca9ee.js b/main.08dca9ee.js new file mode 100644 index 00000000..8ccbb0e5 --- /dev/null +++ b/main.08dca9ee.js @@ -0,0 +1,2 @@ +/*! For license information please see main.08dca9ee.js.LICENSE.txt */ +(window.webpackJsonp=window.webpackJsonp||[]).push([[14],[function(e,t,n){"use strict";e.exports=n(31)},function(e,t,n){"use strict";n.d(t,"a",(function(){return b})),n.d(t,"b",(function(){return w})),n.d(t,"c",(function(){return S})),n.d(t,"d",(function(){return O})),n.d(t,"e",(function(){return v})),n.d(t,"f",(function(){return L})),n.d(t,"g",(function(){return D})),n.d(t,"h",(function(){return g})),n.d(t,"i",(function(){return x})),n.d(t,"j",(function(){return C})),n.d(t,"k",(function(){return M})),n.d(t,"l",(function(){return z})),n.d(t,"m",(function(){return U})),n.d(t,"n",(function(){return $})),n.d(t,"o",(function(){return j}));var r=n(3),a=n(0),o=n.n(a),i=(n(7),n(5)),l=n(18),u=n(4),s=n(2),c=n(19),f=n.n(c),p=(n(23),n(6)),d=n(28),m=n.n(d),h=function(e){var t=Object(l.a)();return t.displayName=e,t}("Router-History"),g=function(e){var t=Object(l.a)();return t.displayName=e,t}("Router"),v=function(e){function t(t){var n;return(n=e.call(this,t)||this).state={location:t.history.location},n._isMounted=!1,n._pendingLocation=null,t.staticContext||(n.unlisten=t.history.listen((function(e){n._isMounted?n.setState({location:e}):n._pendingLocation=e}))),n}Object(r.a)(t,e),t.computeRootMatch=function(e){return{path:"/",url:"/",params:{},isExact:"/"===e}};var n=t.prototype;return n.componentDidMount=function(){this._isMounted=!0,this._pendingLocation&&this.setState({location:this._pendingLocation})},n.componentWillUnmount=function(){this.unlisten&&this.unlisten()},n.render=function(){return o.a.createElement(g.Provider,{value:{history:this.props.history,location:this.state.location,match:t.computeRootMatch(this.state.location.pathname),staticContext:this.props.staticContext}},o.a.createElement(h.Provider,{children:this.props.children||null,value:this.props.history}))},t}(o.a.Component);var b=function(e){function t(){for(var t,n=arguments.length,r=new Array(n),a=0;a=0;p--){var d=i[p];"."===d?o(i,p):".."===d?(o(i,p),f++):f&&(o(i,p),f--)}if(!s)for(;f--;f)i.unshift("..");!s||""===i[0]||i[0]&&a(i[0])||i.unshift("");var m=i.join("/");return n&&"/"!==m.substr(-1)&&(m+="/"),m};function l(e){return e.valueOf?e.valueOf():Object.prototype.valueOf.call(e)}var u=function e(t,n){if(t===n)return!0;if(null==t||null==n)return!1;if(Array.isArray(t))return Array.isArray(n)&&t.length===n.length&&t.every((function(t,r){return e(t,n[r])}));if("object"==typeof t||"object"==typeof n){var r=l(t),a=l(n);return r!==t||a!==n?e(r,a):Object.keys(Object.assign({},t,n)).every((function(r){return e(t[r],n[r])}))}return!1},s=n(4);function c(e){return"/"===e.charAt(0)?e:"/"+e}function f(e){return"/"===e.charAt(0)?e.substr(1):e}function p(e,t){return function(e,t){return 0===e.toLowerCase().indexOf(t.toLowerCase())&&-1!=="/?#".indexOf(e.charAt(t.length))}(e,t)?e.substr(t.length):e}function d(e){return"/"===e.charAt(e.length-1)?e.slice(0,-1):e}function m(e){var t=e.pathname,n=e.search,r=e.hash,a=t||"/";return n&&"?"!==n&&(a+="?"===n.charAt(0)?n:"?"+n),r&&"#"!==r&&(a+="#"===r.charAt(0)?r:"#"+r),a}function h(e,t,n,a){var o;"string"==typeof e?(o=function(e){var t=e||"/",n="",r="",a=t.indexOf("#");-1!==a&&(r=t.substr(a),t=t.substr(0,a));var o=t.indexOf("?");return-1!==o&&(n=t.substr(o),t=t.substr(0,o)),{pathname:t,search:"?"===n?"":n,hash:"#"===r?"":r}}(e)).state=t:(void 0===(o=Object(r.a)({},e)).pathname&&(o.pathname=""),o.search?"?"!==o.search.charAt(0)&&(o.search="?"+o.search):o.search="",o.hash?"#"!==o.hash.charAt(0)&&(o.hash="#"+o.hash):o.hash="",void 0!==t&&void 0===o.state&&(o.state=t));try{o.pathname=decodeURI(o.pathname)}catch(l){throw l instanceof URIError?new URIError('Pathname "'+o.pathname+'" could not be decoded. This is likely caused by an invalid percent-encoding.'):l}return n&&(o.key=n),a?o.pathname?"/"!==o.pathname.charAt(0)&&(o.pathname=i(o.pathname,a.pathname)):o.pathname=a.pathname:o.pathname||(o.pathname="/"),o}function g(e,t){return e.pathname===t.pathname&&e.search===t.search&&e.hash===t.hash&&e.key===t.key&&u(e.state,t.state)}function v(){var e=null;var t=[];return{setPrompt:function(t){return e=t,function(){e===t&&(e=null)}},confirmTransitionTo:function(t,n,r,a){if(null!=e){var o="function"==typeof e?e(t,n):e;"string"==typeof o?"function"==typeof r?r(o,a):a(!0):a(!1!==o)}else a(!0)},appendListener:function(e){var n=!0;function r(){n&&e.apply(void 0,arguments)}return t.push(r),function(){n=!1,t=t.filter((function(e){return e!==r}))}},notifyListeners:function(){for(var e=arguments.length,n=new Array(e),r=0;rt?n.splice(t,n.length-t,a):n.push(a),f({action:r,location:a,index:t,entries:n})}}))},replace:function(e,t){var r="REPLACE",a=h(e,t,p(),w.location);c.confirmTransitionTo(a,r,n,(function(e){e&&(w.entries[w.index]=a,f({action:r,location:a}))}))},go:y,goBack:function(){y(-1)},goForward:function(){y(1)},canGo:function(e){var t=w.index+e;return t>=0&&t=0||(a[n]=e[n]);return a}n.d(t,"a",(function(){return r}))},function(e,t,n){e.exports=n(35)()},function(e,t,n){"use strict";n.d(t,"a",(function(){return l})),n.d(t,"b",(function(){return u}));var r=n(1),a=n(2),o=n(0),i=n.n(o);function l(e,t,n){return void 0===n&&(n=[]),e.some((function(e){var a=e.path?Object(r.j)(t,e):n.length?n[n.length-1].match:r.e.computeRootMatch(t);return a&&(n.push({route:e,match:a}),e.routes&&l(e.routes,t,n)),a})),n}function u(e,t,n){return void 0===t&&(t={}),void 0===n&&(n={}),e?i.a.createElement(r.g,n,e.map((function(e,n){return i.a.createElement(r.d,{key:e.key||n,path:e.path,exact:e.exact,strict:e.strict,render:function(n){return e.render?e.render(Object(a.a)({},n,{},t,{route:e})):i.a.createElement(e.component,Object(a.a)({},n,t,{route:e}))}})}))):null}},function(e,t,n){"use strict";var r=!("undefined"==typeof window||!window.document||!window.document.createElement),a={canUseDOM:r,canUseEventListeners:r&&!(!window.addEventListener&&!window.attachEvent),canUseIntersectionObserver:r&&"IntersectionObserver"in window,canUseViewport:r&&!!window.screen};t.a=a},function(e){e.exports=JSON.parse('{"/oauth2-proxy/-4c3":{"component":"1f391b9e","content":"f3976560"},"/oauth2-proxy/docs-969":{"component":"1be78505","versionMetadata":"935f2afb"},"/oauth2-proxy/docs/-358":{"component":"17896441","content":"3b8c55ea"},"/oauth2-proxy/docs/behaviour-d55":{"component":"17896441","content":"94285305"},"/oauth2-proxy/docs/configuration/oauth_provider-909":{"component":"17896441","content":"357fe94d"},"/oauth2-proxy/docs/configuration/overview-c24":{"component":"17896441","content":"0f425520"},"/oauth2-proxy/docs/configuration/session_storage-129":{"component":"17896441","content":"9f61b932"},"/oauth2-proxy/docs/configuration/tls-7d1":{"component":"17896441","content":"585bdad0"},"/oauth2-proxy/docs/features/endpoints-e0d":{"component":"17896441","content":"efc9be4b"},"/oauth2-proxy/docs/features/request_signatures-209":{"component":"17896441","content":"b5649f1e"}}')},function(e,t,n){"use strict";t.a={title:"OAuth2 Proxy",tagline:"A lightweight authentication proxy written in Go",url:"https://oauth2-proxy.github.io",baseUrl:"/oauth2-proxy/",onBrokenLinks:"throw",favicon:"img/logos/OAuth2_Proxy_icon.svg",organizationName:"oauth2-proxy",projectName:"oauth2-proxy",themeConfig:{navbar:{title:"OAuth2 Proxy",logo:{alt:"OAuth2 Proxy",src:"img/logos/OAuth2_Proxy_icon.svg"},items:[{to:"docs/",activeBasePath:"docs",label:"Docs",position:"left"},{href:"https://github.com/oauth2-proxy/oauth2-proxy",label:"GitHub",position:"right"}],hideOnScroll:!1},footer:{style:"dark",copyright:"Copyright \xa9 2020 OAuth2 Proxy.",links:[]},colorMode:{defaultMode:"light",disableSwitch:!1,respectPrefersColorScheme:!1,switchConfig:{darkIcon:"\ud83c\udf1c",darkIconStyle:{},lightIcon:"\ud83c\udf1e",lightIconStyle:{}}},docs:{versionPersistence:"localStorage"},metadatas:[],prism:{additionalLanguages:[]}},presets:[["@docusaurus/preset-classic",{docs:{sidebarPath:"/mnt/c/Users/joels/go/src/github.com/oauth2-proxy/oauth2-proxy/docs/sidebars.js",editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/"},theme:{customCss:"/mnt/c/Users/joels/go/src/github.com/oauth2-proxy/oauth2-proxy/docs/src/css/custom.css"}}]],onDuplicateRoutes:"warn",customFields:{},plugins:[],themes:[],titleDelimiter:"|",noIndex:!1}},function(e,t,n){var r,a;void 0===(a="function"==typeof(r=function(){var e,t,n={version:"0.2.0"},r=n.settings={minimum:.08,easing:"ease",positionUsing:"",speed:200,trickle:!0,trickleRate:.02,trickleSpeed:800,showSpinner:!0,barSelector:'[role="bar"]',spinnerSelector:'[role="spinner"]',parent:"body",template:'
