From 99672bef0dd65d2b74102cf1dc48744e40acdf96 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 17 Jan 2024 22:25:55 +0100 Subject: [PATCH] reorganisation roles kea-master et kea-slave --- roles/{kea => kea-master}/README.md | 0 roles/kea-master/default/main.yml | 8 + roles/kea-master/files/kea-ctrl-agent.conf | 66 +++++ roles/kea-master/files/kea-dhcp4.conf | 226 ++++++++++++++++++ roles/kea-master/handlers/main.yml | 18 ++ roles/kea-master/tasks/main.yml | 75 ++++++ .../templates/.kea-dhcp4-j1.conf.swp | Bin 0 -> 16384 bytes .../templates/kea-ctrl-agent-j1.conf | 66 +++++ roles/kea-master/templates/kea-dhcp4-j1.conf | 226 ++++++++++++++++++ roles/kea-slave/README.md | 14 ++ roles/kea-slave/default/main.yml | 8 + roles/kea-slave/files/kea-ctrl-agent.conf | 66 +++++ roles/kea-slave/files/kea-dhcp4.conf | 226 ++++++++++++++++++ roles/kea-slave/handlers/main.yml | 18 ++ roles/kea-slave/tasks/main.yml | 75 ++++++ .../templates/.kea-dhcp4-j1.conf.swp | Bin 0 -> 16384 bytes .../templates/kea-ctrl-agent-j1.conf | 66 +++++ roles/kea-slave/templates/kea-dhcp4-j1.conf | 226 ++++++++++++++++++ roles/kea/default/main.yml | 8 - roles/kea/handlers/main.yml | 5 - roles/kea/tasks/main.yml | 65 ----- s-kea1.yml | 13 + s-kea2.yml | 13 + 23 files changed, 1410 insertions(+), 78 deletions(-) rename roles/{kea => kea-master}/README.md (100%) create mode 100644 roles/kea-master/default/main.yml create mode 100644 roles/kea-master/files/kea-ctrl-agent.conf create mode 100644 roles/kea-master/files/kea-dhcp4.conf create mode 100644 roles/kea-master/handlers/main.yml create mode 100644 roles/kea-master/tasks/main.yml create mode 100644 roles/kea-master/templates/.kea-dhcp4-j1.conf.swp create mode 100644 roles/kea-master/templates/kea-ctrl-agent-j1.conf create mode 100644 roles/kea-master/templates/kea-dhcp4-j1.conf create mode 100644 roles/kea-slave/README.md create mode 100644 roles/kea-slave/default/main.yml create mode 100644 roles/kea-slave/files/kea-ctrl-agent.conf create mode 100644 roles/kea-slave/files/kea-dhcp4.conf create mode 100644 roles/kea-slave/handlers/main.yml create mode 100644 roles/kea-slave/tasks/main.yml create mode 100644 roles/kea-slave/templates/.kea-dhcp4-j1.conf.swp create mode 100644 roles/kea-slave/templates/kea-ctrl-agent-j1.conf create mode 100644 roles/kea-slave/templates/kea-dhcp4-j1.conf delete mode 100644 roles/kea/default/main.yml delete mode 100644 roles/kea/handlers/main.yml delete mode 100644 roles/kea/tasks/main.yml create mode 100644 s-kea1.yml create mode 100644 s-kea2.yml diff --git a/roles/kea/README.md b/roles/kea-master/README.md similarity index 100% rename from roles/kea/README.md rename to roles/kea-master/README.md diff --git a/roles/kea-master/default/main.yml b/roles/kea-master/default/main.yml new file mode 100644 index 0000000..3f3e879 --- /dev/null +++ b/roles/kea-master/default/main.yml @@ -0,0 +1,8 @@ +#variable kea + kea_ver: "2.4.1" + kea_dbname: "" + kaa_dbuser: "" + kea_dbpasswd: "" + kea_dhcp4_dir: "/etc/kea/kea-dhcp4.conf" + kea_ctrl_dir: "/etc/kea/kea-ctrl-agent.conf" + diff --git a/roles/kea-master/files/kea-ctrl-agent.conf b/roles/kea-master/files/kea-ctrl-agent.conf new file mode 100644 index 0000000..3d6c537 --- /dev/null +++ b/roles/kea-master/files/kea-ctrl-agent.conf @@ -0,0 +1,66 @@ +// This is an example of a configuration for Control-Agent (CA) listening +// for incoming HTTP traffic. This is necessary for handling API commands, +// in particular lease update commands needed for HA setup. +{ + "Control-agent": + { + // We need to specify where the agent should listen to incoming HTTP + // queries. + "http-host": "172.16.0.20", + + // This specifies the port CA will listen on. + "http-port": 8000, + + "control-sockets": + { + // This is how the Agent can communicate with the DHCPv4 server. + "dhcp4": + { + "comment": "socket to DHCPv4 server", + "socket-type": "unix", + "socket-name": "/tmp/kea4-ctrl-socket" + }, + + // Location of the DHCPv6 command channel socket. + # "dhcp6": + # { + # "socket-type": "unix", + # "socket-name": "/tmp/kea6-ctrl-socket" + # }, + + // Location of the D2 command channel socket. + # "d2": + # { + # "socket-type": "unix", + # "socket-name": "/tmp/kea-ddns-ctrl-socket", + # "user-context": { "in-use": false } + # } + }, + + // Similar to other Kea components, CA also uses logging. + "loggers": [ + { + "name": "kea-ctrl-agent", + "output_options": [ + { + "output": "stdout", + + // Several additional parameters are possible in addition + // to the typical output. Flush determines whether logger + // flushes output to a file. Maxsize determines maximum + // filesize before the file is rotated. maxver + // specifies the maximum number of rotated files being + // kept. + "flush": true, + "maxsize": 204800, + "maxver": 4, + // We use pattern to specify custom log message layout + "pattern": "%d{%y.%m.%d %H:%M:%S.%q} %-5p [%c/%i] %m\n" + } + ], + "severity": "INFO", + "debuglevel": 0 // debug level only applies when severity is set to DEBUG. + } + ] + } +} diff --git a/roles/kea-master/files/kea-dhcp4.conf b/roles/kea-master/files/kea-dhcp4.conf new file mode 100644 index 0000000..eaefd5d --- /dev/null +++ b/roles/kea-master/files/kea-dhcp4.conf @@ -0,0 +1,226 @@ +// This is an example configuration of the Kea DHCPv4 server 1: +// +// - uses High Availability hook library and Lease Commands hook library +// to enable High Availability function for the DHCP server. This config +// file is for the primary (the active) server. +// - uses memfile, which stores lease data in a local CSV file +// - it assumes a single /24 addressing over a link that is directly reachable +// (no DHCP relays) +// - there is a handful of IP reservations +// +// It is expected to run with a standby (the passive) server, which has a very similar +// configuration. The only difference is that "this-server-name" must be set to "server2" on the +// other server. Also, the interface configuration depends on the network settings of the +// particular machine. + +{ + +"Dhcp4": { + + // Add names of your network interfaces to listen on. + "interfaces-config": { + // The DHCPv4 server listens