From 43622b89836fd2bf031c4d978000c33c7f4bc378 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Fri, 16 Oct 2026 15:19:07 +0200 Subject: [PATCH 1/3] Docs: replace the Serve and Funnel images with one diagram and explanation --- README.md | 30 +++++++--- images/tailscale-funnel.png | Bin 46738 -> 0 bytes images/tailscale-serve-funnel.svg | 91 ++++++++++++++++++++++++++++++ images/tailscale-serve.png | Bin 49607 -> 0 bytes 4 files changed, 114 insertions(+), 7 deletions(-) delete mode 100644 images/tailscale-funnel.png create mode 100644 images/tailscale-serve-funnel.svg delete mode 100644 images/tailscale-serve.png diff --git a/README.md b/README.md index c648808d..280034d6 100644 --- a/README.md +++ b/README.md @@ -288,11 +288,31 @@ From the service directory, run `docker compose down --volumes`. To remove the s ## Tailscale Serve and Funnel -[Tailscale Serve](https://tailscale.com/kb/1312/serve) routes traffic from other devices in your Tailnet to a service on one device. [Tailscale Funnel](https://tailscale.com/kb/1223/funnel) routes traffic from the public internet to that service, so people without Tailscale can reach it. +Every stack has two containers that share one network: a Tailscale container and the application. [Tailscale Serve](https://tailscale.com/kb/1312/serve) and [Tailscale Funnel](https://tailscale.com/kb/1223/funnel) are two ways to let other people reach the application through the Tailscale container. -Stacks that use Serve keep Funnel off (`"AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}` in `compose.yaml`), so they are reachable from your Tailnet only. Umami has an opt-in public mode; see its README. +![Diagram with two paths into a ScaleTail stack. Path 1, Serve: a device in your Tailnet connects to the tailscale container, which proxies to the application container on the Docker host. Path 2, Funnel, off by default: a visitor on the internet connects through a Funnel relay server to the same tailscale container.](images/tailscale-serve-funnel.svg) -To make a service reachable from the internet: +### Serve: your Tailnet only + +1. A device in your Tailnet opens `https://..ts.net`. The traffic travels through Tailscale, encrypted by WireGuard. +2. The Tailscale container receives it on port 