From 374ec39a4a8b54593c72063d4e038c75047f2daf Mon Sep 17 00:00:00 2001 From: Sameer Naik Date: Sun, 6 Apr 2014 13:32:26 +0530 Subject: [PATCH] Added LDAP configuration options, close #36 --- Changelog.md | 3 +++ README.md | 10 +++++++++ assets/init | 28 ++++++++++++++++++++++++ assets/setup/config.tar.bz2 | Bin 7822 -> 7842 bytes assets/setup/config/gitlabhq/gitlab.yml | 20 ++++++++--------- 5 files changed, 51 insertions(+), 10 deletions(-) diff --git a/Changelog.md b/Changelog.md index 9bd4cd30..393e48c3 100644 --- a/Changelog.md +++ b/Changelog.md @@ -1,5 +1,8 @@ # Changelog +**latest** +- added LDAP configuration options. + **6.7.3** - upgrade gitlab to 6.7.3 - install ruby2.0 from ppa diff --git a/README.md b/README.md index 3ee4b33d..9336a3c8 100644 --- a/README.md +++ b/README.md @@ -292,6 +292,16 @@ Below is the complete list of available options that can be used to customize yo - **SMTP_USER**: SMTP username. - **SMTP_PASS**: SMTP password. - **SMTP_STARTTLS**: Enable STARTTLS. Defaults to true. +- **LDAP_ENABLED**: Enable LDAP. Defaults to false +- **LDAP_HOST**: LDAP Host +- **LDAP_PORT**: LDAP Port. Defaults to 636 +- **LDAP_UID**: LDAP UID. Defaults to sAMAccountName +- **LDAP_METHOD**: LDAP method, Possible values are ssl, tls and plain. Defaults to ssl +- **LDAP_BIND_DN**: +- **LDAP_PASS**: LDAP password +- **LDAP_ALLOW_USERNAME_OR_EMAIL_LOGIN**: If enabled, GitLab will ignore everything after the first '@' in the LDAP username submitted by the user on login. Defaults to false if LDAP_UID is userPrincipalName, else true. +- **LDAP_BASE**: Base where we can search for users. No default. +- **LDAP_USER_FILTER**: Filter LDAP users. No default. # Maintenance diff --git a/assets/init b/assets/init index f7e4edb7..d98a592d 100755 --- a/assets/init +++ b/assets/init @@ -37,6 +37,17 @@ SMTP_USER=${SMTP_USER:-} SMTP_PASS=${SMTP_PASS:-} SMTP_STARTTLS=${SMTP_STARTTLS:-true} +LDAP_ENABLED=${LDAP_ENABLED:-false} +LDAP_HOST=${LDAP_HOST:-} +LDAP_PORT=${LDAP_PORT:-636} +LDAP_UID=${LDAP_UID:-sAMAccountName} +LDAP_METHOD=${LDAP_METHOD:-ssl} +LDAP_BIND_DN=${LDAP_BIND_DN:-} +LDAP_PASS=${LDAP_PASS:-} +LDAP_ALLOW_USERNAME_OR_EMAIL_LOGIN=${LDAP_ALLOW_USERNAME_OR_EMAIL_LOGIN:-} +LDAP_BASE=${LDAP_BASE:-} +LDAP_USER_FILTER=${LDAP_USER_FILTER:-} + case "${DB_TYPE}" in mysql) DB_PORT=${DB_PORT:-3306} ;; postgres) DB_PORT=${DB_PORT:-5432} ;; @@ -48,6 +59,11 @@ case "${GITLAB_BACKUPS}" in disable|*) GITLAB_BACKUP_EXPIRY=${GITLAB_BACKUP_EXPIRY:-0} ;; esac +case "${LDAP_UID}" in + userPrincipalName) LDAP_ALLOW_USERNAME_OR_EMAIL_LOGIN=${LDAP_ALLOW_USERNAME_OR_EMAIL_LOGIN:-false} ;; + *) LDAP_ALLOW_USERNAME_OR_EMAIL_LOGIN=${LDAP_ALLOW_USERNAME_OR_EMAIL_LOGIN:-true} +esac + # generate a password for root. ROOT_PASSWORD=$(pwgen -c -n -1 12) echo "root:$ROOT_PASSWORD" | chpasswd @@ -179,6 +195,18 @@ sed 's/{{SMTP_PASS}}/'${SMTP_PASS}'/' -i /home/git/gitlab/config/initializers/sm sed 's/{{SMTP_DOMAIN}}/'${SMTP_DOMAIN}'/' -i /home/git/gitlab/config/initializers/smtp_settings.rb sed 's/{{SMTP_STARTTLS}}/'${SMTP_STARTTLS}'/' -i /home/git/gitlab/config/initializers/smtp_settings.rb +# apply LDAP configuration +sudo -u git -H sed 's/{{LDAP_ENABLED}}/'${LDAP_ENABLED}'/' -i /home/git/gitlab/config/gitlab.yml +sudo -u git -H sed 's/{{LDAP_HOST}}/'${LDAP_HOST}'/' -i /home/git/gitlab/config/gitlab.yml +sudo -u git -H sed 's/{{LDAP_PORT}}/'${LDAP_PORT}'/' -i /home/git/gitlab/config/gitlab.yml +sudo -u git -H sed 's/{{LDAP_UID}}/'${LDAP_UID}'/' -i /home/git/gitlab/config/gitlab.yml +sudo -u git -H sed 's/{{LDAP_METHOD}}/'${LDAP_METHOD}'/' -i /home/git/gitlab/config/gitlab.yml +sudo -u git -H sed 's/{{LDAP_BIND_DN}}/'${LDAP_BIND_DN}'/' -i /home/git/gitlab/config/gitlab.yml +sudo -u git -H sed 's/{{LDAP_PASS}}/'${LDAP_PASS}'/' -i /home/git/gitlab/config/gitlab.yml +sudo -u git -H sed 's/{{LDAP_ALLOW_USERNAME_OR_EMAIL_LOGIN}}/'${LDAP_ALLOW_USERNAME_OR_EMAIL_LOGIN}'/' -i /home/git/gitlab/config/gitlab.yml +sudo -u git -H sed 's/{{LDAP_BASE}}/'${LDAP_BASE}'/' -i /home/git/gitlab/config/gitlab.yml +sudo -u git -H sed 's/{{LDAP_USER_FILTER}}/'${LDAP_USER_FILTER}'/' -i /home/git/gitlab/config/gitlab.yml + # take ownership of /home/git/data chown git:git /home/git/data diff --git a/assets/setup/config.tar.bz2 b/assets/setup/config.tar.bz2 index f4bf40e4bcf716a82138afcbabae43e42c0716af..88b4082c1a14b80d3c495b45294f68246fd75f80 100644 GIT binary patch literal 7842 zcmV;T9$n!