From f8f0d0eba3c2b6c23ddb5a2d2cbf24143dee0aa4 Mon Sep 17 00:00:00 2001
From: m3tam3re
Date: Sat, 8 Aug 2026 15:37:50 +0200
Subject: [PATCH] feat: pgbounce, librechat upgrade, homarr
---
hosts/AZ-CLD-1/secrets.nix | 7 +
.../AZ-CLD-1/services/containers/baserow.nix | 2 +-
.../AZ-CLD-1/services/containers/default.nix | 1 +
hosts/AZ-CLD-1/services/containers/homarr.nix | 48 +++++++
.../services/containers/librechat-dev.nix | 2 +-
.../services/containers/librechat.nix | 2 +-
.../services/containers/zammad-hr.nix | 8 +-
hosts/AZ-CLD-1/services/default.nix | 1 +
hosts/AZ-CLD-1/services/pgbouncer.nix | 136 ++++++++++++++++++
hosts/AZ-CLD-1/services/postgres.nix | 24 ++--
hosts/common/ports.nix | 3 +
secrets.nix | 2 +
secrets/baserow-env.age | Bin 1551 -> 1004 bytes
secrets/homarr-env.age | Bin 0 -> 844 bytes
secrets/litellm-env.age | 34 ++---
secrets/metabase-env.age | Bin 1080 -> 682 bytes
secrets/outline-env.age | Bin 1303 -> 861 bytes
secrets/pgbouncer-userlist.age | Bin 0 -> 2173 bytes
secrets/vaultwarden-env.age | Bin 28880 -> 21149 bytes
19 files changed, 235 insertions(+), 35 deletions(-)
create mode 100644 hosts/AZ-CLD-1/services/containers/homarr.nix
create mode 100644 hosts/AZ-CLD-1/services/pgbouncer.nix
create mode 100644 secrets/homarr-env.age
create mode 100644 secrets/pgbouncer-userlist.age
diff --git a/hosts/AZ-CLD-1/secrets.nix b/hosts/AZ-CLD-1/secrets.nix
index d8d9a7f..bb60efe 100644
--- a/hosts/AZ-CLD-1/secrets.nix
+++ b/hosts/AZ-CLD-1/secrets.nix
@@ -13,6 +13,9 @@
baserow-env = {
file = ../../secrets/baserow-env.age;
};
+ homarr-env = {
+ file = ../../secrets/homarr-env.age;
+ };
librechat = {
file = ../../secrets/librechat.age;
};
@@ -81,6 +84,10 @@
file = ../../secrets/pgadmin-pw.age;
owner = "pgadmin";
};
+ pgbouncer-userlist = {
+ file = ../../secrets/pgbouncer-userlist.age;
+ owner = "pgbouncer";
+ };
vaultwarden-env = {
file = ../../secrets/vaultwarden-env.age;
};
diff --git a/hosts/AZ-CLD-1/services/containers/baserow.nix b/hosts/AZ-CLD-1/services/containers/baserow.nix
index 07f8849..dae8e50 100644
--- a/hosts/AZ-CLD-1/services/containers/baserow.nix
+++ b/hosts/AZ-CLD-1/services/containers/baserow.nix
@@ -7,7 +7,7 @@ in {
environment = {
# BASEROW_AMOUNT_OF_GUNICORN_WORKERS = "4";
# BASEROW_AMOUNT_OF_WORKERS = "2";
- DATABASE_CONN_MAX_AGE = "60";
+ DATABASE_CONN_MAX_AGE = "0";
# Proxy: tell Django the connection is HTTPS so cookies get Secure flag
BASEROW_ENABLE_SECURE_PROXY_SSL_HEADER = "yes";
# Published apps run on different origins — allow cross-origin cookie delivery
diff --git a/hosts/AZ-CLD-1/services/containers/default.nix b/hosts/AZ-CLD-1/services/containers/default.nix
index 787b308..7e4e927 100644
--- a/hosts/AZ-CLD-1/services/containers/default.nix
+++ b/hosts/AZ-CLD-1/services/containers/default.nix
@@ -1,6 +1,7 @@
{lib, ...}: {
imports = [
./baserow.nix
+ ./homarr.nix
./it-tools.nix
./librechat.nix
./litellm.nix
diff --git a/hosts/AZ-CLD-1/services/containers/homarr.nix b/hosts/AZ-CLD-1/services/containers/homarr.nix
new file mode 100644
index 0000000..13679e6
--- /dev/null
+++ b/hosts/AZ-CLD-1/services/containers/homarr.nix
@@ -0,0 +1,48 @@
+{config, ...}: let
+ serviceName = "homarr";
+ servicePort = config.m3ta.ports.get serviceName;
+in {
+ virtualisation.oci-containers.containers.${serviceName} = {
+ image = "ghcr.io/homarr-labs/homarr:latest";
+ environment = {
+ TZ = "Europe/Berlin";
+
+ BASE_URL = "https://dash.az-gruppe.com";
+ NEXTAUTH_URL = "https://dash.az-gruppe.com";
+ AUTH_PROVIDERS = "oidc";
+ AUTH_OIDC_CLIENT_NAME = "Azure";
+ AUTH_OIDC_SCOPE_OVERWRITE = "openid email profile";
+ AUTH_OIDC_GROUPS_ATTRIBUTE = "roles";
+ };
+ environmentFiles = [config.age.secrets.homarr-env.path];
+ ports = ["127.0.0.1:${toString servicePort}:7575"];
+ volumes = ["homarr_data:/appdata"];
+ extraOptions = ["--ip=10.89.0.13" "--network=web" "--dns=8.8.8.8" "--dns=8.8.4.4"];
+ };
+
+ # Traefik configuration
+ services.traefik.dynamicConfigOptions.http = {
+ services.${serviceName}.loadBalancer.servers = [
+ {
+ url = "http://localhost:${toString servicePort}/";
+ }
+ ];
+
+ middlewares."${serviceName}-headers".headers = {
+ customRequestHeaders = {
+ X-Forwarded-Proto = "https";
+ X-Forwarded-Port = "443";
+ };
+ };
+
+ routers.${serviceName} = {
+ rule = "Host(`dash.az-gruppe.com`)";
+ tls = {
+ certResolver = "ionos";
+ };
+ service = serviceName;
+ entrypoints = "websecure";
+ middlewares = ["${serviceName}-headers"];
+ };
+ };
+}
diff --git a/hosts/AZ-CLD-1/services/containers/librechat-dev.nix b/hosts/AZ-CLD-1/services/containers/librechat-dev.nix
index a0efbd2..5698075 100644
--- a/hosts/AZ-CLD-1/services/containers/librechat-dev.nix
+++ b/hosts/AZ-CLD-1/services/containers/librechat-dev.nix
@@ -29,7 +29,7 @@ in {
environment = {
RAG_PORT = "8000";
DB_HOST = "10.89.1.1";
- DB_PORT = "5432";
+ DB_PORT = "6432";
};
environmentFiles = [envFileDev envFileCommon];
dependsOn = ["meilisearch-dev"];
diff --git a/hosts/AZ-CLD-1/services/containers/librechat.nix b/hosts/AZ-CLD-1/services/containers/librechat.nix
index 856c465..628e643 100644
--- a/hosts/AZ-CLD-1/services/containers/librechat.nix
+++ b/hosts/AZ-CLD-1/services/containers/librechat.nix
@@ -29,7 +29,7 @@ in {
environment = {
RAG_PORT = "8000";
DB_HOST = "10.89.0.1";
- DB_PORT = "5432";
+ DB_PORT = "6432";
};
environmentFiles = [envFileCommon envFileProd];
dependsOn = ["meilisearch"];
diff --git a/hosts/AZ-CLD-1/services/containers/zammad-hr.nix b/hosts/AZ-CLD-1/services/containers/zammad-hr.nix
index e4c5bda..fab3170 100644
--- a/hosts/AZ-CLD-1/services/containers/zammad-hr.nix
+++ b/hosts/AZ-CLD-1/services/containers/zammad-hr.nix
@@ -28,8 +28,8 @@
POSTGRESQL_DB = "zammad_${instanceName}";
POSTGRESQL_HOST = "10.89.0.1";
POSTGRESQL_USER = "zammad_${instanceName}";
- POSTGRESQL_PORT = "5432";
- POSTGRESQL_OPTIONS = "?pool=50";
+ POSTGRESQL_PORT = "6433";
+ POSTGRESQL_OPTIONS = "?pool=5";
REDIS_URL = "redis://zammad-redis:6379";
TZ = "Europe/Berlin";
BACKUP_DIR = "/var/tmp/zammad";
@@ -231,8 +231,8 @@ in {
--env POSTGRESQL_DB=zammad_${instanceName} \
--env POSTGRESQL_HOST=10.89.0.1 \
--env POSTGRESQL_USER=zammad_${instanceName} \
- --env POSTGRESQL_PORT=5432 \
- --env POSTGRESQL_OPTIONS='?pool=50' \
+ --env POSTGRESQL_PORT=6433 \
+ --env POSTGRESQL_OPTIONS='?pool=5' \
--env REDIS_URL=redis://zammad-redis:6379 \
--env TZ=Europe/Berlin \
--env ELASTICSEARCH_ENABLED=true \
diff --git a/hosts/AZ-CLD-1/services/default.nix b/hosts/AZ-CLD-1/services/default.nix
index f175187..9515ed1 100644
--- a/hosts/AZ-CLD-1/services/default.nix
+++ b/hosts/AZ-CLD-1/services/default.nix
@@ -12,6 +12,7 @@
./var-backup-sync.nix
./ntfy.nix
./outline.nix
+ ./pgbouncer.nix
./postgres.nix
./snipe-it.nix
./traefik.nix
diff --git a/hosts/AZ-CLD-1/services/pgbouncer.nix b/hosts/AZ-CLD-1/services/pgbouncer.nix
new file mode 100644
index 0000000..ff9b7db
--- /dev/null
+++ b/hosts/AZ-CLD-1/services/pgbouncer.nix
@@ -0,0 +1,136 @@
+{
+ config,
+ lib,
+ pkgs,
+ ...