443 and ends the HTTPS connection with a certificate for that name. +3. Serve forwards the request to the application. Both containers share one network namespace, so the application is at `127.0.0.1` and its internal port, for example `127.0.0.1:80`. + +Serve is on in every stack that sets `TS_SERVE_CONFIG`. Only devices in your Tailnet can use it, and your Tailnet policy can restrict them further. + +### Funnel: the public internet + +Funnel is off by default. Stacks that use Serve keep it off with `"AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}` in `compose.yaml`. Umami has an opt-in public mode; see its README. + +When you turn Funnel on, a second path opens next to the first: + +1. A visitor without Tailscale opens the same address. The name resolves to a Funnel relay server run by Tailscale, not to your machine. +2. The relay opens a TCP proxy to your Tailscale container. It passes the traffic on and cannot read it, because the HTTPS connection still ends in your container. +3. From there, the request follows the same Serve route to the application. + +The Serve route does not change. Funnel only adds a way in for visitors from outside your Tailnet. + +### Turn Funnel on 1. Add `funnel` to `nodeAttrs` in your Tailnet policy file for the device, as described in [Tailscale Funnel](https://tailscale.com/kb/1223/funnel). 2. In `compose.yaml`, change `false` to `true` in the `AllowFunnel` line. @@ -300,10 +320,6 @@ To make a service reachable from the internet: Funnel is in beta and listens only on ports 443, 8443, and 10000. It requires MagicDNS and HTTPS certificates, as in the Quick Start. Anyone on the internet can then reach the application, so turn on its login first. -![Diagram of Tailscale Funnel: a client on the public internet reaches a controlled gateway, which exposes one service in the Tailnet, while private services get no access.](images/tailscale-funnel.png) - -![Diagram of Tailscale Serve: a Tailnet node reaches a lightweight web service through Serve with private access only. Funnel, shown separately, is the only part that publishes a service to the public internet.](images/tailscale-serve.png) - ## Documentation In this repository: diff --git a/images/tailscale-funnel.png b/images/tailscale-funnel.png deleted file mode 100644 index 87a0ee5b421c6a2439572484ea3ecb9e78904032..