=T4*^jL0KkKS&c$>s{j*Lf5-lo2>^fp|NsC0|L*_)|Na0F01ybk1ONaC zU?ZIR_U(9aP0y7zN{tv37S@$6wqTVPiOZLB-FUD#+T zE2c`RK`ji9O-O<@w$p~N8pL9b+Eh}o#DM?=0%Xdk;8fG}!Bg~VCz5BBhSc>vJyRx| zPS)XwYN; z0MGyc00EEy03;+pKqjWA=q8D^Hj%0iDf&~=W>eHOdV!(kJx@Y3XaHy$45d#`N?|l; z(@hMTVhl`7fq^j$K+^&+5s{F|iGoCd0DuJ0O(sX7DddmIPg7*YJv5IfXah&6JwSSZ z2kHFCPd~0d>`k7C*QGC5Gb}Pf$|g1q4v+#Lui*9i>YuYq)UJpGvU-SDL2$w2?7Xl? zcM8h2mIVqqSqlY#&?bSjl1(I<0tN|#Ok+pevA@uL)ar&kd}W;FPP(0am;WYOqYS%h zr(3#XuOYb&drqd9YxW)KScMUiKN2M-;R^GFUdHy0FG(NdWN)Sv|Bv$zl}j@9-vy@K zTd9l2dt6JB!uT4m9dLuj`$h~A14%S2LX{B ziKQV6E=q}FSvp~$X4Lu0sS{&)g)mK63L6_>a=LAsY0;&u`)&F&TnnjQ#?4|JEaYMb zwKfACF{BL2ryC+L-9@s$xWY>OeiWSch_~># z`DMmaqG+&v&6W}U3ijWaW94nFerSiJ_4(cR@bqfko>b+=`5U#xH9>t&^KtD$`+@|L z6!o~pph7pHG=yH#LK8_K$)u7U<&lKJ8`S)#E;YjLGD644@BAhyv8E$U1lh5yS`?ZL z97+KZCMKA}H-c2Yx;<46O-9^gfdT`$5QsD}k%SsdkT=p@Ld${L{qqkD9P?%k3jbEh zd$4ttJ(aqd_|8FqsN4N$03bcBF2;6@4op8?=)@z_@B029K8qedjF4f{=`MIg#v*9G zWybJ1Ufc6xp!(xBwrWZ_`y*a@OE5kbiiSZ^voow9K^((`fYQIObzt~J#YH?G3!dUK zL{uL0(aBg3#uL;1ll*+H;uwI)&g18C)91M*hb#xyghpMs0Gd1lYvH4Y|EjHA;QbcO zKO#XCouPqd$mENaA`Axhcn1c!Mm7d}Bp9amQBz{&fD~HDNPffHn?d?ZOUX?K6WKTv zvUh2xEa>oXwb=Z`tGu~az@gZ~C5Nr-vBy2OGuh;0&76U@^ya#B)9&|W?amTKkK=*8 zwgiYyV)b>@RwHCdlEndlLV~zl*;j219;&I{%{b)8u8JXgsB(xAgDMUlzIC)v8(Q_p zsqhvw@&~Hp;HKyel9|-27RYW4yA63QMlx$~gP%^gl_w++bNdGKx=VBN7s3)yqd+^3h7~s!{WZ0;d3WroLf?LmOo~A*+9AgWwgm^TQ$w z2+Y*nKB|3${$wJVSm2m~iC!eb)2>it`)F?ZDx*Jx^}}R6Aw{Bh7w`y(vtx49?4A!0iwMb|d+zUEWMhcfjhTucHLRuv-32 zq6Ali%HhWcm_>A-UYiqUgO?y1mmE%A)|u_yG}+xtDQ%}r*fJ7AV>KBf*DX1(k2%SZ zl%k;vyBsP>9;zpMhHU2}cL_K& z6P9DWSl%hv?B|0S^QeOOb3ehj__t8 z*UGq~a&2{Qj4I-^uIJ2G!=z-mqr8e9YMJ<7ohOOHbJ2L3(-+~)K8$)=m5kX8N=Tqs zd`DyV&}VoW88wr(1|1VgaIv&0=VuwVFOb%fAn!TSZv(=C%!AgRJt;}fgM9XwOtBji zQo7U(%vAJIVSJvw2N7|12>1Hx6;o`NS|`c|BEH$w=wLQX)hz8#*3# z<@D*s`L=me%j-+LR)YhD&DRNS_^P*9h_qnc>C0?C>k;0V$*|! z5PV)c?tUFpNLgi+z7rw*+k#re+bn03ezar z>y6#klx#~N$x}M?!{L?5A%2gg1OWqRpJEu7kkd}g2$hjY0sq~jcT!r=r%gv092AY0 zQaXx`K^^gQWbek>+>50Xb9&w&~+Z8f*o zqV+9NphMz4X7cu z3qA&(f5%nb-T@6G)+ZZi?bFQxkO)jGTQ}}2_o5Cz+%T1|ee^@=%KwNV!E}B6x5Oesuy(M~pTgVo zR?Zm88Qvh<*l2|~ImR;dVZRKD8JcV!