'};function a(e,t,n){return en?n:e}function o(e){return 100*(-1+e)}function i(e,t,n){var a;return(a="translate3d"===r.positionUsing?{transform:"translate3d("+o(e)+"%,0,0)"}:"translate"===r.positionUsing?{transform:"translate("+o(e)+"%,0)"}:{"margin-left":o(e)+"%"}).transition="all "+t+"ms "+n,a}n.configure=function(e){var t,n;for(t in e)void 0!==(n=e[t])&&e.hasOwnProperty(t)&&(r[t]=n);return this},n.status=null,n.set=function(e){var t=n.isStarted();e=a(e,r.minimum,1),n.status=1===e?null:e;var o=n.render(!t),s=o.querySelector(r.barSelector),c=r.speed,f=r.easing;return o.offsetWidth,l((function(t){""===r.positionUsing&&(r.positionUsing=n.getPositioningCSS()),u(s,i(e,c,f)),1===e?(u(o,{transition:"none",opacity:1}),o.offsetWidth,setTimeout((function(){u(o,{transition:"all "+c+"ms linear",opacity:0}),setTimeout((function(){n.remove(),t()}),c)}),c)):setTimeout(t,c)})),this},n.isStarted=function(){return"number"==typeof n.status},n.start=function(){n.status||n.set(0);var e=function(){setTimeout((function(){n.status&&(n.trickle(),e())}),r.trickleSpeed)};return r.trickle&&e(),this},n.done=function(e){return e||n.status?n.inc(.3+.5*Math.random()).set(1):this},n.inc=function(e){var t=n.status;return t?("number"!=typeof e&&(e=(1-t)*a(Math.random()*t,.1,.95)),t=a(t+e,0,.994),n.set(t)):n.start()},n.trickle=function(){return n.inc(Math.random()*r.trickleRate)},e=0,t=0,n.promise=function(r){return r&&"resolved"!==r.state()?(0===t&&n.start(),e++,t++,r.always((function(){0==--t?(e=0,n.done()):n.set((e-t)/e)})),this):this},n.render=function(e){if(n.isRendered())return document.getElementById("nprogress");c(document.documentElement,"nprogress-busy");var t=document.createElement("div");t.id="nprogress",t.innerHTML=r.template;var a,i=t.querySelector(r.barSelector),l=e?"-100":o(n.status||0),s=document.querySelector(r.parent);return u(i,{transition:"all 0 linear",transform:"translate3d("+l+"%,0,0)"}),r.showSpinner||(a=t.querySelector(r.spinnerSelector))&&d(a),s!=document.body&&c(s,"nprogress-custom-parent"),s.appendChild(t),t},n.remove=function(){f(document.documentElement,"nprogress-busy"),f(document.querySelector(r.parent),"nprogress-custom-parent");var e=document.getElementById("nprogress");e&&d(e)},n.isRendered=function(){return!!document.getElementById("nprogress")},n.getPositioningCSS=function(){var e=document.body.style,t="WebkitTransform"in e?"Webkit":"MozTransform"in e?"Moz":"msTransform"in e?"ms":"OTransform"in e?"O":"";return t+"Perspective"in e?"translate3d":t+"Transform"in e?"translate":"margin"};var l=function(){var e=[];function t(){var n=e.shift();n&&n(t)}return function(n){e.push(n),1==e.length&&t()}}(),u=function(){var e=["Webkit","O","Moz","ms"],t={};function n(e){return e.replace(/^-ms-/,"ms-").replace(/-([\da-z])/gi,(function(e,t){return t.toUpperCase()}))}function r(t){var n=document.body.style;if(t in n)return t;for(var r,a=e.length,o=t.charAt(0).toUpperCase()+t.slice(1);a--;)if((r=e[a]+o)in n)return r;return t}function a(e){return e=n(e),t[e]||(t[e]=r(e))}function o(e,t,n){t=a(t),e.style[t]=n}return function(e,t){var n,r,a=arguments;if(2==a.length)for(n in t)void 0!==(r=t[n])&&t.hasOwnProperty(n)&&o(e,n,r);else o(e,a[1],a[2])}}();function s(e,t){return("string"==typeof e?e:p(e)).indexOf(" "+t+" ")>=0}function c(e,t){var n=p(e),r=n+t;s(n,t)||(e.className=r.substring(1))}function f(e,t){var n,r=p(e);s(e,t)&&(n=r.replace(" "+t+" "," "),e.className=n.substring(1,n.length-1))}function p(e){return(" "+(e.className||"")+" ").replace(/\s+/gi," ")}function d(e){e&&e.parentNode&&e.parentNode.removeChild(e)}return n})?r.call(t,n,t,e):r)||(e.exports=a)},function(e,t,n){"use strict";n.d(t,"a",(function(){return f})),n.d(t,"b",(function(){return p})),n.d(t,"c",(function(){return b})),n.d(t,"e",(function(){return k}));var r=n(1);n.d(t,"d",(function(){return r.a})),n.d(t,"f",(function(){return r.b})),n.d(t,"g",(function(){return r.c})),n.d(t,"h",(function(){return r.d})),n.d(t,"i",(function(){return r.e})),n.d(t,"j",(function(){return r.f})),n.d(t,"k",(function(){return r.g})),n.d(t,"l",(function(){return r.i})),n.d(t,"m",(function(){return r.j})),n.d(t,"n",(function(){return r.k})),n.d(t,"o",(function(){return r.l})),n.d(t,"p",(function(){return r.m})),n.d(t,"q",(function(){return r.n})),n.d(t,"r",(function(){return r.o}));var a=n(3),o=n(0),i=n.n(o),l=n(5),u=(n(7),n(2)),s=n(6),c=n(4),f=function(e){function t(){for(var t,n=arguments.length,r=new Array(n),a=0;ae.length)return;if(!(k instanceof u)){if(h&&y!=t.length-1){if(p.lastIndex=w,!(C=p.exec(e)))break;for(var E=C.index+(m?C[1].length:0),x=C.index+C[0].length,S=y,T=w,_=t.length;S<_&&(T=(T+=t[S].length)&&(++y,w=T);if(t[y]instanceof u)continue;O=S-y,k=e.slice(w,T),C.index-=w}else{p.lastIndex=0;var C=p.exec(k),O=1}if(C){m&&(g=C[1]?C[1].length:0),x=(E=C.index+g)+(C=C[0].slice(g)).length;var P=k.slice(0,E),R=k.slice(x),A=[y,O];P&&(++y,w+=P.length,A.push(P));var N=new u(s,d?a.tokenize(C,d):C,v,C,h);if(A.push(N),R&&A.push(R),Array.prototype.splice.apply(t,A),1!=O&&a.matchGrammar(e,t,n,y,w,!0,s),i)break}else if(i)break}}}}},hooks:{add:function(){}},tokenize:function(e,t,n){var r=[e],o=t.rest;if(o){for(var i in o)t[i]=o[i];delete t.rest}return a.matchGrammar(e,r,t,0,0,!1),r}},(o=a.Token=function(e,t,n,r,a){this.type=e,this.content=t,this.alias=n,this.length=0|(r||"").length,this.greedy=!!a}).stringify=function(e,t,n){if("string"==typeof e)return e;if("Array"===a.util.type(e))return e.map((function(n){return o.stringify(n,t,e)})).join("");var r={type:e.type,content:o.stringify(e.content,t,n),tag:"span",classes:["token",e.type],attributes:{},language:t,parent:n};if(e.alias){var i="Array"===a.util.type(e.alias)?e.alias:[e.alias];Array.prototype.push.apply(r.classes,i)}var l=Object.keys(r.attributes).map((function(e){return e+'="'+(r.attributes[e]||"").replace(/"/g,""")+'"'})).join(" ");return"<"+r.tag+' class="'+r.classes.join(" ")+'"'+(l?" "+l:"")+">"+r.content+""},a);i.languages.markup={comment://,prolog:/<\?[\s\S]+?\?>/,doctype://i,cdata://i,tag:{pattern:/<\/?(?!\d)[^\s>\/=$<%]+(?:\s(?:\s*[^\s>\/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+(?=[\s>]))|(?=[\s/>])))+)?\s*\/?>/i,greedy:!0,inside:{tag:{pattern:/^<\/?[^\s>\/]+/i,inside:{punctuation:/^<\/?/,namespace:/^[^\s>\/:]+:/}},"attr-value":{pattern:/=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+)/i,inside:{punctuation:[/^=/,{pattern:/^(\s*)["']|["']$/,lookbehind:!0}]}},punctuation:/\/?>/,"attr-name":{pattern:/[^\s>\/]+/,inside:{namespace:/^[^\s>\/:]+:/}}}},entity:/&#?[\da-z]{1,8};/i},i.languages.markup.tag.inside["attr-value"].inside.entity=i.languages.markup.entity,i.hooks.add("wrap",(function(e){"entity"===e.type&&(e.attributes.title=e.content.replace(/&/,"&"))})),Object.defineProperty(i.languages.markup.tag,"addInlined",{value:function(e,t){var n={};n["language-"+t]={pattern:/(^$)/i,lookbehind:!0,inside:i.languages[t]},n.cdata=/^$/i;var r={"included-cdata":{pattern://i,inside:n}};r["language-"+t]={pattern:/[\s\S]+/,inside:i.languages[t]};var a={};a[e]={pattern:RegExp(/(<__[\s\S]*?>)(?:\s*|[\s\S])*?(?=<\/__>)/.source.replace(/__/g,e),"i"),lookbehind:!0,greedy:!0,inside:r},i.languages.insertBefore("markup","cdata",a)}}),i.languages.xml=i.languages.extend("markup",{}),i.languages.html=i.languages.markup,i.languages.mathml=i.languages.markup,i.languages.svg=i.languages.markup,function(e){var t="\\b(?:BASH|BASHOPTS|BASH_ALIASES|BASH_ARGC|BASH_ARGV|BASH_CMDS|BASH_COMPLETION_COMPAT_DIR|BASH_LINENO|BASH_REMATCH|BASH_SOURCE|BASH_VERSINFO|BASH_VERSION|COLORTERM|COLUMNS|COMP_WORDBREAKS|DBUS_SESSION_BUS_ADDRESS|DEFAULTS_PATH|DESKTOP_SESSION|DIRSTACK|DISPLAY|EUID|GDMSESSION|GDM_LANG|GNOME_KEYRING_CONTROL|GNOME_KEYRING_PID|GPG_AGENT_INFO|GROUPS|HISTCONTROL|HISTFILE|HISTFILESIZE|HISTSIZE|HOME|HOSTNAME|HOSTTYPE|IFS|INSTANCE|JOB|LANG|LANGUAGE|LC_ADDRESS|LC_ALL|LC_IDENTIFICATION|LC_MEASUREMENT|LC_MONETARY|LC_NAME|LC_NUMERIC|LC_PAPER|LC_TELEPHONE|LC_TIME|LESSCLOSE|LESSOPEN|LINES|LOGNAME|LS_COLORS|MACHTYPE|MAILCHECK|MANDATORY_PATH|NO_AT_BRIDGE|OLDPWD|OPTERR|OPTIND|ORBIT_SOCKETDIR|OSTYPE|PAPERSIZE|PATH|PIPESTATUS|PPID|PS1|PS2|PS3|PS4|PWD|RANDOM|REPLY|SECONDS|SELINUX_INIT|SESSION|SESSIONTYPE|SESSION_MANAGER|SHELL|SHELLOPTS|SHLVL|SSH_AUTH_SOCK|TERM|UID|UPSTART_EVENTS|UPSTART_INSTANCE|UPSTART_JOB|UPSTART_SESSION|USER|WINDOWID|XAUTHORITY|XDG_CONFIG_DIRS|XDG_CURRENT_DESKTOP|XDG_DATA_DIRS|XDG_GREETER_DATA_DIR|XDG_MENU_PREFIX|XDG_RUNTIME_DIR|XDG_SEAT|XDG_SEAT_PATH|XDG_SESSION_DESKTOP|XDG_SESSION_ID|XDG_SESSION_PATH|XDG_SESSION_TYPE|XDG_VTNR|XMODIFIERS)\\b",n={environment:{pattern:RegExp("\\$"+t),alias:"constant"},variable:[{pattern:/\$?