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 46738 zcmZ_02Rzm9|304M#IcW&k#LTgk)2H(va%&BB!q@+2StZtW*npJnFyIFJ9|cUDtm@9 zBN_3(U%fxy&v$%&|3{BUk(c}2<9R>FbzRR_gn^z075RDcGiT0FX=$n%ojC({ICF*w zgCGI_W9EO$2mC|iVWfdMQ~L43>X|dBGg@jY*Rj?=GR}@(xccjtpwPP&5}%+CoTu4O zNy26~-qrBde3%!0Di8Om&bD=9)PxDKPfn4YWZ0}vAFQqK_IVCKe-!r9)44Y-t-QV$ zuC3MSPx%*{ZcaCzy3(OhaQqV_5{6MmAc+3wH@N4VgV*wOu5I72`;VXf>%lEVc;b-S z|KoT6{#=^kqSos~{l7o-zh{t51qOE}Ub$=Zf9Cb?M>riMN&nwd zCqfUBfWfPXJTLRZ|9>8d6Hg`nk9FZ-Tw8&s`+;XaZJZW=s(v_Qv|{eb6GqKu;dzeY z>|M}ZdwB138J!U*6d~m#S3>eB|yMsyoWRxyM zWJv~DWbvOnY^3g?jPPWFaXQr9YZ$ZqzcVL~0yBlt#9XI`$)Zq3yrc#uFaP6^vuVK@ zNCu^5(!!RmD(C6=cIl;3{QLC&ndP7@IAtxR>;zq@lnJL7(UUw$H|O7<9DZM&|er_x)Rp%sfKcX%OWz7sA9FDB2Z&b(FtrEv+Z-GqyWO~8RejN*g9F^PW3gr<^Lnt3<5UIC+pUsmM$ z53}ngB8n65QL%D<`D~Ji^up{$-FIQ1KCv!tXs+v@oIB2$dXlnZv+I{r?@gvSW~S5? zyy+8vI^q7|(o_UrrWw|#OEcwrY5m8HfWy_oBa1{*wO$4X?!2)7y9TRRWxhCZdL2>R z(L(H%3xTm$PJX*gx^;Qk#mMF#jbxoH1{^Fg?e|Fx)Yt_6xjdBovoGuP*l{0hjY)4= z?Q*J1tl}@%aht$K`Sq$1y0HYG9PjT{Ul%2Y6tZQO?T9E12yZ(0E+UrQ>qs&6h2jTiYUAfgfrLgWd z14`es&^?tPq%!&#;7C)cm$r}=sMpZ?kR`E#`I6UGrxQ@{EC z$Vl~eUSGfT%nv=KgT>K->Kz<^esZgo|N7gFAq@_%-TK#@M)|L~_!|H3y8_mYiW|L1=z@c-8M80X6^#<7PUyCY=bLw0Tw#c=wkAC(~ z@nt=lKb^jl_TbS9Ia=r{;l@hURx3q4y`D^qk57uj^VPWrp3}bHYQH#UO_kJd)Um&) z0<%oeS6Yox*wG~Y5*jwFf922OwBPp<_DpT(?;qhg{l9k`cywGYmjR>Eox|0F{b|9RhQqbujVq@Iu}5I`Q%2V=Ej2n+?%c-x z{^DGa(XiiNTEDRtO2e`7?(1E_tW*3W@x^BmssJq`pL-`=lMJ~vm@PIpa4GfSp+K2mV9_FHCJ z&Bq3cc@-~UYDbgO_g+`1Pxmj~XwpoX%r@!xuc^nQl~2xSDIsRRUZRDpCy@+SNe~Y_ z_+T?RW@@vZ!&64uxov9m*aYVXF6b7XNXwBU;P+f#=&h}tYEb#jxInwpN+E(Bc&g5$$5%`-g-Xf?UU+}fW1#k1 zR^arXUlR`t)4m2Atxxf$-Jj2zc)UOL*oECb(|6g;G2Kml>^(5`hWC`?8dtX4>0K7P z<4$V7+)3-t2s}Bc@O!k?LaL;*1`O8&JHSkYFQ7jNS|h`M2E%=O*zLC%r{TxIcZ^_b z^`&Qga^b7@#DmA;-v*S9`rM{u)HqI0#+y!-fCs#HWpgW&v!$|UF+qQ0>o<-Nta)4K zsSu|_q=MYAF66NZv@qZEe;yzG>eu{`Iks5n@!81w@Ea^r;L=%G4Ts~Ue!{irwGo{( z^L?8=GMo!0TPTmx4ko5LKUHJj2o9@Y-}hqf^>K7%?u)2Y^KW#In8XnB85i-E#7`1hP;h^Yy) zy90b&g_Ldaxs|thSQvrqkNmfE4?lwVi&&*PzExC-&iTfWqG$JFG*fQmmc08L|5?zt zSl>kz8DHj6%QjS%-z<$>>}8$1J(^`AgAw!Nx`bD*KwhNhH>Qx)d;(nl$Mwej>FKuI zR99nzn@WUNVpJ97zrNn9ZwV&#*C$(i^&)0xPKtRB&u2@p>*m65&t5j_rwA7JHl{rd z__H^zSZj~}2(IimkLhIYF^MAj0eW|@Utb*k>E>4pvb@2CDYLv+^7fIX#sxS0X`oRA z-Nj%MDt9JpY);^D5QVVon~!qEe17Ut%yWUA4@?P?NNWNIQVxq0ld7Kbw&anf+QWp$ z>9E9SKX;5<%E&o6cf%}a-i>~p_<<-5Qo+BQNHx%z82tkgMdhJjjk?v0KubouiYg>s zR6V#R(m48!kMoNJ9%auOfGv%F1S?FIc7|nI-sn5dY z6)h+MQ1(E~28n=6iSmcbg(S-UC~s?URK291(l0g97gm6B%=FFYgKgcNQ%5TZXwE$p<+_U^-@4!O25#ia!JYk6 zhH}_)n$H(iaQkHL$ad=CS-)0PtU%lG8B^)@SQbwWOKCR?I%`jLrMgyGHarD*o_!