>bQ9w#yL20-oj8yCYqJ-)2F1sXTo<7+xbIh zia$FeHXG)f#nf-%Jp~dq_Cf#|e-bK>M1&#WbIIrYY1WpdZ9M{@Uq94Q=x9316ZgN@ z9w;+R;3~)f#v{4u1(}_gZ_FvDmahSIl-o-sBD3c#=FUED521VEKeQM$k@aY&mO=AIDSm8^-xO{IewSgwqJdJp2ORPQ7 zFUwXkpl^+DX;@#*Oro!Fnz(DBse=5$2eCMK3G?smp%!U;?;`L9?yQ9K;7Behb`^DMA( zKn&psD2~>g3eWNvs5-SFmp4IB;Q)ywXR$}ol#}ImETM-A%K6nFei*fT=_!2g>3uQW zm@s2Wu|J+?^%OpXcHBc|CwfN(pYnO7UGe0ae{%&+=fp931L2#$POpw?qn;6{Z$5e@ z%2iv6Hvox0PqBuhzZ!uwAE##1u>4lbFO+58dH5wrxGo#e*}lQxB2(rax6Ppjg5^lwCKQv)#~#H z3Y4<6>O&7vfY}bTmca=dasx^PLr4N1B0ztEVpY<1PSKiePOtSJZXjB-qvL1|qL&)Z z{05n+rJk;kJZ!GP)nE!OqO4bWQaQr%Z0?~izhrhKav`xLPd38yA~FK1aY{{iqAW>A z;MaJ$GY8hCj(vxkwlwU{!I@xHSOB~IFtS|x_V!!~vrJq>ZR%~O9(*~A24&{xOaU;Jq zUsTDU-GC5aV7i>r-G;E9cMEikoFk@agnpC-8yLs&W9A<_9yw?}_PgrI z5N13^xo+YD7oFxAilT!^#5hR3&vQW;#1p7qCK~-A2awV#8FP}mCbH|QZdq0Y7ILhy zCeR&@)x5CCs7GeqY|G$7LMN2m?z-5P!xBpHTY&Ht`SIc0iKH9ouzH4=*x9hp*lsVU zmir3JoIq+elF&!7iCJg4LXk9B2&0l{=d5Z5=~-J2VuAE>_Wvj79wEAFKA%GGX?A<> z`hNuT2HRGN=wDk-jpJ!wiNO4BU!u4bx- z11IYYjL0q^0GsqNinqaetR`8Q^%JH*WrQgOcXeY3OI*j}DvYXcL%5qem4%&x6)siGJwn29x{!fBo+pzUL00gVi8w2~&84`a;O#7^^*KO;sq8x{q8H^QMT#1lK3 zq`vK)jV6=zWLCV4!z|Gu-hRC~UObsGAEFJOVBv%SKE>O?pg95%p(n!=4@D|C>=)JD zRVH(Jwk{*nJf8rxx6A$!?snRSZfc?BV~n+PE^a6D_<2qt6XY@0!_ZM1bm zyNcbdkQcJZx9A{Dnaodxu1*wnA7SriNr$Er{1#FVIGQPO(^!{t7SWmY?6TUhN?BI% zX`x>0d=fGSBL=+zjeR_tCZ#BzOqrNipM-_BMIRwq7HT#nxdaeFRf{{jmLe9riZA)H z>I|bP5Fxo4z|v8lGV?W$j|7s>6T`{gykDbI8yi$Jn7G?r#|6Qd^cwY{jj$NRZD1Yk z38p0>h_BOunfwR$y6j~VHYT>t14POo+`BL*QnlcnniimRj$#(RqmG!pXDSzdaUt4j zT{YOA^Ty{5F1QZJZ3}Z!hBlJVL~75Wmi7(8P4xyW4*hj@!fhs+WU!vBAz?g~{G)~0 z?}(ey7DNUEQxUpFv4W%xNdpgS*wD;E{$z_}+Oi-H4h#isOPr8E(0_)154nBc_p9&w zKKP1i0|j1dab)!tC0HTLWkOs853yay;6&R9s9sq|CJGpV$aXd{hjmd9(688{$MHS- z1WQMD*v8xwUGW&&tnD=My+2Dq1x^UXpTw;#j4^f~Kr&^O798;j&B$%M^1rLN1DE~~5=>@WWY2PQ2C)iKP}+^9#BO^q>+)G=Y%J8`gR z4{nf?uqd^Z;gS3E?DFu_UOfrt(11Nm`l?Tzz-v+wbqfJ-#q=BFa`#3nds!Ts;Kpzf z(x-CVn`T2(+vv1vLmRNc;p>6Yl41y)U3W z(Uzxb=L|%+u6Kwu<0x28eK9HceT7wF4 zEVM*%iwz=1g02*8V9T0bgEjYDWVS+y93M+D9*nT9vRU{V=EC_=5Zc?MOGF7%B!xo* zUL9&8qqmPkT=B(XQ1b--PiRO1?NsezB5T0PRk3_+Mvk#b=q z#6v1j2SvRcW9W2dRr+Lba%*c2i?c1OWejW@1cj1MFo8ahz62LW+8a(GipX@8)H}K0 zb~}%__|+#!Gd`6bD?6VT>)O@LEO|a~LdS_Iy(p`YpuKip3sr{Q!@01^?~`p62nXQR zvL2lUlUC`wj+RkfzDa3sVnWr&MKqYnC5>YI#gjEu5q&Ypg4 zBJAmfq>1Om-^a$T48%Bj%eIeNwXD}TK(*(EZ!b+XDJ+~CNZx^}UQb3BPDg~<5^)*v zJflgmb~7?