\(\([\s\S]+?\)\)/,greedy:!0,inside:{variable:[{pattern:/(^\$\(\([\s\S]+)\)\)/,lookbehind:!0},/^\$\(\(/],number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+\.?\d*|\B\.\d+)(?:[Ee]-?\d+)?/,operator:/--?|-=|\+\+?|\+=|!=?|~|\*\*?|\*=|\/=?|%=?|<<=?|>>=?|<=?|>=?|==?|&&?|&=|\^=?|\|\|?|\|=|\?|:/,punctuation:/\(\(?|\)\)?|,|;/}},{pattern:/\$\((?:\([^)]+\)|[^()])+\)|`[^`]+`/,greedy:!0,inside:{variable:/^\$\(|^`|\)$|`$/}},{pattern:/\$\{[^}]+\}/,greedy:!0,inside:{operator:/:[-=?+]?|[!\/]|##?|%%?|\^\^?|,,?/,punctuation:/[\[\]]/,environment:{pattern:RegExp("(\\{)"+t),lookbehind:!0,alias:"constant"}}},/\$(?:\w+|[#?*!@$])/],entity:/\\(?:[abceEfnrtv\\"]|O?[0-7]{1,3}|x[0-9a-fA-F]{1,2}|u[0-9a-fA-F]{4}|U[0-9a-fA-F]{8})/};e.languages.bash={shebang:{pattern:/^#!\s*\/.*/,alias:"important"},comment:{pattern:/(^|[^"{\\$])#.*/,lookbehind:!0},"function-name":[{pattern:/(\bfunction\s+)\w+(?=(?:\s*\(?:\s*\))?\s*\{)/,lookbehind:!0,alias:"function"},{pattern:/\b\w+(?=\s*\(\s*\)\s*\{)/,alias:"function"}],"for-or-select":{pattern:/(\b(?:for|select)\s+)\w+(?=\s+in\s)/,alias:"variable",lookbehind:!0},"assign-left":{pattern:/(^|[\s;|&]|[<>]\()\w+(?=\+?=)/,inside:{environment:{pattern:RegExp("(^|[\\s;|&]|[<>]\\()"+t),lookbehind:!0,alias:"constant"}},alias:"variable",lookbehind:!0},string:[{pattern:/((?:^|[^<])<<-?\s*)(\w+?)\s*(?:\r?\n|\r)(?:[\s\S])*?(?:\r?\n|\r)\2/,lookbehind:!0,greedy:!0,inside:n},{pattern:/((?:^|[^<])<<-?\s*)(["'])(\w+)\2\s*(?:\r?\n|\r)(?:[\s\S])*?(?:\r?\n|\r)\3/,lookbehind:!0,greedy:!0},{pattern:/(["'])(?:\\[\s\S]|\$\([^)]+\)|`[^`]+`|(?!\1)[^\\])*\1/,greedy:!0,inside:n}],environment:{pattern:RegExp("\\$?"+t),alias:"constant"},variable:n.variable,function:{pattern:/(^|[\s;|&]|[<>]\()(?:add|apropos|apt|aptitude|apt-cache|apt-get|aspell|automysqlbackup|awk|basename|bash|bc|bconsole|bg|bzip2|cal|cat|cfdisk|chgrp|chkconfig|chmod|chown|chroot|cksum|clear|cmp|column|comm|cp|cron|crontab|csplit|curl|cut|date|dc|dd|ddrescue|debootstrap|df|diff|diff3|dig|dir|dircolors|dirname|dirs|dmesg|du|egrep|eject|env|ethtool|expand|expect|expr|fdformat|fdisk|fg|fgrep|file|find|fmt|fold|format|free|fsck|ftp|fuser|gawk|git|gparted|grep|groupadd|groupdel|groupmod|groups|grub-mkconfig|gzip|halt|head|hg|history|host|hostname|htop|iconv|id|ifconfig|ifdown|ifup|import|install|ip|jobs|join|kill|killall|less|link|ln|locate|logname|logrotate|look|lpc|lpr|lprint|lprintd|lprintq|lprm|ls|lsof|lynx|make|man|mc|mdadm|mkconfig|mkdir|mke2fs|mkfifo|mkfs|mkisofs|mknod|mkswap|mmv|more|most|mount|mtools|mtr|mutt|mv|nano|nc|netstat|nice|nl|nohup|notify-send|npm|nslookup|op|open|parted|passwd|paste|pathchk|ping|pkill|pnpm|popd|pr|printcap|printenv|ps|pushd|pv|quota|quotacheck|quotactl|ram|rar|rcp|reboot|remsync|rename|renice|rev|rm|rmdir|rpm|rsync|scp|screen|sdiff|sed|sendmail|seq|service|sftp|sh|shellcheck|shuf|shutdown|sleep|slocate|sort|split|ssh|stat|strace|su|sudo|sum|suspend|swapon|sync|tac|tail|tar|tee|time|timeout|top|touch|tr|traceroute|tsort|tty|umount|uname|unexpand|uniq|units|unrar|unshar|unzip|update-grub|uptime|useradd|userdel|usermod|users|uudecode|uuencode|v|vdir|vi|vim|virsh|vmstat|wait|watch|wc|wget|whereis|which|who|whoami|write|xargs|xdg-open|yarn|yes|zenity|zip|zsh|zypper)(?=$|[)\s;|&])/,lookbehind:!0},keyword:{pattern:/(^|[\s;|&]|[<>]\()(?:if|then|else|elif|fi|for|while|in|case|esac|function|select|do|done|until)(?=$|[)\s;|&])/,lookbehind:!0},builtin:{pattern:/(^|[\s;|&]|[<>]\()(?:\.|:|break|cd|continue|eval|exec|exit|export|getopts|hash|pwd|readonly|return|shift|test|times|trap|umask|unset|alias|bind|builtin|caller|command|declare|echo|enable|help|let|local|logout|mapfile|printf|read|readarray|source|type|typeset|ulimit|unalias|set|shopt)(?=$|[)\s;|&])/,lookbehind:!0,alias:"class-name"},boolean:{pattern:/(^|[\s;|&]|[<>]\()(?:true|false)(?=$|[)\s;|&])/,lookbehind:!0},"file-descriptor":{pattern:/\B&\d\b/,alias:"important"},operator:{pattern:/\d?<>|>\||\+=|==?|!=?|=~|<<[<-]?|[&\d]?>>|\d?[<>]&?|&[>&]?|\|[&|]?|<=?|>=?/,inside:{"file-descriptor":{pattern:/^\d/,alias:"important"}}},punctuation:/\$?\(\(?|\)\)?|\.\.|[{}[\];\\]/,number:{pattern:/(^|\s)(?:[1-9]\d*|0)(?:[.,]\d+)?\b/,lookbehind:!0}};for(var r=["comment","function-name","for-or-select","assign-left","string","environment","function","keyword","builtin","boolean","file-descriptor","operator","punctuation","number"],a=n.variable[1].inside,o=0;o=?|==?=?|&&?|\|\|?|\?|\*|\/|~|\^|%/,punctuation:/[{}[\];(),.:]/},i.languages.c=i.languages.extend("clike",{"class-name":{pattern:/(\b(?:enum|struct)\s+)\w+/,lookbehind:!0},keyword:/\b(?:_Alignas|_Alignof|_Atomic|_Bool|_Complex|_Generic|_Imaginary|_Noreturn|_Static_assert|_Thread_local|asm|typeof|inline|auto|break|case|char|const|continue|default|do|double|else|enum|extern|float|for|goto|if|int|long|register|return|short|signed|sizeof|static|struct|switch|typedef|union|unsigned|void|volatile|while)\b/,operator:/>>=?|<<=?|->|([-+&|:])\1|[?:~]|[-+*/%&|^!=<>]=?/,number:/(?:\b0x(?:[\da-f]+\.?[\da-f]*|\.[\da-f]+)(?:p[+-]?\d+)?|(?:\b\d+\.?\d*|\B\.\d+)(?:e[+-]?\d+)?)[ful]*/i}),i.languages.insertBefore("c","string",{macro:{pattern:/(^\s*)#\s*[a-z]+(?:[^\r\n\\]|\\(?:\r\n|[\s\S]))*/im,lookbehind:!0,alias:"property",inside:{string:{pattern:/(#\s*include\s*)(?:<.+?>|("|')(?:\\?.)+?\2)/,lookbehind:!0},directive:{pattern:/(#\s*)\b(?:define|defined|elif|else|endif|error|ifdef|ifndef|if|import|include|line|pragma|undef|using)\b/,lookbehind:!0,alias:"keyword"}}},constant:/\b(?:__FILE__|__LINE__|__DATE__|__TIME__|__TIMESTAMP__|__func__|EOF|NULL|SEEK_CUR|SEEK_END|SEEK_SET|stdin|stdout|stderr)\b/}),delete i.languages.c.boolean,i.languages.cpp=i.languages.extend("c",{"class-name":{pattern:/(\b(?:class|enum|struct)\s+)\w+/,lookbehind:!0},keyword:/\b(?:alignas|alignof|asm|auto|bool|break|case|catch|char|char16_t|char32_t|class|compl|const|constexpr|const_cast|continue|decltype|default|delete|do|double|dynamic_cast|else|enum|explicit|export|extern|float|for|friend|goto|if|inline|int|int8_t|int16_t|int32_t|int64_t|uint8_t|uint16_t|uint32_t|uint64_t|long|mutable|namespace|new|noexcept|nullptr|operator|private|protected|public|register|reinterpret_cast|return|short|signed|sizeof|static|static_assert|static_cast|struct|switch|template|this|thread_local|throw|try|typedef|typeid|typename|union|unsigned|using|virtual|void|volatile|wchar_t|while)\b/,number:{pattern:/(?:\b0b[01']+|\b0x(?:[\da-f']+\.?[\da-f']*|\.[\da-f']+)(?:p[+-]?[\d']+)?|(?:\b[\d']+\.?[\d']*|\B\.[\d']+)(?:e[+-]?[\d']+)?)[ful]*/i,greedy:!0},operator:/>>=?|<<=?|->|([-+&|:])\1|[?:~]|[-+*/%&|^!=<>]=?|\b(?:and|and_eq|bitand|bitor|not|not_eq|or|or_eq|xor|xor_eq)\b/,boolean:/\b(?:true|false)\b/}),i.languages.insertBefore("cpp","string",{"raw-string":{pattern:/R"([^()\\ ]{0,16})\([\s\S]*?\)\1"/,alias:"string",greedy:!0}}),function(e){var t=/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/;e.languages.css={comment:/\/\*[\s\S]*?\*\//,atrule:{pattern:/@[\w-]+[\s\S]*?(?:;|(?=\s*\{))/,inside:{rule:/@[\w-]+/}},url:{pattern:RegExp("url\\((?:"+t.source+"|[^\n\r()]*)\\)","i"),inside:{function:/^url/i,punctuation:/^\(|\)$/}},selector:RegExp("[^{}\\s](?:[^{};\"']|"+t.source+")*?(?=\\s*\\{)"),string:{pattern:t,greedy:!0},property:/[-_a-z\xA0-\uFFFF][-\w\xA0-\uFFFF]*(?=\s*:)/i,important:/!important\b/i,function:/[-a-z0-9]+(?=\()/i,punctuation:/[(){};:,]/},e.languages.css.atrule.inside.rest=e.languages.css;var n=e.languages.markup;n&&(n.tag.addInlined("style","css"),e.languages.insertBefore("inside","attr-value",{"style-attr":{pattern:/\s*style=("|')(?:\\[\s\S]|(?!\1)[^\\])*\1/i,inside:{"attr-name":{pattern:/^\s*style/i,inside:n.tag.inside},punctuation:/^\s*=\s*['"]|['"]\s*$/,"attr-value":{pattern:/.+/i,inside:e.languages.css}},alias:"language-css"}},n.tag))}(i),i.languages.css.selector={pattern:i.languages.css.selector,inside:{"pseudo-element":/:(?:after|before|first-letter|first-line|selection)|::[-\w]+/,"pseudo-class":/:[-\w]+/,class:/\.[-:.\w]+/,id:/#[-:.