From 2cbebc33237d3f7cb579bfc38a27d5c2f374c348 Mon Sep 17 00:00:00 2001 From: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com> Date: Tue, 11 Aug 2026 16:47:56 +0200 Subject: [PATCH] docs: explain macOS DNS resolver behavior for match-only vs primary nameservers (#912) * docs: explain macOS two-resolver-stack DNS behavior and the match-only vs primary nameserver split Lab-validated against client 0.76.3 (macOS 26, NetBird Cloud): - DNS troubleshooting: new Issue 5 'dig and host fail, but browsers and curl work (macOS)' with the scoped-resolver vs resolv.conf explanation, the language-runtime split table (pure-Go/dnspython/c-ares vs getaddrinfo), and the Windows nslookup-vs-NRPT analog; renumbered Issues 5-8 to 6-9; checklist step 6 now says why it prescribes dscacheutil/Resolve-DnsName - Internal DNS Servers: primary-vs-match now explains that match-only leaves resolv.conf untouched on macOS; new warning that emptying a match group's domains silently drops the search suffix (masked on domain-joined Windows); split-horizon example gains the route-everything-internal variant (the OpenVPN migration shape) - DNS overview: macOS line now distinguishes scoped resolvers from the primary case, where configd regenerates resolv.conf with NetBird's resolver * docs: add dashboard screenshot for the route-all-internal nameserver example * docs: polish wording in the macOS DNS additions * docs: promote the route-all-internal example to its own section * docs: drop the Example prefix from the nameserver scenario headings * docs: state the public-resolution prerequisite for an internal primary nameserver * docs: make the direct-resolver check precise * docs: anchor the scoped-resolver term to scutil output and split the dense solution paragraph --- .../dns/nameservers-route-all-internal.png | Bin 0 -> 62704 bytes .../help/troubleshooting-client/windows.mdx | 2 +- src/pages/manage/dns/index.mdx | 2 +- src/pages/manage/dns/internal-dns-servers.mdx | 29 +++++++- src/pages/manage/dns/troubleshooting.mdx | 70 ++++++++++++++++-- 5 files changed, 94 insertions(+), 9 deletions(-) create mode 100644 public/docs-static/img/manage/dns/nameservers-route-all-internal.png diff --git a/public/docs-static/img/manage/dns/nameservers-route-all-internal.png b/public/docs-static/img/manage/dns/nameservers-route-all-internal.png new file mode 100644 index 0000000000000000000000000000000000000000..6a68c8d3688f35a6efa61442530e68b898fae613 GIT binary patch literal 62704 zcmeFZbyQrzvM-zvG&q3}B)9~(5L`kC?!h&|-DPlx5L^d$cXxMpm%$m_UBAgW-?_Qx z-0;@>`>o5`v)Hrup54{mRn=9$s_Fn4DPiQ-xUXNlc!4Y`A}IIb1@zd97cbl4VIf!A zrnUAV|6bb22@AX^9>(8+d|}s97S)%Od_fI4hkx7G~vOGV8@6uE+sdXioQnY;X0LHKw6t` zhGhIu&m9ODz40sP1Vk?}o;yaNKct@sJ$IMrB^%^^-OJ97=UO1+M-RSwfe`l0QA^B^ zK7>p}K=CXEzYH7UL_DDXezYRL{AFnV;)LJ#~GmSVlU6{MU)4F94-rwgn3>`i*pHj7BtEkE& ztBZwP#!S6J0MU><>ILi%#2(kO#v4SDOMH%~Qai<`#YV?()Cxt!2Nrweu15saDiwMa z`N&8}lX^7rc@z+$%P$k6Q&ZJ%0pGvdSBT$&E>b7+mqoO-wKu{rHU&yFBDKlI`aGNo zV^&DM7FmOe4a)|4m?$R|e=!XMrC(!HkvM?P_#3k;V4y{0h7%)N_&otVwcdYcH)beL z`7=T9S{?3Dq}t#DV1fc&YTWwegW^jz8noKSn{}lEOrMIFe&<4`q}y@l)+J`MQ@~!V ziqS%re{$SB(!A$x#Oy(ik(sJSD+rO$s5e!dx^s)U_-|U*N~NaxG6UxpD~(&v*7WYcMv-!%4j4Uw;9^%w1vov|577F1boDsT2i{IGqezI?|fB zYWjllR;@|77k{*{;k~15JV{gmeDkMDzzt%ca=SSN1Dy$61VPRZSO|!StV2C&Z)s%Z z9E+A1vihU2e)5M?W7>}0J1W*1Sgw+ALfbwj#*LSXvTSZD%AYh6+dRcl++7`n!x6g5 zz0NnWry~=Lq0=Nn1P@smu3x&n%5uw~h){CuC2q7G%Ew|}FIlGZq!A7wsykZk$&`zx zj-XTXP-l17oMKX&&bRJf;bGfohEs?$j`-rp?C0y(&*%PR6wTzS{?Wboqv@i=MNSy4 z2D{c(#e~_?COEu9?<(XVo6`uCAAJ7)qu^uweLsslSr$i@ii6Q~p;l4pTfT&& z|E?517cJb?VT6F#peLJ(fIWY-ClJp%{c}*oLinpY{L}2YP{(?dlTmo1?<)mau~8?vs0<5M2=fen&IPm1AT1|ce-8UUDPS_$UE~Hz)7=FkrcQe$RHIB z=kpj5axXLG2G#PsgM~ZP2(adDC`O02?nAr+Ml4T*?a`8O{!G4E)y&gyLzbk!6b7!7 z#*C|MfOFA&HLy*rlI3!ir6be$0=L}a%A9<0NM1no6Aoaesb2bnclDUm(7fGdZGUKu zQx~%Lul?@42GIXSjl&525<}v0wyUtl@V)U|b`yP#-h?07RA{{x-~!q6 zXN}bou1aBN&zjh=>-i42a@JseJ>qW?Npu09`HK=)kSX$MP=#osXA+QfMTzY-K`FhR z{|iV@%2jP@nQLDb|1MR&?)7-Bo|-3-{f%5=PCONSXmxbpqe3LIZ4AM~;bi3NL^;jR z4K)_i;8<%>6$*cBO=Bidty|G0et}{|%w;3cpq&EDf*q&ij6i@jRL6$F`%06g9 z4Q<}9BVW%B0dnT9ZtC4wC_cF>6ke|=BSM$gxjz+mAU9mS&jf~$Yu6CP1{0n{n`+jG z`QJxVY01`~?^1dbx~NMFtnA`zU6I@E=d}UaV^eHJNCmJFF=;U^a^c&2u3sIMGjH~b zPrNP4%sAch!g`Hj|DnaC=aUJZre-NmgT3-ywZ&ZF%-Kd?2Jo2P`#qnNAfh$e=CRGz zxlt1#$fA@bM{37X#wS^^Q2nc8!`I%U7AcuGDxJUb(OSO~6Dt)tQ7aWu92*ZrvXyi+ zdGPXos95ON3#{_cZ=8;=`gK8~UTv609}{&ejn9?8V6s?PcfLO%?Qc&K^ky~xxH%*I zZ^la|@9!b%C}n&_i9}$;W8rJL`<~v71JR8B7of2qH~#Azd(|P>-TvWZUaAGQBH%nS zuJ~DX64^$-o>Es7oN82|R-OFQMt_oUeAPj&!Ha{*b(AEJvr} zCUs*bA^KV?zTnYS-%#$0!XVto;3hm(4_ud#SN%FgdE`PksEqzz#;<-P59>=W9&wkw z5adt>oAX?Z-zbG^cj+D-CY=t{j#&fy9sB~&j=e9jX)G!oSquz4^8tMkxAK6xI_3>G zmbYop>;`HT+HvQ*6I!a(MmZF!$}~f&)zfCC%jKfjl41|pur zO}3s2nhbZbhg4;vW<+Tw&2+r)zbUu6lql?(yO!na zXW9(jG9^|j+0`(RN{V9OyOD8h#)?t3+Y@aF(SWWSDpqf%Es($7>O#b>%$fJMXxdWu zO-9GuWSsjf;3tZP@_v>9i&|m2Zb0TOacZ{?UET$$%Nss4%%9J5rlv(t#eFk~8Vvgwx)SF^j1Ht!mECGs4 zcO}b}0J%I>Nq=kP`06OotD_ietOEA^k+cY~ff5V9W(&bu>2gBw2FB=UHs3o^-8ZHQ zA1!tmP2b3IIIbzrRoM8y9SzGsLO6>wzPs9=R+udOrW7cO7Io~+tsVQGh0!^6V*sdi zi_-YbIFA{dArYt-__ntukXSPE1j?V z4D3V)d5vkQF21lg?0Ndz=I)n~`s+=f=P`eKXx#qnm@nin(5h$tBtpfvj>8cbd+42-NtJz*CsS5V z8_OkbU2wd5nbfeGKSmM!R}s4SEkb@j;?%X!#%+7ECE2}V{Rn^ZXD2dz*!^glF8xJh zNiUk{abvin+^$2l4xQjo)=rJB5FL;XQ!vUM8MxP8$8tJy)FJ`|J!GmLINicU6U#oF z!q`mGCaH1fFDRsKppEQb;M!C5&4LJ~iH+%Q9YQe5>Qx5Ae!6$evvOwItY}>Ae!Dyb zkw@pthsP!`IV~Jd;nlds$%rWR>~9LWJY;d7cYc%0uz&wPKR`#RL_Iu37zNn-bM{_u z-R)M^FE`O}$!R%F`fF0`f%Q)NjT6`Tt=-M;MCisUWlFdrwLAtN<6tp|{RVu~VKE_l zv)+Udj}!}H9Ja5lRw7p$GLlXs1usIy579b5)C+LwHTvRO-MEKmy`ct9LOf-)$El(v1 zNX|`e^j9zEku+?VB>u^-KjvA-y_F40bmaU{t${o6ZoK8g*Xr*zuoAp1o5trh`+6b z5L5R$5aOr1hZ{6JN97L0k*~D1$(xn^n{N2st~)veDPTA?1wKP1(Gmnoh%u+f;u3oX z%2;85U={aYlMkMwGV?c>F+P-~E&SY^+<%3jB`v)b8qZMaX$yfH_dh%{+#W3u zyygtsv0D5YD#LyQI^t}=U+F5vgxna<7aB2&OiZXA(D>-ftx2NYU(v(hO(bNisr=ZG6!z^x*=foim z;aWrRZnvO>Ogx6R5BBEq?g$%R@8dH92vJ7#P;OXb1g`tCRH~JR*1=zAUVT2iTU{2P zE_8dZS{@P*{a17Sw~_+#d$hzesMnTq-ye459CMnz(4JSR_D{1MUV=-8tnyInS%9Ba+0zEA`EQ|82&1MC5(T>ED^iDLONrDW>CbzKD{`66-tEXxId5xrNgx6)X27DfI&x7+%4mgq7r4nRS-VMc>aQtkRpsa@!uAJUU}$p zOa_&$Y(Am;fsz(@pLetOH)mP=o>1epRys`&hg?VfK{zbu^$l7}^>&e{y!ZUr4UT8o zUkta`LwV@;W=b4#wI97^t4q(q{RzV*6F#Z*&?pvuNO8N&S8;GHc1pD(GSsHfp zv1AGcU^p$8g8lk{TCO{zaQGgnELQD;H_r3RC)`Kr>FFDrK+TveaUkbpVDM4%lTMKNH6!6GK7O;2;HvRsMpL= z_Gi{IQ28QeG~I{tO`aYftidZ>7u6*}h5fYxe`D{k9r$bVtuo;ef*6mtZ{KG7CT$S8 zU+$~GjqL|Aw3Pb1cev^WASljPvTUD?Y$-mWSUuyvlnQ@OQ`cU^WS>CLf38+LLvB=#TKK`uN#& zKYi`bvgqz^V&ApH8(u!xfCsBS5!-X(=?k+$;oh>l-2)0l;YZrO5tbSE0#$wDmKy!7%>b zc_N367=#mw4(>74?=0q3++QwODAs{$uIyt4fAoeC$Na>` zz#w_Jy_g{Q0WZm8x#Gc#>WcHpG*-dC#7qS%7i%L05g9q!qWMwCZ;?YV*=d)`6)>4A ztH|WDOVT)Qeg$$UsS0@1XmQi9pj1jhA>^g4ZE3wbr~yse-L?1bk}3VC&ijWw#!UBn zFnAx2dSYfUPMwLPSUBjoxz+uJ<2ltT4T&`x>{$~K=zD^2NZ~0L>+K2}kM9wgUFU7- zyps6bH6PDXo|HlAXb{&@EPV|b?^CbyQFD$>s$?wVXE0F(+x4wU3F0LoH$VmictED( zj$5BHk!LGl{@(h+E^&`%g7_;)BRZ}FUse^WTj%2GyQ4Dz_;`f z8NwmEWuUP`;w2CFf43nIFP^ z5#%s$_*++Q*mRuKQ5rY4CkWji)AsBiHxWs}oVAjF72X^8%=!I9_?x@^iV@m&k?NGN zV{I(4_Sf7^@vJ7jC zdnPUQQWPd)JjUqF0I7fIEZh6(9EmuR5#Fmplp9)&`pS*rBsG7t`7a!7=8J}sVPWd7 z^Hny$FMNZ3H9>=p&rFp$RNhv=<@f-Dis;5F@<;RiT1@g#6`B;cT_YN#3ZY9wFF>Fw(0vApVge<~NI+s3=@JTM`;lk?yk?+Kpoa{C;Lir-% zD)d!nh^fpR=Y`<|xa{{wyV~BoA!+5b-_HeJU!29J6kS9eM%DxshFJOj%W(Ve5ksPH zZ$wz7D>a*(R8qrr-Ii|cravj}drd7IHPTr$J;cyzHFJv+r$Cn2apGu)C0C%i$?RE2 zq3#n(Z~?N9wf6X{chI%0Ceyw7(FMA9mj~rGV5vA>o%(?})(eEb>j8qb08yAQVLB$8 zOUs2yqsU~BRO71r@dgJAquJ6l`F#1l_=gJRGVN2yLft=__JuspjC`8mt_)$FvNtEi zHQ(XKILwAEB1#CdmM;(@)K*sl#^-%_LYG#SNq_Cn8HNZe`Vf7@%bK(5GxAm|2gkw0 z5v!_)E^MuBG~vOJ05oAA!