{Z#$K63f~MxlY2`fV{fX84z)XzT|$xD?fnutq9j^r26)5?GwZ_8zCf)luLi6}efKX*OClqpjUJ0{rJ|Y$y#@)+Y@8oSYMH!%Ur-4JZiSa|z3yq$Q zhY6w8T3s(HNOc?1H6ErASX)ztxcN#l4Kud3X4SdjoFT_@iwYHr6znpa4L|jA$6<{% zA-$y}VP`N~s8-AHv~tV0i*iph=KH-(UY^`Eai(DA63` zQHtC6&n5cYcA*#iKqe`O)_V@GO=bER%IdQ6tu>fNX@y#G*I@Ik!(M0qi;B+k#bHT? z7u*sMpQV`S_(ztB41Pl19;c3U3Qcs*Q~W1eIs@{fR8kBo5HhZcNr5hoz=r)B5s@sj zSYzbZU;;f!E>Z4TvPLD|bXN?A3;lEzJyWUOx&i5&7Iqk=5cZ9-T5^syxPX+M1OH)k zr%1CHI3*M{vn@dkW{F@$X9P5SUMV?Ei9)2MQ^f=M?kyw=W+B2sVu$e!vcf*mtF~ToO^DX$!Tic_&6LWh#9am`p24A-$rIE} z*=$gOL%MeN%>;6V!RSs|mg3Hfer#;ykkz&=S}V{9G0YO@ST$#JORU0@#($&%U_53E}Pl`AW&Ylva`B^#Tx! zrrAJnKH1(nyjvW5FNZJ1K3;8H%2E@Vqqv)}#a+r%Z5frT^-N3j{`m8*sf!`|w6?Zo z4LjOA<_|RkXvNh|(OP#v4nY2Kg}u=;NWAJ{gg1IZvw@XPfA^W?TV!XfTTnKqY(+FN z`whYs#Fgr;w>h;Ngbqk8yZ=mXZ~Rw6J)NSh!WM=`i1JE%4DD1 zO;FeGCT_s%@M%)JToKo2>t=B8M)JZ9?eXLhA*wW4G7Unu<-RnAB<>U#JW?orRlTFZ z__wSzS6dj34^(07qr_o6sg@+M^zKLa);F(@mTigA?Z0Qg*!Lv$G^tum9>cxeq;2{^ zx}=mNvYs|u(yoA0M(_5(%QB!^hF)s%!@+hJhyRM&6_juDSN8#B$v9;e1=<}(mBDl7 zpu+L>%u9nRoNRJX1V&07X!Rw5_)`@4mW$A-sX-P8@Qx_)Z*rR$C^;2 zdo`TIMK5SqOebE)GF&KrV}6~Ee3AaZ5+#gjwd-VY+^zM#82gQ`_7SQtH+e2j{Lk)4 zJqVJ#UKbe`w13lb)3A$<9a68hC0lZ?I0d5bW2GWV(boxj1g$a5+xT1Kk>Z>V7P!i< ze*qSIsN{|!>d%&o-**cpF0GOOQLajIS<2=rt=HZ6rX|HVZv1@`QwwLFK)cX9$6OoV zUMF<~?h)i$csV@d$I1EC0$4D20!|Jb_d&VgtIzPkF1{iEhc-rB1v_g9Bima}dzjB@ znmPvGfw4#fkQwhn7cb|kaWOx=mBY(Lm@@A%g-l?QzZJ%5C=rZpA&R^l_;Cls! zNKx|PoDo_860LH*J|V+pLas6D?`ji~;7)X~O4eh<8;agcS-jKco2-;Q;3|ELJIm;L zO{k*%q7`2$hdbB0F8z8t;j{N-Uqbsqwei4>cbAOvpE(tmxLj49`R&5yyH{@seL@LW zSpWbZ4DQ0KY_DB;WWV2aF6pz~eE-3f(tbu&z1QwHF?Dw@8EUNjx+i@GIsP8hkol&f zVSGEIWDl9?M1<>qR6bh_v1LLPxYBo7J(`c;`$hJrmyty6Sm9@f%R#qoxVGs_Q1nuz zFbJbzhn-2TgL#!mCm2|U?vnzIzgxAAQD%MjwL4)ldeM_RYvJA5`GVRT70;0tAl>`^ z+mdmu$2N>@`QhE!)J`Z%W2!Dz)VkPp32~L6;AQb>yJHFj9II8{-*HGNAh?5?;dRrR zI74@IWr&Dd!r4}@{PjK+1AMK$96qlPWK}H9!z<#iL2@v{d7FY(T;@^CtLlCz*i&kAqClN{gvp+M#*Hp~+{2t!