\w]+/,attribute:{pattern:/\[(?:[^[\]"']|("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1)*\]/,greedy:!0,inside:{punctuation:/^\[|\]$/,"case-sensitivity":{pattern:/(\s)[si]$/i,lookbehind:!0,alias:"keyword"},namespace:{pattern:/^(\s*)[-*\w\xA0-\uFFFF]*\|(?!=)/,lookbehind:!0,inside:{punctuation:/\|$/}},attribute:{pattern:/^(\s*)[-\w\xA0-\uFFFF]+/,lookbehind:!0},value:[/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,{pattern:/(=\s*)[-\w\xA0-\uFFFF]+(?=\s*$)/,lookbehind:!0}],operator:/[|~*^$]?=/}},"n-th":[{pattern:/(\(\s*)[+-]?\d*[\dn](?:\s*[+-]\s*\d+)?(?=\s*\))/,lookbehind:!0,inside:{number:/[\dn]+/,operator:/[+-]/}},{pattern:/(\(\s*)(?:even|odd)(?=\s*\))/i,lookbehind:!0}],punctuation:/[()]/}},i.languages.insertBefore("css","property",{variable:{pattern:/(^|[^-\w\xA0-\uFFFF])--[-_a-z\xA0-\uFFFF][-\w\xA0-\uFFFF]*/i,lookbehind:!0}}),i.languages.insertBefore("css","function",{operator:{pattern:/(\s)[+\-*\/](?=\s)/,lookbehind:!0},hexcode:/#[\da-f]{3,8}/i,entity:/\\[\da-f]{1,8}/i,unit:{pattern:/(\d)(?:%|[a-z]+)/,lookbehind:!0},number:/-?[\d.]+/}),i.languages.javascript=i.languages.extend("clike",{"class-name":[i.languages.clike["class-name"],{pattern:/(^|[^$\w\xA0-\uFFFF])[_$A-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\.(?:prototype|constructor))/,lookbehind:!0}],keyword:[{pattern:/((?:^|})\s*)(?:catch|finally)\b/,lookbehind:!0},{pattern:/(^|[^.])\b(?:as|async(?=\s*(?:function\b|\(|[$\w\xA0-\uFFFF]|$))|await|break|case|class|const|continue|debugger|default|delete|do|else|enum|export|extends|for|from|function|get|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|set|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)\b/,lookbehind:!0}],number:/\b(?:(?:0[xX](?:[\dA-Fa-f](?:_[\dA-Fa-f])?)+|0[bB](?:[01](?:_[01])?)+|0[oO](?:[0-7](?:_[0-7])?)+)n?|(?:\d(?:_\d)?)+n|NaN|Infinity)\b|(?:\b(?:\d(?:_\d)?)+\.?(?:\d(?:_\d)?)*|\B\.(?:\d(?:_\d)?)+)(?:[Ee][+-]?(?:\d(?:_\d)?)+)?/,function:/#?[_$a-zA-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\s*(?:\.\s*(?:apply|bind|call)\s*)?\()/,operator:/-[-=]?|\+[+=]?|!=?=?|<>?>?=?|=(?:==?|>)?|&[&=]?|\|[|=]?|\*\*?=?|\/=?|~|\^=?|%=?|\?|\.{3}/}),i.languages.javascript["class-name"][0].pattern=/(\b(?:class|interface|extends|implements|instanceof|new)\s+)[\w.\\]+/,i.languages.insertBefore("javascript","keyword",{regex:{pattern:/((?:^|[^$\w\xA0-\uFFFF."'\])\s])\s*)\/(\[(?:[^\]\\\r\n]|\\.)*]|\\.|[^/\\\[\r\n])+\/[gimyus]{0,6}(?=\s*($|[\r\n,.;})\]]))/,lookbehind:!0,greedy:!0},"function-variable":{pattern:/#?[_$a-zA-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\s*[=:]\s*(?:async\s*)?(?:\bfunction\b|(?:\((?:[^()]|\([^()]*\))*\)|[_$a-zA-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*)\s*=>))/,alias:"function"},parameter:[{pattern:/(function(?:\s+[_$A-Za-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*)?\s*\(\s*)(?!\s)(?:[^()]|\([^()]*\))+?(?=\s*\))/,lookbehind:!0,inside:i.languages.javascript},{pattern:/[_$a-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*(?=\s*=>)/i,inside:i.languages.javascript},{pattern:/(\(\s*)(?!\s)(?:[^()]|\([^()]*\))+?(?=\s*\)\s*=>)/,lookbehind:!0,inside:i.languages.javascript},{pattern:/((?:\b|\s|^)(?!(?:as|async|await|break|case|catch|class|const|continue|debugger|default|delete|do|else|enum|export|extends|finally|for|from|function|get|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|set|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)(?![$\w\xA0-\uFFFF]))(?:[_$A-Za-z\xA0-\uFFFF][$\w\xA0-\uFFFF]*\s*)\(\s*)(?!\s)(?:[^()]|\([^()]*\))+?(?=\s*\)\s*\{)/,lookbehind:!0,inside:i.languages.javascript}],constant:/\b[A-Z](?:[A-Z_]|\dx?)*\b/}),i.languages.insertBefore("javascript","string",{"template-string":{pattern:/`(?:\\[\s\S]|\${(?:[^{}]|{(?:[^{}]|{[^}]*})*})+}|(?!\${)[^\\`])*`/,greedy:!0,inside:{"template-punctuation":{pattern:/^`|`$/,alias:"string"},interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\${(?:[^{}]|{(?:[^{}]|{[^}]*})*})+}/,lookbehind:!0,inside:{"interpolation-punctuation":{pattern:/^\${|}$/,alias:"punctuation"},rest:i.languages.javascript}},string:/[\s\S]+/}}}),i.languages.markup&&i.languages.markup.tag.addInlined("script","javascript"),i.languages.js=i.languages.javascript,function(e){var t=e.util.clone(e.languages.javascript);e.languages.jsx=e.languages.extend("markup",t),e.languages.jsx.tag.pattern=/<\/?(?:[\w.:-]+\s*(?:\s+(?:[\w.:-]+(?:=(?:("|')(?:\\[\s\S]|(?!\1)[^\\])*\1|[^\s{'">=]+|\{(?:\{(?:\{[^}]*\}|[^{}])*\}|[^{}])+\}))?|\{\.{3}[a-z_$][\w$]*(?:\.[a-z_$][\w$]*)*\}))*\s*\/?)?>/i,e.languages.jsx.tag.inside.tag.pattern=/^<\/?[^\s>\/]*/i,e.languages.jsx.tag.inside["attr-value"].pattern=/=(?!\{)(?:("|')(?:\\[\s\S]|(?!\1)[^\\])*\1|[^\s'">]+)/i,e.languages.jsx.tag.inside.tag.inside["class-name"]=/^[A-Z]\w*(?:\.[A-Z]\w*)*$/,e.languages.insertBefore("inside","attr-name",{spread:{pattern:/\{\.{3}[a-z_$][\w$]*(?:\.[a-z_$][\w$]*)*\}/,inside:{punctuation:/\.{3}|[{}.]/,"attr-value":/\w+/}}},e.languages.jsx.tag),e.languages.insertBefore("inside","attr-value",{script:{pattern:/=(\{(?:\{(?:\{[^}]*\}|[^}])*\}|[^}])+\})/i,inside:{"script-punctuation":{pattern:/^=(?={)/,alias:"punctuation"},rest:e.languages.jsx},alias:"language-javascript"}},e.languages.jsx.tag);var n=function(e){return e?"string"==typeof e?e:"string"==typeof e.content?e.content:e.content.map(n).join(""):""},r=function(t){for(var a=[],o=0;o0&&a[a.length-1].tagName===n(i.content[0].content[1])&&a.pop():"/>"===i.content[i.content.length-1].content||a.push({tagName:n(i.content[0].content[1]),openedBraces:0}):a.length>0&&"punctuation"===i.type&&"{"===i.content?a[a.length-1].openedBraces++:a.length>0&&a[a.length-1].openedBraces>0&&"punctuation"===i.type&&"}"===i.content?a[a.length-1].openedBraces--:l=!0),(l||"string"==typeof i)&&a.length>0&&0===a[a.length-1].openedBraces){var u=n(i);o0&&("string"==typeof t[o-1]||"plain-text"===t[o-1].type)&&(u=n(t[o-1])+u,t.splice(o-1,1),o--),t[o]=new e.Token("plain-text",u,null,u)}i.content&&"string"!=typeof i.content&&r(i.content)}};e.hooks.add("after-tokenize",(function(e){"jsx"!==e.language&&"tsx"!==e.language||r(e.tokens)}))}(i),function(e){var t=e.languages.javadoclike={parameter:{pattern:/(^\s*(?:\/{3}|\*|\/\*\*)\s*@(?:param|arg|arguments)\s+)\w+/m,lookbehind:!0},keyword:{pattern:/(^\s*(?:\/{3}|\*|\/\*\*)\s*|\{)@[a-z][a-zA-Z-]+\b/m,lookbehind:!0},punctuation:/[{}]/};Object.defineProperty(t,"addSupport",{value:function(t,n){"string"==typeof t&&(t=[t]),t.forEach((function(t){!function(t,n){var r="doc-comment",a=e.languages[t];if(a){var o=a[r];if(!o){var i={"doc-comment":{pattern:/(^|[^\\])\/\*\*[^/][\s\S]*?(?:\*\/|$)/,alias:"comment"}};o=(a=e.languages.insertBefore(t,"comment",i))[r]}if(o instanceof RegExp&&(o=a[r]={pattern:o}),Array.isArray(o))for(var l=0,u=o.length;l>>?=?|->|([-+&|])\2|[?:~]|[-+*/%&|^!=<>]=?)/m,lookbehind:!0}}),e.languages.insertBefore("java","class-name",{annotation:{alias:"punctuation",pattern:/(^|[^.])@\w+/,lookbehind:!0},namespace:{pattern:/(\b(?:exports|import(?:\s+static)?|module|open|opens|package|provides|requires|to|transitive|uses|with)\s+)[a-z]\w*(\.[a-z]\w*)+/,lookbehind:!0,inside:{punctuation:/\./}},generics:{pattern:/<(?:[\w\s,.&?]|<(?:[\w\s,.&?]|<(?:[\w\s,.&?]|<[\w\s,.&?]*>)*>)*>)*>/,inside:{"class-name":n,keyword:t,punctuation:/[<>(),.:]/,operator:/[?&|]/}}})}(i),function(e){function t(e,t){return"___"+e.toUpperCase()+t+"___"}Object.defineProperties(e.languages["markup-templating"]={},{buildPlaceholders:{value:function(n,r,a,o){if(n.language===r){var i=n.tokenStack=[];n.code=n.code.replace(a,(function(e){if("function"==typeof o&&!o(e))return e;for(var a,l=i.length;-1!==n.code.indexOf(a=t(r,l));)++l;return i[l]=e,a})),n.grammar=e.languages.markup}}},tokenizePlaceholders:{value:function(n,r){if(n.language===r&&n.tokenStack){n.grammar=e.languages[r];var a=0,o=Object.keys(n.tokenStack);!function i(l){for(var u=0;u=o.length);u++){var s=l[u];if("string"==typeof s||s.content&&"string"==typeof s.content){var c=o[a],f=n.tokenStack[c],p="string"==typeof s?s:s.content,d=t(r,c),m=p.indexOf(d);if(m>-1){++a;var h=p.substring(0,m),g=new e.Token(r,e.tokenize(f,n.grammar),"language-"+r,f),v=p.substring(m+d.length),b=[];h&&b.push.apply(b,i([h])),b.push(g),v&&b.push.apply(b,i([v])),"string"==typeof s?l.splice.apply(l,[u,1].concat(b)):s.content=b}}else s.content&&i(s.content)}return l}(n.tokens)}}}})}(i),function(e){e.languages.php=e.languages.extend("clike",{keyword:/\b(?:__halt_compiler|abstract|and|array|as|break|callable|case|catch|class|clone|const|continue|declare|default|die|do|echo|else|elseif|empty|enddeclare|endfor|endforeach|endif|endswitch|endwhile|eval|exit|extends|final|finally|for|foreach|function|global|goto|if|implements|include|include_once|instanceof|insteadof|interface|isset|list|namespace|new|or|parent|print|private|protected|public|require|require_once|return|static|switch|throw|trait|try|unset|use|var|while|xor|yield)\b/i,boolean:{pattern:/\b(?:false|true)\b/i,alias:"constant"},constant:[/\b[A-Z_][A-Z0-9_]*\b/,/\b(?:null)\b/i],comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0}}),e.languages.insertBefore("php","string",{"shell-comment":{pattern:/(^|[^\\])#.