$7_mu+-#}Fjp~;<(ubzo5ufZgrt)7?LZ9`JcY9JyO34>tn6+x>>D;7Nv zp|zulg)~D&rg?^gB!VO(X|#(-4LWP7L@vr?1z@Df2-`KlxHnQaR7g_rW|((nfk{@k zPwa-q!sAAdvJ&xPGo0j)QzRXB!45!ovJD}oCaNgD7=wPTJ^~?jGf!2v7G7f%mMyi; zMGJA5rRPhmXygoPNeC#!L%4z?Y{alS**_6XxWhElXl!i_o%fBHa9&^!)R}PoRSC8~6IPO~u=OC$X>&z#`IIyb zcaA^ryM0+1BT(3H?div5QS6O(oXqsn!w6^$q5M=vkl6YU;twMM1uadRm%$Dcr@!AX zVYbv|?IuQrn+;-ekAYxnL@LWB6ytD~(uvm1h+5$)GuJe>qZYi8d)%5=)X->#dYCqq zZdWKg7HLm<1F)7h-KME*DBbSs&xO%VH>>&|Wnl$sOIImU;wVzC9Gzw3$n#zm^F(dd zVm1X-jay!>-TRmt23F}UpFlix=_w(3RM==~;^zmOA?OuC!GU(%QEie)$~+}88twqW zFk?t;5Y8Q@tcsd{@3=NEbMZO{G;2dmrkWdVG!45$DpAuIjQRPM((g@o2ip%64447i z?<*f{T31pivCZvnuX5A~gg{%*iaHtv0`5-W?5Scx1#=KhT(9kS7hsuE=9Ud2CSgTS zZh@lwam;DoJBc3|+vt~`5vPw!HA%TT0Ix1?Y_8$!K5{&bx3F>+E;TW zTh=!#xK0&QiI@@xxfNxd=H#3y&a6b+ZATo&sdY>(d$nVJHXUU~O%(AGyK!+_qw%pM zJ0xAv2np%~#hGdqYYQyE9^5Jl-Vj<}I1|qoa%W1sr>i2YEmwA98%dO!DPKNL)Prdj zDVes()TA);412j6Xcb99F0Gcwu|4B1e!;FTftt+D1q^|=4CKfngu(qB;%H(xSWmRg zY~FaAY}LV&b1u($%f*`W^9tW?BWW9A-C{nMr$Q>N8cUD?Viu6wB8u5 zyxqx7L8#=DWJ!MG+w_+kORJ61d7A^hmL>cwv{%U149%!CHZdlObs|Z0!DwLa(aeTN z7acD{^j(4)d1V~7Az!8DiDEv<2h1)b7{P!b__F>Lr>TNerCW&=^3>F{}c_ z9quSl*=u2I4g3&*-4ZzvF^v&V;c?eGrJ*5~By^#da}j#JNRpRJT%ENys12@@4H=6d zL+(cUHFibD$F;#RqBi5JMMaAZQALuD&8E~C9)yRntuR56YpABO8QRqW1kwY!g2X4t zuuKKiHr=rr!8?_8u2C|Tl7M3ll0uY=8E_&eGnIRq7rwDx28NHXuJssecEn0b%(R86 z5i3)HRS;RmD8nwMwJ5lZ1Y%|0yGA3EUwNSCVitHZ%?+TlxWeqEq`0=Zh||CT$!TIT zk`)9F=~L9TTCn336Rhw^3dsZJT^5@VNCGMWG=m&T#U@)@hSS zZ%71tQADxx7^JF=#lnytJ3exN)1Vdx#*<*fD4W&SctHnq1~S{4UKFh6fG}kG(2_-f zX_@Km8LY!nNVh$#(_v*k`xi7elVI9d>~P>i(u_gyzILT7Uln@n)J(lL3H;Es!63G@ zi!r&Do+HJPL$=!_!KnJ#M>c|byHML2U@&73sIJs!&0#@+yjSF47t;IR6w9EYrQd!g zvno5r=1p+((5A0*%au@!qqP_$KBGrEpMSE3!P)am$`lBn0ab9^FoB;X=Q%g2s7qe- zdp<%6LtYGtHrpUQ%!0;eKCcO){VpoVv}{zr2M^tziz`y*=`=$5-BwK{l1m~aV`}F} zEY_nJ4n$P^&0UxV#vdyYnq`eb%bj@BC2$iBMHFqh72IV) ze$Am)2p)C>8ABs*kqm<)Lt?>!YL`roqzW?`7|>PVMA92h_!I?ztc7Jv02p&KjXZpP z@Gqc=E^xqCxDjL`$lK=_5i+D~lfkMTOU607eqI!9J%sq+y%dWNhNc;hJ7K`|T%b=5 zImk2`V$4_g^V_dmxH7J`3$5f^^Ed3r6D#M9hW7YY0A^>F0`PDM3Qj?kJKdkWLo+Vh z`-Pp6Nod3$MUoWc)@-{%hz@0v#fWKwGf4KbHyZg2J@KePa8VgQBVoj(y-Y^bTXzHL zEDAJJ5=Rv-nxUjOI(4BN&|CuG(@LOuZ!