@XrsPt zAgT3SY(Z8)o&WBT#$!cjUO`)RKPo>wk{*!XR0!nZiC~bwx&@#AI?Tf(DNzPbpC+{}aJw1EszyPODUxfiBC+UeN7z;U8cM){gA&{luz1~Onf5&{MQq)U}%*81qze|h}(BVOL8LY3k2ASXK> z7*P1xhrc*3qOO!W6L>ns#9g~?sKItwo0USOp?rUOZj&I%dAwRZ6TteCRzVVFT+_G$ z)lk+lT9~5ws*?PKXB`QlH$?zGQR)wj%E;z}a~`F1NEEYJuF|c`+B%{waO)(1s=N+z zzUkJQ4OJI)*0NDl(pSdnHs0JgCBxN&0HOE=zRFF@|3Vf8w+I1#;s(0J8?P(|@K@s~ zHv;3|Z0kC>T`cE>6U~;nnlv((Q&q z9_|Xo*(b!4SDCC9g=-h-Y&=2b;c>65(R)eEy-1m{5mf$)I~8VsK@=#gx@^>bD^*af zUwn12@*>txGD~ehCgT+z-UY!jmiH?<{6=eANLcfBX2p!|Bw2ZHTWijS@D1L7)4#mM zn|i;pXHul;c-~_(`DAfDXDXOl?v+MN%B6RoTOTy;eR^NExTF%59&`cMd>%lmQ1PT- zSlLD`e?5}};0VW5T1Yt%sUrtARZnX^p3l9%HQS?#F03Mi{T!78}cr#Fn9Wl#1 zub_(J!8FE$EG(iEvQ&;cA*Q{g9FJy&n~vQ%Lf=lhf2f^ssqfElZ6%9nxoi|l`if$c zZkOsT=Uq@BdA##|b1%Q;XAfW2YX%-?(VpO;XamW1I)R7v>+h!N`FG94()qi*CXu#_ zKj(bir|^D405_bj=hZ!3Ul!=ZHK>5qBjd$Y!>GN8NvRnm!6NOWl;gBgUL)}DA0J6Y zTimEi<}_a!^(?5XfxYK<=H};5%$v^hdO0MbYaS==JZNP8xBOE9=9J)q`gGGnw;EXF zD7OQ~j(&g{5eX2+&k17q^R(<VrDQIiRZmRHT;=fgP_lr`@+ ztmHnevx`;yG?R+=(KjN~V(|~XAcV(ke*=}-9=kYWen?oPZ^`VJ+vq#=x{`(=;VQ8p z=NK_1WvK)h(C-Kio!hh<%X)&-|y&nADw@vP}DH;8&T2 zD2d}}BjjDkVvN)!R1k}?%JrHlTNcyD{)LQqWj9)*&XuSQ=Hiy-{Ng-{f-E0F94Klx{9`7@;!6X#l8`9(PCe0F-t8R4W`=35sT{ zKDB}_$`iShcOPI^E&u~BROmYQl^~CnwXDqRY467v-CCrO|^Z;Dy%t0dJ23O`X$v@H$xjj|*dIEvZdy#^I?`ULO z<>@#vFV9?i`Pwo{JvwUW}i!V5< zuFx8-2M}cA5TRK|q|oFtUb&PIH6HK|plkj+9SRN@s_oCs_jnpQ!az~wh={2C^_}OL zE>yJnpMYHbmli&H>j}3?l3-bb_*nmS_1@W#c3smwdnokgAu9o<_-mzJku_8#BvZ!L z>0CRLY~WVr!TeK^-MMQlr2Py^roOkfj@RS*{47w*ah7Y}u1kDubii_ek00qE?}DSZ(>3Bk^Fvnh(u zhCjXts>0O$+b!}W1B`34?@--gc>ogO^r6he5U${N4W#AV6@4ak4fYJAhVi1D-B0~6 z{yvj#VVg9z+KlWZ!uZQ7qXduTyac@+lesC3xh8iw644^Wn0$4)kiShSSG@KsB&l_q|lH z!L24VO+gHKnLw>Bpaa;G%*5GzPA)%9I-U0kcVS{gwu$Qco>X2z$2DM29@EcVGW@iR zr`KC)46JEE+%C!lcCT_(e4hLEw7ji(X4jjL#YSu$K`o`YGddA{KWa;io(@JIZ_h4D zxC!w6B!9p$9M9w=YtVmozh*pq0#b}!B|fBGjE3G@!fWow8+jnpmUEUIOUmUObOHGz zJM1bO@#wq-f!pU&O0_({2)PPu8)^xJ!}hS4IufVj2(qgecr4`?)m{J z?lVfDGWgSkj=f=Kdsbs5ifmx+3&x3dQUAQ+P)q4Isf;brmV51oGLL?{W*vpLzsols zo)pKvBpCChk`{bgdBRicgOUS7O_b6$ za|d=_)Bc-{&lX#5uuC6<10RN{ETvV~;gf}0d*9GjwU*U8*595n@{jo16|tYA!Fe-> zWZyzFK$RC?p5b?-Q`b?!*2_=PWfp(!-#%0stBSe#!{-i_m*&;QuohJk7%VpGuJ~7{ z7rw1{)`<6~Cr5^nwAA$0PjxwGMQugqt^zOay;S5FzdOHI(ZOhWy*snq2=fe~aR}n2 zx-&&CkwBxI;3_ zupyLuB2|F#*5 z(E)3n=gM_)jRkGM3T+P{p#?