+}: let
+ txPort = config.m3ta.ports.get "pgbouncer-tx";
+ sessionPort = config.m3ta.ports.get "pgbouncer-session";
+ pgPort = config.m3ta.ports.get "postgres";
+
+ # Podman-Bridge-IP des Hosts
+ hostBridgeIP = "10.89.0.1";
+
+ commonSettings = {
+ listen_addr = "127.0.0.1,${hostBridgeIP}";
+ auth_type = "scram-sha-256";
+ auth_file = config.age.secrets.pgbouncer-userlist.path;
+
+ admin_users = "sascha_koenig";
+ stats_users = "sascha_koenig";
+
+ log_connections = 1;
+ log_disconnections = 1;
+
+ server_reset_query = "DISCARD ALL";
+ server_check_query = "SELECT 1";
+ server_check_delay = 30;
+
+ server_tls_sslmode = "prefer";
+ };
+
+ mkDatabases = dbs:
+ lib.listToAttrs (map (db:
+ lib.nameValuePair db "host=127.0.0.1 port=${toString pgPort} dbname=${db}")
+ dbs);
+in {
+ services.pgbouncer = {
+ enable = true;
+
+ settings = {
+ pgbouncer =
+ commonSettings
+ // {
+ listen_port = txPort;
+ pool_mode = "transaction";
+
+ max_client_conn = 1000;
+ default_pool_size = 10;
+ min_pool_size = 2;
+ reserve_pool_size = 3;
+ reserve_pool_timeout = 3;
+
+ max_prepared_statements = 200;
+ };
+ databases = mkDatabases [
+ "baserow"
+ "litellm"
+ "librechat_rag"
+ "librechat_rag_dev"
+ "metabase"
+ "az_kpi_raw"
+ ];
+ };
+ };
+
+ systemd.services.pgbouncer = {
+ after = ["postgresql.service"];
+ requires = ["postgresql.service"];
+ };
+
+ environment.etc."pgbouncer/pgbouncer-session.ini".text = let
+ dbLines =
+ lib.concatStringsSep "\n"
+ (lib.mapAttrsToList (name: conn: "${name} = ${conn}")
+ (mkDatabases [
+ "outline"
+ "zammad"
+ "zammad_hr"
+ "vaultwarden"
+ "dash"
+ ]));
+ in ''
+ [databases]
+ ${dbLines}
+
+ [pgbouncer]
+ listen_addr = ${commonSettings.listen_addr}
+ listen_port = ${toString sessionPort}
+ pool_mode = session
+ auth_type = ${commonSettings.auth_type}
+ auth_file = ${config.age.secrets.pgbouncer-userlist.path}
+ admin_users = ${commonSettings.admin_users}
+ stats_users = ${commonSettings.stats_users}
+
+ max_client_conn = 300
+ # session-Mode: 1 Client-Conn = 1 Server-Conn. zammad_hr haelt via mehrere
+ # Prozesse (rails+scheduler+websocket) real ~15 Conns -> pro (user,db) 15.
+ # outline/vaultwarden schoepfen das nie aus (eigene Slots je user,db).
+ default_pool_size = 15
+ min_pool_size = 1
+ query_wait_timeout = 30
+
+ log_connections = 1
+ log_disconnections = 1
+ server_reset_query = DISCARD ALL
+ server_check_query = SELECT 1
+ server_check_delay = 30
+ server_tls_sslmode = prefer
+
+ # PID/Socket getrennt von der Haupt-Instanz halten.