on this interface. When changing this to + // the actual name of your interface, make sure to also update the + // interface parameter in the subnet definition below. + "interfaces": [ "enp0s9" ] + }, + + // Control socket is required for communication between the Control + // Agent and the DHCP server. High Availability requires Control Agent + // to be running because lease updates are sent over the RESTful + // API between the HA peers. + "control-socket": { + "socket-type": "unix", + "socket-name": "/tmp/kea4-ctrl-socket" + }, + + // Use Memfile lease database backend to store leases in a CSV file. + // Depending on how Kea was compiled, it may also support SQL databases + // (MySQL and/or PostgreSQL). Those database backends require more + // parameters, like name, host and possibly user and password. + // There are dedicated examples for each backend. See Section 7.2.2 "Lease + // Storage" for details. + "lease-database": { + // Memfile is the simplest and easiest backend to use. It's an in-memory + // database with data being written to a CSV file. It is very similar to + // what ISC DHCP does. + "type": "memfile" + }, + + // Let's configure some global parameters. The home network is not very dynamic + // and there's no shortage of addresses, so no need to recycle aggressively. + "valid-lifetime": 43200, // leases will be valid for 12h + "renew-timer": 21600, // clients should renew every 6h + "rebind-timer": 32400, // clients should start looking for other servers after 9h + + // Kea will clean up its database of expired leases once per hour. However, it + // will keep the leases in expired state for 2 days. This greatly increases the + // chances for returning devices to get the same address again. To guarantee that, + // use host reservation. + // If both "flush-reclaimed-timer-wait-time" and "hold-reclaimed-time" are + // not 0, when the client sends a release message the lease is expired + // instead of being deleted from lease storage. + "expired-leases-processing": { + "reclaim-timer-wait-time": 3600, + "hold-reclaimed-time": 172800, + "max-reclaim-leases": 0, + "max-reclaim-time": 0 + }, + + // HA requires two hook libraries to be loaded: libdhcp_lease_cmds.so and + // libdhcp_ha.so. The former handles incoming lease updates from the HA peers. + // The latter implements high availability feature for Kea. Note the library name + // should be the same, but the path is OS specific. + "hooks-libraries": [ + // The lease_cmds library must be loaded because HA makes use of it to + // deliver lease updates to the server as well as synchronize the + // lease database after failure. + { + "library": "/usr/local/lib/kea/hooks/libdhcp_lease_cmds.so" + }, + + { + // The HA hook library should be loaded. + "library": "/usr/local/lib/kea/hooks/libdhcp_ha.so", + "parameters": { + // Each server should have the same HA configuration, except for the + // "this-server-name" parameter. + "high-availability": [ { + // This parameter points to this server instance. The respective + // HA peers must have this parameter set