}{_y^0ju7yYn5=%SDwBTB-amm2$}Mnkx)OjMGpF^wA*k z8DR1!ztOoS=gWSuv$g>RGCX{kG~a{#e6>kI0b}GlGGVpkbEDOE-|5)?D7tkmDRoAwTP7BY%+ofc^Lmx6Vy1v9e_ca4v;I-x2YHR=jb zZLiZ`BehReg_)pqIh}9+82YelN#y%UDv2}8L@0#_igV!=Dt9W+4Vv5SR)U49KYD(h z@dYF}XCEwIpg1%i+WBy)BC~2_FgQ~^c#}-OItAy=J`b^-_9|0^9(9WnqNDaB8GFF2p~>|DD<$5!8y5d>1IajL&BP8SI;+N_rdmSodM%b!VYk#bj~T+Qc1?X zINE-_5M!y;P1!jY=cH$q|FtPZwB>oPS6&SaAl(cdubajq+xBlzO&^Bx-itKfT;kD{ z{&+i>hKgJj5{Cuvx9oOSG>56RP)>bp36ty#F?Px*SX+${5VEM|D7D@>vJ1W?{i{LO z3N1&MIPt!tw^yVd?GP^Ajg0=h&Jw?@8wDLK!x}NeBEv(Uv+KH?TY8Jq=o6 z(A*w>ZYHH4<5(vxGqw5s2eyMFBhFA9j3X|*`4q+#)xTH!uY8IV#UHaqK0sD{ zs5|OO`H2>gK2`ipErfuBTCK)h@?(ms_66BYS@~wa*k*q;`I?Z={%qM7dX4&x>Rm4w zM6rwADRP72#B%p1H=egOlzC9im7AhXqEwM`uBXwma^3AVf1R#z%HMd)S$)~eUx|WT z%o8CR^0CQYi=D%K1_F420Qe0fDAg)Im$pE}f&sxYa7s9Po=eME!Gh4CxvKr+89&H# zPy_-*=r``-vphqEhY|#|ar6!J{cArV#tkzmq=~qbe4D}Nx~lmblEI>X`&{NrZxEyj zz3zfxrsvW-{+}5L_~ZPKh>;$I@X)aOKx0;8(ZfYY-Lvj0>-BDAzH=|hzZ*yTP;;jn zLr+r1ueO&AQjr?Zc;`y(qXmV8oEGmZ7#g$tg?sZNDKU6@CaeP#+r5pv_%HW4HnL_w z(XhesV!pqk^@jTOZV5z+hA-YT3K~xpGc?$nN)}NpRevk}PVD%&$+mf#6=;1qXjHSQ zLbQosdjL{Xtu$v)W3v#6=}vY&v7?g9jNMU%@lpw9?_P{gOh%m#rn9o*GxPoH}%1<&~C}&dfYus)2k}EMx z9prr%PJ2-nu|bR$OBdL=D3M&RjQEFfuLX#vc*e@}fxvD_HL+^bxlG4_>T=6R)6hGO z)bF4BqG@UtPLpG7)X)*HllX(|4q-SZCEKL8b!Ocu?^@ZKCt`pYRXXvK`~&Ah+N+7MC(sV>mdd?n;>Wm+}|LI+1gePrf_{zisN!H z&&w!wOnGz=1G(Jjj@@%Oxyz-P+)H-NLP5!0jojWnJ*Z|&-~vt8qH7i<9l5>R+P)6z zM*zQC>qWnY8J{+AkARDoqG7)lEd4T45Zw47d`x~EKh^TTvQLPn;4=^17mSs!VF{l0 z3Asy^0*wv@KmIglVq!A)1gO%d{o>|Wj${TPcrP{XT%!_PavfD%k*A&Q>y;jg5^_^{ zUzY13hUI=3;dy!BDk_GToM<7wRj8*1i!Q4t8SH6$733~V@f?V{vSV)z&Vynp z_4YR-%OB5jkKS-EMV_qaN-HM_L1G4Zf>}OIAa1jXN$?PJ-5vyLx7}L}8fk(fa1-NI zSR;p~mmZpF_Vd#O+L)V@D{%bwq;nDjj+<3}l2OFi)vPiQ| zUjK<@irTyW7#Wc1#8jYKlnrXpxqEwKb1GQ(l-84_ej~Q~l}>E)OqJnD;%;d*s|XMf zVeP!!CRZ=P@h~1(?ViLq|M{Z;{P@xpAN3}U{J1N-`(fcd%LD3Mi$l#696$;Q-#SIU zSWYr@6B4(**}Kxx3q7r7)W5|^6VPT#hS1)7Y{47ZaOkRBaeY|u6rb)CaQfkDuE%2U zAhXi*wbSJxWpF~(QYPb${H+ktZOGrOf?x7EiFYQ=b#>~K3_!e#@>@_Zp|3* zvvFgzc`){m;4|=0RMM}8GM{df5H1E;r4i6WmSNf2EpCxk!+70K&}Fun)?vWB9iGS$ z7p%x3cNqiHyDNruA&y1h3e%}S!{+rEX}vW34^Wv|g?ygk7qMvi0+zE>QiNRS-g7x9r8^=vSu7`OFs~m`S&Q;mbaU6$NT}Q~mze~ib)h6R zh^~@+tvW7s2HW50oI=y}$8-LAOOuvNXZJ+Iz#N1y=ytbha8YMDhl$Re;d+Z49+5S$ z?b;JU5YzG$O9me9dRk2tN0^JSI}WZd6{F3Z=h zaxVEboW%0pUq4`5uU*T!qPW=|xHUW`b{Jp}E;T~+ABvOrmKv(}nAU8J#=JPnzk_HW98#BC z8!muy-<>y4$>U;LmqnZ({PHMgrj}R&Mh5QudDEWEiPf>Fa95a+ewfS#TKs&dU#-}W zo>>NNietm`ngl&87aVPmn4VotMjFtS8Gt4O$pw3QlAS)IZQXX|98unK81juQTyTDc z+Bo=BmzAt45XfiGs+z22DfuZSpgg}nfhW*qk~h@0C`a2Vy5pR(74 z^wOEwQu<3~yCY=BQgbQKV|m9;7^(z@1lo6U{LM1jawB4MSx%N7w}lvUmYi~jNmdFZ zNzgO}vQ^rAZKt(r^)h&UR|*>PCT$;!A@ zD46dka5S{i9BC^D4RT--ThP~;2LQ4y_{>ovx$-x{MD z{Nzw5kLrmD3v11T=Rit@d^2P@psHJ4+6LBqEk@E*o{u!07~|(JA4&e0_k3s~Q_3*+ z-!zL|zN%Ch*WvS6i}+_$8BZ{QN>AFoMq_#US)drwXePxuH0_CO=Y}S%FKq^$>@U`2 z^Q>8yQbgZ$=K^n+VeXOvTTc?`O+Ga*d@}1Qvip7>@hQ1#W&1V=NvbMu+G_0jl7u?R zzT+~kEmUt--u*zl5zPhy;&XUaeyEm15R#1YkT0<3+2d|h=Ks(xK1xQOxVp*HKpl#0 zSjr3=ULY}Ned~Lfz`#3AvcYr3r|nz4mbDp9>9>>kqe5RInu)aK8$(jh1_+L@Lh!?+ z-faMo$!A&OQIFPs;B7P<0t3VGZMoWmpQP?nvvL}Jo>`^ok|sDvwefrLY5J`)f??p~ zfaMW@A^h@^7!Zs9jnCzd4~Op-&h?$^%bM5G`McQVWf}e^FKv5yzFb^?4k({Ei13gK^^Z7yG0Y z*-u%W^(mMG;&4Ro^U)%W^ZLM8+lYMXO4 zquQ*q^9k3!`iezo1!4#UIXYRyonGn*%)Dc`MvInC=B8g^vbjx>t8xkk;1jyv!W>M$ zoCfTSWN6l&4B~YlvTJtQY#@z~Ao-kdJD&CH>^3IWS;uLg#B2i#Mr}40`;&PtZT4#d zbSg)oM@SZzCm!#I^5IhOYU#TnX;Z~LuU7F!t^~-76^b;!ftgtJO3yENJyurkZ+?8>)CgJ z^`z94Tk4K1pGF?R7C0wM;LA1o83v8UT;Ij|3p^vwe!Vm`E}l9dMng>TZg*|`CzAsr zvW&z6aJ|{xu(d40&asrBl*qg0+0V;B`bVYZWnmP;DCbFRy5v}hc8N4Noel4}ZT_0D z4R^RIj?IwUoIKO+NPa%3hE;&II3mq` z7V#KizJaQh73%>zW+=Ao0!54rH8J>#Ez=fcdMdnpFUKvt*rK%V44#0Rl_f6?UV2M^ z$M97==X7p!0>!b={EMNt@`YtnV)+^%Gf1f&o3;RBB20EAOTUgRl=^I;*s{)rR4AUh zr0B>Z@FBe`ztgB|@|X(t!}8oW0LzeSzW0#L-$^ z7DS1b^9ze1&zBlgquDe~iZK|7`HtHiEkdz>c{Iph3xH0*aWCE^m`lygwW7yn z+{re7rgt@Lw%f=FN&B^#bD}x1V%Ri;9)l&oqR50#pDM6$Axf&hENxs81JW_5$(I`f zJX?vX+r*_|ZguyQ8b|j<`Bz=~yv(13d+#Nix zzQ|p$E#Jv6gL9;lChyR89d_Db1_I$h%3V?K)Fvoi?|JRcTr-iBU!X5m8 z3B`TK-4TX87Rz=O!_m`hYbT8=r^$3ImY6OmGMnaoXO}|Ye*088`U{N1aDrA~Fnm36 z8t-MORbj6IS@2hzTPv9E_eKh_tpE-JL`TyZp%M>}1opxjnqx-pjAU=^E^*~6D*?OK z0q}~a>-0reRXeLks+z_oawj;jEOQYq8>K?Mp!t|_)z2U0FtU8N0{)E|ty+02WV7AT{=VDh_>6`*nw><<+V-_r}IS zgU6A=iteN?XoSi|YJo3fRY9dm-;6FZgRl1`+=!$^OgQNW5py5^0;Z2+DOGTn2V)wS zTPhIeA;Ibkzw`YLc65*akG5q8cxNg-v^J>dh{?UHfpRrRK${!=TYC440fv&ALAsGa zMD#3AsxoSU>g3>vn&=u}+51q;@wMo=PXmn01s1Lf@CIeAklO!ywu33P1xQ}Ux0>pHvZEU z(1u8_j#)5IP0f(APA!pF>Qv@o=}$;j&gXuZcuB&%dEAb~1l^9K$v-OG*clJx1&9&# zadR_E@F){-*vj}D#XFS>@&$i4xXf5a!^h3XVGOP^oKp0!j}NQLtS*zZqLu%ke7Mb~ z99))a4x66JV>?}WV2*$)01tBs{FGQB?`yNEWY@9Y7F%!F~m;5i>Y?;}t|8hOJl-Q8GMGstn7b;jx^ z;t94Xd5u@ahkCu()@0!WTPjqX-%MSIs!eo=_cOLYiMA?VIF^-Npp(tdz^td54n;F` zOIeKe0uV)1uRF%=zq>jV$Rw{g;=P1qQ!$co*P5skGhE>FC z*(4mRg{ThNuI&o+(ZR>6e)0Kl5Lt=5l`vOKTY*17?vMNCe6+@K>oClBdqgLwtb9;^ zQ6fwN z;RoL_*Ct*GM8oLUx)VP_8Q4b1Uy8ZVpkZFsyng5`j4X!!i0}PV*E%n4xT>ENF@zra&=KdMKnYg=d6aRGb&0GveR2(?er6mhElmQb>(sTguA z$l7ch(06N*4j1$Qy;i9Lbus%6@j{LJlgh*<6!67|3pq2kdzR1?+S`WpS<+snshTH^ zc@r2fc!6m3xF(A&K#-G4d4i(~%sw2rzOoqDkY5*`}()LeNDQ2BaZL2 zW@B9(w%)aW3|}@2#K_TD(#cj2!f-oKR7ZF$*59(bxY6SqX+Auxr?`mokqH^W%w%l^ z3S6sq1Lgfu2}Uc%%t5t^?lJdfh(CU7cDJpe+2c8j!MKFE6m@Zze3Bc!eK_nN(eOhb z?Mq(k2%<1=ka>Te75I>8!^?7k9+j%`+JPG|)RpusElKHzo%4FHXvXir0$892_lh%Z%~LjBZdBiksryz zj7e}$$=c9j4Bc0$(lp^$(x6XXJiWskq4aTy%iLi{?K#mIoUqPrWDo}sFJ7&zbDA0t z_F7aqpzJ!z4DG^(mS)ah?9JGU8Q>~KP6#f+7}XH zr>@+m{+6fPH%d9qm8hUE+tLHm?`^$oO1q(7cSp>_YUVNqyl`9DnW;CUJc#ytxGYtk z(9{+`AkXULHK1`B7#P7mdewMMdfzj5N_|ukh`rv3BbRRGoB)A-OJF{dSuE#UPqjI} zhB^;?a-7kmothzZ*`T7EBw>5oIDL%NK~s_N?PnFkd-2_-&Bd*o3WE#!4aQ1$KXzcp zr%pw9qvIfNHeA77N`-gl{zr}Zfux-?kJ{$D9>PWfUiDNuPmS%oV6$(-OXKkE*AhNg zaZ9H(BU4|f2U&`6c)5tUiAPj3x`!0#E6t|C%{A+NZ&$7j`lGLOv1nh?Lv?TI{;`pZ$`w~ zJBh;5gk9;E!Af6VJT?OHyE#ZhW$)99d9?`T*eV#$tf7^Ha3p%s5EqD z5TO0WVXB}^L4nB#8_E@X@`2?p38?P{C6QPv>08FRP&Zo3nG_m#aN|D&mQM;Okki z1L&<1x&mB3b9?@1kdG?|DQ=eE_pSHX))MSi;x$f$g%QA(p)jZ(t9Aq;oc0jCvT$F4XIUzLvpQER@2$}^2|Oet)|7wL-}C~N#J_m8zuX& z>_nQjpcIsLk$ep_IpSY1{|qAEKoaj2Z_}K1eE%csGINF<<%kB{_x3k0X)#t%%zjb+ z_+#Yw^?41JeBBUH5D`NRdRxJ4duil&OD0Hd*sMbwj=%-YVjp&dmyF$?9i`(eSmn!) z521I2Z{Ud1`1BWilVoO~z_Tf`lirO+Jy9ZIVZ@8?BB^IP6bn9-bw=w|xpJ)RvNvWi zW@l65gUoXY>#7qw9`^O_t5Bp#7b$xWexjL3pg^SVWaSKH#9D*Aa~63usLyQT@mA8^ zewH$tA1@gsp3QeyoJHkN-dJwMpdn5+lGfCyB0Nhy?0v0Yb1UUedeGCTadjDoWQoB! zM$pXIVc>RwTcvwfEm@Bk`}y677I4AIB-DW0q1(lEdhkZMT^!E{(+&4AI)08TWzlt+ z^s=L`8HEXf1cxjwaz^`n1cw}rINW_mZ8ecq;gNB6M6F|Ugoh0p3b&o20Q1+KoD8e!q707(G1KFFImkGnmMae_iK zmbm!hkVS-W!JUSf#d_U`nxULB#Z@%y2!TO4_I@S2$6qvuzKq0^w{55dvU=^55fg?i zAtL9HR|V%QnCvpGXnHujK6Pn(HHOWAI{_3<0ceI|r^RYSIcOqBe|L=$>pu!4uEc!6 z`MBXmH~iVdMcMI=LrtvG%;FV8FWUIA7t#p1x-cN;W?|*QE79+m#HSSTr0<3tG{cLV zE!yOMa4;fU;jc|0dj4jO+3gVTwl;qC)a`<{=k+98^c6*N4MEf0&Rw%%8OANIm!(c4 zDx}PyShM?V&j7O>*QW*&w2(tIJDcK(3_DO{Q4s)m_k6JCowgViTvEI0q6tCMJx3mC zsDL+T2%7UGj?ZYhrY*|V&vxB70iT-|_AbOuBO$G>`f`UHTULSlzG(5hM;-Pa4cYr? zfYEnDY))D8xfJhg;woZbClJ1Jy|2l~IzVH9pBz8#-sKu;KfU>#qx#V8FMEeM3SWMn zL!{*DV-bAoBbg+W7mhuQHuMy+BJ^ilaX#1<6@88(7a>lE{lL76R*Ul(qTyva*Fq}xx+_VbpH3VbS0YF_G1?H8&gQ> zshstU8zEefNZ3FMBsgq+qBZec^?uc6>yOWjw37i4ic+v}(kmWVQywNz9V`3D9<<@jx1auTYYU z!}0_0(t}OvJHP3g`o4|A%uvE^i(n2#;=t$31jb9@9lm38oXc^%T(Lm=SY%WNCdTuZ zER-O}EALbHl4hNQj=&_*LevqSLHU~%Qt3UQ{W_~R4wgFvpXY^ZNnEHwSycTTVcqD$ zPwRp0x%7JxHe`%U=QEuLFo*^AGZtF02$@^in7Lvr1~aa2Y?VBENF6OV0L zKJ0cb;B0CYr#e03XDm|Vn?8df;6($xf?6kt%&a`<<0*sS>*QhbV_vA7e$G~__j6)M z2S1L?8|{=5*Se2vN#}>VA2$27?{FOm^dCAeoSl?SV@Uxz_Fq_bUhY~d03BoY%{pfz zPjX)+gVZiL2b~t*4JFT#TOVx7YU8x~ae*)*#tgW{d!