%kLYf#<$AQ0Qyl_+$S^5LQ2X=Q4NQJAZj zU$}>47)X{|ZW(Hju*W&HF!dama{&E0=Mp@!C}QRsFm`t_OtN~&n;5Z!Gp!^W1j)iG z7@)}%-G!h`G*J~nsD&jnNVDk_c@8D0tShbMucnIV*ATfUtrIO;!1H?IwqRytVo0^F zD9gc=##l0Bhl&yyI#$$aghv$xAk9R5FlgB&c#LLOA`E42N}2DWf9e$Q7l(x$gfC`l zv~T*(ok07@q$Fw{JfUh(ZwjkRwAgoH3uKMV+8zYMmXjxt?zXiR+hbrR&_MWKk@ZEZ zS?Hdng4P;JFl)lISVr}DTbPVs=)k@S_GO*@-rTJ7V||Z~#K~@pVq`3xp7QFK%K7Ow zb;oGiWsfM0|FIuo%81m9fq0t+#G6cZ%Z;oa?J)Cx77c*fL5H|v=6QxkoJ^`!QM8+V zyOEjMsS1*OqvB@Eq9Wk*X?Ku9S&I}_RVsFiNjNan z$w@uqqSlmzXj>q@cWAtwO0g=S1@*@& z#4!re;X#gxXXy-MI1r3hXiNr(o@)yp1(LP2++b51kc_%Ja4wBj8+KI~l09H!WRHtW zq$ylaRHSPQ)!Z~~Y~pf`nvq0oa6Q6d4X8{9K_%kAMOu)`Dv&l_(2HPHm2aS+C5(#1 zGj;c?Of7G{B6rYiX2v8K zv>9s$x{~KHg*44;%sx#`i48D0D=ZQlyn&iCtdNcP>*dxnh$iIjDGN!2f^36cwZi2E z5=PSw2_-PjjMlQu1{R6{J3=J$-OpGU0PmLO8e~r4jxZ4*e25)*SZsy&2QlgHzgB~WtJT%#-m8wBsP zuYG>HuJnY}WOd~Q)WKlZkI>%I1%@^*O{v~0RDP5#h_5o$HV0-$XfPp=<)-nA_2>PW6Crm$|_jgl%AY+%RnE`*eoti^(QhPhGJNqg*4 zGDe>E6iB!+ge!h|=*HziQ65iY>d^Fqrs50M<*9GswYDD92nlP!%~8#%G;3&^Zvh-O zap_r2T+Y;evixx?M%nN>%RF;uw*s&mWNy-mDU6QU*2L}}B$C-fOn8XI^YH*Tth#O3 zI|b&gYd#29n27jS#()@@kNzQ&1<|GN4W`FGS{}s4!`rln@wNS@zT-n}k)t|^4YKez z3<|vsV+cKmAJ6vwhx7fk8~uilZ(YuBvXY62-GKfup(!{ AkpKVy literal 7822 zcmV;99&zD9T4*^jL0KkKS+jnzssIxx|HuBe2>^fp|NsC0|L*_)|Na0F01ya(1ONaC zU?ZLP+q_b}>(SS(5MltJ3BlL_+dZ7~=JkT6Du2?&T0H5*AO`%}tklS+Px>Vrp+Owf-_L(~J*)6@)r z00x376GX`-nt4qC^#B@Z9;SmJ02%-oKm$zx0z^arngE&z$u@-4dL|Un=+t^33XsoPGvy8c{$lP-^p z_h#edmdSVX^F`+CSKAk#WWDz>dW}Dl_z%?_S3G(&&EwScqx6gpZ)f^{P#-BSMN7p5 zv78yex!t&$FJW4!6Cdx~?!(TKb56aj{mb>fiAIoTV1Mh zv#Llvs@NKK%COj~am5jbH5SGGvk5Eo`Vw`*BHyCptzZGbjXvP*Z6EN{o%34z*B;B% z&*7))mab~x>rmh zgGC{ze^G$-vU#b<-Ln+#M7bGud!s#VS&tGwbpb&R=FOe5pLhP>C9i2#bdG1 zURu&o!ownzUk^OO7)F}^x{&)k56WN+sY|Dc(`So9s^8BO+@y_MH-fahk3}of)wlHJ z*X@h+Y`Xt8#+#myD2@`^mx)*o-gOi;!ZENj;E-aRuA-*J(;z6dkdXcNw^oDpme-X; z9FKh^AjLO7FT-I>?B$f#FuVg8K|Doh+u_4iYek zw%gMkDlPKf@HbR#sfw;jXn!}7CEOHKU{EkgwQfi#6|RWu!SSztnJFk1ZG^c^r@ls| zrDPhz)CPkSKu%Q60Hp^wL%v z8(|Z{txjAmQhw}?JR$0QJV{XPpfeu3_OB{Zn80RsTOLPnfD_7(>!o=-n40p)?4+;7 zl40c*zo&#iit%||xZ?8&u9N4d0&O7a&<5$xGmiUA_i|0RJE>w@gzcsbgpirij3U2wnN(+F=TT##4{LN50k+$V#f}WE;;JDHwqa+>A+=GJM98O<4C)JgynF zI5%*UlR-Gp@K!g9d0m|HV_j+>zK!