*/,lookbehind:!0,alias:"comment"}}),e.languages.insertBefore("php","comment",{delimiter:{pattern:/\?>$|^<\?(?:php(?=\s)|=)?/i,alias:"important"}}),e.languages.insertBefore("php","keyword",{variable:/\$+(?:\w+\b|(?={))/i,package:{pattern:/(\\|namespace\s+|use\s+)[\w\\]+/,lookbehind:!0,inside:{punctuation:/\\/}}}),e.languages.insertBefore("php","operator",{property:{pattern:/(->)[\w]+/,lookbehind:!0}});var t={pattern:/{\$(?:{(?:{[^{}]+}|[^{}]+)}|[^{}])+}|(^|[^\\{])\$+(?:\w+(?:\[.+?]|->\w+)*)/,lookbehind:!0,inside:{rest:e.languages.php}};e.languages.insertBefore("php","string",{"nowdoc-string":{pattern:/<<<'([^']+)'(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\1;/,greedy:!0,alias:"string",inside:{delimiter:{pattern:/^<<<'[^']+'|[a-z_]\w*;$/i,alias:"symbol",inside:{punctuation:/^<<<'?|[';]$/}}}},"heredoc-string":{pattern:/<<<(?:"([^"]+)"(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\1;|([a-z_]\w*)(?:\r\n?|\n)(?:.*(?:\r\n?|\n))*?\2;)/i,greedy:!0,alias:"string",inside:{delimiter:{pattern:/^<<<(?:"[^"]+"|[a-z_]\w*)|[a-z_]\w*;$/i,alias:"symbol",inside:{punctuation:/^<<<"?|[";]$/}},interpolation:t}},"single-quoted-string":{pattern:/'(?:\\[\s\S]|[^\\'])*'/,greedy:!0,alias:"string"},"double-quoted-string":{pattern:/"(?:\\[\s\S]|[^\\"])*"/,greedy:!0,alias:"string",inside:{interpolation:t}}}),delete e.languages.php.string,e.hooks.add("before-tokenize",(function(t){if(/<\?/.test(t.code)){e.languages["markup-templating"].buildPlaceholders(t,"php",/<\?(?:[^"'/#]|\/(?![*/])|("|')(?:\\[\s\S]|(?!\1)[^\\])*\1|(?:\/\/|#)(?:[^?\n\r]|\?(?!>))*|\/\*[\s\S]*?(?:\*\/|$))*?(?:\?>|$)/gi)}})),e.hooks.add("after-tokenize",(function(t){e.languages["markup-templating"].tokenizePlaceholders(t,"php")}))}(i),function(e){var t=e.languages.javascript,n=/{(?:[^{}]|{(?:[^{}]|{[^{}]*})*})+}/.source,r="(@(?:param|arg|argument|property)\\s+(?:"+n+"\\s+)?)";e.languages.jsdoc=e.languages.extend("javadoclike",{parameter:{pattern:RegExp(r+/[$\w\xA0-\uFFFF.]+(?=\s|$)/.source),lookbehind:!0,inside:{punctuation:/\./}}}),e.languages.insertBefore("jsdoc","keyword",{"optional-parameter":{pattern:RegExp(r+/\[[$\w\xA0-\uFFFF.]+(?:=[^[\]]+)?\](?=\s|$)/.source),lookbehind:!0,inside:{parameter:{pattern:/(^\[)[$\w\xA0-\uFFFF\.]+/,lookbehind:!0,inside:{punctuation:/\./}},code:{pattern:/(=)[\s\S]*(?=\]$)/,lookbehind:!0,inside:t,alias:"language-javascript"},punctuation:/[=[\]]/}},"class-name":[{pattern:RegExp("(@[a-z]+\\s+)"+n),lookbehind:!0,inside:{punctuation:/[.,:?=<>|{}()[\]]/}},{pattern:/(@(?:augments|extends|class|interface|memberof!?|this)\s+)[A-Z]\w*(?:\.[A-Z]\w*)*/,lookbehind:!0,inside:{punctuation:/\./}}],example:{pattern:/(@example\s+)[^@]+?(?=\s*(?:\*\s*)?(?:@\w|\*\/))/,lookbehind:!0,inside:{code:{pattern:/^(\s*(?:\*\s*)?).+$/m,lookbehind:!0,inside:t,alias:"language-javascript"}}}}),e.languages.javadoclike.addSupport("javascript",e.languages.jsdoc)}(i),i.languages.actionscript=i.languages.extend("javascript",{keyword:/\b(?:as|break|case|catch|class|const|default|delete|do|else|extends|finally|for|function|if|implements|import|in|instanceof|interface|internal|is|native|new|null|package|private|protected|public|return|super|switch|this|throw|try|typeof|use|var|void|while|with|dynamic|each|final|get|include|namespace|native|override|set|static)\b/,operator:/\+\+|--|(?:[+\-*\/%^]|&&?|\|\|?|<>?>?|[!=]=?)=?|[~?@]/}),i.languages.actionscript["class-name"].alias="function",i.languages.markup&&i.languages.insertBefore("actionscript","string",{xml:{pattern:/(^|[^.])<\/?\w+(?:\s+[^\s>\/=]+=("|')(?:\\[\s\S]|(?!\2)[^\\])*\2)*\s*\/?>/,lookbehind:!0,inside:{rest:i.languages.markup}}}),function(e){var t=/#(?!\{).+/,n={pattern:/#\{[^}]+\}/,alias:"variable"};e.languages.coffeescript=e.languages.extend("javascript",{comment:t,string:[{pattern:/'(?:\\[\s\S]|[^\\'])*'/,greedy:!0},{pattern:/"(?:\\[\s\S]|[^\\"])*"/,greedy:!0,inside:{interpolation:n}}],keyword:/\b(?:and|break|by|catch|class|continue|debugger|delete|do|each|else|extend|extends|false|finally|for|if|in|instanceof|is|isnt|let|loop|namespace|new|no|not|null|of|off|on|or|own|return|super|switch|then|this|throw|true|try|typeof|undefined|unless|until|when|while|window|with|yes|yield)\b/,"class-member":{pattern:/@(?!\d)\w+/,alias:"variable"}}),e.languages.insertBefore("coffeescript","comment",{"multiline-comment":{pattern:/###[\s\S]+?###/,alias:"comment"},"block-regex":{pattern:/\/{3}[\s\S]*?\/{3}/,alias:"regex",inside:{comment:t,interpolation:n}}}),e.languages.insertBefore("coffeescript","string",{"inline-javascript":{pattern:/`(?:\\[\s\S]|[^\\`])*`/,inside:{delimiter:{pattern:/^`|`$/,alias:"punctuation"},rest:e.languages.javascript}},"multiline-string":[{pattern:/'''[\s\S]*?'''/,greedy:!0,alias:"string"},{pattern:/"""[\s\S]*?"""/,greedy:!0,alias:"string",inside:{interpolation:n}}]}),e.languages.insertBefore("coffeescript","keyword",{property:/(?!\d)\w+(?=\s*:(?!:))/}),delete e.languages.coffeescript["template-string"],e.languages.coffee=e.languages.coffeescript}(i),function(e){e.languages.insertBefore("javascript","function-variable",{"method-variable":{pattern:RegExp("(\\.\\s*)"+e.languages.javascript["function-variable"].pattern.source),lookbehind:!0,alias:["function-variable","method","function","property-access"]}}),e.languages.insertBefore("javascript","function",{method:{pattern:RegExp("(\\.\\s*)"+e.languages.javascript.function.source),lookbehind:!0,alias:["function","property-access"]}}),e.languages.insertBefore("javascript","constant",{"known-class-name":[{pattern:/\b(?:(?:(?:Uint|Int)(?:8|16|32)|Uint8Clamped|Float(?:32|64))?Array|ArrayBuffer|BigInt|Boolean|DataView|Date|Error|Function|Intl|JSON|Math|Number|Object|Promise|Proxy|Reflect|RegExp|String|Symbol|(?:Weak)?(?:Set|Map)|WebAssembly)\b/,alias:"class-name"},{pattern:/\b(?:[A-Z]\w*)Error\b/,alias:"class-name"}]}),e.languages.javascript.keyword.unshift({pattern:/\b(?:as|default|export|from|import)\b/,alias:"module"},{pattern:/\bnull\b/,alias:["null","nil"]},{pattern:/\bundefined\b/,alias:"nil"}),e.languages.insertBefore("javascript","operator",{spread:{pattern:/\.{3}/,alias:"operator"},arrow:{pattern:/=>/,alias:"operator"}}),e.languages.insertBefore("javascript","punctuation",{"property-access":{pattern:/(\.\s*)#?[_$a-zA-Z\xA0-\uFFFF][$\w\xA0-\uFFFF]*/,lookbehind:!0},"maybe-class-name":{pattern:/(^|[^$\w\xA0-\uFFFF])[A-Z][$\w\xA0-\uFFFF]+/,lookbehind:!0},dom:{pattern:/\b(?:document|location|navigator|performance|(?:local|session)Storage|window)\b/,alias:"variable"},console:{pattern:/\bconsole(?=\s*\.)/,alias:"class-name"}});for(var t=["function","function-variable","method","method-variable","property-access"],n=0;n))/i,delete e.languages.flow.parameter,e.languages.insertBefore("flow","operator",{"flow-punctuation":{pattern:/\{\||\|\}/,alias:"punctuation"}}),Array.isArray(e.languages.flow.keyword)||(e.languages.flow.keyword=[e.languages.flow.keyword]),e.languages.flow.keyword.unshift({pattern:/(^|[^$]\b)(?:type|opaque|declare|Class)\b(?!\$)/,lookbehind:!0},{pattern:/(^|[^$]\B)\$(?:await|Diff|Exact|Keys|ObjMap|PropertyType|Shape|Record|Supertype|Subtype|Enum)\b(?!