=E#9jH3-@p}vqky5_t2)mZl z>EMlQcUqBNu-x7cSZD*2O||!PSEnUvXTgi8+z9}o@Uzzp2k+Jkaol$pUde!FFN+fF z7U1!E43^<6dbU`DND0+23W>KqqcL7VHBzE$np`zP;6zKiBniR;ai3skReN8IO=9iX z5oTwe9nXB|YgL${+ zv-&f;i>p7wI%FkUK4%V;gOY3 ztcaf)-<}|mxNk$CWV_-KX1xIutC7dWSV%xbWD)gbV9w71Df&2fcH>dH0Ed0qB0{)$&*I>}Cu&0&KdHYE)i7(rLcSo7N;qCh9 zC=TnPuz~+Jqp}jRdlP+>KpYL@qVT^A)39uKT`JA;ptC#G_#L87B7lD@B1M@yfQJse z*DCRFeEHfczG!TQGihWXjt1y9$Nx@Qzz>M-<3Fb*k~pxI;68Y{6B2jk2r{M2LIzNO zx91C*00OnZZX|pd?e-Y!TP`6DW&jwH&e!Qe+A$br373{dXV@Q7zczLrx_;xWih=(; z5W|{)1xj2zpx6Y7io~$Tvq5_`egInxtEC7#&=<9mj92MhF*B+wY5p+c0+d9f4-#! z18|@BG!a?SN@~5j-h#|FAa`3bT&s8<`vj0vNN;K&U|LfKWkc*jUkc1>E=$NU$CeuJ3(8Y(e!8}~G zA@aw{`R|FO9?){XyNU@lVEhLY`1c2xQ6O#LfK{!@{&eo&_uiorgd|qI_SCC-?g1Qs zNE<;mbQ~DZ4JRg~B#+LwwOsYN2ZDZAk#*O_;3NDi(cnMo>iAznQm0e+*O?KQ7REgH!20ikI;&!G;lCCyKt?4@;CJ00nzG`vwQT>( z7XQU1IR5-}#@njbix$%DIVLHe&S2e32wgNd0lbUe=r8 z9s_ec;>e$K5{{h}|a zBn)E&ik$P*uTxN%T)e5U(;d1z-vpA+{wW}&j%ubvGiqD6K6~dtQwKa@8DWqHq#+@Z%fGAaOApR>!N69yS zar#`hVmJZAC=5X>4J+5kf$@c=2s!+SK+3&8n#40mh)6-O68|#?Ii!lqnrFjUXuap; zpK5}P<>h@*>oSth6Xg_I3|tzF7b4v{daIqUKXI{*939UxO*A3@R8g~}sI zk1mmy^taU44a3L#$1VO-bpBbsQv-^ruvc_Kj@4t#^e=t3*ElJs#_yUU)bS(w!@+;j z82N=L!l+4bDbT;8R0g@=S(*OsXILZjF&ildMQR%v)Szcf;|xX7l;2(ge&pB8D`)aL z_ROlifyY1Ejb9Z~^G~9xipzNSoP_a1fgqWnTXak@lz&3`|E4v1ZGWrHdhy|xe~9~c zWdRU}B%9WBDkuM$tAA6EL=))ny|$!V9=~-W(W^J`@&V^(TMQpKyu9u|_2aFsVpwlR zKynhVi%?DfN5X1E0z}zuQ1svaer2mPG*K!Ry`lgKsksPXo0acEfJ}`)^|0rLCFeut z%>i}kkAI_`$a90D)pGd1{d~m}_9Y!B^|&<8PqViN8HC%Y|D*1m`SouNy(wmm4;k{f zgw~-1PM?WosQ5bgZGRLhg@^S2EbrqNB7!s$WQoNASw%f1q=|~e6t`b69CxT%rSHO__~YUg!FO<1&_P$e-K|>x6x4sr@*#XCB6^YX z$r>c2j*NgpPYWq*vA#X0;wZH!QE#*)UV3TpkKNc>Q=rRr`$(<>0s^eIg&!pQJlX*ry~qAX^Ux7&REO}LP4!PiSpW=`XsWu$wT5BA}f<@uDh62 z${&=e6^f~U?{YK%q^D3ci)a6|k({Q=-A~&dj;?04q*inAJ)oo(yFaRkNN*r|=1!4T zO^}IBaxrZm`VZd&q=+8f_mfi+sL2=Xw?9BO?}+e*Y%LQvVK6B!^eHbJy6Q5Cb0FOv z+;>}L5>Z7sR{qWu+8$#;)oeG#9?X(QC$VL@hs2a;j*P0UkjPmpXwOM{w)%o_yt<`h4j#t5Kr>@myGXak_YB(@B zd^Wn&8(+bU2~ZtFz@n->SG|%n!cxzN7eS-kYRzp0t}R%u^&7KZsIy8mo%sCW3Y+Y; z*U?t;Xe!(AO4mKBii(O89aI-yF+!%C)2BDf_Z4ByDSPO5yD=GfTjx8RpjX7P)yo>B zkp6CGevEkiW$ifn#HzW zR^YsPBGYG-{Ht{o{`(;TXwNPJ12!0h{ZD!MAlxQ7T)($H&jX)>IY<*XHbz1Jy=b~A zQKlOr<_f*A%2e8#Zg`B^uZXTA9_M&tlgNT81ZTfHe1=Il7WAIsdOE}J$h`gAm>DEBJe zKwNCQ2j`k2_!HU`?v|`bpWo7lU-HK%*}Z)KmmGVKFJ1pi7hxaQ(45AEggsA{xv5M+ zu%9Hg7`G33EgNYi(>Q<)mkBAixa%##d;UBRHoz-G|O3p$g<>Yzxc zkL%uBC_2pT8Tr7gUwnUR(f)N(TuE^d{ilj~2-i~@YU(l8TrXIt`B!lXso~aoi|@sK z&O=Zf>$&xT7{~dQ7Aq_SC7xwq4`-N17$qqanV3QL_GLaXB4 z_UGiv!If2mfkFiaF*S~#^QY@Q0JKAdpTB-pHt_4|a!EpWh!L9j0Vu^6OE3`UxZwbO z3TwBJ6z4SRt`7OIM2WF`@@5aLcE|j0UF_jJ;Xs+LjL8U&Og=c*YhT%(#SuOtLo+i=oqG+(^KrDZY)%VHD74Gy7?pR<4wIe2?*FH>z@_ zMMvyI-wB_W^L9$u2!5qV4>Et+S!gt|+38|z%DLLafq|>E5#MH75~szd8$pvMp^0*} z&_u&dXN}NXJ68-Ei3qD%#^l%Z^wQOghw&OVbMU*}M1vbK`z)TSnbAa;l(zPlJz+=b z@Q~ioYCUiq2*>B_pn2SOt}yS2b(kSKrSj`p8sUl8c{VUe2w@a1g&4Fj1!sv<{IDk2 zY#A-BM$79XMudN)!5qVzEl+sL*z4CD=|at)jw<`)u12`wg~pf8s*0g}uO^@fOOuV& zymt;CPTJhZV4!GK2O(!q~c8}>Stme0#{3d%PoQkAO1!$2pmE7jVOr%p|)hD;uHw>hZTIggNNwlnI@ymI~lWGQ{EMni+CU%a#JkaEjggLi5vdYqUNx z5V^h@zGV1ysm%ISl#XF*UT-80rQn-0_@=;}vzeUSW)$ITkL;!N_toIE`t8al_LNVb za2X6hNg$lKQor}!BwmXpAqRFYcZk?81a0Mu(fE1wgK;_P>y}hr>Rsbm?`sBavk6_t zL5BtcaxJM;wlq(9BtuuT`CK%4?3c|Wc_N`S#lmf8d&#iba_KMLLeJ9;I`wtZt`EiF z>6@deT8mBA)TBIipVb)kmmvJatU9dAhD_Twsp*ho^E;aT_a2{9>=t3>kfy`jP|gi$ zo9W6{TSz-!Hn^t4|Ketc^JDIvZ3e$tom-A-QBSrZUjoqA$~S-EwHgkqMRFNfN61 z2Rq9kj8t6>8#x)lmWT+3n}OlklgRMETOZoyD>Cbu!dATd0<)=`)&tOs!xjUPKGC;5 zoiX+;Y?+6#ApbF4RMHVmeqW__%>xoJyn5f@z=9hU z$M72kS?oEjA(zAAkhO3)o;Fpcz8W>Zk9x;jwQVy(W7H{BH~0M+LrTsr7`UoR;yDHl z>g=d`M#|V2b*fy1Z>!7pbpA(I*BGu+EvZjT*u&qb@x&b2!%}M!%G;lJeD|vt&!J8b zjp_ZO>~PJ)GG=5oRaqo{!be?3jxYtQ=lN|9mU&}&GP$DNbZMY^nYxN2aH`~$ zZ0T-kwLvc4;77!nO%yVn!m1$_8bC1%bXabv?bIY@)lb4AW|Jwx+$>TbP5=qOf~W|J zQP`H)Jk#u!zIIXsm$Ai@5Hp99&iW=}$g-|bfNF;qliyN3s74SM564D?Jnb+km z-(B+DY5_*V7p1-A#72T~)6`-~*Vzg~q`$nBV@TFJjKH)I1YT7xJKS$pD;*%fFLaQ& zPN&H5lSe;VD~rEj>Kx)k`;LgsP#&wG*uZ6_%{xW8SfXC?s#74pdV-ppRZ#Ktrf2B^ z_$>}po#gLawa2sDau=uubJ-)ZaaAVDY*yv6N(VD+%ob0qXD@60WJ#_)VA;s`ki;lzmHtY-(Ql{;gYpnu_P>vk}&*|qxN5v0zo4bNPR zSrl{G9M@#e{bqwfr;U{-KBEjjTN9$u@zsR!{-xpFZ&inVAZ^~|(fe(P1`1j?Lh8xiLK4s=YI!ZrF}2A3J1Z1LSBQLpN&p)TzC z4$PUXciq@=Vwn?}4-Kb!id^S4C)gpiYGmGyq=H^;hPsJlbtY=tnTx`;M2E{Q*m}6< z=Iv88iSDoa45QL+aYqJeGG2(WMhD?w)aW?f<^agTvO7G0K5>5zc!P*Ts+!(xUDTfT ztV}0iJv$jiX(RwWMjGvBUuX8r0+EwHCI5?U>Zh(#u;r7vRU@=`?H9dI_R->b+VBD@%h);jb4sc;qIAX{mQ zzpoOLdy8dZoPy8En!;FQXiP+>`F-6ak8#hb40Gjsg+Krz&IyfK(jcZ`<wK{#qcmpJ*4z~ z!;Yr(Cc?7Sd3)v+$zqTPPJ0`|sDV9Xs0X*$Qk*L!mn4{&V(;cs``MRU0=Dg6WWha& zIIj|*oLJ0ba(S#tLu}tGF_qY9a`Se6C(;#3HkMy8_uX^{_IZC5jAFJaYw##9wd4vbh_Ka85&TQAF{xEe75ah0wLthg^lg5m$fMHT*9Q1aI_J ze~u4OoxFUG{WIk&N)9bwbqC*1hPm}7MP2cbZtDYbrNieD4eouMx-zqo7U&a12b>t2 zZvn8AE!~CdpEaik9p3QClMm=P80~S-_Eu`ly(=qG$JJmjt)Pg&k}BY*dBAGhZG^)- z5KctfzNt~~>#pk6FbanDsy=Y8R7dJpJ;Jhczs#I%+aBuZM3i9M(J-R7R?y}>z3voY zJicaTyzXe8q^(2oPuJvMY=K-%`Q-D>T1w0TI`8n)f%t4878=`Ke4>psJ!j8M!$XExD|W3 zefE4jioYA%(35)P7&F_@y*_@Sb7hu41p7+|c?hWYQ`>MS;L!CdwB78CSc)vJ={NUx zngU}~4j2CMC+)LM3){PRm$SIjPx4?1n5PoU?Ay4i+n_!0P})S0#Hi~9<3R^Z_NKzH zF^U<`DCu*s03UWA)%(Hv0%0(YH%9f<%jU`H@Vbv48R~k-BJY~9*aY4X^wp_+FE-(8$C7CNBiG|#V3&wJcRbR zC~ zIjv7UcO?hbkqT_Tdi82HTBC9ZX`)z@CCc(MuFofz5#nHv7bsjImf{_Hnv2YtUB@-pA6ly$@j=A{%!{MgcI`M9;-xAw^T z`wlPOSf3*{G}7`(ZI&(8fDMJzg&P_6YM z2Ar~xnnZh`gos%1ZIN?bdPk?X^$Wq;TK{OB=dLWvU6TVucax^FP=X6^_}r7UcO7qn z*!h%PEAPjEZ`qFrk>~feGki&!d?q^i3l4RlY z{Frld2SG{we#9`f7v~qe3Az$9-A%Y;)G}p1-80kpx#mPs#H!?4i(juIMjvEp{szCB z|Hz;AHFIm}8-s%&i^;~}*V(S+bXSU8h#+r3FuUprMGouk_Y8A-}}Qd7Tnsu=MKwcFsR zC`jnPEr`+n4u2H+wx7(J`HLWdQI3m-A=}bph1r;RdW&x_e0+u+ z5Fwh-`!8|7?EP%UFo-oXl*&OfDzdLicXUbY3ttbR_sKe#`z%eF*S7k!CNu054th`9 zvwk_-=uly<8QNX%GvP;DN;qROz+6%N6rV+$x9d+}#*^ z_gd()#S^2v{lzAAuz>zt)k@(ZlKl5a2cq$UqQCUFIu8>mh5%i99a z-}y&}H~ou`XS~{6!khSClW^7-huJN(sGOB$THs1nGvuM5^_br5sHlEbrtV24egZVS z<@d|{K-||Wh6s!<%)hrTIf5YK*}(&zcP}SIFt`WfDK+X3Q<4=8K%-%9Hl|lI!ZWFl z169kMH3T{7yxot!Ii<1h<3MH9z+-xV%8zu;IaS(C+G8_|suO#WKJ}np*~gb`056eZ&DtE z4y9on3bI*~A)F>E{kB(?%$siTC~&?`ep80C$?>;yGD>GC9s~wA!2NWFh`+PR{65cF zg?jLX->-xq0cBh+ym|?_`<#xpfJB(|xzJsA_v(Q?J4Vlw5D~Gb$UTCA?=nmi8{5vR zSD+odZ9cqkdnb=`TpSc^6uOqSw$9U*jySr9bTE6C>Yw0Zh71&Q#;gWBg z3vH=6V=9nctm%>iIX7G4j+>(hgA(>8lGfGFXo^}dXU$k%@W}4m%*LYV zm%|idXmN^zqm}NfV`9IqVfF1{pD~u_jIq{~qeXo#oW;}EYF`+A8I9xf9V+>3*ho$%_~!*tyutDA z((Ef1%j9A=?+JQTgLkvW@ga|pF{lC_K0Z+(o00I?6P>mB^;*o=>ajt-HeGa14pOwZ zfbFXZmAS8XZqJRiLcOa}6g4U|ojg|0#X-UY=7lL_)^3C~qnRKy>#P9`tRUvv>p`EY zbr@EoE;pf;>LZ67(i5SbftOh|x*iNeC%vOJQf$vo^`VQd%#BBkvcK5QR-M%Y%mZ0=xPnWO9ld6QziR-(^#cmtB`otw#aZIs8;?x5vCnQiodWnBGnT+a z>U+wcB_#KDHXk!7`T5H&Dy=_<-TKUeqWhT?5bx@H$8xN&0i(#mj>O-6C^~sGV)Y@JjcjSxYCj>=$*U+Ov z1x|&c{PqDMHyUKmsBy;Z|25D7B9a(MS1Fc}Gh!-wx&0I$kgytWhS|zCCEFjRpQ+$7 zfI{W`F2!qpIN^{D`3D8=?Bjb;xb{UaYeLnz?bATc*59kvq_2=`G(GyW2p&Z%Ah^<_ zzZ;% z>;&??KrYf>o$Ps>vN_PhPsDj_%NSMVTq=m#E~Mad=jK0Hl;MgOs=d$x&%6l#iE#w0)P`@{?*x2PKP9mhW(dMz42rHiLL zjE87~baH^hWzi#D%xjga4>_4$TpG{Fi2rWdUyY=Mb;0|bCGgX{YOlp><#KU zf`d~3?!v?W5?(3uFtjEx{IjC}TC<3DT6}sW+Q3=L!AJPdp8snM5S>nv#@$~HyiGC4 z6LTI9(0~3=GX4(9fYWuK-kRTg<7@Jm@kUTSf6CUaMpyZEezB{64MFM$74ikjzuWpQ z5mokeM3dPMvS(va9(Et)r^q19o%C9-b?ues8f(_GX1HA4^GuM>$xnL=st-c%iR z_K3EbDgOW-=e#8E|ErDEs57BI05o+>7dDbZw$A&S17qqS53oC>rAlsKbylnA^jRpZ z*0-Or)9_!N_pN!|msc9M7yr@0a}pih(iDsUlL?HO3-e{XPEwctZ#wRRob{-0eRW;J+*7kVLGD z0d;P=sDD=VuZM9p5rx`(XCMAi)!)q?dVyFXFV$u<>HmO!5p6`F(dInP-~ax1egE6Z z|Bq%eSAUFzyYFE1VN3g;Q*9a|(z++B!LcUJC-VnF3$U5P0C>bw{JKP#pB#E#g=If~2qRQ^zB;8#Rp??^4>pYSz+fh#`xrF={L zzZT~|;Dvx{FD9-y7SrG#d-{?_1ee96JRM)+517VaLKOaQC;#7Oaubj5hxKd)}+V(stPXa-j$quIN5olnMdf-?fnocv98f)Qw*2K#n1hlQK2is|JS8o1#KK?uSj` zls8JIt=a0O%02d%(^>92lhmmzE6npeV9A62%n9>FI!b@sws#X?Eq%AfWR{H0xtw>c z3NPRL?