*H58`~TFNDmt!Gal9ge-fj^4!VD@n0Q{1ut8A zsaWV>PkC_balU}s`rh_*aok3|sGN)){0oJ{jOBYEcC3`fQ@XmRGU$&Km1a4xq^_Fd zyHw60RF$ua=8e&}-M@fU#c5tg)K|y0Fu9|=iXN3U<9@WBX9?G3=4(vfk5KzD?P^vu z$YN4O0>kD!ui-(fz}U&GozODqn@fd`5T~m+(`NV^(nKBSRGYx@pmQMgr=x08bwSHq zCKDNs1k|qe14b%)D6qaBy`z}8yM%lHVue)Uh2Dw$fW%koolb@WYKuCO9F#kfPhE?< z)_}W=bV5}V$3GT}9sCJrTo7b2$YeD1BC)fBrMFUrW9)A}6}u&!t1EQ+o%M=`8(A?| z>;HTQ11Fc;x1IFb#XVkcfa4J&Z@R-@FR6uJK1V(yE_n6Yy@!KR&j-wQ)#X7@|q7$QL{j zXyq!DY-_vihWy>GM6fJK=9bF77oiaZ^Z5`M1{I=xNMc^Wrk$`NR*FCm|1LL$CEO{~ zQN~9FBW4tiqM^|wl3S;8-OHj7ibZm&Cgl#OsU5{d*&B4pa+upKU-aDf1OlhxgZu!yY>=*LMW7?pdR0sH842ENjXdQBIuIlD~}N=_QQJ31n1c(x)%P;OH7JDSjBAT2jwIiY`CH@48_ zWkC+8S8bUz_mkqP`NL^MwMMSG#<1jUdr^M1K`{4>PS`@~qxEWskW-IDzHL`XR6%o| z7BbiCw(N5=m`*z2MYms+YrWkiKNb8D(y_&;z7J<7b@`6(Caaj7Rb-Xev6WeI5)|(n zhBJ1BoQQpjGL{y#R*8XbhT$A$SLPT9Ke3(8iHwJFXR0&*R_to1rm5sR5Ab=M=!BM; z#-A)bGUbak4i;$x2_0}%7Z!X@3JUAzv({+OUA3~Kl7>&33S-5ob`_lxFE#j(L}GBZ zrWHnADexY!cNreU9VF5NSu^B~N!1&$?# zj98gA+iYycvsIh3xN~!oGzOZ zW8%m59I*Nft(TWG7QY({n;QLEX>h+2)eE%w4b&aXGTEe<&|kSKG>e)9TkOTeKIX+9 z)FS+<#A{ACzQ#bbU_Q@mh09>bD8?knX+jXKs3q7Cqaibmk^$MU4N7SSK-${lBzfN= z+d&$Oo$K`N0qwv|hiV8Ya?}|A zD%Pz)Z!r{Nc;39tvHoWp4{O$D@3P^sf(CR_@nsL@)};Af3sBFJwZ_#)>_bMeh<#7% zeJs&1V8)YTe|m@Xl|Hk6+=Ee;CD4+)0=zc?qGx7sJ4 z(z$wP8a{y+obU`I{lzs|=MC5JoNc2$r)d{9zKIW!xBa~`b+W8%Y-x?A#E^@1dOrx} zWusG6voQ1|P6+&JtH4HSn^2X|(j4QCI@QHCuZMmh^@0Z11T*)cX=U2y97H)2VTZidj`LcD+cN6rgyetD?^Dc)T0= zw#a{R=>?U53&YM9OOJlM?geEN7eYI@inlHPV#;@}e%uM&cH=VqT%lhLk zsODNh6LD-=&ILA|GE1AO(5lWe9eFNz$a8gxm%#!6a-u0oN^UkHVQ5ZPi+q?kM_yqF z{V-U?c|mlx95j5G{U_#y>Xu2~-@42sB?-ovr`+ZU+?$xi7OIlG2PTksEC6iImIdNr zuf!0029aXRq^z$x?3bofVFJD;g{16B+3zlejEaPJ^WxqzLvkm|-RrLg{1I9UcpiaU zpDsP$LCfy6u zi6oM<5;Y%TiavL!_vRkdEw{3aKE{Y(uVN*wlnN$#O+&ejj0Q9@w$ezVXg)WYxrn9b zMtmAEv}{-wdN{(VIfy8DHCg^Gy{#sb_T*;$@dq2MME=*y*~W*zhV%F99PT9DP+z6} zK0OIy8G}z-OFc5A+mO9IvoROO!#G<L^bs#iMstxO|1uQNtw~BW( zEr9Hf0u{bS+%0&<=@)hIkm(qeO?D@+^;Fjitw%&Qg`-g;8%b@tIA`7&e-PXx=}=-Bx>_y6CE|9?;OBD(_h&5gJ+!DPe9hF7{k`h*XtUCiP|8wjv3Em6&a zh9GeVV`CV2RS^vf9qKJUm(y^GZt&X}+k$JxBTK7yH}&G5rJ#bR1ZdC3u3nJQ*#ZHp zFfy2>xEMk z__p&CB_cf9Y-x;sLlvEo*4hRD^TG&@z><_vt;g<1zGq)|w4E)uj--_I6!x=k@w?gRRgycc&D4ygJMuQb!AB_RyPtXm_o(J5eqbMQhYUkk_6BL-tE@3|v#Q$D