to their own names. + "this-server-name": "s-kea1.gsb.lan", + // The HA mode is set to hot-standby. In this mode, the active server handles + // all the traffic. The standby takes over if the primary becomes unavailable. + "mode": "hot-standby", + // Heartbeat is to be sent every 10 seconds if no other control + // commands are transmitted. + "heartbeat-delay": 10000, + // Maximum time for partner's response to a heartbeat, after which + // failure detection is started. This is specified in milliseconds. + // If we don't hear from the partner in 60 seconds, it's time to + // start worrying. + "max-response-delay": 30000, + // The following parameters control how the server detects the + // partner's failure. The ACK delay sets the threshold for the + // 'secs' field of the received discovers. This is specified in + // milliseconds. + "max-ack-delay": 5000, + // This specifies the number of clients which send messages to + // the partner but appear to not receive any response. + "max-unacked-clients": 0, + // This specifies the maximum timeout (in milliseconds) for the server + // to complete sync. If you have a large deployment (high tens or + // hundreds of thousands of clients), you may need to increase it + // further. The default value is 60000ms (60 seconds). + "sync-timeout": 60000, + "peers": [ + // This is the configuration of this server instance. + { + "name": "s-kea1.gsb.lan", + // This specifies the URL of this server instance. The + // Control Agent must run along with this DHCPv4 server + // instance and the "http-host" and "http-port" must be + // set to the corresponding values. + "url": "http://172.16.0.20:8000/", + // This server is primary. The other one must be + // secondary. + "role": "primary" + }, + // This is the configuration of the secondary server. + { + "name": "s-kea2.gsb.lan", + // Specifies the URL on which the partner's control + // channel can be reached. The Control Agent is required + // to run on the partner's machine with "http-host" and + // "http-port" values set to the corresponding values. + "url": "http://172.16.0.21:8000/", + // The other server is secondary. This one must be + // primary. + "role": "standby" + } + ] + } ] + } + } + ], + + // This example contains a single subnet declaration. + "subnet4": [ + { + // Subnet prefix. + "subnet": "172.16.64.0/24", + + // There are no relays in this network, so we need to tell Kea that this subnet + // is reachable directly via the specified interface. + "interface": "enp0s9", + + // Specify a dynamic address pool. + "pools": [ + { + "pool": "172.16.64.100-172.16.64.150" + } + ], + + // These are options that are subnet specific. In most cases, you need to define at + // least routers option, as without this option your clients will not be able to reach + // their default gateway and will not have Internet connectivity. If you have many + // subnets and they share the same options (e.g. DNS servers typically is the same + // everywhere), you may define options at the global scope, so you don't repeat them + // for every