&Jc0-4zZAr5a4FSR=BrunC--n!Z%}YqLvWay@uxF6_qZ-xGBZ^G^C zZ}5sSxAk0u6lLdx`~K2P9pb|)=hkcCn|AkYsisK3qaL5b`5Uhsy)+Ip`Fn7)JupS1 zTz|m;{n;h_M`hZNo2`8|M{s>-D&)iYJ>={Fia%`pt<>q@N_~pL|0HmzZgn`oCQP?t z&hBP(eNbsWg(YJzx<7jFn6Exa;l^aPd{!QuKcJ9)1)tg)Bi&DoUv55y&t0ANoU(ql zF>xIToZ?gxG|%9*i>b8s7nSm0)e;|<7!SvxY?7h`@zyDv!nkdFW1ANXn^(T}M-yFa zc3ht{9z#4DY&`_$xPgl^!*}VV3k-pDB>gO$h3k{o zSAHsGkOn@;6%Ls#>0C|ycFx%C%ksDWD~nBt;Nh)QP4-Y@CBeI|0Qb3t?ZqNsO~Z&r z`TS=ZDcj3Bw!N%o!}|5Xc)efE88#N@YemG_jg2;%IUO^Q-m=3n_O7 z*b0%q)^pkHhi!)8`J_cFQgE2=?G-lEqP4Ec2CPU)Jmn_IaHi|}@g7O9*0`+W{s8j% zXuyvM+G^4UJX?s-2V)u3^Hc(C9NN#EO}n;ObQf}|`}SKcvcJZX>#BN#!IWZf5PV zwkKlu)Mnsu9BYgCKLz$>#8{^4^l{7eTaWI>rYgNgrQci`=WTk^NR+s516ET#_GY-f zYf&#}$_)nn(;^HP`hlga03ir4qI{1S9b&)SFl;`SNpY#uXl-_4k18Y#6SD0ucHSJ7 zB06m;Z8lg93PgCfaS77>mw*xz(8&eAzqN<@Z1H~#4vVc+gnHlctFkhkcVv5lQ_T*r z+#Iv$)ru?c6Uf`=!m*3;`UYEUw587TEW#N)>m61M;lN=tccY2uTW{1jS3xE<9=g?a zVh|viN$a<84}3=omGwJPD1EPt? znn4Fkk};q;Ve7tC@6@42_Mw)hwm39N1CZeh=Ck+(x|*?`)}dC#EKuu+1`pFVsQQS( z?Qm+;mE3R}*+=b-za{$F;kjt^oZa{l9RHT^Fr9SIrx#Tq$-1p>CtRH$70;^+h4yfI zU+mtaU?L1NLaLCCBC-dVm#|a3tjV>(f{|`&bII;p#n+Wb8`^jdJzIqJu+C|MS`$t@rK+ z);b6G*@UC1m$`LK!%X+9_eh(d*=$;jy)4(qgV(s5ifu2m?(m7Rqn}idS_T9Pb30{fhS&JAUxH?it@!QxGt?{L*pV z9w)yGtEgrH8I~HUesUedT%+!(J30X6+tt^*2-QmfJhp&BgMgB181H1zgl)eQbgH)X z429eA%H+U-uB1lTE;2v&{&E`tO-<@6srnIwh+T7mg9~C>D0RZWH!_1XRh8I5`hZT6 zoi+e*k<8KdPDE`TLFSBuXNj9XjuC1e8UO z9ZO2!h5c)fTL2l`rW;VF(YbY3sw}b1tKMbs*|qDD)MsXb?&;Wsg#-JQa5_C|C3lu| zhn7no;%>On524%Fb#_KMWbfU%wBS3UA0)L)SfRGdOAFQgqdai8-?VpqlUNgin?aUL zzGrGBzH9MN|L%_~)2vrtA`MC3d+Z;0KccP2g4&&cm zFE`oARd+$CC>t@=rpY}~yJpAhCumb4wd;d7N2}nIT{ZbCzIED0p=;NXLBH8v)MML| z`6qK%mGyQ9nG^B=^Tn2J(Gh1Pb0EX?_I!bq5;S6r&Hq*ycjNwd_~C*9;JOLtWcRS@ z-Cff~8>V%*6hbb^-9Vke(*=hS=lJslCz_)siMnmO_C~+(ftB-iSl7Bp_1iNc{y)&}IU6wmg_u6JO@Aq@L#-4$ zqb(pChFw;@=#;8;Lma%;&TpJ{%k7~6fz3pI>`3AYwY5%~d|Y|pA-Ge@*7*Dr>d zw<1AkWc;3!jYFjS!Wd{3!4>Dk)e?&C?oDvkx4qCuHn1Rcsr}j1oOsvMr%i0xgZQkZ zx1VGyL_`tOetmOB?#pWhd^z8Y2$JvM4^#AZH1t-YyE?C$NS*Tc*<8BT-Nhn~P$gl% z(!IYASw6%BG2v2V<=?xT9Ii<@luRVcddD;EMn{j#7g{OWAm7^U))#{)rAow)wG0>U z=W8>m0K>P4g->Vz5O^4yC^-=@Ixq#xex4D4{o&}m>t;OL?Su73@<`i+Mh|w*ki}GK zMtfA+ch{bG2Ar_jiX1H-R8}n^I>pS0lV{AW@VKayG;p?9qxcU4vDnY~?>D!z!3PbP zv*@I#gC}S|NafabGJ)e>_DfM<7rX1rJ)OD1*rK^cJ*AABVRRv3U<=ql*p4#GwQ@)E z$&|-&LGvj5au?{O6dOs@@b1TjovfPDa?y7twv@j#Yl519fuj+30RQZXzCi^6{W0L9 z0kKRhoUl;5hOOspD*lv|tHI;|%f%MUIySmEXNT)-ku)E0wT+4UI(-IDlG4;wz6i!` zJ#P-yW#-wvnqO?Zi@K}J*=bY(>i|`>YrkJN4cwFxCBp|n0DB^Z0tp^>pD*`2u}P|WVi{!?)R9chE4+Ly6F_e+%{v^#mL)xH3>SY^)(pR4{2wLZB6uV}iC zF!|dRbV+U2h-83two!gM4@fe{b+O!4=i3BrKkSCXnCk8(yVen9R19${HHMGxRapvG zd~ati%!0#WT%lArdIrPhokNO(s7~yB2Z>FXD9`Ccjv&XX<`Q;eWYTfAt3+!Nwx!|X>4UxMeQcn zP5LYAnF?h{ez3Wg0Wdb%ZM~8 zdfUy2?8w?JW}2|*Hk?sr5@@T9X63rYu25~IR=0t+tZz!@S+kr~c)1!6RG2{3)fpAA zwNDulbUVdFi3Url`Y!8rg`2%M%WU2`Hcy3Vfy))DMN$6MPN&PjZR~r2i{zn|=BC+| zm^a8zR9z24Q0>2(-tNdn2)!>K9r^m)1ZXq;@p`Ar;MT7HjY4tWqx9+Zc%c_hx~(d? zZv{(7V|DwizGs-prCxMR>PB;5WR8Hb@<^xjK52|BdGXgfJBIHcbme zf}YyEK16cUVWvw>I%`3^EKC<*w|S*jcmiJ*&1U z+@N`I$0_;bC;iSH;R1aQo#^Q9YI<`I_RPwhLQ{eHRS)^V4XBdH)ovzhK+>L!krt?| zrYgt9B3xr|jXXFr`Nh%Ns#sHSYInr%vF|09Oc2`G?1X{6FE$i~NgkI4v4VdTk5$Rk zZ+-5AHL9vq|Ni{lGl3wmeVGmOD`OdLy3ir&?$Yt%z>|E!oAavM^TQS5^Nw62QR~_A z^<#|ygAURYP-liC6@UNTJ{p|MJ_b36BwP!cO?U#I%yX&MOz~c^dD`vAYFSO?d2)|0 zD&)0Ub84-VtFwK24^BO}D9<{)+p@^Y1UCKa@D2Re;p>WR1s5{0$|r3kQ)2=G4?wr$ zH3W&@x&Dp?05Rv~^l_b5roJNcI<5lnK-;G*grJqf@cL3+QTTw;+YcvxytQfw$(0VE zDrZ;pk<3F7?6!UAf7y|po$@f(@~vl?lB7DHuJvS1o$i#lvPZ8EJN7LSF`8!3(Sb6` z$LC-}FKTVuf6QIY$q__h`AgL_h=#Iu=cC58RzHq zia7#%npyAbClxO6o%YD8<=8McKPZZt%%a4KsJY`p=K}sLH{Y?}RKT;*Y{3^MQ{a)@ zr>F*`k5ikMJ!z+H0oRPHMNhmjNxo=O&bZRp_F^}qg`dQ`!RI`-KXcYMArq$GDzgkn zzwa)hGWkWVJg7GLwI%*D{F|rB>xZe{ZcF(HGP*kSzu`;h0+|9ff_`3otzjb*W!yP@ zKVMy*0p+6g``+r4Kzr2tT+5fAah^r*{svbMD#z+aC0_ERNOgC z-J_E0D+3oBhW&_i?e6;%B#Q0FNitM&qzXnUH&UhV&~Yf6ebWNnJ&1XmuKB7q21Lu-!7yt?SpTAF+nO;vX>w2z~Ut$)eT$puXJxjFI8u zY>zV@J%ivvn+!}&9%7@kJY&Z1x|=pQxYzC>Tf&_R3M{LK8hqD(-km7Q)nVmEr{@1u zmQ#tRq;<;2Y$+*pyTuwE^E zo31y2N*~vXlU_0~Jgu!satP~?VMqGj!dHhIsD{j~4^{!D4cBb$mQ~4t>+>H}P7M$& zVH$B5Y+;sqWO?I@E7{^pe&8*5)>55uNgLZ&Oj=`9<0a90P^z!*b5xzhDHM@%URICx z2Ws_E;5QU!9QBlWA=|$i{hz$9h~yIlOIixsGW{bG!g6n^Lyre}Cp#|j` ziGO5CA1KrqlI#Cqf&cnyn)E;gm)k26{h_^74?OW(>%HJVQNbz?RB$rcaE{(yzb zt1a6uavLe6K&op6>q33;3 zja0lVt_6Y@-5r_*lBdRFso(!}U3x@BpL$+CUAq+qr<+IkOYNWXF3XpSba)$>;ybi1 zQ26c`U9a}V<1NzZkV3sj6%fgnp7@-#5=ZUh0@?OW6i9fRcciq|vm$LbyN(JPQ(0L1EOaG$mxxYI5EjA*Llg z!)9!49`7w=PUa_;(YVUSAlt9U{@Ck-G)ugWffRky-j<=2`4rBzZIQd!cju zdKsmp^g7xis?&^x$m+g5OK^|o&t1fQik(fO^9v4%TzX_39UaYnpv>g@&kyK8suKFk zT8DRmmCiZ{Ylt8-txC)5rSMxshEdw2=clQ-YSX-!dj2wOFVGQUp)xWkPrc0^SfQMk zPtNE3?HSoTB_pM~Y?a7DosMRKxm|^RQM%m)vxmWO0%@*lw+g7lN-OWOjRHV1^9?HzP6;LhkR@w3x0`=M8;C6ZnKqLEGc)Lga5V;$u0wUA1++WULdttlzQUizah2XpK90?PT}`0$41o5ZzJy->W_(T_hU<8uF6Ks z2O)m#_hPl_HI{4G&3v)hzxcf_l;hwJ@AAFtx`k5i-QozHjQ%AF5lF5&p69vSg5BTO zI$9gK%dOb)*3_;aY>PuEggmu>Q#KbJwkjWSYKkCnfn%1R?Lj;SvQ79i=W7cF<%KZ| z%M{%Ymp&`kmUV@EN$6CWzmoIrd53^~2%hqzs`l$n{~@UUtD>6j-|K_=0_$ID%pS}ES!KJLl4}Lj_jF6CczYCy0S&oxXSCEO{K9fi5 z@w*3b&Ngjl+4$eXb9_ar^e>$|s4Be|VfCU_i{jS>E-jUR?mCkn)O%Yf9T7;w-95ET{Y=IO4Kkup6AoPM3l8i1L* z>w;b8ic!is1NshDK$6J6!+a#$1M8guU`7p6KNq1wLUQ}5{z!pkQraRc0H#`nsnKkt zsv2Y|N<8j~I^tl^zQ4|*cc5z<`;vD#EcV5wZvOr+2Utoq?Hs8?rx}j$(U+CYsln{8 zl=mAYcbBpD`i&nBK17_g9#_{aRN*_EnAm8*CgwJoV{4xM{F!1M1FLF83_VXTe zze=9QNznRu&3qC=4rt!!CEV>Z)~h#PiWM`=!Es$ZlJOnmL@b83v*j9`sQp2%7r%^1 z`Mfg?{MW}=m76)VGvU7juzF+3xaTBWC{d?Jl9?>JI=7p7eqLqxGI7}nSZ_FXDdn5p zUHJn?57`n2DJFJ}-C}JPN@hB5FNG$XT^BeGVZ=vR2+5Q_q`Qaouy%cPo4`1p(?%_; zZ6J__S~(qs3vIF1gpZd-POX)rgBhk-0b-z6@kf19WDd+fO--M6Qb#;2En<>O{yyag zX+^G`PL2>V0_FC7g@p(am7wtLwS0~cP2FYt`c^~u1M!&9@~d@cF+M&g8c z+~v|S+tqf~dygn)y;kdFhaw^!-0fimqG_Pa&9)1$X3xW0oSXIUY4tZIS^RD{Ca=si zR~4Zq!6yrQd_wO$#uqFuseYDzrnxCE$?@Zv5BZB*QAYN|LjpIln% ze@EJUCwBWllgx@VEAt9pK-s^jVmWB~wXT29nZT<6kzKsW*T^trY5sZ?^%5hx26tD7f`Ow!?u8YmvF zPKFYu0?c6p3ypFXD|Tnl^W}JG4ETS_tlcjeJ|$75oBuq4@)W!w`sK~~uE34<^GF+e zf6@%Onkcox8^_UaYQgVt$UGZa3^O^+b-x^0-f*B!rmz6)n^&AtC)UvI69RkDre@q+ zh7;Is?zHshz{2BMyc5Di=Qa6Bmp`Q_PDLB^>|2N9XL;OU4Qs3vmwzygDbl235N)6t z<;^hvIrAF1=Y^$pVDY2$IaX+}jg_nI+9`iulq|}Lr?{DCTXNWA(Iv%|6 zLi3rK7p8zq81IdH=xw9B-MIWS%yg@@AW(JNh8bP($IxM$i?4ab_C*T|3x3Sp3K4Iu zrhWXT19~?Shngf9>d$5`T(C*GeuaB)Ol8(?H~h!o3nonM zNeOmCkG^%*i$X51BLclf>&8aQsikUi-nj$+RqE@5bH9)N7f^>vgSIA~-zgcl?lyDP zZumGi--U6G1l@0D0s?#L+T)7SH~?O!+@u?55UuP*`>N4;oqBWDiOhpfxqwfY7IzvgtRg#9cSS2rp5a*V=Bc%HJ4XtSc8At(%wN1h}DPmV-R(HSK2I;?$9IZdA_qFa$?&wT7zp5u}<2ajC{#rd&U&~KxW3^ zzcUH8Eb4gUaj>*0974|e(S2&#ks^!Vy}|nw)~bofQHs?d43Z&nPYp9xK|{eEQbqzs zl1x_wpB~PQW3}^{1a@#;9*Y5~{Wj2>=L0DA_YrYYn-1@eTlEtvvM)l%beiVEZhkqm zroj6vx^AKx?UpBXrIK=GZ)4+jE(yuRzCXyuv0~^l|92I_x}^ zG|VVA_2PilR9}C8_i@PaM{A8<+rZsr$%@o?6@7}g@KXx*5m#*G!+8Ju)A%NOF&Ii@H-DaaU&sMwcMRB>=ED_gxBCLT<`1W7TS#&SV5{0iO5%~gx z_2F{xXoQfUS2U7rdke~BUzM}rQ`2D$vSgUP@4@lU%%>r~`^wgNQnwramo}lB3#=G8 z+h@PEJ>A-O2XG@;dVT>C+{-uFEf!JI|fU|G?8%IEFAi~H5<%q`h|HAk@*)&3;{Q*Lid5&|0m8uFr(9TqkrHH)0{wCg*T&7`t$dQn!jgI3+Gq3A`aiP;%y2 z`o6uRa+EA{4sIN4obmXpj}Z`-~r;_N+}^n$1~RmYV#oyCW=warYazkC|}WNmPZi z-CWhSL=yzHmuNf#9;~D5)rnO}h@faiD$+@{_8N&P8*c4iV0X;jGm!IpH16goj=ROo z6K^-ZUqK&3c=B0Ww-(LZ=0{^a%`Y3>$vLIZcW`?R(8mgE zbiW4Q!5a{^zoQ6$CZ8HGz-tO&T4zM4ZzFcAUSSA5BbfZ~YL9)^`K>hOmvXsn)GQE! zKvMP;e-s#kN>#p-98e(x!f)x=MMzJYNaYalN!q)-SVHp z7D3!Lds)1O=a5WDQx+m=*Z>#15vK=@b^mk`&yU8Y1Kw2p^<`Lzn(XF{uI-zv&?H_m|FA(OoJKKD?b8SO#Chm3WpB%7Xcr$K<@Rj2Lr=5tvQgA z9N#@~zst^CL5abtZjntXVg}~(unKOf(vxRNoKbMzPoEX~lAvYSbCkGx4TR{}n_bUEXjTg)nm0~AP(d1h?s7UP^D+%UG1Vy@I4vD6UE)gi36 z4x*=xv>d|s7D*i%8|n01EZggXROd}3w=10HXGokb>+)lR$+GAs5XW3SN(#%^<-JM& zky)or39^lKTJa+t!?H50x>IMCT#x-ltDK3u@3B+bkm|PI<{mEPF+d@kl&&`nABzgB zPcRvGw}Oz3tyPLe<`sFT^6inaUkH4|vBYm2nZ+$C{?M_LFv8sP^9-7Iz*bF^e!FgJ@gWqi1gk|fY4h4NG~Dq zE}y;6dB45S{>JwQd}oY|3`WKPR@Ob&UFN)g*K91hGymho2m6U`B9Yl?^mtnVZN5%u z{Z<1X_Vkkk{e1%{4fiZAIi{Q8cX*N&!>7R)e?PBZ*|RH>_1*XC;5esMBJ55D()rzB zn~SZfQjOZ!WVb4EQGReT+gVW}ic_pTMex zYq3cyyueddoYG$1p!j{r*ZmI|3#tu~V5sZe+NOPZ$q9=g`ZcW$@H1@jgc7Y%8)2XG z!!@@>-yYD-zONzL%FD@+AS}|^NQ1i|1$H)7ig@0>IBo%woie2!3eur3h%_ z(0nU;7I}MqPqa_We^!#;A_l6*y7cbw;jQ^m#*7gW+3_C=;fb6v3QS@LvnAs7UI3r< zAg%>g{IsD4*3j0I9E4$czZ?Bl3KPvaG?_!+hR<)uePDR_3`$HZ@=SN;XPuOwJF2l2 zd~{px=zm}!*t58;x2)$WnOhgtIoj()qw^X+r%CW7b8p6&S}UuyawmN zyN!3WUE4GKi_I54pL!9OKQ;*8^1EpgJtN=O*}Z{IBID%kQjyiPwF(nv>^33Shqwpm z)3Jxb9Q%7ve8SCP@LIiNLzAlo`7HCCrJ6$fDrEI_!C>D%3LXKgkKegpOS~*KM>a@g zHdq^Q90?69rVMZ_@}tyl&Gi@GAufmb%3=wBSliXEvBn*#aLea$JGf|lu+r>A&OK28(_*$ZV8M=>q*JW%DY3QmfBo&t z@zISoJhoFB6(s8j=ijQU3t|#I*=lfvm9Z3Gv3%X|*M?lhc?^yIb%t7tzJkR&szAMT z$v3`(-CQIN!w=JVjPv5p<|Z;-R%vAcLJNKP$?zd)+b9g&i^k7`Nyntf1@K$pg(G8hpQ{LYAYeF zN3le%;vB-v*dq}C<3~ORHC>l9Cj~eB)pW1VJhfl^KfJ;_u;)+T=c6qyxl`f#V5OjBTa`B?pIqdS7=`I zDTgpRADz1 zcznSS>M@^tTHAf0^L11IG`CC5@l*0?mo((pJmai|ttMIOKo0xeoF{per!!6P5cf