+ pidfile = /run/pgbouncer-session/pgbouncer.pid
+ unix_socket_dir = /run/pgbouncer-session
+ '';
+
+ systemd.services.pgbouncer-session = {
+ description = "PgBouncer (session pool) for prepared-statement apps";
+ after = ["postgresql.service"];
+ requires = ["postgresql.service"];
+ wantedBy = ["multi-user.target"];
+ serviceConfig = {
+ User = "pgbouncer";
+ Group = "pgbouncer";
+ RuntimeDirectory = "pgbouncer-session";
+ ExecStart = "${pkgs.pgbouncer}/bin/pgbouncer /etc/pgbouncer/pgbouncer-session.ini";
+ Restart = "on-failure";
+ RestartSec = 5;
+ };
+ };
+
+ networking.firewall.extraCommands = ''
+ iptables -A INPUT -p tcp -s 127.0.0.1 --dport ${toString txPort} -j ACCEPT
+ iptables -A INPUT -p tcp -s 10.89.0.0/24 --dport ${toString txPort} -j ACCEPT
+ iptables -A INPUT -p tcp -s 127.0.0.1 --dport ${toString sessionPort} -j ACCEPT
+ iptables -A INPUT -p tcp -s 10.89.0.0/24 --dport ${toString sessionPort} -j ACCEPT
+ '';
+}
diff --git a/hosts/AZ-CLD-1/services/postgres.nix b/hosts/AZ-CLD-1/services/postgres.nix
index e29bb33..40f1bcc 100644
--- a/hosts/AZ-CLD-1/services/postgres.nix
+++ b/hosts/AZ-CLD-1/services/postgres.nix
@@ -12,8 +12,9 @@ in {
package = pkgs.postgresql_17;
settings = {
ssl = true;
- max_connections = 200;
+ max_connections = 100;
shared_buffers = "4GB";
+ work_mem = "8MB";
superuser_reserved_connections = 5;
idle_in_transaction_session_timeout = "10min";
@@ -116,6 +117,17 @@ in {
host az_test az_test 127.0.0.1/32 scram-sha-256
host az_test az_test ::1/128 scram-sha-256
+ host baserow baserow 127.0.0.1/32 scram-sha-256
+ host baserow baserow ::1/128 scram-sha-256
+
+ host librechat_rag librechat_rag 127.0.0.1/32 scram-sha-256
+ host librechat_rag librechat_rag ::1/128 scram-sha-256
+ host librechat_rag_dev librechat_rag_dev 127.0.0.1/32 scram-sha-256
+ host librechat_rag_dev librechat_rag_dev ::1/128 scram-sha-256
+
+ host litellm litellm 127.0.0.1/32 scram-sha-256
+ host litellm litellm ::1/128 scram-sha-256
+
host outline outline 127.0.0.1/32 scram-sha-256
host outline outline ::1/128 scram-sha-256
@@ -128,16 +140,12 @@ in {
host vaultwarden vaultwarden 127.0.0.1/32 scram-sha-256
host vaultwarden vaultwarden ::1/128 scram-sha-256
- host zammad zammad 127.0.0.1/32 scram-sha-256
- host zammad zammad ::1/128 scram-sha-256
+ host zammad_hr zammad_hr 127.0.0.1/32 scram-sha-256
+ host zammad_hr zammad_hr ::1/128 scram-sha-256
# Podman network connections for Baserow
- host baserow baserow 10.89.0.0/24 scram-sha-256
+ # host baserow baserow 10.89.0.0/24 scram-sha-256
host kestra kestra 10.89.0.0/24 scram-sha-256
- host librechat_rag librechat_rag 10.89.0.0/24 scram-sha-256
- host librechat_rag_dev librechat_rag_dev 10.89.1.0/24 scram-sha-256
- host zammad_hr zammad_hr 10.89.0.0/24 scram-sha-256
- host postgres zammad_hr 10.89.0.0/24 scram-sha-256
host litellm litellm 10.89.0.0/24 scram-sha-256
host netbird netbird 10.89.0.0/24 scram-sha-256
diff --git a/hosts/common/ports.nix b/hosts/common/ports.nix
index 84cbe41..4819ea4 100644
--- a/hosts/common/ports.nix
+++ b/hosts/common/ports.nix
@@ -20,6 +20,7 @@
azion-scheduler = 3039;
azion-scheduler-proxy = 3049;
phishboard = 3055;
+ homarr = 3057;
metabase = 3013;
baserow = 3050;
@@ -42,6 +43,8 @@
portainer = 9000;
postgres = 5432;
+ pgbouncer-tx = 6432;
+ pgbouncer-session = 6433;
pgadmin = 5050;
mysql = 3306;
diff --git a/secrets.nix b/secrets.nix
index dcc4441..ea7e5e0 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -44,8 +44,10 @@ in {
"secrets/snipe-it-app-key.age".publicKeys = systems ++ users;
"secrets/snipe-it-db-password.age".publicKeys = systems ++ users;
"secrets/snipe-it-mail-password.age".publicKeys = systems ++ users;
+ "secrets/pgbouncer-userlist.age".publicKeys = systems ++ users;
"secrets/pgadmin-pw.age".publicKeys = systems ++ users;
"secrets/phishboard-env.age".publicKeys = systems ++ users;
+ "secrets/homarr-env.age".publicKeys = systems ++ users;
"secrets/vaultwarden-env.age".publicKeys = systems ++ users;
"secrets/vaultwarden-db.age".publicKeys = systems ++ users;
"secrets/zammad-pw.age".publicKeys = systems ++ users;
diff --git a/secrets/baserow-env.age b/secrets/baserow-env.age
index 5dcd271117daf188a4db8f1085e4f08a2bc547db..3943b3111c4d6a3587e533f3ad18a095ce398d12 100644