network. + "option-data": [ + { + // For each IPv4 subnet you typically need to specify at least one router. + "name": "routers", + "data": "172.16.64.254" + }, + { + // Using cloudflare or Quad9 is a reasonable option. Change this + // to your own DNS servers is you have them. Another popular + // choice is 8.8.8.8, owned by Google. Using third party DNS + // service raises some privacy concerns. + "name": "domain-name-servers", + "data": "172.16.0.1" + } + ], + + // Some devices should get a static address. Since the .100 - .199 range is dynamic, + // let's use the lower address space for this. There are many ways how reservation + // can be defined, but using MAC address (hw-address) is by far the most popular one. + // You can use client-id, duid and even custom defined flex-id that may use whatever + // parts of the packet you want to use as identifiers. Also, there are many more things + // you can specify in addition to just an IP address: extra options, next-server, hostname, + // assign device to client classes etc. See the Kea ARM, Section 8.3 for details. + // The reservations are subnet specific. + #"reservations": [ + # { + # "hw-address": "1a:1b:1c:1d:1e:1f", + # "ip-address": "192.168.1.10" + # }, + # { + # "client-id": "01:11:22:33:44:55:66", + # "ip-address": "192.168.1.11" + # } + #] + } + ], + // fichier de logs + "loggers": [ + { + // This section affects kea-dhcp4, which is the base logger for DHCPv4 component. It tells + // DHCPv4 server to write all log messages (on severity INFO or higher) to a file. The file + // will be rotated once it grows to 2MB and up to 4 files will be kept. The debuglevel + // (range 0 to 99) is used only when logging on DEBUG level. + "name": "kea-dhcp4", + "output_options": [ + { + "output": "stdout", + "maxsize": 2048000, + "maxver": 4 + } + ], + "severity": "INFO", + "debuglevel": 0 + } + ] +} +} diff --git a/roles/kea-master/handlers/main.yml b/roles/kea-master/handlers/main.yml new file mode 100644 index 0000000..a6f1953 --- /dev/null +++ b/roles/kea-master/handlers/main.yml @@ -0,0 +1,18 @@ +--- + - name: restart isc-kea-dhcp4-server + service: + name: isc-kea-dhcp4-server.service + state: restarted + enabled: yes + + - name: restart isc-kea-ctrl-agent + service: + name: isc-kea-ctrl-agent.service + state: restarted + enabled: yes + + - name: restart mariadb-server + service: + name: mariadb-server + state: restarted + enabled: yes diff --git a/roles/kea-master/tasks/main.yml b/roles/kea-master/tasks/main.yml new file mode 100644 index 0000000..547c760 --- /dev/null +++ b/roles/kea-master/tasks/main.yml @@ -0,0 +1,75 @@ +--- +- name: installation des dépendances + apt: + name: + - liblog4cplus-2.0.5 + - libmariadb3 + - libpq5 + - mariadb-common + - mysql-common + state: present + +- name: telechargemement du paquet isc-kea-common + get_url: + url: "https://dl.cloudsmith.io/public/isc/kea-2-4/deb/debian/pool/bookworm/main/i/is/isc-kea-common_2.4.1-isc20231123184533/isc-kea-common_2.4.1-isc20231123184533_amd64.deb" + dest: "/tmp" + +- name: telechargement du paquet isc-kea-dhcp4 + get_url: + url: "https://dl.cloudsmith.io/public/isc/kea-2-4/deb/debian/pool/bookworm/main/i/is/isc-kea-dhcp4_2.4.1-isc20231123184533/isc-kea-dhcp4_2.4.1-isc20231123184533_amd64.deb" + dest: "/tmp" + +- name: telechargement du paquet isc-kea-ctrl-agent + get_url: + url: "https://dl.cloudsmith.io/public/isc/kea-2-4/deb/debian/pool/bookworm/main/i/is/isc-kea-ctrl-agent_2.4.1-isc20231123184533/isc-kea-ctrl-agent_2.4.1-isc20231123184533_amd64.deb" + dest: "/tmp" + +- name: telechargement du paquet isc-kea-hooks + get_url: + url: "https://dl.cloudsmith.io/public/isc/kea-2-4/deb/debian/pool/bookworm/main/i/is/isc-kea-hooks_2.4.1-isc20231123184533/isc-kea-hooks_2.4.1-isc20231123184533_amd64.deb" + dest: "/tmp" +- name: Update apt + apt: + update_cache: yes + +- name: Installation paquet isc-kea-common + apt: + deb: "/tmp/isc-kea-common_2.4.1-isc20231123184533_amd64.deb" + state: present + + +- name: Installation isc-kea-dhcp4 + apt: + deb: "/tmp/isc-kea-dhcp4_2.4.1-isc20231123184533_amd64.deb" + state: present + +- name: Installation isc-kea-ctrl-agent + apt: + deb: "/tmp/isc-kea-ctrl-agent_2.4.1-isc20231123184533_amd64.deb" + state: present + +- name: Installation isc-kea-hooks + apt: + deb: "/tmp/isc-kea-hooks_2.4.1-isc20231123184533_amd64.deb" + state: present + +- name: Copie du repertoire des hooks dans le repertoire /usr/local/bin/kea/hooks + copy: + src: /usr/lib/x86_64-linux-gnu/kea/ + dest: /usr/local/lib/kea/ + +- name: Copie du fichier de configuration kea-dhcp4.conf + copy: + src: kea-dhcp4.conf + dest: /etc/kea/kea-dhcp4.conf + + notify: + - restart isc-kea-dhcp4-server + +- name: Copie du fichier de configuration kea-ctrl-agent + copy: + src: kea-ctrl-agent.conf + dest: /etc/kea/kea-ctrl-agent.conf + + notify: + - restart isc-kea-ctrl-agent diff --git a/roles/kea-master/templates/.kea-dhcp4-j1.conf.swp b/roles/kea-master/templates/.kea-dhcp4-j1.conf.swp new file mode 100644 index 0000000000000000000000000000000000000000..a8771645b1de8378ee934fd5cda2fe1be9bde00a GIT binary patch literal 16384 zcmeI3U5F%C6~`;auOym?c@*T@BH5Mhp6=esW~U*M$!yFH?ryS~-9(9Dsjj*`U76~t zPF3~vw(CX=L?HX}_O zPYP1K{L|A_x9&ane?IOxr#pkr-J2)WTD#-$dY9wGfBCBZjdQK@$VVL~iQ`NzU+$H* zf@qkymmB6hC=;$^aU7;AZj=UtP_JyKgI=e%x{}19PFHrcyOQbgBy=RFJAWwp2RNUN8(iyHlPsvbmX%5b%=_J=Rf{s!^~#QtmFSxPu@J zvbh>+H-jNHj1%<{?Y7m)IJ0XN+lg4SkcMmWo0795x1Gjqvj`84S!Co!K0iWHLFC2b zAllwT?=XqSMrK%;Xq}{`pj=4w1JfW8CCp+aT;xPL$S1DB)rfx zZ;DrA?4D~S+6&!a+{%KnhSbi*@0!Vk^iJjRQ5^ck^V%WOEl&e+5PSYautnlYir;srl(xr zXA<_a?FJDx$L*<`xKXBMM{Z`7#ujD)9=oIUWU*1P$6}|jho_rGd&G%(D)tKz+X*fZ z&c$;1D-{WHH)l>EubvS=?*9`+~GZ^aJO;!)}@~4fl5DJA@ywHp^qI7%qVZ;`55W(~f zDfTGRCz%)<)a07eX;a~)+>A8#jDGQ&IfSB8$j1|QbvQ4rBmWP25O!Boc~4n9ccf!dBqz4-46RBB7u$*5hFi>P8t7#DK6S zwYjySjvm{%Q~9yZqm<&s?ec7y1vrX)$~|?K1O!@KkWi#Hw(eFkb6ag@B9aj&4aS7r zgb~&CPFNXa6bvc`5vcJQp%hCb{Be%B-VW|8bK_GoDdb>@LDXUkaWXd(HjJiPg@kOd zj4N9d7s2^oTL8WaEkad~>zs zWl7kwcNeDF$cGoUJB@;K4IB0v_({gkKZ|E7ieJBT6Z_0&IzJrtoxBK*Qzz5Ngx?}f zu{$i%A~6k)lT5|fv9Z#-ZreINoQ4HC>)UcyR4FEG9LGi|VxJ@%>(ykVJm@#9)XF?v zOjTU8yA`j<$8!c^3utc4&M{Ikzv|BN2lvw)a7ZLWms16n?