\$)/,lookbehind:!0})}(i),i.languages.n4js=i.languages.extend("javascript",{keyword:/\b(?:any|Array|boolean|break|case|catch|class|const|constructor|continue|debugger|declare|default|delete|do|else|enum|export|extends|false|finally|for|from|function|get|if|implements|import|in|instanceof|interface|let|module|new|null|number|package|private|protected|public|return|set|static|string|super|switch|this|throw|true|try|typeof|var|void|while|with|yield)\b/}),i.languages.insertBefore("n4js","constant",{annotation:{pattern:/@+\w+/,alias:"operator"}}),i.languages.n4jsd=i.languages.n4js,i.languages.typescript=i.languages.extend("javascript",{keyword:/\b(?:abstract|as|async|await|break|case|catch|class|const|constructor|continue|debugger|declare|default|delete|do|else|enum|export|extends|finally|for|from|function|get|if|implements|import|in|instanceof|interface|is|keyof|let|module|namespace|new|null|of|package|private|protected|public|readonly|return|require|set|static|super|switch|this|throw|try|type|typeof|var|void|while|with|yield)\b/,builtin:/\b(?:string|Function|any|number|boolean|Array|symbol|console|Promise|unknown|never)\b/}),i.languages.ts=i.languages.typescript,function(e){var t=e.languages.javascript["template-string"],n=t.pattern.source,r=t.inside.interpolation,a=r.inside["interpolation-punctuation"],o=r.pattern.source;function i(t,r){if(e.languages[t])return{pattern:RegExp("((?:"+r+")\\s*)"+n),lookbehind:!0,greedy:!0,inside:{"template-punctuation":{pattern:/^`|`$/,alias:"string"},"embedded-code":{pattern:/[\s\S]+/,alias:t}}}}function l(e,t){return"___"+t.toUpperCase()+"_"+e+"___"}function u(t,n,r){var a={code:t,grammar:n,language:r};return e.hooks.run("before-tokenize",a),a.tokens=e.tokenize(a.code,a.grammar),e.hooks.run("after-tokenize",a),a.tokens}function s(t){var n={};n["interpolation-punctuation"]=a;var o=e.tokenize(t,n);if(3===o.length){var i=[1,1];i.push.apply(i,u(o[1],e.languages.javascript,"javascript")),o.splice.apply(o,i)}return new e.Token("interpolation",o,r.alias,t)}function c(t,n,r){var a=e.tokenize(t,{interpolation:{pattern:RegExp(o),lookbehind:!0}}),i=0,c={},f=u(a.map((function(e){if("string"==typeof e)return e;for(var n,a=e.content;-1!==t.indexOf(n=l(i++,r)););return c[n]=a,n})).join(""),n,r),p=Object.keys(c);return i=0,function e(t){for(var n=0;n=p.length)return;var r=t[n];if("string"==typeof r||"string"==typeof r.content){var a=p[i],o="string"==typeof r?r:r.content,l=o.indexOf(a);if(-1!==l){++i;var u=o.substring(0,l),f=s(c[a]),d=o.substring(l+a.length),m=[];if(u&&m.push(u),m.push(f),d){var h=[d];e(h),m.push.apply(m,h)}"string"==typeof r?(t.splice.apply(t,[n,1].concat(m)),n+=m.length-1):r.content=m}}else{var g=r.content;Array.isArray(g)?e(g):e([g])}}}(f),new e.Token(r,f,"language-"+r,t)}e.languages.javascript["template-string"]=[i("css",/\b(?:styled(?:\([^)]*\))?(?:\s*\.\s*\w+(?:\([^)]*\))*)*|css(?:\s*\.\s*(?:global|resolve))?|createGlobalStyle|keyframes)/.source),i("html",/\bhtml|\.\s*(?:inner|outer)HTML\s*\+?=/.source),i("svg",/\bsvg/.source),i("markdown",/\b(?:md|markdown)/.source),i("graphql",/\b(?:gql|graphql(?:\s*\.\s*experimental)?)/.source),t].filter(Boolean);var f={javascript:!0,js:!0,typescript:!0,ts:!0,jsx:!0,tsx:!0};function p(e){return"string"==typeof e?e:Array.isArray(e)?e.map(p).join(""):p(e.content)}e.hooks.add("after-tokenize",(function(t){t.language in f&&function t(n){for(var r=0,a=n.length;r/g,t),n&&(e=e+"|"+e.replace(/_/g,"\\*")),RegExp(/((?:^|[^\\])(?:\\{2})*)/.source+"(?:"+e+")")}var r=/(?:\\.|``.+?``|`[^`\r\n]+`|[^\\|\r\n`])+/.source,a=/\|?__(?:\|__)+\|?(?:(?:\r?\n|\r)|$)/.source.replace(/__/g,r),o=/\|?[ \t]*:?-{3,}:?[ \t]*(?:\|[ \t]*:?-{3,}:?[ \t]*)+\|?(?:\r?\n|\r)/.source;e.languages.markdown=e.languages.extend("markup",{}),e.languages.insertBefore("markdown","prolog",{blockquote:{pattern:/^>(?:[\t ]*>)*/m,alias:"punctuation"},table:{pattern:RegExp("^"+a+o+"(?:"+a+")*","m"),inside:{"table-data-rows":{pattern:RegExp("^("+a+o+")(?:"+a+")*$"),lookbehind:!0,inside:{"table-data":{pattern:RegExp(r),inside:e.languages.markdown},punctuation:/\|/}},"table-line":{pattern:RegExp("^("+a+")"+o+"$"),lookbehind:!0,inside:{punctuation:/\||:?-{3,}:?/}},"table-header-row":{pattern:RegExp("^"+a+"$"),inside:{"table-header":{pattern:RegExp(r),alias:"important",inside:e.languages.markdown},punctuation:/\|/}}}},code:[{pattern:/(^[ \t]*(?:\r?\n|\r))(?: {4}|\t).+(?:(?:\r?\n|\r)(?: {4}|\t).+)*/m,lookbehind:!0,alias:"keyword"},{pattern:/``.+?``|`[^`\r\n]+`/,alias:"keyword"},{pattern:/^```[\s\S]*?^```$/m,greedy:!0,inside:{"code-block":{pattern:/^(```.*(?:\r?\n|\r))[\s\S]+?(?=(?:\r?\n|\r)^```$)/m,lookbehind:!0},"code-language":{pattern:/^(```).+/,lookbehind:!0},punctuation:/```/}}],title:[{pattern:/\S.*(?:\r?\n|\r)(?:==+|--+)(?=[ \t]*$)/m,alias:"important",inside:{punctuation:/==+$|--+$/}},{pattern:/(^\s*)#+.+/m,lookbehind:!0,alias:"important",inside:{punctuation:/^#+|#+$/}}],hr:{pattern:/(^\s*)([*-])(?:[\t ]*\2){2,}(?=\s*$)/m,lookbehind:!0,alias:"punctuation"},list:{pattern:/(^\s*)(?:[*+-]|\d+\.)(?=[\t ].)/m,lookbehind:!0,alias:"punctuation"},"url-reference":{pattern:/!?\[[^\]]+\]:[\t ]+(?:\S+|<(?:\\.|[^>\\])+>)(?:[\t ]+(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\((?:\\.|[^)\\])*\)))?/,inside:{variable:{pattern:/^(!?\[)[^\]]+/,lookbehind:!0},string:/(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\((?:\\.|[^)\\])*\))$/,punctuation:/^[\[\]!:]|[<>]/},alias:"url"},bold:{pattern:n(/__(?:(?!_)|_(?:(?!_))+_)+__/.source,!0),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^..)[\s\S]+(?=..$)/,lookbehind:!0,inside:{}},punctuation:/\*\*|__/}},italic:{pattern:n(/_(?:(?!_)|__(?:(?!_))+__)+_/.source,!0),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^.)[\s\S]+(?=.$)/,lookbehind:!0,inside:{}},punctuation:/[*_]/}},strike:{pattern:n(/(~~?)(?:(?!~))+?\2/.source,!1),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^~~?)[\s\S]+(?=\1$)/,lookbehind:!0,inside:{}},punctuation:/~~?/}},url:{pattern:n(/!?\[(?:(?!\]))+\](?:\([^\s)]+(?:[\t ]+"(?:\\.|[^"\\])*")?\)| ?\[(?:(?!\]))+\])/.source,!1),lookbehind:!0,greedy:!0,inside:{variable:{pattern:/(\[)[^\]]+(?=\]$)/,lookbehind:!0},content:{pattern:/(^!?\[)[^\]]+(?=\])/,lookbehind:!0,inside:{}},string:{pattern:/"(?:\\.|[^"\\])*"(?=\)$)/}}}}),["url","bold","italic","strike"].forEach((function(t){["url","bold","italic","strike"].forEach((function(n){t!==n&&(e.languages.markdown[t].inside.content.inside[n]=e.languages.markdown[n])}))})),e.hooks.add("after-tokenize",(function(e){"markdown"!==e.language&&"md"!==e.language||function e(t){if(t&&"string"!=typeof t)for(var n=0,r=t.length;n",unchanged:" ",diff:"!"};Object.keys(t).forEach((function(n){var r=t[n],a=[];/^\w+$/.test(n)||a.push(/\w+/.exec(n)[0]),"diff"===n&&a.push("bold"),e.languages.diff[n]={pattern:RegExp("^(?:["+r+"].*(?:\r\n?|\n|(?![\\s\\S])))+","m"),alias:a}})),Object.defineProperty(e.languages.diff,"PREFIXES",{value:t})}(i),i.languages.git={comment:/^#.*/m,deleted:/^[-\u2013].*/m,inserted:/^\+.*/m,string:/("|')(?:\\.|(?!\1)[^\\\r\n])*\1/m,command:{pattern:/^.*\$ git .*$/m,inside:{parameter:/\s--?\w+/m}},coord:/^@@.*@@$/m,commit_sha1:/^commit \w{40}$/m},i.languages.go=i.languages.extend("clike",{keyword:/\b(?:break|case|chan|const|continue|default|defer|else|fallthrough|for|func|go(?:to)?|if|import|interface|map|package|range|return|select|struct|switch|type|var)\b/,builtin:/\b(?:bool|byte|complex(?:64|128)|error|float(?:32|64)|rune|string|u?int(?:8|16|32|64)?|uintptr|append|cap|close|complex|copy|delete|imag|len|make|new|panic|print(?:ln)?|real|recover)\b/,boolean:/\b(?:_|iota|nil|true|false)\b/,operator:/[*\/%^!=]=?|\+[=+]?|-[=-]?|\|[=|]?|&(?:=|&|\^=?)?|>(?:>=?|=)?|<(?:<=?|=|-)?|:=|\.\.\./,number:/(?:\b0x[a-f\d]+|(?:\b\d+\.?\d*|\B\.\d+)(?:e[-+]?\d+)?)i?/i,string:{pattern:/(["'`])(\\[\s\S]|(?!\1)[^\\])*\1/,greedy:!0}}),delete i.languages.go["class-name"],function(e){e.languages.handlebars={comment:/\{\{![\s\S]*?\}\}/,delimiter:{pattern:/^\{\{\{?|\}\}\}?$/i,alias:"punctuation"},string:/(["'])(?:\\.|(?!\1)[^\\\r\n])*\1/,number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+\.?\d*|\B\.\d+)(?:[Ee][+-]?\d+)?/,boolean:/\b(?:true|false)\b/,block:{pattern:/^(\s*~?\s*)[#\/]\S+?(?=\s*~?\s*$|\s)/i,lookbehind:!0,alias:"keyword"},brackets:{pattern:/\[[^\]]+\]/,inside:{punctuation:/\[|\]/,variable:/[\s\S]+/}},punctuation:/[!"#%&'()*+,.\/;<=>@\[\\\]^`{|}~]/,variable:/[^!"#%&'()*+,.\/;<=>@\[\\\]^`{|}~\s]+/},e.hooks.add("before-tokenize",(function(t){e.languages["markup-templating"].buildPlaceholders(t,"handlebars",/\{\{\{[\s\S]+?\}\}\}|\{\{[\s\S]+?\}\}/g)})),e.hooks.add("after-tokenize",(function(t){e.languages["markup-templating"].tokenizePlaceholders(t,"handlebars")}))}(i),i.languages.json={property:{pattern:/"(?:\\.|[^\\"\r\n])*"(?=\s*:)/,greedy:!0},string:{pattern:/"(?:\\.|[^\\"\r\n])*"(?!\s*:)/,greedy:!0},comment:/\/\/.*|\/\*[\s\S]*?(?:\*\/|$)/,number:/-?\d+\.?\d*(e[+-]?\d+)?/i,punctuation:/[{}[\],]/,operator:/:/,boolean:/\b(?:true|false)\b/,null:{pattern:/\bnull\b/,alias:"keyword"}},i.languages.less=i.languages.extend("css",{comment:[/\/\*[\s\S]*?\*\//,{pattern:/(^|[^\\])\/\/.*/,lookbehind:!0}],atrule:{pattern:/@[\w-]+?(?:\([^{}]+\)|[^(){};])*?(?