GIT binary patch
literal 1004
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCTS$_Oh?O;-pl$qOtu
z$WG7k_ptCOada|qwFpY}%+Jp&ue2;TiU<#g$kk6xbV~DfbLBGeNy>?`%!w>1%8c;L
z_fGQHX?sTke19QVSosC0#>RI|u}k|du>FT;Z3jBt04vO@15
zPd8)j%%q?U=OXQtaO1!TQ?nHP5EHKK(BkksFN@@GOGmGgaL;U`5VJr_!xTS@6qnq*
z?DVAYWJ}9(ccZ`%_hfY2oP&KUGtw2z!lN=%oGZL7D-8AX(tM+m)560F!y=O`3Q{Z5
zy;DP6eX~7$GlEmnf_%BW%RN$pJ+mAmBHc@jN+M08Jc7zi{4Bgef)Wi%gTo^u{DXbH
zd;^Vr%uTp-b#)cI5)*?Bjg2ddolDEYvT{p`)BMZBl1eH9%~SkCBfK)gjSPYl0}4{p
z^UJx)vwmcDSb5q`uUq8hylaQUzXQ5Ez8Emqg|&Wrc#*Y+G*
zR4P|&;QQA2i;kRvu6Bv)<;3mrOQkduXUsbJIVzj~^@gIQOG~HqAA8i~{MX{ojuqFo
zhj;cY)DvCyqW%6vCca~DZBkQfUY)pG%(|@2Xro5^B2{CNd3g(1ycx12zTGapmbrIX5eJvn^q-8}bDuwn)4Rvb
zbMMq@{R+2D%)G%&f5&H
JCVH}U0RZt{qk#Yb
literal 1551
zcmdM|0Vh{?Pd^1mcUJ{hKj)yxfDl&~1vgJ0SCE`8S7dlfj!$@4X{522X|hL9L6VV4
zX_B#5o{w>4g>$BXwx@?*Rid+DPLzwMpm#=@Q
zUsY&GR2Wy1VPtuTM|wqyVZKqSn_o$gL4|2#W{FXFxLZk*dxm?cVSZVPOR`C7c4)c3
zOS-pDh)H^~v0uJVcv!Y?R;VGDZ%B4}sIix4WQ3cOr(23aaCTr(aIj@XWKMyzx1n2U
zkgK0psz*>>lB-|1Zcw%;Wd1!b}sdrUMSV(wsQA(AUo3~+3Kv0#FPpDf;AXij*en~*4
zQ&qB2dP!7xV5MJ3XoY{UQ*n^7TX=YGa(Yy@pJ$?rS8$MlTX;%@t3hOhmrsyuMP+0}
zif3?DN)}ggc8Xh2c2H)ZQGt7kt6{c}L6m1wo?B2zU_p3@p_fsjp=WuBv0q+TNK|le
zXi$-#K}A()NLWy6wqZzWc#sR1x1m>wU!GG@RBmx)XjV{IV1%0+*64Hf3kiwH$&adZ
z3QuiHhP%3JWwzay2NAa!)r63e5=&47RLF3h^`w
zcg^tiu5$AU&9+QTadQPnUtq4OuTOYNWmLFZRaCH}eu%qeDp!g@XnKfSV0x5eL5PpB
zU!hM`hFfT8zCluMplMRJX;6@hZ&{F`TW(agS7CCPTX~4FlTWIR5({q
zwxwT?p=WuNi(7$jcCoQvwx@Aas9|Jim7jY^h@-bputABZYe`;cXhC+6v13_Kc2tO;
zdrn!hYmj?#SX2&IQchGrN?uS{WT;m~RA`iQxQkmxN=SxDa9D;(WS*~gqPAy6Nu*b1
znMGD{Xkv!Bd025sS)N~^v8QFEvqiZtm%EdDVz!faV7h5ovU8%hxprEFcbKbrgqg9Q
zOHpxDVn(*HXFx$pNRYp4QFy+$QAAO4pt+-dR)nL6yP>aBAXlkZp}TXGPibXFSyfJlz%|FhoO62NjOIBc7s!2tXOQu(WNou0I
zsef2hVQ8vXsd+k=Yg9>PMPzEYPgz88u6uZ3kanSEfU&EuTX<=@nR!%MxrK9BfTe+D
zNnk;dk+z9>P-S9zrG;UsN3edlsYyUCS5$^uikq8DU`Uo{uya{nqGeWzX`V+~W>RXR
zNri`ggqd-ffnTA8iKm6DXGO5SuYrX@YN4yMeo|?!lez>%
diff --git a/secrets/homarr-env.age b/secrets/homarr-env.age
new file mode 100644
index 0000000000000000000000000000000000000000..8b3404bb4cc9728225d4bfa96852f2333f96ece0
GIT binary patch
literal 844
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCTS$_Oh?O;<3@4Ja{B
z4EHWf&Pyzg%FT@M2+H!#@Gi(QsxT}HiVSxO^Qtfix9~5m2;{1C&dM+GFD}S3F--K-
z&u}z!OwIJlFm`*gQQs
zr7S0)$kf?S-z6%?B_}U0x1_*1wJN*F+@RQ?!k5d_!!aknC^^eDy)4ndz^BkZ(c2(B
zugpU~(k#;@vdAga$I{O*wW`cF&llac9QVSosC0!y?JD=80#D<@T+_l*FZ0|qvusc8
zpwdF~z(8kH{ZfyJg51oglH35ZECa5b@bL1Il=8AFi}FgNDA#<~N@G(C6Yaok=dg6Y
zg5;nGlPZ^7SFfU=^lWt7oP&KUGtw3OeJxVb{ZcIg^xZxEEi)~Pt9(-f%8jypOY{pe
zEqx~?2b#)c8ODf$%a^3t*Q@wKhvOEnOlS~XlBeGLGLPD~V0t1aBEGoh+Bg6CD
z3(~n-eLtCoy!`*c{@}q`-=nzaZMYNKwD;p2ODEPp_pXN>HJSgW$o=1~t$o*KO>D0U
ztFIB^h@Iw?|4=mZzVg8t?;kgxZa(RC<>PAICYu-A)?D1)egD%@CszwImkpmq-K-rV
zUB7-^A^YtRujv69l?~P$EKyOcbMxn2t)2JwmiGHTU*(E}$GR^@FN}EIGt07Y`(ZtX
zOaVr}#OQw=>hsN=3(aTtTeUbfezEOPJM~nsRx@?)GSfiu+AY;-;n^!Ak4t_z@IU8q
zj<}POXN;8T_H( ssh-ed25519 ZhVseg P3zTtdI1xXB7fzI8tAyHrqu3smq5+uVn+BFUmkg77E4
+0/FaClfU+bnyme+UIvtvt57Ah/7Mq+CZHUm38qU6qNY
+-> ssh-ed25519 SrHaqA 2lJ/qjvkmK2WbpIt0+lkYoJohV1ffL4JF4Tq1tKa8CY
+yT5xn9AlfDdc9cuP0Ci0cSeXQZhc8F9rgGrleWCukH8
+-> ssh-ed25519 lGqVZg 5fL5Akvl1qfSRvBiaXLvAbe1r++19onOzLbvrCL05CQ
+ldMBTTxpOboF/NYO0ZxCQUk+PzTtoRgpuBrit4F/zEs
+-> ssh-ed25519 CSMyhg NPvZ89Q1qRqFMNNkGoHMbSvJTMhvBMPLFkaXR783wl8
+SMlZ5SpW5KKXAZUw+6U3wOmmfed83KJ/O6RJAi/6uWI
+--- gDcEVCwfg5yURH9JLZbRXRP282xfSfC9c+3AWZs/Hjs
+möV9CO9¥p]ÙñײC‚9ðDd‡YVº.ˆØDoû„f)X„»ðJ�:írÅù•ˆL
+íµGÅþ®bî+^RÆ®3ÁâA‹æxQÉLûh–…€g™�‰³~Lm%
+ž°JY˜x(àÛr¨ðRr¸¯Æ
+•¿Ýd–½sí–�þžZ:þZcXä°Hžêv#›ý[߇näY–�˜©}d‚eŪdnÖ©{7æcEa×ÈŠá[zeÅoXÆDÂ_¼;`¤f„v´_-L‘— VBtTù�î±jº£™•”ʈ%Aài'±y߀þ1�(Ñ›#¥44bÜ3k%FÇmîúº©k^
\ No newline at end of file
diff --git a/secrets/metabase-env.age b/secrets/metabase-env.age
index 22278212f26181eccb266f026a20fb52bad07325..f57ce3c139cd8c92ca4729bfba7fad27ae363889 100644
GIT binary patch
literal 682
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCTS$_Oh?O;@P&H>k4A
z)h{$E33n|{3N!S|2`WeoEhx=2aZb!Ca!fa`@JuvG^iHWX4CQhu^!E33a<0sd3W_Rq
z&++!sFRpSgGx81z%nvZE@CdUsaWBaWH8=7P3PraqxX2^1&`}}4+_cC!xG*I=Co4GE
zG0`m2)!Dho+b|?DILk04%dav#z%R$gJ*C(+Jd(>a*)S(E$<)KA%+oK!qokxLptQue
zDy2LmHQXgR#Wf_{I4Cb9#KX0~IUn7&9QVSosB{I#tm25U0HgdW^K7G(G$SXo5bXe?
zyySd?{IpP`3Vko1V6W87qD=D~_iQe2i>&;_z$mAbfO1#2fE3eA%fgCuGhc19)a1&@