zSU3`57P7=ewQFaMEjUfaHbzETXxg6MZQ}3q=H!X(v1tByh;YbIn}m2UnHxihzK7-EQveL# zf=NGHJuj^+3`#YKfQVU48wY@@4jM^WXTJ&?Tez50L^oT_whhKf1V~2HX&8_ibk|i7 zyXlY>g(gTw*~Ux*bt82|g)c)l&xW}vEazMLBV%Ey*wOSvy-Y_tx<}Y$2ZwAUpgdUy zkkb=Y6ki-c(}tgrL@>r-r}NofXcOMx%Ln3l#C7TU~`5>R`XHk9b9NO&vKj&KdoO4@0LDP&2f&C301iD|r_ z-hFI@7FbTsb6be1TO2udPmeRxcv!tL7w9V$K&8=M8a3}>zX4c-!zsf)LB~c@X^*Ov zfoqPuta?%&fnpX63%6p6cFIOk=$Z)D;0zN6G={+pu+#s3fZD!?;&ul_YKEIl zG&b638+Q$9M@(Wi?(-}q;+pUe$q!lvMSykYsD6l8PV`AbgUz|EN=PCIKvTZdbTA1* z?@r+BVQC@-a}ZHnukLpjV3}caO9qh?FsiT5plH9-9LAmWxRc~Od_ZjjV&b>{4-)?$ zmEtm73`B$+k?5?yj=0(t29VbKRUx3S6Fpg3*>S4Z&2eQpX5|CwjI&3v)h89*Srcuw z9CJ#g)@JJ%YX?m%b*&j_r=XS_nwi#ru7(Rl(IZ~;ATOXErgG>k<}JB^K6$7s^mfp= z&hRI_7lLP=u_^LoRhz6kV;f17nki#`uIUG17KxiS$=swCWHITu!vL`*2)fHw*R?(a zE`IT@PNAC2=LH!C+-GYbij@&S{%+`+7>^~1`=#qGhp5htR2dpFtmfjduU-5Cb*9m@ zjNxfPmngcpgS;6)F90A=I$S9{Zp3<2v|u>b_i+ZlylmJewUghi2BHV zLgX=wZ2P33KS0luSGobF?MjJk1;TK)dXb!PAz2tdaLJ>ppM1sE3Ote)i>%15M;m`) zVO&X>F^a}&?z4hvim=5RUFQ^|Sa#sZGdfm6$UI%*>gmFlCAp0%H<$ZQN-m?U|mzANIgF*f` z@YQT%V2r`V#4ovdzkX>Wb>}T(c8Kur`(+asGYgtSct8;IM3F=3ElEt86$wCkvigYw z4!|f4jV8f{u{Xo75P}Z&3}&5LUj8$7fH!6MV5EycX_@KsjMT$oNVleJ!y<}5Ws8Cv zNw94za&T%v=|!N;Ykeh7FOt1=*igMT3H?yC!63I(i&)(YX^8P;RPMKIuxdX8D(KK( zPZT!Bm<$-h_DuGpZsnQ`i`KuPfMM@lk7zQ8Bw%+}X^dSbaNJzhz49o<=QAMA9=Nd7^>7)0!V=C;_|Q60!CA{{>YsMX&9U8Tv$NTOqBV zP|!kT#5P2DH6xg;F~*xN@RKvxN67;8N-ZB9j58i~;l%i^P$!2hziyPXgp~DVq2O(0YKT#xS1%{lL$VB{OD(wuTBIy7 z&YBo}=O!G$KW?=WJyIxQ<{C0~cQH(1>mqDpb~g6cLD@NAl^LnZQ^lL)(>I-EQ0UDn zGf1=T6nPFMsH`i!<*&BN=+_XqPc$%?ga?!IOz6PoayTf{O-wUjW;m_cWe

9=mU? zEwUn|;*51r-z4>`2OY^QtkhJaeFciL5-Mr=QM{%~xJ&_$hUOw}- zh}4V7VkW_{Cet13<+~4);Nwqo=U~_kq!#?cONq#2JRve=Ov7n5`*tGpuBcU)(mo8` zbVOVpy)O3zC77{AlVM^hdOD;8xbrE}I{tL=4x=%#}?M}sa2)h49O zsaB|wF4BuwN<)=O70CJ6=z(W6xKx5d2!y674g*W8pz5)2g(Tp^QwmA)9Tv2tBSP5) z^>&NN)TtR%4tj{Tu(jnskZ4y2jT_T%`Y?(C+)!cM# zZRB%~&4{WtxE}E^hBXrb;7NLzkYpIzp_o}9*|S14+{szn0)bpnnHkq@mX;cBpDz7& zT6AnkqMB*2QqqQ)*ln34(iRt zt#c2jV`4*04rV`R}dj4+8I55mKhlpB_sPxpq7Q3V3=iGUyn_#oF4QBBe*?Lgb0!u}y*3Be)n4$aALw%-Xu*Q3s%DoZ5pxXo0ZM zZpPGVFf-?R#HqL)iyrBp0pgV&TVgY(8@c3D*ZjS4O3yR*E%Rgf(4`PeWF%OdR$! zZkY8dsmiZKGo?=ahmfkIH%O97<0o}2w57wul(y8<9zroZxg;DK6AZgIZ5^R`vsIrI zE6hZFrSc?(CL{ldWPi4C$W7z-uNXcQReG4pmG gKV$_|K2Ga1vDU3Wp`!qvHDCC