0eT`R&hOEr&8BW%`o9R^2R9GEve6o!^B=OQQy zsg?Qa-7<*cU{km|Q{+aKvW~4gmQHQgCH^(!c(i|IBl5c&AX!i9x+KT;|^Fy#Ce zN$c;c4!*ay*X;pEI@BjjHd;k|A)9;@{r5VPueY4vm!*GvRfic&r5yp;h&~nl0W32X z@JRvtcx@Y}q-N{@&OyrFfc9iyCfC|b>6%cq;{nyMdiRJhMF1=SpKpj}`(nm}Ij z#@f{^kT-3E={a_u>GqJ^=TsD1+<3Au`U{I?q46cqy|Dk3KKfcupzD|!5I6$`e!D49 zgD^OM;@B9)vS_b0zqxNQ%=u_N_h|cGoqtIa2cEdvZ~N%xw04hk8kV(w zpVRCYfWUWQ!~#1_r_f>X+8?kMjAET2A!3FSAE6hL6OK8yx9{0dX7kIOQt_Ukt;xn` z^IS@=1&A}EGm|-tMBHlTEsLAaZYE;_hyI+hXzDL~hg4wusZ#oGjWc zrl-x)$e+`QroH*gE95dGQJ9iV;&)obH`#ZrbGsGG+z0Kd#^A@#fb37Nvhl=cB7d;H z$D$fx1r&mAzL6dwQM?kZ4QSrvwwmq5Z5?jU4q8OPTz7HQa%Atm!XWs~E@VX8tS~r4 zn8+_2N$U$?TH%h0zewC#AGi(*`?xpvLD=2PmndQQffXk+!XRAzEO3(FP)37;6`T83 z^^CoCxgOZ)gtWr8q}zFdN6q}%a>c|<<6OfU12)1T{el5OsT;rr$^}QV6}#X9Et8BoWcAaBjQgyboj{8qZ=Nyi%&8KghAxF>w^TeS#hl79*XQ)vAH7N=A zWqd3Ox@_W#D||+>FpqgXqi>U&s2ab90pqOZwo7XGN+44^dg}H{OD2O1+)y>MRm(dO z@des`^1iaT{R6GnU&rf*q5BQ`?bn**3I}rbLUH=(Z8g&k8-jXjddT#73z7eo1lakw{fjhzt>? zx6HjtThTjjy%kT~_g8DYA}m4w`m%7KUZL^eCvNhBFyk7H{(T6l(yOB#~%406-vYt`zel*L?xUX8{*!iWn$SRYa4hc z4e>n7h;Xq^n#(-uDc3Y2d;D~()niG--U205^X?L{W=bq&zK^|Ek2O@NhBHkIoUCck2QbDXx}%pCL6w4oWH~%(yM+nhz%Ts+ZEko@G7icgIFcD zPq6h#zwo*Ln7l~8{kv^3*anp-aaN`eZL`godcnD-jS?Xkw|Y=ruCD}6i&$hFv;~v& z4Oc9;eL}sO+`qd0VA@k88IQxpt}s5B4HNVqt&?Nk(U__un1%7*?g#H^Kup-C=HK7b z4NW=aM!gNstsp6GUw!w`3ph_55(0S+_ll~n$HMR5AoJ?ARTLL_+mAbG;ldub(L8Pe zZxp$+Pu5MNXS;oI*3PNAF7tJBcx)|I<17X=Dw&r~Rgi(=w?U>)&c4~~J&RDJSpP1~ zrftg|X-Sq=tHk9b-M}5S$mj|B{!vnJMZ|LZ+0Q(=L}qviX-F10<+m`1+U=1LM7Fq3x4H7&PE>rbEZyl&dQPg8?cdqW*rT9aJ}fXp z$z#1q0r=Z&BGkzM^tNo~%in!nL4PxnG|P(c;S=?s7fkh*!&-gpMkf6~|9Q&!zq!MN zTCrl{9DK8lYKF66mJ#$Fy`XNza=4_Q!JTy%zKsiU{c2+e*)->tmv|cB8W(P>$zLPg zv1I^${S{QE>wtiD(Oe)M*UqRoqVDlH`X%kT+M+vOa!9`J910I}-(<8)zU z=`A>sOWS&XwO*mtcwK(7xvL^rT(QTzPnrhxVC+7rYWi@+%VlcO46jOvFdwPixnZ(i zD^8?>dP4~Vyk*3tU~u}5d-55TS!7zn@1Tit-KGVR)RWJSr(`Hv%+tPs4Xei!!IXsX&_;;Qa! zxRm3<*DV6S!Eb7_@p@SJ7OQkMP+lO}!w53RPWxt-=>6;J0s2jruvDe;1 zpLg3g73{}oKcw7`p1J&K=$}PS0~rNQv1a5(OCzb=wkx=d2CW}c6#Wm_5P>RQ51)!m zC;J?s9g+FUYYvyyLz%pDq6d3I3Ec~xY2`-E{Y#!J*0)!v`aMv?!2V4OH}?Me`BGGR z1EBoX4y_ROQMn>=khx%gL zR!fk#fgRg?y8Vdgnb^x3mI{hZ1jj+^VYN{b!sjK2bc*lluyYrAxGxQM1|&JN71Y{% zH)CI94RiJcxc)kdwynUc7=W zjdy-tlch{|fY-g1FhLWl3&&k?Gstj^scnVrTFadQE$d)Ebj*=_W_iR{_u&$vhVuuM z>Xp_51w{3pOV8RDe;@LptzAfk)ZVDw&GVG?8fcNu8UV#OG>JkYS$G$88{9xrfX&uw zkUs(H!LzsQaUtE+rG_;Y>vfq{2GsztHxJZO=>w`lDjdj$Gxi#6{gm{{XIr|Xnm*<2 zHUpHK$Vf|fS97+!#{qCp3~47P6`uQ{iK{8ut#oJe&Vz!v02udq zL@r=-m&avGUw+HeMOPf~@rdfz8Q@v_rY61xJx>etI#Pe6d5^$|YgeG%5d{U>xJ!}^ zxi9j294t6|nbbEcj91PXAa9QPA5|NG=C_`D%m$<5wb$7);5Jj5*?fO*xkJMU=gIU8;m|b`Ecv9C`No~|HQahuN4L{EHu2Q&XTJv`fc3^3N}@v z7Iyh18jYF4thTk)O-&Hru#BHN{QibN-6YMCCTdyWC|PU$fe*nc&z8fTG&!IwN@<;# zKdnQVW()7zSt`{i-Gp)S4uPN6Nn9W0ME8;V?y!oqB6@8v3Z;^=1jW)cjH@s+sWD{C~e(Of;bpA z^N&0-6S-3m`LH5#MiR?PuYf&5Tn)(srqURdEH9qqQ4c8glr8V&R$tK!l9tjc#a0_- zRw5)_SDoP_GHkay#6p0T21rkIT0a&a0FFMEv@>!g1;`Se9$fKS5gBINn6v$*jUEE^ zJBrrGB*hz5wx+=6^I!ABF`O7R!m?BLi^(5}T)aFsai&xA;0<7<)2x`X>C1aQU$SAe zu19ka5~vTHQsl)Oo_{LXAees@R-omMjXf6Vn?qYu-G8a2Tdk!%`n(uzTP^?&N^YXj zG=i7f)h|_$W(3OefWn3IzcT5&Z_K~TBJV(3$J*wTzXTUg1(SU#kXWMcXPJL1a3C=Z z8C&2lppbTKIc~SBBYa-cVr#%RFQLx4%Qj|OLycw53p=;*JHI{NO#k82{iV_M9EZYV zHQmXYY*gim?nbo%;qPBikNivD;e_g9B@I4ohF$3M?~`T9wKr<&0#Sfl12+CM5#Qd^ z*?t$qS`#msS)vkBv#)alb(o3sxe@B362j}+?6VETm5y|TVk)zd$qOuuvl#Fdl0T)X;rm(jccT8 zeucNGV_WBwmt#6+X?za9#i8?Hr1a4^NnI+7f&dxGvMRX@H9fCpS;7QH^KR4j5foIn z(C{mKQ3N`(t48&bq6g=jS+@P;V-9HECmloC)BHT4oPpx(38fi7UPCp$$@Ig8Gjv4> zp{PeWl)dHEQo$wrfcssw{8{3%p4?qQLmcx3+8o{C(1kz2djkY7r!b?-4N?nQX-V5O zGr6l+<6VL-4D{>J@g2MD@}a3;THWa4yidTQas#AtB((XWj6dUy_1EuPZCGT&V%2p- z>!qJlVBs!C_Q?Tgb3iUSE>_s<^OMmn{wYQAFIOxwuXvCocO-s6g|&@Wp7D^t%&A&&2vxj1TXDjZ zUn_v4=Hi@|Uzv&dpUC)QNty{{p9Ilvbq&><++PqnF67zvl;B0Tnrs`1jW~ zD803fbn9WI)Gm$k!;k83C<656i@QKE+;}%+t&bHOBZ@wh;vmcNNQ*#?HAv_Q0|F1_P&dBK770czgvjnhpmk>j&uxJ-=`h2GD zGi@xCI5J5ar&n3xnN2W?uO&4ih;8$BAd#ojL z$D?;>|0#!cjL%SN@p5v#<8(Ts_)xvboIvj~MH=)5<>FyTP|2E(p0oBsIfFi&qvm&*7)Rf^Fn5~Y`#d{Z z#dmQ${gA#Jv6?QOUhil~n8cyGuAf8X?hmxvIIHnLb3M%yi?N{5oNqB{C9bx926Lwt zfd5!2WTYOwTC7lzBZy+oF3e-EcR>M-PG`)pC=p5|PYu>#z1{NYGvGg(+M@Scf#fAH z+8`>&8m#1<*4hz8q3`Dtx?6R}?B0$Ng+#V4uo^?IBY|7PI9<0-CE4dPZiZgM9NX6% z&E8=|&1X`M>|Cvmi4RfHh(NJ;Yb!zQXwo|hc}qvkX-TEc6);v@HX7WfFM@&2Yuo|d zbq=86VDih2pD+coqTeSYY^756EO1v9CBP_%x)Z!I*|eL^BJ#VO3uDLM&P_VIC8GY? zDwpGS_p_8-gI7)EY4ZBVSYbe0_GEN+hXD5KBFEuV-pLb{ zMa?3Wv6=i`ZaX=k5CGntYWTA^9Z~Iw)EsE5q=*-dsP!KIN}lOC`ngeTmVwD~QUjUo zVd%9)w460zBO5eq`vy}%etK48YC{Y5Q|D6x+fOc|L|&~}3~Q*}+1}I6Iv+8GSPxbz zi>8|`dV?P0e|jBrzS&16u1!R_qR*rV_9``>?}=YJsgba$mnK?;9u5rKBKmHvTJ`!i zc-G8NRk=pe9@vwYpwZL!$l2CH(aie!n zvFF<;PPd%up7plhpcbna(+t=yVP~j4KF!ijVE0aiNvd3 zTUn^EyY2Kvx7WrDYRYv=Yq!m30(%Vb$5`zx}&2cW*-UB2HPdVXU9 zmA6Gyp%oRjb15XrBQE7<%*|pzLyRVU$YwGvl2bW*u)aGH-?Fa4kGLWDoI(aR* z1G~l4`LybO0?I8tY;K`o2S#g@Zscpd;-g}%+5Eae%a2Wyl(#?H{P633UvXt4H7?F!%O0!j^U2zCe{OLtEB9GR9uxxlQG z+8w>?QfMq~Snlj*vzzMi`-i_MnJ%ihL_SC4)2px~88yR_h-`TyI)#(R5Ukh?QI&_zxsgWYm8k&dLKGxTERO3r4GX9`LKgCdGTpZI18-h41U@G z83HSV?BfjudAN%7OsrcOU3*zV{Guhck`b2!3P$de{cmEQEbj5nwq<)0)`$B|UgCmt z?v(ilo<}Z8cO1`R{#3L6OEvQMPhv3qJW2W5pV`cEWm(s1{(eS5Z(EPxqTV2XFG)vo zv_W~uV%7uev_krL%QMj#OImee|w1i z^SWYe0@B;Gi`lVzIO0A9e)g)nW>)J)rOO*5mRh^UVQkt3E&pl&^hc&r`{>;o%(Wmy zAVlInIQ_`5+||p;*95ET{3paf1Hd8VLj-#MUw$*t%32fj#6zaLfq zT;I4H;HIUgNgnc_Knj@|Y)B{&7Q| zmji}k|NAxne=?d0rMkHm%uxgXG5Q|KPzAUErW^`sKh;$JLy+CQ4+N6O@c)M3|2}E| zJE8o4&6^2V&*zC|q8sjNpDTwb#zq4iiW3$8N1fPXSuGs<`PzDY$EH32oXITv5X14W z%j=&t)(P;LW!bZI?mQ*2+ZxU|yP|Sr)R;7EWv~9yuwVzU7nOd$SETXx;>#kRWD7X2 z1`DGX2>S#iDtsZQ1I=uucDm@{TeN@0hF9zM1o~sM`+^R<#u8etS0?}+()nXx`BL-$ zNfqVMgbvELi={*klwF5L>i~zYk;SsI{_a_i}cE2nx%#l)io?nY}?GVII#d9`;y&LxrQJ^l9x^kp3kWO?uPMGm+zBYTdRb8Ekf|EiE>Ez2nUx17r!A!^9-c z7y+}bGqgP$bE#FJkg__Qbp2=T&ifBU(aVi@W~owG{}U-9&=)4ZbBFuAtc1A6MA2_c zDbawrsxa=OlUFu3~IK|mw2TTU!R9KteV-Hm5jGZ+RqkE#L<+tw_{SPW-lqes_ zYv_j%knZ)y(z`GJxKX*RRJXzIPa3KQG>ZBg%u{yg>7fEDn!mXTg6t{GM%^ZzKrE*w zYI+`bvflspa5SLy`v)BOFMY>)rcB@dtJCIwp!uF7yuq>I7Sjc_>j(^SKUUoLTFRI)fqsLZ{i|pvvc<8L{Mxv~S;Uhg^REJ}ni-47&1qPvYsf zn*_B2zAl$E@`76K9#-wQtp|F*7h-Mp1sa3cCS&#vZWW5K4V(sXX#l(6i1z8l9X87Y z1#iH{;FJgbg+&?TeQMW7ZZvz~f7>I&QYFu^W9qSR!%(VOnsoby$75dzJ*Mox%Y0iT zd_EYzA1%N{cXJdz!k=5XH`YVba5cQ$jJPbwa2@6^n7>#J&-c&5?C)E|Q1aMW5ii}+ z+Ky%i*q$~F_#ZbT;1LvDK~n%Za0g5FuXhW6Mbz-RMJ3ks)P(CkZX#^n|7MAP=>1`d zR%G)$VoAkZhqm{Cefy3dowebWsdRLT{}UPY4AfE+{dcaMo5vsJuB1$m96Q)+ckrG+ zk`udId$fwzNU&|S@nrsC_y{^fAkQMkdP zrE|JFg%U*E6r8#*QY2Dx+btir`u_y8m-znBsxa87AG+0s%}rUOz7e zHP>UdLlNgaV^`N|PJ{3^x6-|(njU7@F@?}JB^sG^yWOw7hzX#nKZe)UIQp+4Mbg~& z=I5g!C->AJscZ$`Xs3to_GOFT!_*6$!@$T{j)NOo79=br?$1+YhM!