*l18Kp|@ENJU`I}T5U;v4j__qL9IRn1*Y(^DPglJ^5 zspn{>wCYpvf98aL-9Cv(bRL>5V)+|ep94$lq0=4X0Whl(L_uEFUcxIcAgbCfQfj3< z6~XTJd;XUe;Qi-q4NiC+EzY|k5b(2Z`Go@@rYEukU-Xg#;|0E?gTA~V#cw4J|N6{z z{OdV><4Q6vFA0c+&37#l|ND{OK!nTp=(?du54)mm|YI}J^elU6Jl!Fs=bL#+4!6aJJDs zjOWX#JRL>-xBu{2NKGxWzY|U3+S+eAo!TZHTIaJ;Vi|pm9>lveT>fv=21=u>TLnt-d8VU7-i!r= zp3i{de$>v-XE!W**j$^5{$0E*?f*}%cjY~x_b7+@ss+B&l)SE<_Jf#3m%0{W8im1< zn)%2LkPCW(i|jM9R|tc242rbLerttO0Bu?d4F5I_^419kwFEu6!Yd7SY)2XSd<70>% zCeby=8~>t``rKShp_KJ#N6WY z!=x$;j%rGkMlrGOqY!&D#l^afJBANGd4ZdC-f#>^AD$pr44~_{(p+ST$(}_p#3k15 z4qx-fwj*!+1Vzi?O#!HgI9jis5qJd^iY`%Nom-3K@Q*I_>&uysf0>{9#~(vb{E5Kq zmfS6_dw^HGmuoZIAHcKoJF$EGMZ%%2X?1GWvQfDqVA9$+5th9 zey_B4vOA7zDoWzx3Lv&Bid1t9ew50GtP4eJvaQ`$z&xqA4AhK5^O8YERe1!gdQ$1=#{yuVGgAL7Jm=9{rj4SHLN#di zG0TB?GzAXdw6IN+1>=o)%-Qf{WEwEtJ#!)SeiM?E_o->-X(d5ke~_Bi&p%RZD&hn1 zuHWUN@P##SNd{EznUKLUFuiz>!D(rQE8Xk({jcDP&5@}p$f@-n`)nk9aLn-fw0)|# z77uQfx5+T}H`w zoW4P?R}LIh*A0IlxTx_MP?Xk6xFn+5dK(kn9UMG25k=4leI(8cX7{`v)jBcJPr8dI+F?|sNj2lK}~|}{btkY$@8Tcq9pE3 z{mDAZYL5pO!Ldb!T^QGl$#92N{q%}ZS`8TncrPH< zH`oJ@-Lii2>D{%}@?EoVcxEy=bMi}?qtwA83@Jr9X;7nh7YIInJ&;i1#S%fv4CkDl zl1Bvu@w5l;QYHXX{^!{b$khlmV5L*`-(nu*+Mi*!8qvSfxPRO3!7Dx>tFYxM>*ok; zw-Haj6JYMIKuo0azW7_Fzwo(LpKf$m4aDv4r}<{!e>_p3{%K`C{W_2AahiEq%~Eum z$}YROefLGefaHjdOUc_$JJVrUP4t+i%v$Q>Utj*{y1n)pi%-x8>8cV#%)>J|=GdDK z{G1MzYQ|oFs~|aM5O&!VYSvPb7e!(H1abAcLB*3lNlnKcrw;-}3BQAVNSjoDr)71J z!OxZ+AY}>Si=k)@N|>xNr{T%xXP+VDOT(5YWwUVIge?!W(2V&=bPlzt+k<_HC>Zy%_Cn~&k5(!GYU@kI;>!Np1-cDKR zas)I~5s2Jae^ewXo;JazRd-_jOl}C3Z8k&;7|2k1- z+yGLE7~k;OKWdmwCzve)2eBsKtSYvY5QMSk z?Q-O>YBz1*o6H>IO`;xO-$38}c=F9t5Ev#F{@6w1C<~u2%J<0Mc-WZhB1-D$QuZ`* z>0Rr+$YUF~Aa<;0xEv3WUQ6G6PQy9HXw%5iQ_|YFnKzXR@aI%>WC3 zwgqcL#*>P0z{^s=p-<6EGp90}K>*+>8(FB>XG951T9b86`U^nXA1g%|h{D$8w(huC zxBl)pldJe%ezEQ|2v(1-41KVVyUJL|Oo(cMijtvdymU8Gn1twdI~BWl`mk!E@}Y7m zTB`#8qc!|$&GLoVBw%X--U7C>xqKMe)_Ud{PHk}U80nm*h0*9cHLAIB^dU1L@Fxc zEubA#pqavbu`uc%S={efWFT@WaR?7lNG6C;PKUmuvvi>ZCQW9kC7?P}?I7kY%)}p! zl3O+>hbFd^^Ky4Y9h3*?^=^;eN_fal`^(=w;wE-3WO^y9xRh1`W^Rc-m+OEw{Ba|( zCg9eibzp5L*B=2q(+wyNbVF{EHDa6X2D4S3381cvQtFC|%FcC)wwd7uTiVWu6EDQn zkwqxC-lW^z!;!LYb@IsaM{VJ%A}A_~q#3<2da{SQrpcoas9Mzh zE${NdXIoXQuf-VA*_wlW{PKB}JxVNb4WgcnYV+K(;mVMT8At6?j|Wh|uBj5O3-};Z8oE&e*e1=;{`wAo$Lg89 z6q_o$cHvE;O$0ZQoa-CbJOo+gdIqj)$;v@^UIo_DT#uX9{2lX>MOE;_R|>6GDl^3Q zVNixzk&$U1#*A5(weDw48cS_%-Np4Sr?vPGSg=-aSbV-HxAXARgKoc1%AQiKUou~& z$N2yb`A$Mg81vIaXZz08f9fVCsEDB;wX$M_omEC@_s*8a7~(W2xheTR9=C*Cp|m42 zp&?