=\s*\{)/i,inside:{punctuation:/[:()]/}},selector:{pattern:/(?:@\{[\w-]+\}|[^{};\s@])(?:@\{[\w-]+\}|\([^{}]*\)|[^{};@])*?(?=\s*\{)/,inside:{variable:/@+[\w-]+/}},property:/(?:@\{[\w-]+\}|[\w-])+(?:\+_?)?(?=\s*:)/i,operator:/[+\-*\/]/}),i.languages.insertBefore("less","property",{variable:[{pattern:/@[\w-]+\s*:/,inside:{punctuation:/:/}},/@@?[\w-]+/],"mixin-usage":{pattern:/([{;]\s*)[.#](?!\d)[\w-]+.*?(?=[(;])/,lookbehind:!0,alias:"function"}}),i.languages.makefile={comment:{pattern:/(^|[^\\])#(?:\\(?:\r\n|[\s\S])|[^\\\r\n])*/,lookbehind:!0},string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},builtin:/\.[A-Z][^:#=\s]+(?=\s*:(?!=))/,symbol:{pattern:/^[^:=\r\n]+(?=\s*:(?!=))/m,inside:{variable:/\$+(?:[^(){}:#=\s]+|(?=[({]))/}},variable:/\$+(?:[^(){}:#=\s]+|\([@*%<^+?][DF]\)|(?=[({]))/,keyword:[/-include\b|\b(?:define|else|endef|endif|export|ifn?def|ifn?eq|include|override|private|sinclude|undefine|unexport|vpath)\b/,{pattern:/(\()(?:addsuffix|abspath|and|basename|call|dir|error|eval|file|filter(?:-out)?|findstring|firstword|flavor|foreach|guile|if|info|join|lastword|load|notdir|or|origin|patsubst|realpath|shell|sort|strip|subst|suffix|value|warning|wildcard|word(?:s|list)?)(?=[ \t])/,lookbehind:!0}],operator:/(?:::|[?:+!])?=|[|@]/,punctuation:/[:;(){}]/},i.languages.objectivec=i.languages.extend("c",{keyword:/\b(?:asm|typeof|inline|auto|break|case|char|const|continue|default|do|double|else|enum|extern|float|for|goto|if|int|long|register|return|short|signed|sizeof|static|struct|switch|typedef|union|unsigned|void|volatile|while|in|self|super)\b|(?:@interface|@end|@implementation|@protocol|@class|@public|@protected|@private|@property|@try|@catch|@finally|@throw|@synthesize|@dynamic|@selector)\b/,string:/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1|@"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"/,operator:/-[->]?|\+\+?|!=?|<>?=?|==?|&&?|\|\|?|[~^%?*\/@]/}),delete i.languages.objectivec["class-name"],i.languages.ocaml={comment:/\(\*[\s\S]*?\*\)/,string:[{pattern:/"(?:\\.|[^\\\r\n"])*"/,greedy:!0},{pattern:/(['`])(?:\\(?:\d+|x[\da-f]+|.)|(?!\1)[^\\\r\n])\1/i,greedy:!0}],number:/\b(?:0x[\da-f][\da-f_]+|(?:0[bo])?\d[\d_]*\.?[\d_]*(?:e[+-]?[\d_]+)?)/i,type:{pattern:/\B['`]\w*/,alias:"variable"},directive:{pattern:/\B#\w+/,alias:"function"},keyword:/\b(?:as|assert|begin|class|constraint|do|done|downto|else|end|exception|external|for|fun|function|functor|if|in|include|inherit|initializer|lazy|let|match|method|module|mutable|new|object|of|open|prefix|private|rec|then|sig|struct|to|try|type|val|value|virtual|where|while|with)\b/,boolean:/\b(?:false|true)\b/,operator:/:=|[=<>@^|&+\-*\/$%!?~][!$%&*+\-.\/:<=>?@^|~]*|\b(?:and|asr|land|lor|lxor|lsl|lsr|mod|nor|or)\b/,punctuation:/[(){}\[\]|_.,:;]/},i.languages.python={comment:{pattern:/(^|[^\\])#.*/,lookbehind:!0},"string-interpolation":{pattern:/(?:f|rf|fr)(?:("""|''')[\s\S]+?\1|("|')(?:\\.|(?!\2)[^\\\r\n])*\2)/i,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^{])(?:{{)*){(?!{)(?:[^{}]|{(?!{)(?:[^{}]|{(?!{)(?:[^{}])+})+})+}/,lookbehind:!0,inside:{"format-spec":{pattern:/(:)[^:(){}]+(?=}$)/,lookbehind:!0},"conversion-option":{pattern:/![sra](?=[:}]$)/,alias:"punctuation"},rest:null}},string:/[\s\S]+/}},"triple-quoted-string":{pattern:/(?:[rub]|rb|br)?("""|''')[\s\S]+?\1/i,greedy:!0,alias:"string"},string:{pattern:/(?:[rub]|rb|br)?("|')(?:\\.|(?!\1)[^\\\r\n])*\1/i,greedy:!0},function:{pattern:/((?:^|\s)def[ \t]+)[a-zA-Z_]\w*(?=\s*\()/g,lookbehind:!0},"class-name":{pattern:/(\bclass\s+)\w+/i,lookbehind:!0},decorator:{pattern:/(^\s*)@\w+(?:\.\w+)*/i,lookbehind:!0,alias:["annotation","punctuation"],inside:{punctuation:/\./}},keyword:/\b(?:and|as|assert|async|await|break|class|continue|def|del|elif|else|except|exec|finally|for|from|global|if|import|in|is|lambda|nonlocal|not|or|pass|print|raise|return|try|while|with|yield)\b/,builtin:/\b(?:__import__|abs|all|any|apply|ascii|basestring|bin|bool|buffer|bytearray|bytes|callable|chr|classmethod|cmp|coerce|compile|complex|delattr|dict|dir|divmod|enumerate|eval|execfile|file|filter|float|format|frozenset|getattr|globals|hasattr|hash|help|hex|id|input|int|intern|isinstance|issubclass|iter|len|list|locals|long|map|max|memoryview|min|next|object|oct|open|ord|pow|property|range|raw_input|reduce|reload|repr|reversed|round|set|setattr|slice|sorted|staticmethod|str|sum|super|tuple|type|unichr|unicode|vars|xrange|zip)\b/,boolean:/\b(?:True|False|None)\b/,number:/(?:\b(?=\d)|\B(?=\.))(?:0[bo])?(?:(?:\d|0x[\da-f])[\da-f]*\.?\d*|\.\d+)(?:e[+-]?\d+)?j?\b/i,operator:/[-+%=]=?|!=|\*\*?=?|\/\/?=?|<[<=>]?|>[=>]?|[&|^~]/,punctuation:/[{}[\];(),.:]/},i.languages.python["string-interpolation"].inside.interpolation.inside.rest=i.languages.python,i.languages.py=i.languages.python,i.languages.reason=i.languages.extend("clike",{comment:{pattern:/(^|[^\\])\/\*[\s\S]*?\*\//,lookbehind:!0},string:{pattern:/"(?:\\(?:\r\n|[\s\S])|[^\\\r\n"])*"/,greedy:!0},"class-name":/\b[A-Z]\w*/,keyword:/\b(?:and|as|assert|begin|class|constraint|do|done|downto|else|end|exception|external|for|fun|function|functor|if|in|include|inherit|initializer|lazy|let|method|module|mutable|new|nonrec|object|of|open|or|private|rec|sig|struct|switch|then|to|try|type|val|virtual|when|while|with)\b/,operator:/\.{3}|:[:=]|\|>|->|=(?:==?|>)?|<=?|>=?|[|^?'#!~`]|[+\-*\/]\.?|\b(?:mod|land|lor|lxor|lsl|lsr|asr)\b/}),i.languages.insertBefore("reason","class-name",{character:{pattern:/'(?:\\x[\da-f]{2}|\\o[0-3][0-7][0-7]|\\\d{3}|\\.|[^'\\\r\n])'/,alias:"string"},constructor:{pattern:/\b[A-Z]\w*\b(?!\s*\.)/,alias:"variable"},label:{pattern:/\b[a-z]\w*(?=::)/,alias:"symbol"}}),delete i.languages.reason.function,function(e){e.languages.sass=e.languages.extend("css",{comment:{pattern:/^([ \t]*)\/[\/*].*(?:(?:\r?\n|\r)\1[ \t]+.+)*/m,lookbehind:!0}}),e.languages.insertBefore("sass","atrule",{"atrule-line":{pattern:/^(?:[ \t]*)[@+=].+/m,inside:{atrule:/(?:@[\w-]+|[+=])/m}}}),delete e.languages.sass.atrule;var t=/\$[-\w]+|#\{\$[-\w]+\}/,n=[/[+*\/%]|[=!]=|<=?|>=?|\b(?:and|or|not)\b/,{pattern:/(\s+)-(?=\s)/,lookbehind:!0}];e.languages.insertBefore("sass","property",{"variable-line":{pattern:/^[ \t]*\$.+/m,inside:{punctuation:/:/,variable:t,operator:n}},"property-line":{pattern:/^[ \t]*(?:[^:\s]+ *:.*|:[^:\s]+.*)/m,inside:{property:[/[^:\s]+(?=\s*:)/,{pattern:/(:)[^:\s]+/,lookbehind:!0}],punctuation:/:/,variable:t,operator:n,important:e.languages.sass.important}}}),delete e.languages.sass.property,delete e.languages.sass.important,e.languages.insertBefore("sass","punctuation",{selector:{pattern:/([ \t]*)\S(?:,?[^,\r\n]+)*(?:,(?:\r?\n|\r)\1[ \t]+\S(?:,?[^,\r\n]+)*)*/,lookbehind:!0}})}(i),i.languages.scss=i.languages.extend("css",{comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0},atrule:{pattern:/@[\w-]+(?:\([^()]+\)|[^(])*?(?=\s+[{;])/,inside:{rule:/@[\w-]+/}},url:/(?:[-a-z]+-)?url(?=\()/i,selector:{pattern:/(?=\S)[^@;{}()]?(?:[^@;{}()]|#\{\$[-\w]+\})+(?=\s*\{(?:\}|\s|[^}]+[:{][^}]+))/m,inside:{parent:{pattern:/&/,alias:"important"},placeholder:/%[-\w]+/,variable:/\$[-\w]+|#\{\$[-\w]+\}/}},property:{pattern:/(?:[\w-]|\$[-\w]+|#\{\$[-\w]+\})+(?=\s*:)/,inside:{variable:/\$[-\w]+|#\{\$[-\w]+\}/}}}),i.languages.insertBefore("scss","atrule",{keyword:[/@(?:if|else(?: if)?|for|each|while|import|extend|debug|warn|mixin|include|function|return|content)/i,{pattern:/( +)(?:from|through)(?= )/,lookbehind:!0}]}),i.languages.insertBefore("scss","important",{variable:/\$[-\w]+|#\{\$[-\w]+\}/}),i.languages.insertBefore("scss","function",{placeholder:{pattern:/%[-\w]+/,alias:"selector"},statement:{pattern:/\B!(?:default|optional)\b/i,alias:"keyword"},boolean:/\b(?:true|false)\b/,null:{pattern:/\bnull\b/,alias:"keyword"},operator:{pattern:/(\s)(?:[-+*\/%]|[=!]=|<=?|>=?|and|or|not)(?=\s)/,lookbehind:!0}}),i.languages.scss.atrule.inside.rest=i.languages.scss,i.languages.sql={comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|(?:--|\/\/|#).*)/,lookbehind:!0},variable:[{pattern:/@(["'`])(?:\\[\s\S]|(?!\1)[^\\])+\1/,greedy:!0},/@[\w.$]+/],string:{pattern:/(^|[^@\\])("|')(?:\\[\s\S]|(?!\2)[^\\]|\2\2)*\2/,greedy:!0,lookbehind:!0},function:/\b(?:AVG|COUNT|FIRST|FORMAT|LAST|LCASE|LEN|MAX|MID|MIN|MOD|NOW|ROUND|SUM|UCASE)(?=\s*\()/i,keyword:/\b(?:ACTION|ADD|AFTER|ALGORITHM|ALL|ALTER|ANALYZE|ANY|APPLY|AS|ASC|AUTHORIZATION|AUTO_INCREMENT|BACKUP|BDB|BEGIN|BERKELEYDB|BIGINT|BINARY|BIT|BLOB|BOOL|BOOLEAN|BREAK|BROWSE|BTREE|BULK|BY|CALL|CASCADED?