&pUx=zhy}!ez`@=dDidAa! zy{MusFOEcoTnu~kr0KJUz05;^GKEa%rw{ys> z^0+>Tfs3_5{v;b;$Hrw7TDD+qG_Wt79RmDB+t0c;RF0ie5iV?F?iYMud4Qpd@4 z(s~UZ9BrE_&qjk-*z&0s8*K;#tg{3Uu2L5T4&6ny=BOJK|K!a_gl_{8o5}50;L6@3 zfh1nfgCOE-9sAsF16z-UOVTvX4Ru6D^^7EY*f(R?ZAU1oJIw*WtF}bidzM;#>@UK` z03#MF+DAg?3$E8kfY~}6exOi&aJwvhqw@zd;?QNu+7Hb44%}BSXHR<+s2m7FjzJmJ+;Ke2_NKcwqyN?et{bs2+tbjgTtxjbv2f%~`T2 zPB?KLwnP3n&kMDMiv4Fs8&+=6phUF3o z+Qdl@bY$^!tRDl`&14+bAk~SxGi+~VqzSFG0DL6Uc*5YXb>Lpiw|zSliK5}h?A!YH zc%#NbedVE;3aa(br&OqHTm0!V>xtgO$6k*GRm#FMx)kZ9AJlLlVkZI}jyKurtybue z24c2V{Y;1_KIfaF6|(!TLW|EG0(Abbne%@;DVW8G0d!ny$b<(xB30){8VoOXI#B|U zL~Tt1BvCnxJLLx(i87Ijkkj&1y{Gf=H*1sriL(}0KY+38acEy-&*~yxczG`bC~te) zDaK`UAJz+AOWaEhTRzoRcH}1)7TgL9AuI>xU0x?K$i#gdxm2g`Jt5@t%8)bB8=iLH zxdr0vU*8DGWaJ+0^&Sls=)U9mBK8I+RWJMXrvh-FLa7$?Y|eoybagx48`9z zH4V8r_3+tRJTLQ^sqmK?k_;z@YqwoRs&wf#^I9_EVh?dUi!Ta*QPl%ipZi&2Gk6{6 zR$*nlHO&Uv!^IN?bH7bKU}nw7(ED>WGs+KstMkqMP*)Z;rChUL{#3dckw2rCD;0VD z)D}|#8y9t$gYkH4Xa4&M{?Gkfr;kbag6$@RJ>Y(Q#Q=YE77Yk=!YRcB{e>*WMC(|? z6?+!#(&gfrln>eJxH~uM*1E5B8QamVw6j1ryfVpfvOlu%P&Qo>+6Zf=n=?e zTCu)GGJA$!!*IXDCtXFlM;W*6HyBz`7VCp>pE&@NYv~-h*>X_#7-C^>AG|tm?jIQ~ zmc>h0%~(4md64>ze%SHf2j!92a)Q|386%olfjSZUENiWP7l-$EiH2!2^coyC0zpXM zJIvl*vs^B7E`QSuo4`$l~rn}N$2PKsXA^!?~}<33t)|MQO`>T z4>WYaL;m1SVqXYQ?UtXZAt(Efg&A?>MFajz--98@EMTYr)IEEPtt^W25DW5Vn^Veq z@Nu`Va@^HGGE+Vapvg%fiwOcClT0i&y^Nt>SYEq%=LCwZl{Q`EAtGP$+_qTVUdL4i z>3!{zA6R^9-Ic=4vm3`j0JzRRpyIP-RI@p1Z=q`O{Or~8qcW*Kk>7hKfQvUQ=`OhE^`9*SPzvBs{ooC* z{3CZdhPZZP`B)!qh1|UNWn5Y0EsDmR4dkM#9dCv$SPc^oiX+=s-}{(e`NHc3Z&T8a zhw@@rW<*X|(7Rcgm0O~jpkCp*mRiDp0!6!_BVpQFMAUCBrxoBZhQqhcq^QQ6+dIgm zn&gqALIm2qqO3=$5vW36-|l7L`f8ZNx{Yi;-T6*}^__2r;rsc+$0bkl@jps#RG2T? z&LLsDFqTsCf%yvKyLmFuaaHdF>i5Ktyo<105L;AjCY%ZbkKR8Y8Q@4sacw(JyyZ8u z$UIK6v49_%N^c;QZ~3yVK85|1T>oO3l|1<3#pXd*o^!7GUPDJ?eV1|m&Z|u?E(tm{ATx=eHcVT58o@;1e>WG@F2KiXe=A}>&2O@7~ zTaPe&MrsnLIH_=;nfv3vw&$9m5;g*_XU7r#i45)Rac_CRZb0PBh9JQRxbFvfXjc*wD zz`^!m5<~FRLr` zs6&v{5&Y+6@y3ZW%}X(?;sh~3WU>J?i{SMBMQrielSq{azQ9)Z#g-?>R<`PKm-(!= z5llG|>i9T2tXn?d@7|ruZO`uzbK_Z=l2;_zy!vmuD5nNGb(s1eCmOA))h;mQwl5g z7hhz#lq`B8|IV)8XQU4X!rg$hrP&y+k#FAE^>iQ2<%MwmUcu>>KS+<7YqX)@e*%&6 zzQF*%_-=X``ijVPuy+QxH`+C6V0olF)wF7V*Ziy8LSGH1)wXiA$;gW>7!#W=ho9bb zk|@S9y%wt9wI=kIuWTn=RG9IUC2`#KIVV7VNNn};>xy_~Colm0!-^1|ex3`9}lpoRxy>hi2;))1FV7#}gdYT{ILl<3-DVzZru z!!+Tc4Ek0@WrkG-yvRs;TcR{>&FB@Et4vQ-EvNx|v&a5qyYp1ORPEY<{cT}p?3k#( zqr+EEs)@6W8@vvuu|TiK9usM71+L_CRrYD9g*HV;xr79q$W$4bq(^i4rZ)nR%;Vn# ziOlkKsj6|Bj_G!DwW>hb)9%b`^%1aEXlOy*@@4`<820Q({XaCt-g{R0sZ;6(F;(D3C-h_7kqPp)ugeltk-5P32|D}>7gQq!9iJDZk z+3?E&5g)~ze$r(8_VW0jUaoy8VqB^htjbX;uPI`cGp)3Z3Rve}CCZb<+9O)oE`L@J zJR@R|g!oOdJR}2Ed~2D_FE-PFR?3F+$<$D8n2q&tr1{O>NFCHyTOXLD6q(i*YpRN9 zijUCn$w*e37LN3d5BUrVJj!g6$Vz^#CI;gxww{;V9AQ%|O$0i9J@!dAiIOB-e{0WN z+CXzvq0bo`+Jf(^YocqKGMk`a9ipLm>0M>X8_)xPS;8(Ke}Bjv@#4iRp=zwGxp z%cwv(@p1kDo&?tnZP`LvXeu8w-q^AGgI~~ird8}rS-f~5x8I-sQg1mmZ-A>P1e4eM zHwIn%Z+IMs{Bmg66B4GoCNa7%m-w260UY^Ml$ABPu;5GmN|5mV+DSW)wQF&)V~dXJ z!8E=sf7L6{2%OZb7D3{&UBHKXlz3TV+~c-K?lrp{+32C%zaj2UoizfC<~{@vUkKj# z|Jq+PeJ}W;tb>aPD}|3GhfZJk^pl9sS%jTIyOJySW^B*Z=}emXj@jCL-KH>pAnAke zCyx@HT<-=x73zN;oH6!3yb*trw;)K?@>4xE%qd8UF z5Py^R2EkhKo~^>kMjwH+l$@27`xbjx$SXHI=Q4P1>v}rb+rS^%AZ#uc_V;48Gv9Nc z2~t}As>g{;!}B-Ze@0WH(}x%FXyc4|hIh|2qS1=7@CS!?PW~OUhvHbkQ~1(p>;ChX zU8N0VM-U#3l?Tz4VJ#+`Uc;lT<8`V;DJ|>MAl?~OuHwq6JUv}6m)>Yj?+%+9$; zr2wfMWh@d-A+L~iX!&?hq~+-?TrUL!?NEEJ{qWLvoQ|~XjPigt%>A3Z{i#k3&Ork} z^-Q-I++5m9y$U{`S)ylJPk9(Qm~OPcq$a#w;SI{&BQ$gd<6tIQgdmq+g=RXO&yVBr z3D;Yh1o|4dl1p$G-FK!N3)UxF$U~Z28Ob#@E|9-pKNfWkJ8@8z4}k@3UL-*u@*wN| zd{UXtIs~C&`_BsOm(stF*Sj;29y9kDP=}r^KNf4_T4?$#9nTab6U5tR{^Eu1$p?(H zmxO3At=3)pc>m&8k98+g8v5by9*G;zxtb*l5K*QIfiPJVX8XfFf;jL!*z+*(3DSsx;moYD~glUj$rIS=;`XfDN+c6MqUsQk}+N?XFuRyq^--&)}YfLm{ z#^)TB)RX0_$7wliXLwtoO6G3#_Ef6bA48ntcYH7{4|&aGekwJib-Mm}X8z)BZseVi zdxuM3olaE|#M*aloAI}Pp;=gA?jWe?W?z~%c12DBwSNZ}`+o0VTejy+XRV&c-H{e3 zkO0}wTa!~tp14HHYDeLT3Zr)R-|qp(%kOgs{oj=^IGe&I$O1(dz1Cnpd!2(BmN~aL zg?1sxs%*jV9ML};p}r&!KtkUAq!>eF(jN{x$V;w!h>T==Y_{lvNSlo-`t}giZ#(VK zsIE+xt7}R6Y?FKMSv{yl*j3HL`6Yp^MWs4E`NmfQUEY?X2paO7M6B|?cb=tRIp6cf z65jBLiAmF+fo)V2Ey@>G z?Y8!0e=AtabdzrdBdFDP&`9m?-(5_}Fc>O{fzbe1+L%D)%g3Klg> ztP_$15B;nTSy=rTy|or3{X@I4fG@h*__aZki>~NG@*CQV(3W$))(J!SHEriDlhNl< zxu-{Z;_m{bDNB6lYA2HCpXssW!sTbzG)B6g1s6aXxpD2m6zAK#JUi?i2b+NVIvibUzv?pUj@RcM*~%o^rzI5D*xZCWfA* zAD(ZU72f@8`d6F6$+oS+wSDc%*}GRD*olZ_Ey>}b)Gy?GZehwul)b+BP5PY6#*z7{ z#sGaCaynkmyXM!JHcaBRo&kT^%(=5?E|IT8j6sX1>U7b&rjK*u5_^hF9y{ccwaxdF z7US;xiGi0K0dEPlWcNbl`e!EmNy213gXgvmP7ay#*O z3cs`S>xG0L&nX{$PU|9v)bh${=I5#_E)U_3wAx0#{a}NM=7dC?Yc|#7q6OU#u6bUZ zj>pdqy&-dc@0Q9OGd`#7(_-2RJDc|I(mU}zoh)TW%|?}7_WTkxoF~z~coBoK3fc#5>RBAJk5f)SjAP7)K( z6a0^~jgHef56|SO-Y1k{``naBPsJTwnWM7(Q$Q#!?mI6!NlP^nO^p26i|)(+X)_&Q zj2}UBnR_yY#W&6M0P~zYwZYdavs+e1=FtKtrD*rc7Yq3EXO%B%`FrwN(U!ySmdI;-GI;J6soSq}@W1*%xJD=eo9dr477(M=w+O(B$eJO}YbGn|@wL z7g>=F2b4rFKn}AW^R&oS}IpA)P!vzje7!{nu<4XWL$cxk=;+hk=_I5@fWJ1 zN6{H_jmE)kF0t5(jRm2dj&QdPz?V*?Qu%{?TCXz^XELR#;=qN@ zjvLp%7Ick`iBqd`(WEbWAzo95wX(ALPU8ibZ;l0X?IB^-)Jpd(IrbX z7-^jG``JJlMEP)Gvl~B&Ax^4OrHa(mVZ0@=@7UD!+}Nmc3u+KTuz9UHmUFiP2m0VT z`^TO8Z^ENkD``TrJD=|qeMUS+DkX^Hu( z)rmf@{j=*Tj#@U(T>^-ppxeI9Q8?MFrw$GZfS$1NFQRD2C#zN8lRF|(Vw{x1Zzr{( z4Nh#2CV#dZtoT)$?TjDgR8aBNx^L?Z+crPrcS$Yov9V%4YFrV1>}pqfFhOj4YOjoQ zSdRF?6v@XK%+(^jCd`{3k!kf>GIb4@QGnONUw0R#C^_Bhi+_H3(>pzO)m5nT;__n4 zD>a_AALV);=R#YVxOx7*7!E zc2`T`I^^ne6Ru~erSzkeHNJY9F@j{H)&+Pl_xn4@!v?70TEl0>BxgradzUDa%tt3D z9l0;kCjn}~p&~+aq%PJ~`yC(OOdck(G$~O|@5Q8_(y-LkuU3wAPaiGUJf2d+B@Ik1 zl4i8Njo)r3Nx0goa~M9oH(%(tKYu=Yc)UJEQ_jr+0@FYHxM!GTNxZdoPwWn@!J#Q3 zp{L&CGo~(Jr)&C?eeZ3Mp|_?|spruc?g1r7o(()VUpmX*f{&STIGwYP_ta|$bJFSL zwK_+>UhX0KX0K4mY2nhH2IU)f(VxL<-SRmmDIwViGEh5PZ5?EXsJ_&)b-azO>-uDw z$@P(zveSn^RMa00rc>s#ls;eXTYLv$*iVS_i=+W&Y?h2vM8`wdFcbxmp&`Gm%%(xQC+8?8_e`3R)#SX(GR78tcp+E{oK zWr)fuE^86WoR~Wgy6yvAfe*LJyh9SFb9l6jxrltP=L-&mixTGYeTZG}-OpkoAIxyo zH@Aa=7Os!q?S>xYC6m4KT*=oSB+8!^zM6AfGH`uL@HBh-hilO7%g(l|_kk3y!-Ev# zbv?OK+wTLY*M&P37h0P=(ynckMQ?K`kYByMmDAQei9HnbHlu_Vv`5X6w0m>S zRNvF^wyvR~w_UZ8-(I!Ms`ZbDNJ}vK7s?jL@<050J0q6L;B?qIb<`sh8k4Aj*BBqd zoL-*G{Oto|j3DK=*fCRfQxr)iQ{hVk7#;aZ&*E3oL6!=y_Jwn_HxWn0VyZlmEYLoK z=tW)6b8Q{$^3*RM@5-#x7Ja{BI;tn#IYhW9b@AE$PL-DvJ$n~iwb~hhyn1W&L=vw+ z6wX1wn804PQjM;K z@OWoZxka4$pyE4kg>6vp=VvZ`em8;U_>P1xs~;BZT34FFj_}UBo^Nr?ws}3nkNL64 zpi(B0BGJ@^MLndIA>k8dg9rCLjci!&JilRIVGjO2ddF_C=r5N^X-@x%-cAmUFH%#( zf^Rhjf^{}_Fpto7;}Ah9wVq&)#vw&(^bh*_PAa0y!383;N&tLnVzxEXk2;Pad|~wb zb=ixj1F1Y|sAxs+Df6#Z9iy9X|7@DYuskG|l_Y8fDKFS*?IdfZm)t$G7En0b}w8Oqn`nk?uY*V4GN$f`Ai89h^Fwv8!mDmrs>x0Gmq=Rw9D?xDe z0H-0AoJ28qN5qvFE2qAd`)l3$7CS`kQf@W%Hl2K8>2q@Khv@Ct4*@iBc6*$~M@uar z>A70>#AhOv9CKHvld8{6Hzqt!4VsR3c~;wZvkKofMgqwNapQ}@{Kp>5)|o;#voA)T zw(Nb5NLhovK9B!<7W~Itn5Tv%`i`XooGHg?z4!rh-b>!)z-ZbqYnEiz zxFMw0;Y%E`?DtcYYGr0A8oPQlhv%EOARCs92lk?>%p?rqakom#z9&--A+%&FR zwtlX+qF!%o5bpk$u+L_Zl3x=OTq$uO4U*jFRYx}4ime6ZW@ib9sjp`KBGW3?n;fzY zrb~sJ|4jaKj`_eesH}z-qZGaE+ZIc$`mfW#Kdw0D2Z%9dSCYF7g2>F^^q7~R&nAs{ zMW+g;DhV4`kdHD-%FyRqG?zf#IFNjLMYf}bk93Ikf}%yibcSu{YlO$TEcrI&LQg-? znEJ=FMCGzDGAkoH>A#P?e@DbW;sSWLPW<8bB4;i>C~r)fm^NW&4H8$;iYo&;ed$6v zX2WO4+$EpP#ZWiqFqhL*klrLL(w-C;Suvw?M9%v1)gpm%{SfjQLrv_D3g^CUGR&QQnNx;o*g7~Fy>mWvLa(W)>fk{A1OfeGMC`3K3`d)FeUT6##U%u zN3(4cp^p*LejL`Cz-}})SUxhr(a$K%gw$r|f@Zi5#%apW(W>L9*CrgWjd0;PYUb?9 z)Q_t0m*-5Pib=Rv4)*%+$0+(6I!mjpzKk=*zSu-Lybw^rSd`~EnZ1oSI21$C=)#Qa z4+ACOd70#%Dyx)iS|t$_$Ecl&YO6DDP&j>)%gEi4{y1#cm+mv}#j4G1huxk0Y(~YY zc_T4PZ$Pl$XTQrIP;e4Nfto*7*})r!S#zCBLnAHW-&TyCnmjZ;-@dIa)7`f+?I9Se z{!Mf;9|S%)Pxvf-kgOZuoicNw*{UTRu=UYfaluFCmYDS$&s0;i@}Jb*zrCKbk;p(q z*=asf{^G#Hek5Y72>l7Fv+geM^6!4FjBKYHM03^tk$o>_NE^z=myQ7JSJ zw_Z_w$Nxz3O9oFV^MPpq|F0Lp>V~6gh)0I7?ZYCSI?Enj(h@mYH%#}Y69lED}nui!_p1z#7@B5wa9OwQ2J=gy6 zT>H;j`(FE6d)<4jeXV&~X&B0QvG1q-7Owm7Wcfu3v zT6nXvH!