`HKDR@(C7tFwG3X&+-M@gV`~8RYVZ)pU12PxRA8Z&yAFlnv>9}sp=#7`P3H*Z@>7e*1%7U7AtbLQeg|Kma-QW=dg%-KP&dg!p=o($ zUv)FvA9kXlXgX)t-s1aQd6amzQ2yUyfn;YFrf$EEkC!x05XWjMQ;SM>m#MjMh9~FI z`9*z^Xs{%3%pFBDX*UJ@dGs0SF@_)HN3c$#DFf<1vFV_+bML`D(!8EzdAwll2}}4W zvULS$L>`SO#AX6HqHhPW{fMq~$z%||nsrWYBh#l(re4NtyHo~A)c;w>3f@KqwceI7?Qtz$3Up{D3i152A^ zuzk-&847Bn9@ZuT`<*^WNvV_-!9v6Am>y#nmFm{==J_cqRfPEQr9P5BTbyFw*t$(Tqx0m8f^>uhX}^Vyx|W z<6KTTF)xcL7Lp99xT-<c6qDpM!y#id%OwcQVDo?$JW$=}r7uTd?GM0(Z$L6_=qP2FXf#I^xY)r{qYh zMz+SHDa|wf13hCfH{1=IAZnXfY-nge%j5#A{ozp|bAIr6*S-oXpMdUsnwy=x<+a}#Rz+#jH0~On!JQ( zi8x*mAXBD{*1vHy-#*^SxQLIt?RwQ8Zm;v;R>~U+hj{RtL_e34Z@DlCb~LwTiPRH|MHqv0uMj^`AGs#-`SH{UmR%_k|9m z>M-5P))?Wi>Z?2%Ht$5*?5N|PycY|rQMu^%Cc*cyD+O!a3#P|QY`1jhWUr-LiIhdr zYVFcu!mkie4W^@{Vjbs6SMAtU%}Y(ISVL(mNR)YTT+`v`A%^OWROxeY&glSbgz~fm zFY-j8?Jz8f21eB36XNsyAdQE`&O;|pCw@%b;qM*9D9irSYthX{bZwNvP{rk})c(!J z$O>D`G=qYw%v@Bws4r5~EknwPcf+%uQFGE>O`tdRhZFZw^`|hSJ>tNv?82 zD){Eh{eCia~F--7PLzj;4w?4JsoGB@dOx{C>XV zGZNF0t!%X2I_DO7`xj+1ZXoyq$2NEJ_ zjIOApym?nk(F`wY1z5Sw-};-B#E%<1kcTuWx^v--K)CegLSz*3QDA0TE^qeyO>c?IOcigmhJ zz5`Q~%%uU!vxxP|yoSC&chNZ4^zwY}=|ChC!ROQXT{DU4s(Ur|Z>`P!ZC#iHZuA%P z*KLIQ1{AG+^y^L@)M!WtTGA}-8m<9l-k%SGCf~HL?=9afnE^LSBS6NpN(DRS{)C+lwkKlonHE zy}2oc?R=tp)BRR!o)81MU9bDQTMXOs?y2~3;|X0I{NwDLkHfH(^F1hMCW~ zT#_r+Z;(wN+2EPn4rc<^h#n+kQ)=VKFFyxgqlQ7CMe|8`rNk47)$*y6o8Tp7d zoF^bgly6H&Ex8L{a9NPkA@!=kz~8o-Iyk65t;7e{@{vxoFgI(l=dYQ#h!#i|$Oe)J zliyitTjbptyMy3sZB}c_!^lwNMX*paWAHM!G()OI3^@wQ2^{H89;vz@Kt6HeG}mOu zgtvZo>JM*LB{n)U{z$|zg4OaSITcNJ81d?kA9y-Y`vd)VnqIPFx zL#N$p#JkAeK8b3Tv3HRa+@rf;TAX!LHGE2aES$Yhj85t&DGf1~Q&bf0QL|at@A5$z zO(IM+LCD1>=+Ui>A*D@|c){-V=WMMh-O&u8{2g<*GVjmr^(^-@Srf56eqKwej##+9 zF6Yq8onf<^^oK?5p=1~1AKWaOl>BGL;wJ(v0f~%Yyy57V%TepRVrm_~%vSu?IwfE? z;w?o+@f?el&qC+Ruc^p>R)+zL+YURQ@zU7Kk!h_-=dbDw{KJ4!LVGVYyH<+qCc_b; zBK$h=ovfWowNj$qtqI+^1aaAxkrx(GWSS8cp_z(LlFk;45!9Y{*U++wxob|6t2D1) zJ}$iTL((XaYrsr6$0;*PeNB5u$4DsU16G%oH%NoYmJ%uCrgkP&>cDMF`?i7@r&wfh zoQ~FRUuBf_QvsJ%6ajaD6y$Gybk9(;5(F72?UucB5O4Nh*SOB%xe-&SPhhW ziXHy6f@JjC=d`eoTHkdJV|YqLHr*E|af6txC&A%8?uvB$3HykmfWHAf48jjpNsOkD zum_mz^DOj!9pzu5GxIdc+BbNO@^w{T-l<38)U{Z4YLrQkbs>(#n}RU@W)936W+3@u zm3r^!2WP`7bj7{$7t*}vboEz_sUdR2E@; zH_=w}&gd~qJgC{l1>sE_6Tpljc`0Gx&0dAfO zH;ARc39Fz4#XDz#teJ;iW9q&jESeyGky5NJOZ_26P>^4>)uJ@%+jFsa;%j(i2|)5V zlPD?