zJX0@6U)LbdbWh{rf?{;roP&KUGtw1IlZ;*cOwzp4T%0mYf>V>z%)`r*J&W?3{45H6
z4b7Y)jLP)G%!=L#b#)aC3|%dP{KJcqyi2OglENx716?drL$k8dQ!35Vy)Bb-JhdbI)7^?g
zvhukeWS@Nbw>f-?q~6>_hAIw=n7vObyQf_Il)q=)Q;*1fvjx?6Ye^j5&^%A*8rQBU
zzRgAM5qp~NnckSY&P1J8Ke5KSq{F^qW3hkb*Nz{VoF3aR2$vRbVy-;k?C|f^fpvyE
ze;qklXZGekduI2OC9}8by46VZJnC8EHEo%yZ>`OxAKMK~3d&FZOPq08c&qBP2b{?Y
h4gVin=IY-H+Eh62mtn7h`s`04-v
literal 1080
zcmdM|0Vh{?Pd^1mcUJ{hKj)yxfDl&~1vgJ0SCE`8S7dlfj!$@4X{522X|hL9L6VV4
zX_B#5o{w>4g>$BXwx@?*Rid+DPLzwMpx{0qr
zzKLIMj!Tk3j#G+Za(S3>flF9+kb$pZR9IN0WocljpQn$3SCC(>pJ#Y@ij#9*x{;qt
zs7Z2YMF^L_OIS{@k)e-Yc7|7Icu-DYPH1^#mZNcCZbq)3fn}h7NRCN(xM@aem|Ikm
zhp)F!h)H^~v0uJVcv!Y?R;VGDZ%B4}sIix4WQ3cOr+dDkuX|2jpixOsQg~!VWUiZ&
zpGSU0PYIt^qZ>U#5l5s{>s9Q>qUv7psS4c#5rEjQ#cUVNENmOo%p|3$f
zMRK@dR+6ime^7RgQLsTpc93g@kzZ~_MVNtMV2DS)VX%Q$c5;YQP*|>4IhUVfen~*4
zQ&qB2dP!7xV5MJ3XoY{UQ*n^7TX=YGa(bAXSEyf(tEqojkZE#6U|Fz7x{+^In3okXhC3DUXX86M36_QyG2!Gc94%>ZiR=hV}W0iyJb;eXi8R4PD)Tvc($RR
zTTno9UX(#pR#147hnsVdb4emsh`V84s;i|_xNA;Mct}RBe?)pY*64Hf3kiwH$&adZ
ztcnWpEJ}6v3rRAv4B`s)$glLvDezAXbF2!_Eyzv@b93{}^)g7#N%2f{%g76g@HI+t
z4+~8Ubt`htjmnISaC43_$}kHyD9DV=^EKcKGb(UOcFBlL2`}&p3JI!6uJS7I_3$f6
zGK}(0uJZCp%nEXe3^f2pUr1JtX_$dyNm!;~UUF_&MzT?8I#*JbsfCY$L7}H>cDj#2
zWKK$0funO)SXG#jYf*4$SU^%vn6I~CXk}tUT$__mA+${bFx8T
zUTAW7h)GyvS)rLxQnq=jSERd9WVT->S5mlPsatwlrm=RaQ%O>kg=b}efq`G7k*8&P
zVt!z9h=HL+aaM4eSB|4&R#3XBr-@sJONpsbS$2*`sH=0h3s+v4MY^M*Ym`}KWNva+
zVrjaCk$!4%poK+IW~pmRMrp8-fwzH$zQ4I+a#fmdcy4%*LAsZ-lS!qQzDJ;Mr5RUF
wR(hFxd1P{0j;WWaNs>vrwzFTAc5-HtSxH)%MQE9kqpd9$IOn_ix!^1m02wk`nE(I)
diff --git a/secrets/outline-env.age b/secrets/outline-env.age
index 00dca3392e876eb0d1667fa21086e672c179d596..ccf3b587b01ab14010ef4d9ccbf65afcb011dc3a 100644
GIT binary patch
literal 861
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCTS$_Oh?O;_;LPR`bL
z)Xp?742{f83C=3j_6qmU2ro>JOw1@tb&5!gGEVWR2uXDea^>>2&^IkAaIz>f$n?+4
ztIXCncXZB8&n)r?PYSB=bTslS(=RJ3bF=WSa7DK*xX2^1&{4rNy~@YSCn+Q-yuc|e
z!Y$dn*eAr@+$%LJ+b=!Y(Yr9B)Xy{0IX$o3z?I8Cq`c6>TiYPi-NGc-(7ZSz+$1+F
z(=t5S-_Rn!!^qXiEXBh&%RAWD*96_R9QVSosB{GbQ%^(7@XCll#|Y0v*W%n9gRqJW
z-{gq=;9M7PEUbho^0a|3kSoP&KUGtw12e5)cIEew6a{LM<8{2hy2!Ywk&DvN?cN-8}~
ziap9xjl%N_BFhskGYq&~eG+ps^ow$Gyu*!CJ&Vg-Q=IdBLy8bDbkf)AI}s^CPugJ<1ERqY?|#J^h^A3yaDkgMD(s
z^dq_WZnDP}C2i4>`n2$-UbM=Ti^5utya~R0*8bOL>fd_%;fq_QuO6Q}AX?G<$}-Nt
z^ey{Lr-^?}S%T}NUbDs-@a$8Kb-8U|6cbYO=1{iewGF4IW(T=n;o|N}bv6>byS3Dq3r%y7sNw`{1bJ}3FnX_rKo
zOr&OaUGcvs-rPQqQw?Xz>l)f!kS}5gJb$w0n)#FqpBJoD@V?orwChq#m8rr;+nXuj
zX_3`=Jo&Q&T5VD4g>$BXwx@?*Rid+DPLzwMpGVyhds`SgtHsVSQ^YRSJO7V}3a54xFaqPghw~Puk@CpwKar5E|_we&d3iB%Q_i!@wb@TEI&CUo7HOeju
zi3kc0&GI#f%CxNV%?<@eUs_0cNtCfyPGp2%j;CvorE^|JK9`@NTTZxpfp@68pJ{4d
zRFPk(rE!#tmvM5aUr~6trC(@Pn3KPoSEzHQL5WYWQ+|p;L3yI9S6-ljX=ZSqt1(xi
zdsty`UQUj$Yk_~VM|xF?QF)PHc#ct&p_505VU(9&SbkM%ZicaQepzv0nRlkUr+2V%
zlA(Epvrj>8fkio2K#Hkpwn1Qeep!y8t4C6@TUJqucW$yvnOjz_e_~*cpMQ>FRa#+1
zl7&U7rDJwLNr7KfRZ4|_qJgV+WQwmoS9WTCT7_Gdr+INiYLTC7n3+jnRHRX5PO4dc
zN@zhW>T4Rv3Gc;S5kOnSd?G5hiP_V23KZfT3&8eo?B*kpmUUS
zQg(r7Zn;Teu%nNwnO|VJcB!wWWnq~~in~F1u1Q#wQHglnGZ-
zS!toZVSr;rW{7V^XhB{|il19Xh*OZczHy>sl38h0l8?Wyv!h>_OF&6pWk`^tUt)oC
zez3NYZ=}9?h9^zH5|cif5!rgulL<
zhkitMfm5KlVR(swMVf(6KuLaiXoPEOP_n6urCWB0e~M35euTM;yK9bdplNxztt}V0
MU~~0z!CB@30K)~Pa{vGU
diff --git a/secrets/pgbouncer-userlist.age b/secrets/pgbouncer-userlist.age
new file mode 100644
index 0000000000000000000000000000000000000000..4bcb2f67e0385fcd4a642a0d1322ab9e04471770
GIT binary patch
literal 2173
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCTS$_Oh?O;-plcF|5Y
zD)lgSa?Nl|4fiSVEe%LbO%E%~a`Un*PRtDO(f73U%rZ+hOy}||%*`~(Gb>CtPc5=E
z$~P`ea`jEC3WzK%cFK%OOv`gL$_e+;Hjni8H9)s5xX2^1&`}|>Dm=@z!q_ClC^z3A
zG(6BSGP}gcrO-Xk-!<6HCos*e$S}h*AR^b%*@P>o)IB&n(5bL2Hziy@*wxIW#5dc_
z&m}X^FDE@K)uPJK%`-SVH!r!Q7{j(4_rkEKbcM*`kTMICB9Gjt0LMHJ*Zi=|WVf=k
zvM{Hp5Q}hk{ldzez=)(^ZzuPlWUj(g6LWooRLgP$GyPImHxIw?2(L5?{j3~6j|dNg
zqD=2_mvH@11ILV9Uv$4Y2m4lLq$}hnMy014B!?P>g}a*Pn&lQ&W(F1}m0Cu62Zv=^
zmgQHJTNWiH29+lUT5$P$lsFlf8N}gmUTX>MEE-n5Vi{7CX9Fx;sWxlo+~)I~r8xg_j0cl$xbDoA{bUc(|MS7zcV<
z7;xPS@@!XQHts+1fb-{^eMMF5>}|$}
zrVIUAX7GH&(h2{=sxK|EQTlT)bK|{7uTIu2I3ZeFHn~S=>DS^KK8?9gj$W635?Frs
zt!adYl|l8Dl&$XCx3_Pp<@8pFk=`_C(}`_=_G`|l#2
zbH2AY&&q682EUljf#W}z_S{L(3OXjdzaZ$>R)+0PA%U-JFQ(gCicfC#OG9qA#kWn-Ib5?M{q*mz6j7CkDCS`mMR4(QSg+>qqs4Teo#z?7A&}oWJ&u
z=rzIeH|t+sGQ49QTbT8xv;OS+q*)VUqP1p8EvPyDXZx?p@)NyLJs0em9o|GfI@7dN