^TWS=Q$tTv%&Dfg@(G% ztgCoox#h@(4a?DC+;Tb~!r&moAPVxe!+2&bHh)~kxn4FUM2Su%_|1v`i)ouC_ruQM zQ^JH8o#j~8s7i7=r*U_+NJhhe%pj7Zg|V9&}$`K*PU5fe0Euy!C0+f$@u1S{hAt8VB&T5L3%21^aa8?>uB7-AQIcO&!V6o_w zY)*uM8cxua-fD5onqVhh>Y}!2hxMR=<$Q8aPZAum8%%}Yjoayn!KuoR!9si!#HeJ- zT1uRN`C<>tE>1QpqnvRvy||_!Bnie+{TO!eg$g;wDwJ@pBU%3>(|G<@w^LgrCssC@yi`SQ_`F{z11il5H1y6%7g8?`NZU@pExB@ufS^5D3@F8#u zxDLEZU*Ki%P4Fe~D0l>X5d4gOzzAFgzD^I|Gavx>fLE_}oL_;jfhWO3pap(Q?f)n^ z3El%-W35-yL377^-Q>4NR7?XvP&XnL~rTxiZF7P^rxmmpgHl zha_Rxj>sdW%^`I@kDZ3O7w`&dBW7>q)anYyg9`h^3K*N@o0eLhvGzv z(@aubHKQRTnZKzHqqf#fj-OE_jx@A~nWUY<$IbBjwa;*_#9 zdlgp{k4fA>+{CnlCP}dCdUHwDJe@?9K20HS{;)TS9Fsz~ z)fuCCbdg9uBB3dM^yHRPov8R5X)tk9*)fX@%hP`hJ~eJIa(4~eV+tRdQPQx>&E!%O z+SR=O2@W(asM|wokfH-vgegiCDK_XYL}=J7u+T{ruVeZm2PxQg2(VD~y8w`qYs1Qs%H}5;9UOeH87m9Y-jvq%i zNN0OO<5)(G_ljVT0x2p?TVzgGR5U9SnwEARbJYRe-fl0M(Sj+oUyR>7J=cRo1a_xk zrnZT3#0;~T>C{RS)Y##s)bi51z)d1)+wJm=4=qGf^4lR2iuX=$6_RT^C!}e<5~B`A zMaYG4b`RDWiq>_xJi*lzdU%VeI`=Mddc^5z&VqspQ>_X~dyi4I8QE~_(P-qD5(N}i zlzZBg z{l(b%Od2t^1(L}(p;G@E9hs3m2 zX5Xj9;wtqyU2Ga+Wf#Ogfk%)_<;@{0Tg4KV53uD=VmB8m4Z*^YX}_O zPYP1K{L|A_x9&ane?IOxr#pkr-J2)WTD#-$dY9wGfBCBZjdQK@$VVL~iQ`NzU+$H* zf@qkymmB6hC=;$^aU7;AZj=UtP_JyKgI=e%x{}19PFHrcyOQbgBy=RFJAWwp2RNUN8(iyHlPsvbmX%5b%=_J=Rf{s!^~#QtmFSxPu@J zvbh>+H-jNHj1%<{?Y7m)IJ0XN+lg4SkcMmWo0795x1Gjqvj`84S!Co!K0iWHLFC2b zAllwT?=XqSMrK%;Xq}{`pj=4w1JfW8CCp+aT;xPL$S1DB)rfx zZ;DrA?4D~S+6&!a+{%KnhSbi*@0!Vk^iJjRQ5^ck^V%WOEl&e+5PSYautnlYir;srl(xr zXA<_a?FJDx$L*<`xKXBMM{Z`7#ujD)9=oIUWU*1P$6}|jho_rGd&G%(D)tKz+X*fZ z&c$;1D-{WHH)l>EubvS=?*9`+~GZ^aJO;!)}@~4fl5DJA@ywHp^qI7%qVZ;`55W(~f zDfTGRCz%)<)a07eX;a~)+>A8#jDGQ&IfSB8$j1|QbvQ4rBmWP25O!Boc~4n9ccf!dBqz4-46RBB7u$*5hFi>P8t7#DK6S zwYjySjvm{%Q~9yZqm<&s?ec7y1vrX)$~|?K1O!@KkWi#Hw(eFkb6ag@B9aj&4aS7r zgb~&CPFNXa6bvc`5vcJQp%hCb{Be%B-VW|8bK_GoDdb>@LDXUkaWXd(HjJiPg@kOd zj4N9d7s2^oTL8WaEkad~>zs zWl7kwcNeDF$cGoUJB@;K4IB0v_({gkKZ|E7ieJBT6Z_0&IzJrtoxBK*Qzz5Ngx?}f zu{$i%A~6k)lT5|fv9Z#-ZreINoQ4HC>)UcyR4FEG9LGi|VxJ@%>(ykVJm@#9)XF?v zOjTU8yA`j<$8!c^3utc4&M{Ikzv|BN2lvw)a7ZLWms16n?^TWS=Q$tTv%&Dfg@(G% ztgCoox#h@(4a?DC+;Tb~!r&moAPVxe!+2&bHh)~kxn4FUM2Su%_|1v`i)ouC_ruQM zQ^JH8o#j~8s7i7=r*U_+NJhhe%pj7Zg|V9&}$`K*PU5fe0Euy!C0+f$@u1S{hAt8VB&T5L3%21^aa8?>uB7-AQIcO&!V6o_w zY)*uM8cxua-fD5onqVhh>Y}!2hxMR=<$Q8aPZAum8%%}Yjoayn!KuoR!9si!#HeJ- zT1uRN`C<>tE>1QpqnvRvy||_!Bnie+{TO!eg$g;wDwJ@pBU%3>(|G<@w^LgrCssC@yi`SQ_`F{z11il5H1y6%7g8?`NZU@pExB@ufS^5D3@F8#u zxDLEZU*Ki%P4Fe~D0l>X5d4gOzzAFgzD^I|Gavx>fLE_}oL_;jfhWO3pap(Q?f)n^ z3El%-W35-yL377^-Q>4NR7?XvP&XnL~rTxiZF7P^rxmmpgHl zha_Rxj>sdW%^`I@kDZ3O7w`&dBW7>q)anYyg9`h^3K*N@o0eLhvGzv z(@aubHKQRTnZKzHqqf#fj-OE_jx@A~nWUY<$IbBjwa;*_#9 zdlgp{k4fA>+{CnlCP}dCdUHwDJe@?9K20HS{;)TS9Fsz~ z)fuCCbdg9uBB3dM^yHRPov8R5X)tk9*)fX@%hP`hJ~eJIa(4~eV+tRdQPQx>&E!%O z+SR=O2@W(asM|wokfH-vgegiCDK_XYL}=J7u+T{ruVeZm2PxQg2(VD~y8w`qYs1Qs%H}5;9UOeH87m9Y-jvq%i zNN0OO<5)(G_ljVT0x2p?TVzgGR5U9SnwEARbJYRe-fl0M(Sj+oUyR>7J=cRo1a_xk zrnZT3#0;~T>C{RS)Y##s)bi51z)d1)+wJm=4=qGf^4lR2iuX=$6_RT^C!}e<5~B`A zMaYG4b`RDWiq>_xJi*lzdU%VeI`=Mddc^5z&VqspQ>_X~dyi4I8QE~_(P-qD5(N}i zlzZBg z{l(b%Od2t^1(L}(p;G@E9hs3m2 zX5Xj9;wtqyU2Ga+Wf#Ogfk%)_<;@{0Tg4KV53uD=VmB8m4Z*^Y