|CASE|CHAIN|CHAR(?:ACTER|SET)?|CHECK(?:POINT)?|CLOSE|CLUSTERED|COALESCE|COLLATE|COLUMNS?|COMMENT|COMMIT(?:TED)?|COMPUTE|CONNECT|CONSISTENT|CONSTRAINT|CONTAINS(?:TABLE)?|CONTINUE|CONVERT|CREATE|CROSS|CURRENT(?:_DATE|_TIME|_TIMESTAMP|_USER)?|CURSOR|CYCLE|DATA(?:BASES?)?|DATE(?:TIME)?|DAY|DBCC|DEALLOCATE|DEC|DECIMAL|DECLARE|DEFAULT|DEFINER|DELAYED|DELETE|DELIMITERS?|DENY|DESC|DESCRIBE|DETERMINISTIC|DISABLE|DISCARD|DISK|DISTINCT|DISTINCTROW|DISTRIBUTED|DO|DOUBLE|DROP|DUMMY|DUMP(?:FILE)?|DUPLICATE|ELSE(?:IF)?|ENABLE|ENCLOSED|END|ENGINE|ENUM|ERRLVL|ERRORS|ESCAPED?|EXCEPT|EXEC(?:UTE)?|EXISTS|EXIT|EXPLAIN|EXTENDED|FETCH|FIELDS|FILE|FILLFACTOR|FIRST|FIXED|FLOAT|FOLLOWING|FOR(?: EACH ROW)?|FORCE|FOREIGN|FREETEXT(?:TABLE)?|FROM|FULL|FUNCTION|GEOMETRY(?:COLLECTION)?|GLOBAL|GOTO|GRANT|GROUP|HANDLER|HASH|HAVING|HOLDLOCK|HOUR|IDENTITY(?:_INSERT|COL)?|IF|IGNORE|IMPORT|INDEX|INFILE|INNER|INNODB|INOUT|INSERT|INT|INTEGER|INTERSECT|INTERVAL|INTO|INVOKER|ISOLATION|ITERATE|JOIN|KEYS?|KILL|LANGUAGE|LAST|LEAVE|LEFT|LEVEL|LIMIT|LINENO|LINES|LINESTRING|LOAD|LOCAL|LOCK|LONG(?:BLOB|TEXT)|LOOP|MATCH(?:ED)?|MEDIUM(?:BLOB|INT|TEXT)|MERGE|MIDDLEINT|MINUTE|MODE|MODIFIES|MODIFY|MONTH|MULTI(?:LINESTRING|POINT|POLYGON)|NATIONAL|NATURAL|NCHAR|NEXT|NO|NONCLUSTERED|NULLIF|NUMERIC|OFF?|OFFSETS?|ON|OPEN(?:DATASOURCE|QUERY|ROWSET)?|OPTIMIZE|OPTION(?:ALLY)?|ORDER|OUT(?:ER|FILE)?|OVER|PARTIAL|PARTITION|PERCENT|PIVOT|PLAN|POINT|POLYGON|PRECEDING|PRECISION|PREPARE|PREV|PRIMARY|PRINT|PRIVILEGES|PROC(?:EDURE)?|PUBLIC|PURGE|QUICK|RAISERROR|READS?|REAL|RECONFIGURE|REFERENCES|RELEASE|RENAME|REPEAT(?:ABLE)?|REPLACE|REPLICATION|REQUIRE|RESIGNAL|RESTORE|RESTRICT|RETURNS?|REVOKE|RIGHT|ROLLBACK|ROUTINE|ROW(?:COUNT|GUIDCOL|S)?|RTREE|RULE|SAVE(?:POINT)?|SCHEMA|SECOND|SELECT|SERIAL(?:IZABLE)?|SESSION(?:_USER)?|SET(?:USER)?|SHARE|SHOW|SHUTDOWN|SIMPLE|SMALLINT|SNAPSHOT|SOME|SONAME|SQL|START(?:ING)?|STATISTICS|STATUS|STRIPED|SYSTEM_USER|TABLES?|TABLESPACE|TEMP(?:ORARY|TABLE)?|TERMINATED|TEXT(?:SIZE)?|THEN|TIME(?:STAMP)?|TINY(?:BLOB|INT|TEXT)|TOP?|TRAN(?:SACTIONS?)?|TRIGGER|TRUNCATE|TSEQUAL|TYPES?|UNBOUNDED|UNCOMMITTED|UNDEFINED|UNION|UNIQUE|UNLOCK|UNPIVOT|UNSIGNED|UPDATE(?:TEXT)?|USAGE|USE|USER|USING|VALUES?|VAR(?:BINARY|CHAR|CHARACTER|YING)|VIEW|WAITFOR|WARNINGS|WHEN|WHERE|WHILE|WITH(?: ROLLUP|IN)?|WORK|WRITE(?:TEXT)?|YEAR)\b/i,boolean:/\b(?:TRUE|FALSE|NULL)\b/i,number:/\b0x[\da-f]+\b|\b\d+\.?\d*|\B\.\d+\b/i,operator:/[-+*\/=%^~]|&&?|\|\|?|!=?|<(?:=>?|<|>)?|>[>=]?|\b(?:AND|BETWEEN|IN|LIKE|NOT|OR|IS|DIV|REGEXP|RLIKE|SOUNDS LIKE|XOR)\b/i,punctuation:/[;[\]()`,.]/},function(e){var t={url:/url\((["']?).*?\1\)/i,string:{pattern:/("|')(?:(?!\1)[^\\\r\n]|\\(?:\r\n|[\s\S]))*\1/,greedy:!0},interpolation:null,func:null,important:/\B!(?:important|optional)\b/i,keyword:{pattern:/(^|\s+)(?:(?:if|else|for|return|unless)(?=\s+|$)|@[\w-]+)/,lookbehind:!0},hexcode:/#[\da-f]{3,6}/i,number:/\b\d+(?:\.\d+)?%?/,boolean:/\b(?:true|false)\b/,operator:[/~|[+!\/%<>?=]=?|[-:]=|\*[*=]?|\.+|&&|\|\||\B-\B|\b(?:and|in|is(?: a| defined| not|nt)?|not|or)\b/],punctuation:/[{}()\[\];:,]/};t.interpolation={pattern:/\{[^\r\n}:]+\}/,alias:"variable",inside:{delimiter:{pattern:/^{|}$/,alias:"punctuation"},rest:t}},t.func={pattern:/[\w-]+\([^)]*\).*/,inside:{function:/^[^(]+/,rest:t}},e.languages.stylus={comment:{pattern:/(^|[^\\])(\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0},"atrule-declaration":{pattern:/(^\s*)@.+/m,lookbehind:!0,inside:{atrule:/^@[\w-]+/,rest:t}},"variable-declaration":{pattern:/(^[ \t]*)[\w$-]+\s*.?=[ \t]*(?:(?:\{[^}]*\}|.+)|$)/m,lookbehind:!0,inside:{variable:/^\S+/,rest:t}},statement:{pattern:/(^[ \t]*)(?:if|else|for|return|unless)[ \t]+.+/m,lookbehind:!0,inside:{keyword:/^\S+/,rest:t}},"property-declaration":{pattern:/((?:^|\{)([ \t]*))(?:[\w-]|\{[^}\r\n]+\})+(?:\s*:\s*|[ \t]+)[^{\r\n]*(?:;|[^{\r\n,](?=$)(?!(\r?\n|\r)(?:\{|\2[ \t]+)))/m,lookbehind:!0,inside:{property:{pattern:/^[^\s:]+/,inside:{interpolation:t.interpolation}},rest:t}},selector:{pattern:/(^[ \t]*)(?:(?=\S)(?:[^{}\r\n:()]|::?[\w-]+(?:\([^)\r\n]*\))?|\{[^}\r\n]+\})+)(?:(?:\r?\n|\r)(?:\1(?:(?=\S)(?:[^{}\r\n:()]|::?[\w-]+(?:\([^)\r\n]*\))?|\{[^}\r\n]+\})+)))*(?:,$|\{|(?=(?:\r?\n|\r)(?:\{|\1[ \t]+)))/m,lookbehind:!0,inside:{interpolation:t.interpolation,punctuation:/[{},]/}},func:t.func,string:t.string,interpolation:t.interpolation,punctuation:/[{}()\[\];:.]/}}(i);var l=i.util.clone(i.languages.typescript);i.languages.tsx=i.languages.extend("jsx",l),i.languages.wasm={comment:[/\(;[\s\S]*?;\)/,{pattern:/;;.*/,greedy:!0}],string:{pattern:/"(?:\\[\s\S]|[^"\\])*"/,greedy:!0},keyword:[{pattern:/\b(?:align|offset)=/,inside:{operator:/=/}},{pattern:/\b(?:(?:f32|f64|i32|i64)(?:\.(?:abs|add|and|ceil|clz|const|convert_[su]\/i(?:32|64)|copysign|ctz|demote\/f64|div(?:_[su])?|eqz?|extend_[su]\/i32|floor|ge(?:_[su])?|gt(?:_[su])?|le(?:_[su])?|load(?:(?:8|16|32)_[su])?|lt(?:_[su])?|max|min|mul|nearest|neg?|or|popcnt|promote\/f32|reinterpret\/[fi](?:32|64)|rem_[su]|rot[lr]|shl|shr_[su]|store(?:8|16|32)?|sqrt|sub|trunc(?:_[su]\/f(?:32|64))?|wrap\/i64|xor))?|memory\.(?:grow|size))\b/,inside:{punctuation:/\./}},/\b(?:anyfunc|block|br(?:_if|_table)?|call(?:_indirect)?|data|drop|elem|else|end|export|func|get_(?:global|local)|global|if|import|local|loop|memory|module|mut|nop|offset|param|result|return|select|set_(?:global|local)|start|table|tee_local|then|type|unreachable)\b/],variable:/\$[\w!#$%&'*+\-./:<=>?@\\^_`|~]+/i,number:/[+-]?\b(?:\d(?:_?\d)*(?:\.\d(?:_?\d)*)?(?:[eE][+-]?\d(?:_?\d)*)?|0x[\da-fA-F](?:_?[\da-fA-F])*(?:\.[\da-fA-F](?:_?[\da-fA-D])*)?(?:[pP][+-]?\d(?:_?\d)*)?)\b|\binf\b|\bnan(?::0x[\da-fA-F](?:_?[\da-fA-D])*)?\b/,punctuation:/[()]/},i.languages.yaml={scalar:{pattern:/([\-:]\s*(?:![^\s]+)?[ \t]*[|>])[ \t]*(?:((?:\r?\n|\r)[ \t]+)[^\r\n]+(?:\2[^\r\n]+)*)/,lookbehind:!0,alias:"string"},comment:/#.*/,key:{pattern:/(\s*(?:^|[:\-,[{\r\n?])[ \t]*(?:![^\s]+)?[ \t]*)[^\r\n{[\]},#\s]+?(?=\s*:\s)/,lookbehind:!0,alias:"atrule"},directive:{pattern:/(^[ \t]*)%.+/m,lookbehind:!0,alias:"important"},datetime:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)(?:\d{4}-\d\d?-\d\d?(?:[tT]|[ \t]+)\d\d?:\d{2}:\d{2}(?:\.\d*)?[ \t]*(?:Z|[-+]\d\d?(?::\d{2})?)?|\d{4}-\d{2}-\d{2}|\d\d?:\d{2}(?::\d{2}(?:\.\d*)?)?)(?=[ \t]*(?:$|,|]|}))/m,lookbehind:!0,alias:"number"},boolean:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)(?:true|false)[ \t]*(?=$|,|]|})/im,lookbehind:!0,alias:"important"},null:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)(?:null|~)[ \t]*(?=$|,|]|})/im,lookbehind:!0,alias:"important"},string:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)("|')(?:(?!\2)[^\\\r\n]|\\.)*\2(?=[ \t]*(?:$|,|]|}|\s*#))/m,lookbehind:!0,greedy:!0},number:{pattern:/([:\-,[{]\s*(?:![^\s]+)?[ \t]*)[+-]?(?:0x[\da-f]+|0o[0-7]+|(?:\d+\.?\d*|\.?\d+)(?:e[+-]?\d+)?|\.inf|\.nan)[ \t]*(?=$|,|]|})/im,lookbehind:!0},tag:/![^\s]+/,important:/[&*][\w]+/,punctuation:/---|[:[\]{}\-,|>?]|\.\.\./},i.languages.yml=i.languages.yaml,t.a=i},function(e,t,n){"use strict";var r=Object.getOwnPropertySymbols,a=Object.prototype.hasOwnProperty,o=Object.prototype.propertyIsEnumerable;function i(e){if(null==e)throw new TypeError("Object.assign cannot be called with null or undefined");return Object(e)}e.exports=function(){try{if(!Object.assign)return!1;var e=new String("abc");if(e[5]="de","5"===Object.getOwnPropertyNames(e)[0])return!1;for(var t={},n=0;n<10;n++)t["_"+String.fromCharCode(n)]=n;if("0123456789"!==Object.getOwnPropertyNames(t).map((function(e){return t[e]})).join(""))return!1;var r={};return"abcdefghijklmnopqrst".split("").forEach((function(e){r[e]=e})),"abcdefghijklmnopqrst"===Object.keys(Object.assign({},r)).join("")}catch(a){return!1}}()?Object.assign:function(e,t){for(var n,l,u=i(e),s=1;sR.length&&R.push(e)}function I(e,t,n,r){var a=typeof e;"undefined"!==a&&"boolean"!==a||(e=null);var l=!1;if(null===e)l=!0;else switch(a){case"string":case"number":l=!0;break;case"object":switch(e.$$typeof){case o:case i:l=!0}}if(l)return n(r,e,""===t?"."+D(e,0):t),1;if(l=0,t=""===t?".":t+":",Array.isArray(e))for(var u=0;u
+

OAuth2 Proxy

A reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) +to validate accounts by email, domain or group.

note

This repository was forked from bitly/OAuth2_Proxy on 27/11/2018. +Versions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork. +A list of changes can be seen in the CHANGELOG.

Sign In Page

Architecture

OAuth2 Proxy Architecture