zR6cv*)y^GK%Ur8A`(9o1L3-Ev`?ZAyn_h_h?GRyK>UQT#`A#AK1uEU*|AZ~G4dUv8
znG&C>_Q&XbbMm{xzbY*9V%^l*AjxS5!Z{iIk2?7=`sn-Ysa@_M$QhvJT$maE=B3D$
zIOF0_6$jrR-uv|}g}-jNa>9YVA!o6cKljpT9tTB%qpyt4?K{psdF$5+nKGpuI~QKvMJvBYxS&KXBh8%>I>$mc3jik{VMnEe^#z%5)bYub0+2s
z^&da{XKv58qg?UN-e0cr6PYM?r7N{_vE!Wu`hlifrYt&QkP+S|$Dp25QMWbD&d<
z)!YN_Z=Sb)YUfRJW8(I+4m9n2y|=TAeVw?2ih#rVb4vrgE14r~Js&g$ew&wnK%BQT
zb^Z0AFBR3|zI)57Y&o<3{*+m8bw=rp0;|aCfUNzCvX^ggtr9-hAG0aw*W{A&%%zGm
zX6ei9_;SGi)sx-2r3oia-k%#{SDSmbbxJ~w+7q@H^BgQ^{)=lmwfJVqzS>{?71H6`
zoVJKneCl0QTiw0Kxh&;MgT(KE`&(Tb1tsq6Wh$M)#MhkgXT`guCd&;R^K3h9uI65H
zPg{RzpXfY&mybfr?#3+Y=@fFzU%}T^FLyFUT19%=m*xI!59+rn?4Nh+8P}}+%}0;F
zIk4H9XO;i5dtX)Gy5(=HJkR1YEp^q5k0rWQf<=4YvjrKtTus^NogT_?XSen92M-+f
z2&R5pxbNtPM{BJ=3eDC2|8)1!=zHaSrH}kxJQTbCuQgJBairVq`)Mn7E6cbDE);HB
zwq?fW1tkSS`@EbVatqB<5!3p$V2jY#MXkGkJX^@MXnLGX3Q$c8t%Qe
zoh|t9;K}T)9Hq!DQ3~=-ueLuCt7~6Vs>^U2ej`Z}Ifvr=pT4
za~y3OKEGsaUKF$1=4iatzIuVDD(kwRmQGl+Jpb~?wN^qK^J278!ZE
tX`P~L#MG^w#px5`zWm556mz_}hyT{&BWeF6=1+eXFrn%mW7W&X9sqIz=g9y7
literal 0
HcmV?d00001
diff --git a/secrets/vaultwarden-env.age b/secrets/vaultwarden-env.age
index 89986e81f538475fbba942290bae1610c2665468..08c4bda02ae8d285ba7cc07ce01024a07846b2a6 100644
GIT binary patch
literal 21149
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCTS$_Oh?O;^ZwOU}`E
zDvSzst_UyEj`AspG6^m=baV^|3pF(NbIQwga&|L_O7~56&*pN;&BG_X%p$1JsL07Zr#R2eIGw9BJj~2A%P+jdu{7DtxhU1$Fxacg
z!`VgO(=Euy)F7oKJ;=bhvfME_9K*I8_rkEKbOpnJY#+;z0Av3$-xkrY2d+WOxW&~#Xg$C!A`)5Q2Mfrq8
z1-MkYx@TGX21lhjM{;FXW`{&p=;wH56{I=mY8x46Mtb-c7v%;!mq+Lac$J!@`MCNz
zc{}B#Sa9j;>M9r|ms>hl7zd}Nrj)0YC;K}EIa!9dW<(WwCI$N$Bs)1}d%IY=m1S6F
zI&vxgE!%vs@zu27IbRcF3*LN83yb0p$?yJdoqXt{KtikWoBCF+|h&a?9K>wo_;
zxp~ggG_kKezdYJL|EQZ~`8M!s`@xC7k~`+#?#o%xzS8ylpJJIn+mmxX?2F&z9W3*1
z=_S>>?<%icTYhV;;6{coYj-|>&JlU{yma6zC&AWr@(QmeMA-kads1dt#vP;fj+67|
zLpPz~_~$)+UWswj7OAvV@$ohZnVtThBEM<-w7EOjA`i4aseRECVo>O5zJ1!44lc88
zyXIeP3pTBqyJ^uE*Bh(0D?Qxd5q@VLOHOXR&UeGR3uc?y{A7vqyZ7|=uly5zr`I2l
zohNOyA*0f4<0{AUOE0vvL>Y|xH=eTI(zR+s`y;jL3L(pT+NNTzsF`RoA3UX#Kd;jXQX~r-1*j1>TIFOyB+%@UWSRR`*`n
zxWTu{^5Yx}Mo-U{5Us?UZy$U)x#jcBJ$m!linjPgPHefWe?f--WW1aE-Wl&=EnX_!
ziYq>{#&q|~#fP+3%I3#i({;I0WBBbsuX)LfsEn^l%3<-_AEu_==J2YOJuQ7?Yjy5P
z^;S#wy&3wMYs98>uV!XmRJizDf!)38|L!w|?thu`?e+`3y?l-HZmOTYn%h9?
z7+=^Q-F6-Q`kMwZ=Ohj|UFa`mG`E;8_Hp|+kKXBXqnoEhDfJ!aT@v-mCoK1Z!*R=f
zRuUhRJfgfj1!vV~^#&%i1uG?VF7ono+v)TDuCK}z`M>9RXI$Hu#uK$x@07FN{G~6<
zj?d@2_O_V0rO6>mvl^BC4$)_&SP|I-QUG9~o#>AX-*o?caYzD|E)y`u?Xo<+eW-
zY@4!iO89?^LsHH)OP256@+(Xy;KV+E*Ocogo?R+>!IA%o!9j1vQp4h^MXgDnCdMSr
zFAaY1sAhR)PJHXnX+LDFcy5I+Y^~d~HiV;3{=>t+1&4Zh7+!Sc%wo^xw(?p3KmT;?
z@g)UYcr9y=U)^I>=Cwm;f_}@9%lCqUyr*)d>}-&IDy8Kqp=pr4SSs6pMZu|F)ft~t
zR9H=%s?(P&Bir#_T7CP+Vf}H
z&TErcFLqi^_FvTExBs>8f+G`iW}VV#xWxV9>sqngcE?NiRk9DR>z-9Fp2<0F@g7nX>z~L+|RdlckWiDitYIf9Ns(roUXZL{Y_TZ`fA3u#+h=vuer0EH=GY!
zcwcVT>b7-Lxr$@=>1msbdU-Ci?i2|z-KKci!?S`VN#BHzxyd-GRHZwPvE!D_@x&RA
zuf;xlq$?lhR=4@uME;X+9kNtKSKeNCXOk_*0m+_sRwY+L!rx1sX?xqUB)}>r>uv78
zc>*a}lZ`_KuN;`SeuBy4jQ5F#NBUn`O#Z+hWh9qd@Z@)I?++uptu7xXZ;^g2uDff}daA3*x+BrF8nGLj{wFVg
z#>;Qi?7W|=*!@O8;}QEivOm*)CEQf<=$jE3S8On=&iRI2{?xymvwCJul2=Ofd2+kx
z(?+g*3mC*vTT2L;?r`O%NHgd59+$`X@!X8njh6CT*UcXcGz)?+r|}J7R~w4
zU3@a~Z%*#-Uy{Px>H;@Me%6+*Ugy%BdDSQP(a&|6TB1r1gFOzFzuGo8XZF9lcb`fc
zMH}f`2AEB8t5dScOJ90_qFM5+Ww{@Z$<#hfxjO0hH|>q4FV560ZD9Ihb6#Wj(d)c7
z|B86@X&3%ayzIba{$0^g_L@?#ivJ_4w;_^72eZCc7oT}|B|YgbqtfNKyH`d(w-d}g
z#?*O~OHsX$=S4A(btYPJLgTGwoSL
zLk`!H)B=gir(bQ)&p3Sk>n6cV_y0~&c$wL1?{#XI-<>AjJn6Jl&TkQs%Z_E0nC5;vJu&W;J{x((&7Wm|&1qe8%*6hvnuE~h=dCKgl|4Ub
zOg6E$y}P;iq_6r-@m7WCZtg4=lk)=G6y~&D(K}-CXx2LYfGhD+JoLg|%~iUguGHxl
zsU~V<_HD|dn&h4f)8@V4h)D4~7~Xrdf7zFe=pSnO6Lll&bv=jwhc@Pwyj&Q@#{4*I-|65+U%&9kT+r=5O3B1{p
zkNn`u+$ZP1>qzj&%T_CR78O~lmmS+a{kh!p{hP9^e;9`5=&73Ui@65ejeDJFR<_6P
zlABichJ)o+`K4|d#)iLJ^SA_GIvNY8JP~GK+A>|0>(8s3uXUDu`LTun#Q~iPE8)YJ
zcfBgTTJ+UwLaytC%jriil&5z1tXAiheHOax_!r$}Qx@hw;+^=!Q!ch*^PH&yoSF}o
z-dbtk`GEbHdsjtYK;-sd>)ra1Kbi7^{&hXK7P>g))YOmaQc|+pHZkbL8y%5yQFyd-
za{Bd6k2pUl7X$Yqa)|vnGZDgV9ZVLtHVgaj#+k++s7(5ZZ8*8Hf`Xax{|0~C(
zv(NX~h@NU^Up#Z3{{D%jWgE2K+FAB1zD*NM{M^owd(x1jWg5?c*%_0L+Mhghp0DkA
zz80^do=uJer`)VKpO|Joq3CPx!)-QNqz5iNxhOk-`ne|8$7_8ys;yl1jF~|;t7m7k
z$hlRu3xZaNm+j4Z`OZCJF@Kgy>(7NoMpKT~2;|+3&}ujz^4clvP{yEj(DYtnJaC
zAG^1T9**9;>-HZu?%N`=uaBwb{WUBzRd;aSC{$P^9X^Fo{JX;ffWE3}?