@_Okcg0%*6Y@FA}yy>4V`C@V2LN7n}WgD=puj z`=)b@{jQ-9iPk zm|a`dXwWj3f=vZ+>Hc0ux%-yEKRNlhw}FD4v-ptm;qTgY-YeMxa@W2rgb2M*W5n+_ zLoNxEgTpc6@caFzGaW=x!X-`qCD+#7{O*l`Cms>IjDXikTz1aOgSSui^wz*#e_7Ha z8Lz<*{19(Y5cnL#nV;?ItoDKjKi(?GM3Lo0}Lo-eJ z1j-UEhMc>{oYiWs$Laj0Gj#otX2v-)zFkut?B^M}u_};Mrn|eDa%nBVo-Ckb-WQ2a zdR9DeP+3e%SL={ql_Tqzg<#xRVfQYrqa*E>1uCG{*E%_gc9GW0BE-#`OZD3wm}TKL zsceS;pj)5G`!>VAF4Nt!-IDe1C-3Ay2Q@YJl-Hj z=QX?nRHj*`TQgSnwk5qiHzp3vz|-{6j_4f5ebAQV@-E#H<|rTfh-H=bVwWz#te&r4 z)zlv-pKawJW%sVQ()kq&@V+gU zx_uT?IaPb2j;iHi(ZoM>0GQ%UT#J}*F*nooXS6+PPVEw@KY8r6NsN|9eSc?~)@?m? z;(oK!=i(Zl#k*8%F}3kikf$~%3~&Xct)&U6c9jqSF_@Z zARGWkQuiN{8vRw_(N~zI#$vRaYgFUm=pbrgr>N1vFC*w(RX3j1SFR?kYLi3eFEVQ{ z4}^~OURSK8tO$g50RVt-j27-%6Bzmy&gGDG+R+>P3-XQh#wEKm#07}`mxPy+ zMjmC+n!9&C?+l7FE@g#*^4`WDqSGuuo#e8fOuxIT>^Mn?YrhG1GLe=f`7%&CS^0ia zPaQ{AMk^svwr5C&BFS_E-ItMQ=={t?)}yVIe>ZvfAeyT8s;~!tuD&G z%;GnJG1ei533G-fCZYKhgM(~S!9rqvEC5VzeAs;yc1A}`{|wS5f@y)Q(EEQX73V}{MHfYa@SX1~)_DE!tR`Kkl9<1gz5ZwjXFKqoIw z8<2oWsZBdp|JmIMtGmw_)FJ4BSR9K17{t8Alc5NUc*IpV_w&eg@P3)`93=MgDKh4a zyP5qp*9Z0iQJrzBi3wdrsUHAgpes@@8!3-^-Pa8j#Iq7X6tEc>RvK7kcaceFJV02^ z3wqw-Zb|$jMx#D?%V$%I7gEa34?|EUs$!vmAC9pCmL5xg+;lcL9#fPIYU~ovib}fP zCLU;ny%*{$wwgmtQSSqamRvwMZlquJloIZXH+-kghkC5s0#^fS{kmH4*n#S83tS(r zY`>HeyR&u6UJ7##yC5v==&*mXw}P{kM^a?cCr z-kE>my!K>g{Whn;P^YFbtDzanxF}1Bh#udOwQUHolIeV1oMpg_=yvpm7X_hiy64db z1^2t|=z7@>?fM_oSrEd6M2WT?5+PtYf^@zPs3k)6iIeX67;!CU%G$(vEE`^go<<@F z6Wt>7n}j?0i=L0~g#CWlQ6hGyU|Ga{LzkQz7kr)>GBFy*<=`h3n7$F+W#Y+Qqqzv` z0-4zGR-Y*k*t|bzE>LI$Fn0f#}uj?|Sg0 zT~5IVvlNOu>$;-{tE0xM-edSTsUkbcd?q#sJ@GU$wNi1&SH%}&>GpLQXpNu?>F^yh z^Vd60_@*S!h>EwHf^hAVAD?YjG8$W9xC>i$z- zqPhtaJ!Q0JzdTl1Gcv4vt0QJ=$L;gr)n0*7;>ikVKKCcRGs=gg5lT;)I4wt zm9nRGb8*Y6(v9-PeHc|7v~j*od+aAA8@6J!$75VZE{o;ki>L9^OlXO@ma+^l`Rw8w^MxDc;IjV z>Q0!#94kp}NU?MgK9|HU^N8u1sZA{g0_KI$qWunRZV%T@H!#H8<>Ya1^T_4n0rX!7#wkBqbL2wNV3>C zFYPYpNl0jevsoQyIAtUY9e9%@qxDG&K!~s7G4@93g5XDbTR@-J%~_3FJ;jkkjj?y- z#RJNX@btvH84t-qkk}75*qb^;I%V$1`(0`A9Fm&k3(PZ298Dv5wmFD@xb)%+cCHXv zM%4a^UVF2C2C<%OGlVhuGNL^#XoJ$nVQNY8o3!c%ay6q@rVH|aDe#{^44*eFL~^_Q z@Yr)yx`aDEq+vz=oZ2cZ4R&l*4Rc)w@359rPytvkVK5FMxYrIv?jUeewfd zlOu5|fV3H?wJ7`$0rgBruEBT-ZMY%c7t1iCrw{V8NyWk8>otwP2EP#bbYWWWNSFpv zc(@Cdu`Y`;lyB2}|=G z{Xf_DH|kGf(yxFKI6y~8!M|xjFp^oIdyj8C=$};hBd-EO2Scq>8d-oxrT>^=6n{K+ zI{(adE17; zOn;}$|G{OCFEer~2K1L(ssAf2*N=hp=e?h`nf_e)UlBO~n(D1xiroEg=KhReAbtDb mIGE|b7z;pPDEa??J1idxKx-Yt=gIR-jPJ6(i5`W)Q2qzWpP9`7 literal 0 HcmV?d00001 diff --git a/src/pages/help/troubleshooting-client/windows.mdx b/src/pages/help/troubleshooting-client/windows.mdx index 8ee74836..8c1a6548 100644 --- a/src/pages/help/troubleshooting-client/windows.mdx +++ b/src/pages/help/troubleshooting-client/windows.mdx @@ -98,7 +98,7 @@ Windows Firewall or endpoint security software can block NetBird traffic before DNS on Windows has a few platform-specific failure modes worth checking separately: -- **Match-domain names don't resolve, even though the NRPT (Name Resolution Policy Table) rule was written.** A lingering Group Policy `DnsPolicyConfig` container can stop NetBird's rule from taking effect on an off-domain machine. See [DNS Troubleshooting: Issue 8 (lingering GPO)](/manage/dns/troubleshooting#issue-8-windows-nrpt-rule-is-written-but-never-takes-effect-lingering-gpo). +- **Match-domain names don't resolve, even though the NRPT (Name Resolution Policy Table) rule was written.** A lingering Group Policy `DnsPolicyConfig` container can stop NetBird's rule from taking effect on an off-domain machine. See [DNS Troubleshooting: Issue 9 (lingering GPO)](/manage/dns/troubleshooting#issue-9-windows-nrpt-rule-is-written-but-never-takes-effect-lingering-gpo). - **Active Directory login, mapped drives, or DFS fail** while a file share by IP works. This is usually a DC-locator (`SRV` record) problem. See [Domain Controllers as routing peers](/manage/dns/internal-dns-servers#domain-controllers-as-routing-peers). - **NetBird won't start on a Domain Controller** and the peer shows disconnected. The Windows DNS Server service can claim WireGuard's UDP port 51820 before NetBird does, so the tunnel never comes up. See [WireGuard port conflict on Domain Controllers](/manage/dns/internal-dns-servers#wire-guard-port-conflict-on-domain-controllers). diff --git a/src/pages/manage/dns/index.mdx b/src/pages/manage/dns/index.mdx index f8c75d4a..16bf79f9 100644 --- a/src/pages/manage/dns/index.mdx +++ b/src/pages/manage/dns/index.mdx @@ -100,7 +100,7 @@ You don't need to configure custom nameservers to use NetBird. On Linux, peer do NetBird configures the operating system to use its DNS resolver: - **Linux**: Always sets up DNS via `/etc/resolv.conf` or `resolvconf`. Original nameservers preserved as upstream. -- **macOS**: Uses system APIs (does **not** modify `/etc/resolv.conf` directly) +- **macOS**: Uses system APIs. Match-domain nameservers become scoped resolvers (visible in `scutil --dns`, not in `/etc/resolv.conf`); a primary nameserver makes macOS regenerate `/etc/resolv.conf` with NetBird's resolver in it - **Windows**: Sets the network adapter's DNS server to the local NetBird resolver - **Android/iOS**: Uses VPN DNS configuration diff --git a/src/pages/manage/dns/internal-dns-servers.mdx b/src/pages/manage/dns/internal-dns-servers.mdx index 25d903c0..e5259b83 100644 --- a/src/pages/manage/dns/internal-dns-servers.mdx +++ b/src/pages/manage/dns/internal-dns-servers.mdx @@ -98,11 +98,17 @@ For details, see [Manage Network Access](/manage/access-control/manage-network-a Each peer should have exactly **one** primary nameserver. If you don't configure a primary, peers use their original DNS settings for non-matched queries. +A primary nameserver does more than catch unmatched queries. On macOS, a match-domain-only configuration registers a *scoped* resolver through system APIs and leaves the nameservers in `/etc/resolv.conf` untouched. Applications that use the system resolver follow the scoped entry, but tools that read `resolv.conf` directly (`dig`, `host`, and some language runtimes) keep querying your LAN or public nameservers and get `NXDOMAIN` for internal names. Adding a primary group puts NetBird's resolver into `resolv.conf`, so both kinds of tools query the same server. If your users report that browsers resolve internal names but `dig` does not, see [dig and host fail, but browsers and curl work](/manage/dns/troubleshooting#issue-5-dig-and-host-fail-but-browsers-and-curl-work-mac-os). + ### Search Domains Toggle **Mark match domains as search domains** to enable domain suffix searching. When enabled, typing `server` expands to `server.company.internal`. Only applies to match domain nameservers. -### Example: Split-Horizon DNS + +**Don't convert a match-domain group to primary by emptying its domains.** Removing the match domains also removes the search domains, so short names like `server` stop expanding. Domain-joined Windows machines hide the regression because Active Directory supplies its own suffix, so it surfaces as "short names broke for some users." To add a primary, create a **second** nameserver group with the same servers and leave the existing match-domain group in place. + + +### Split-Horizon DNS A common setup with two nameservers: @@ -115,6 +121,27 @@ Result: - `app.company.internal` → Internal DNS (10.0.0.1) - `server` → Expanded to `server.company.internal` → Internal DNS +### Route All Queries to Internal DNS + +If you are migrating from a VPN that pushed your internal DNS servers for everything (a common OpenVPN setup), the equivalent is the same two groups as in the split-horizon example, but both pointing at your **internal servers**: + + +This setup requires internal DNS servers that resolve public domains too, by recursing or forwarding upstream. Active Directory DNS servers do this by default. If your servers are authoritative-only for the internal zone, making them primary cuts off public resolution; use the split-horizon setup above instead. + + +**Primary (internal)**: Custom DNS with your internal DNS server IPs (e.g., 10.0.0.1, 10.0.0.2). Assign to your target group. Leave match domains empty. + +**Match domain (internal)**: Same servers. Add match domain `company.internal`. Enable search domains. + +Two nameserver groups pointing at the same internal DNS servers: one primary with no match domains, one with match domain company.internal and search domains enabled + +Result: +- All queries, public and internal, go to your internal DNS +- `server` still expands to `server.company.internal` +- Tools that read `/etc/resolv.conf` directly and tools that use the system resolver query the same server + +Two groups look redundant when they hold the same servers, but they do different jobs: the primary receives every query, while the match-domain group provides the search-domain expansion. A VPN "pushing DNS servers" maps to the **primary** group, not to a match-domain group. + ### DNS Failover and Overlapping Domains Configure multiple nameserver IPs within a single nameserver entry for automatic failover. The client tries servers in order. diff --git a/src/pages/manage/dns/troubleshooting.mdx b/src/pages/manage/dns/troubleshooting.mdx index 16c0e5c4..58a63657 100644 --- a/src/pages/manage/dns/troubleshooting.mdx +++ b/src/pages/manage/dns/troubleshooting.mdx @@ -42,12 +42,14 @@ dig @10.0.0.53 app.internal.company.com # Replace 10.0.0.53 with your actual nameserver IP # 6. Can you resolve match domains through the system resolver? +# Use the tools below, not dig/host/nslookup: those test a DIFFERENT path +# (see Issue 5) and can report NXDOMAIN while the system resolver works. # Linux: resolvectl query app.internal.company.com # macOS: dscacheutil -q host -a name app.internal.company.com -# Windows/Cross-platform: -nslookup app.internal.company.com +# Windows: +Resolve-DnsName app.internal.company.com # 7. Confirm public domains still resolve (verifies split DNS is working) nslookup google.com @@ -372,7 +374,63 @@ cat /etc/resolv.conf **Fix**: Limit to 3-4 most important search domains. -### Issue 5: DNS Works on NetBird Network, Fails Outside +### Issue 5: dig and host Fail, but Browsers and curl Work (macOS) + +**Symptoms**: +- Browsers, `curl`, and most applications resolve internal names fine +- `dig` and `host` return `NXDOMAIN` for the same names, short and fully qualified +- Typically on macOS with a match-domain nameserver and no primary; hits CLI tooling and IDEs hardest + +**Diagnosis**: + +macOS resolves names through two separate paths, and they can disagree: + +- **The system resolver** (`getaddrinfo`, via mDNSResponder): used by browsers, `curl`, and most applications. It follows *scoped* resolvers, the per-domain entries that `scutil --dns` lists (flagged `Supplemental` in its output). +- **`/etc/resolv.conf` readers**: `dig`, `host`, and some language runtimes read this file directly and query the nameservers in it themselves. + +A match-domain nameserver registers a scoped resolver, and the `resolv.conf` format cannot express "use this server, but only for this domain". So `resolv.conf` keeps your LAN or public nameservers, and `dig` asks those, receives an authoritative `NXDOMAIN` for the internal zone, and reports it confidently. Resolution did not fail; it succeeded against the wrong server. + +Search domains sharpen the trap: they *do* merge into `resolv.conf`, so `host myserver` expands the short name to `myserver.company.internal` and then still asks the wrong nameserver. + +Confirm the split: + +```bash +# System resolver path — works: +dscacheutil -q host -a name app.company.internal + +# resolv.conf path — NXDOMAIN: +dig app.company.internal + +# The scoped resolver dig cannot see: +scutil --dns | grep -B1 -A4 company.internal + +# Query NetBird's resolver directly — works, showing the query succeeds +# through NetBird's resolver (replace 100.x.255.254 with the nameserver +# from the scutil --dns resolver block whose domain is your internal zone): +dig @100.x.255.254 app.company.internal +``` + +If `dscacheutil` and `dig @100.x.255.254` resolve while plain `dig` does not, the client is working as configured: `dig` is just reading `resolv.conf`. + +Language runtimes split the same way (verified on macOS), which is how this reaches developers: + +| Reads `resolv.conf` (misses scoped resolvers) | Uses the system resolver (works) | +|---|---| +| Go's pure-Go resolver (`GODEBUG=netdns=go`, the default in `CGO_ENABLED=0` builds) | Go's cgo resolver | +| Python `dnspython` | Python `socket.getaddrinfo` | +| Node.js `dns.resolve4()` and friends (c-ares) | Node.js `dns.lookup()` | + +Windows has the same two-path split under different names: NetBird steers match domains with an NRPT rule, which `Resolve-DnsName` honors but `nslookup` bypasses (it queries the adapter's nameservers directly). This is why the diagnostics on this page prescribe `dscacheutil` on macOS and `Resolve-DnsName` on Windows. + +**Solution**: + +Add a **primary** nameserver group (leave Match Domains empty) pointing at the same internal DNS servers, alongside the existing match-domain group. The primary puts NetBird's resolver into `/etc/resolv.conf`, so both paths query the same server. The internal servers must resolve public domains too (by recursing or forwarding upstream, which Active Directory DNS servers do by default); if they are authoritative-only for the internal zone, point the primary group at a resolver that handles public domains instead. + +Keep the match-domain group with search domains enabled; do not convert it by emptying its domains, which silently drops the search suffix (see [Search Domains](/manage/dns/internal-dns-servers#search-domains)). + +**Verify**: `dig app.company.internal` and `host myserver` both resolve, and `cat /etc/resolv.conf` shows `nameserver 100.x.255.254` plus your search domain. + +### Issue 6: DNS Works on NetBird Network, Fails Outside **Symptoms**: - DNS works when connected to NetBird @@ -426,7 +484,7 @@ sudo systemctl disable netbird curl -sSL https://pkgs.netbird.io/install.sh | sh ``` -### Issue 6: DNS Rebinding Protection +### Issue 7: DNS Rebinding Protection **Symptoms**: - Router blocks internal DNS queries @@ -457,7 +515,7 @@ config domain --- -### Issue 7: Active Directory Login or DFS Fails (but a file share by IP works) +### Issue 8: Active Directory Login or DFS Fails (but a file share by IP works) **Symptoms**: - Domain login, mapped drives, or DFS paths fail for remote users — yet the file server is reachable by IP @@ -479,7 +537,7 @@ Running the NetBird client directly **on** a Domain Controller is a separate cas --- -### Issue 8: Windows NRPT rule is written but never takes effect (lingering GPO) +### Issue 9: Windows NRPT rule is written but never takes effect (lingering GPO) **Symptoms**: - Match-domain names don't resolve on a Windows client, even though `netbird status -d` shows the nameserver as Available and the client log records the NRPT (Name Resolution Policy Table) rule as written.