zoOLI6pWF;j!@}-}j!hkRPSD_V))4yfojl%T-(<&o(0`CHd(#x9!WCVe0;^Y4s?OrY9sg7Lk|}F`zi*w^#J}Xh(o0o$7mK$tytsPjxnWz8
zpSsWY^)5@IgBdH5)5M$Nrca(=rEdPZT3>MT+G&lVytW_wCo-JSV2=FXRHveztGC0o
zF!r2G7Q1en{Ylkb|KuuOFcyAU|2-&6Xb=1JkDh{Ax~Bg%c3P&d;=J9m)NM&uUQ)}O
zTT8FcNjO-UXr3GJG$Z@QqY3kFZg?b|KHu}~lx=priVwa?8*^=0A9PXu`lZMjetWG&
z+v`_$uUMH`ZFSXR-J5RtnlD|?zLb2i$!WWp3-{fY`gJRPUZ$S4pHt(&
zUz}gzdRt)go!hUkorw`xS*^9#qXv{dHC)&
z^{<>+K38YG#|G34-m81ZD{>V+?#u{We~FM60UJJaCjG?7Mui>n?^Q2DgUoag_a-5u+F
zcb;D-$tB9Twefy->#ELWu5#8=@2_k+?`qr9o}c5q#o)J=q=STSU$9ha@S907cFQ;?
zsS5S}YP;+IYSZ6^nl~3)mhTK+t~a?oM{Pmikvs8c4u@PkCOAv~K;d)tt+{H;7G0f`
zY$EG_e);k1_mqM|4-K`n)6F;bdc41y
zFmcCpsb3wt_ZmkhpPQ*F{?zv-XV)d)AHllM*OcFz@n5H9%g?yu2bU>M3T9kt&U$*<
zw_Tr4PH)g?nCQtjUxoF`_jQShhkTCJwqH%Ei8!7Y*qA)oK;DEwEc}_+jJDtBcg;#M
zS@4%(y~L~+OP-fSdYUO$G8HLzyXAJZ0N#)+Ohy8u6-mASW
z{2ls?|I6BKhlL#v`byhOlbyC(`rXsn7WMVrjg>{}yuO?Nv~_Pecm146)ypM@*Frfy
z7%%74Kc06G
zG``w)ck|j!Pk(*e)S31qS2=pqwNF#0^p(`{8iuiFuemOj(B;Q9>+YiPoLV2&&inVT
z+!eiW{q*9_#)Dh^Culv+ykDfw-dLGAW`Z0o}hWm*fY
zTvRG`L~G&g)9=&mGta-2zqah(ahJO}y)!cG_vXj!)|-7pd(z*AZww1xMqAB29`yOw
zEv2lPCSO9M+~)*Y-4NbfZPs#qS@I$Fv(8qkQchw@h|Q>IrqMI2obUSIECTXrvvjuJ6yQ3_fB##S2R4bfj>)T&JGvL
zReKco>`ctOpqSyY(dPEb^y?)Mn~j+m!c$?9cAZaM@pci|3nIF;kJ*;pq7t2C1h{R-^y|M@0#%I9X3W^OzShaq#yMK>lO2!UUWZo>h;yX
zAB%X}-Em7gb!lnp(r-50H?PJof;fWtQ(2>$lSjPcZAVe!0;3BP09x
zXNkj)SlXCA?>r>pbFnSNc;WmxMR(OtGF1tCT3+M+cJjy0Dp$ru3MRp4OT{;zcPhLW
zQ~yE6ZTshHrp{fPMP}X$zawNEK1C?y_rZoWCLAv$TA6+y%GZ|2QMUW|$L`|1-k8dt
z(h?U|#4edyZE*98lBPxElDE3EPOcAfdHTaZJ-X;fhTrq3PeJG9mYZ_ETyFfXev;d4
zy{orsb&L4tviT%TUBBwcdg~d_Y?ja2yofVOpYgNAH`i~I54#@T*`qb=9(X(5o
zV#Vqz7Ny4k9=pi
z-e0A4A=TR|%BT9laozM6?SI7CpBy}Uro(#58*$$IoorF&$G5HB6a0eT;d<(yl?!wZ
zql9_o$&bk#MP7ED++z;TYX}N#-ojAH`m>&;^*X1
zS@X_n=7j6-&ff_WtP$vrJmC7HW5XS@*QwjA6{T;n&*fdW*C+4Rnt5?j%WqoV@z<9q
zl|3%;u+QzyD-Y*8%Wvg=oT!!D^ZeqYo@?o{7eY%X9pnmJzjXE#iL&*9ril-a`DGl~
zR`hIZfaFV+v=?4{E7tv;8=A9rR{b5#TN?}1CRaW*_j{wc(RYiBxW&V{q3?V;F1(s2
zUYjPc!0&zXwhE8+3tPXR>R79Y2{(#pOFhh6)K;3^#mEXQa_Ar|j5+
z`4y)PUA34yXTNy1eo5iYKy?d+BpDwjJ3fyEQ6EFax)>eac65H6vF!!>;sXUuqE}9t
zZFSgZ_$O=c@+lfTGVAy!u3uolcU{{q$vJs}wOy?89yi7Ld)0f_==zB*-_z3+muh1D
zOkt7$ljWsrsrx)tR+eX^yRuAXPhb6F`?;{Yb0%Kby09#ky09z57x$r~UdWr1vqP+iOd6gHnu>(aEEEC+~Cn
zspv;^3UQvDvcvY6Z$WLM-1X^um#5p#C_G!d#kS?xtPqBI+j7>J&XkG1!7ThCA>~3-
z>HXjp@&3P(Zf~`@_(Er!peIB5BL(Kyi8e|0Ki&&@XSz3-c^~gNR`=VgUgp`K7?~}b
ztEAGlw)$V4yWqj{HcKCY#|Br7yPn@X)vU$zcE-FbN4@o*XZW@GEH&Z2aAu$PA^rA-
z&T_F07uiFhxpBYybJDwa*lm@0_2aB;b%;P@?_+rfD&+Fi!+W>W{jc=O0yd-m2eY
z?tGBy(UGh}w5HFj2_WkPzXZM)1OgM1%
z43E*&_mB6P$?fC(_KtCj4d1^jvx^=}PuzabjpJ3@ufWWyLdIwIaxD-jdGKeyv9Q>|
zjV{yja^%Wh_`J6H)!lwE);DE=R)({rp4R`Pv301kay2h
z`I^1&g}b8V+YUM&R}A)YUNdE*B6C~Ck`1?FPp`WlX`5huFueYBdBYmN8CLDBPb05<
zys~FvTJs69jmz(=UWl{zl;vUeUG!*aljl6=IL{*WMsDt)Ytl!YXiio!An>)?!
z&fv;7V2|gUz3k|pLmOtg1x1>ys(Fy~+riL6eu}V7Ue^wt#Rq*I)FSO9%wNtq_2K6A
zR5yJ|mT7qbzEfu$(P6B+&%#pw;Y~_V&H_faP0v0$&6eNm!~M>3WySP#<`=UWh5jTi
zPf&c^6d}@cKL4am{D&sx8kIjATwd<#j9KQmHCxi6LivpN2f1nHM<$5>e*7@9&vDiC
z$Gd<3{JHe1jqJgD%yDjp;YFV!HTvQNg!sL@9rAuy*QMNYJr!WQn1|iqW=K)RgLPhP
zlYj2I`^f5s_1TX*+sh_wRhh^AF)R3Zsn%py=at?(Qd}=CdM0y(ua^=(9P)BU<9_3!
zYnm}Kx{YklVmA9GbO|1J%9|+~`?pK8?w-phmlMDCx$AqpdAs$DQgLL!v56O&|1Hlo
zH8-|B<0{E&x8a5R#wA>}Gj6YwEcl{&s_@nOey)h69`9{@1Quy4wz6w0F0@ac_V&-q
za{g(&{4v~*c3)n8?aJiM+^Xu^&7W_%#1S$(_>yoqqs)@{O>e^;-vnIS+#|2ulKZ*&
z-K0d#lNU^0Jt|zd``886>EE+Y{#~>F#95uBRrL#6S4&!dm#^7&pXbe0rTNEIS9dBX
zhfHVhyBTx+=;s%@rvpki8g44FX
zk3P2T_S?kiu*K)<*S5UFnW5{Oa)rKczmRvY#>KMB(t~eF@XSO#;q8&v`V%DL{@<{5
zZPr(s@Ba5mzmK7N@xvP_`6bESXf)Ovr-ExdpJOkMspUTY@*#cz^q>vkMU
zc;hwSyL=D3+R>d1SuxsEj5=CW(&oHanA#L`>-^M9ZKdhqb?HQtxOC?$
z+r%sG&SpnX^`)-Lf6?(ayYBSW==z<};j*R`J4=k?F4u=Rt$DUBGyQ~e%-!vL+gy(C
zUo)##K$@v;QeIr~{GNoMCp|p(W*>>xUK#yORb=U>jbFFl-PPf?V%5u*XR_H9`bSI(
z*R(&mc<}hqn>lCCI!}vR{H>wvT}c_|LX&fqfxYLSZsmLavi!S9;pbIxuin|re`WS=
zdbj>N|5XwyaSOMt%S&DI+9tH>_?ceKV|QX$o4Dqgy3*LVAxo7lj`s$5r8&>bTbK>y(
zzoi_L)qkHW&f#wKzF~XyUr1npjxKjvcg)uAH5NPKR_)lR&XII6=aT93CmksUT;ETq
zD<5@X7I<=3_JHKABI&cgzTEnCFkn$B3fz(?_nXtMf?Aoc4FAx0qp}hIfC{^Aii1ZZ$N_nsb{q%I0hF
zL`TjqNmcQQI*TtHtU3Gr#|fwGYjdyky0u`%3N&An_%n277w19Ab2
z9`%3OD!gQ$J=YuW$QOGHW_#+d$<8=?^j6Qark#bdk1zIfzjS!S^4x;6B2IO;RpJ{xAM^`J$_p`CWrI
zK{+aKPTXE|-$Z<`ybz_XD@fZZ$Z2XKues7_aa0b?FlpU!3C;l{!by*_L7b
zjA%cVySJ_yN!B_AOmv++W8(aB5Msz*?8b
zFBVq*DE`CGdSF5LoZiU|9rud7{8;jFozAYdYU|4%%A^KuBZPd
zO`PT2v)9iV-pO95x7vU3$V^Y}+3(&rnXKZs_ezmb{V0}Vny7NPa<$m1%-fk-vkLx~
zZw~PdfU+7Dq_=}yTJyNqjy;xx_*7f{K}ZZ9VI)RUdR2YldC!z)}&Va`b$n^
z$J1-qzdE~yPoA8k(YB^#Y1~4MH3|Kiygf(0b{C%u-%`qu`t10t>7kX@`xzLIgjZWV
zKJUZ(*CO-Na{F~TNwpcj{6zj<|01Xm{Os)W!1ix-j7e+PJgZp$-)Bj+ZC{^%ne0)a
z$F~AoRE3W86d$@%>ea9+C^+VS@Lj%$BE}Q!8*Z$L;lHe4w7vG|g2bKQw{HpXPoBMU
zcY|8=E!Dh?h10$!CAV(-e2e$@Cl0-yDIG6&+SKuvhoAXxcQj)0?zQ@l{9exstmR&B
zYNn9G^kii(^J??llLw3Pgs$j&x!bzP6gzF`JslPowl0t9-%sVw0pUMaP3QZWBRQex
zMd!x#HScfPblBdI|FhYP_hQp7!L$F>cYKPww{hi_2+^wtn!j^zZu~X%B3pk`Yp2uI
z-J9=MJ*k;}cWIImpf_ok-~p)xYjizfXES;x0&%e7}}FCzpd+;cp5VTtV0Jf}B;
zvp&~sIKFG<^_eNcn$zM74IXaad^cv}JE4m~zt%DP-B`Twe^$$kUH&h2$?Ki^zjU>p
z;*Zapx6L}ZJWKjr>NQ!-c9GS8ZY|Kti&GV5)JcudjhgXl^?|U@|128XEFa0-Hwl<6
zp0`?>vGTa3^n^N
zbHCWbId$(t;kxK8FKqvXtrl>Ou0MRYH0sGBaZ}58RofJW;@Zsaq`IgN{p|02&0c?d*!Rch+NRi~hfQ|r%KIF?uX}3Z(z!c-
zYSeLwdbzmVC8v3>+3q{Hd@7@-!Y4WcKnX@auN0LZdI7WLs=U4|
z|L|twnX237DG$tVdd9|H@SXH1bduv8wV38BD;_<{Q?(IVHtR{klSzv*RFsY^^Evgl
z-8#Be^c&}-jI-0ri?8&a?~~c^P~#?liPA52VVSk{yB97wV8&E>$<8*=^Fxbrt-zws
z_S;rp=In0Rkgc9^H1|lI;+02l|5OMTeOk%iz;SDj|AyYZ*B5;-^K;nKsy(~>a{aw6
z@xr|v28$|%C-Ej9@o2aZd*@B>kIS+h?~;~mulXK$@Ph5%yjLEvmt?~p{M9s1nW}I?
zYM0Bt{+Akaf3dHsnV`PuFVn@cqqZ{){r=j7_sC6&)4bkx&P}Fu;lVk&YA-iee=JQc
zh-z2#6rQ+`Og{d_-^u!g=O;la
zm4+qXFNk$lvq}YdS4?^({k+yxs{U?SncG73qH@FPE391ytIjv+RU753)8>A@FQ{K&
zt~^gr>U%CH-Z`f<#iyKZ`=-^HQoU%VOnPfY-|eTuFvJqhay`@^}~o+
zTc7MNoxH9u#dgh>7aRSSL?2+0idr|Zxo9n;u@%$Wop0{=WX;pasZus-U9Y~z`{vA|
z$UTO0uGgK