*{)M7BAt-w2R&g;VTLmuqu|_@7KF7Pnt0c`dUXsg*mrPrL3!bW)ZD^EVdn2PM zK4l_lEn`%ALhsW+LQM+m(2m}(w71hmWyxSr{^c4?!N12f2RKUO8gv{6lP!u!_Mx<; z#7np)XuYwI^3u!Gu?;nk^b`eiAEptm-gaG=m95~$WV67d((jvmR1XokEMehyo#Cy!KqF+Q8W3c4vIoeEzgohWhMapIp`z9=}HS2fos!(qXrPIvy&LU?6p zQQSdVA$Vn=PQUb!vPY?>Vob+yZc_)aM>>!;a`tDjI+CjdkPOl1m zCJGLEQH^+Mbp*KKa_qR81~GsLzw`%mz!cCo9CO46+~EOe8^&l4fm;KM9{PcVt*e6L zJt{Z-0I*;L&IpojU2o%Y2vJ@}jP|nrgqR)BvQZBx6v3a~S9|TL3k4WpFMvs_Ctwg& zfZvQ0$5X{Sv7%K1FAqKYyq?B-*ZlALAwfeb5|iyuo9y1p|EKc-$k2aP3#beti*|v; z;LiCXhA_aSY-ISX`QAe!W-2T~&Dp;)v*c~PR2VeLaDa%#e>Vnvg(xB^nkT7DASphx z6OxvAxWBo12$~lC_BYlMCi9-rqAzXRLLJT*aRbyh_%&}mJC2hePE10%^*urj;mHM4 z@2y%>Ecda_6rYlr73eL`s1BO2+4q}$7j^ZP!=vhN=!9-W=<_z%_<4q;svJiTfK zX~TJU9yq*;*Gwr*cVF{NqrC{@r>9EORu$*wksKcFA#j&e_qP=+PvDg=8x=6d(Le6& zjZAbNK^6TY7Wx7i;yc=e_ZSo#%q`-PC0kJU<~pjJr_ za+_hHzrs%hE)_akI4vyWsq*E`b2swl}phV!50CdcBDPEecd*N}#<=U~7LB_qHd@)C_MV6st?t=JRKF@ zr=u(6&^R5U#R-_~ARs!_CHZ?_wIF1F7?s)|};8>#nsxDS*@b)bW_nTlQEGtlf= zzHCu5y`6ODRi4v-uM)UA&=ZVEXQzkus)`kiz0OYbRsKRaG!l|<>Qesi-Lwi;E^&RC z=2F)~#i7)YXa?rGRIarOIhcI4U>=hYWfCy|o-=ADXkdLvCsHunS6tm!23QaBqQCfz zMI!@$!hPyjiAW~~FvV!j0??x)3!T+Rw}elSvmpX(e}XcCfd;3iwJd0qkM+2A-irnd zQ|I`4%ou$J_5khRR7JZwQT>oB_Sr^Cj%wJQ(x0G#T)fQq9B3CBv<4ed#T58f7@mtz z?k+bqck4L!hveyLLf<}UG8VKFw*ek#29y05Ow^g<7w}7sdRr3G-( zC>YI0z6xpnFS+l(1D+2ZjIp!|P+0!Amp_O!d0wa_bSDMJRr35i$3LR=#`rP+f9r51 z!<2u2G^RfaCn6^K{YN!@_piizFZCFp5hi8f0V43PkkOFr~CkFB0$mFX4h6G-*m{MILx>q;hGVjv(cXx@wNauSKj<%disrec~CjrCTao8Mu{x{|M-rNqWo%D{FH*saph*l7b8 zCqcTk$Ogec0cPHDp2j&r0-TgPiP=~+bi9{BEThSYVxNQvs&u}t8rClL*__TKtS-9p zfFn4@WWR-0b7}gn?tdHX3?$O1VsN?q{J%z`z#(8$=S#Vb)XRd9PM5&=7Eh}!=wa)S zptN2?dHvrXwFHHObfO!3(49|fd#2XAVuFN~K)3bY_Kka(>?!bh5iCIHZr0o{`z?JV zQn1t&C_ydjyENAwAs0>Aa^2(sl-W##DU*8=!QAGwK@V(>|16Gla<(N{e#iTzUt3YS z_#Se2GXxwGm_GFt#Y^zsP-W9NamIbChXkN+Sbi*IJ4Bd8@(IWV;x*^w4J}cTyY} zs{s#qsHBR0X3h)LBh`RP|GmvD=jqgD1-zc9r(gLKXeVZ~HD3;MWlua?qXEL5L*_y} z(uoAvOMiBOV~FwrG>tbv(p&?;`dU&yh%NK~QPDNobo%Gv={KMgzE5ri0B_4>;22BI znb^huDpOXngDw`l^;w{jm&uF^Yu*6nz^>u9mgEr=8- z+;1+p)GjgZ1D7Hx$*ErTqiRHNBZSHNm3bE#U-~SgHP*Ho$Uf?mto?edK>MW&=-KoF zV&pV`086mmZThO3Z(5=~AopF!2LL?2vqXl8)q9~9X&2DSb>HlA zoH&(g0VxG!)iCPF>jIZxNT_QxipFMRq#$-*v;%cs+#YJ{HydA$jbJqZ!lsO6qXus1 ze0r3%bfGTj5R}8p2dKUJhPAH)B+{vG{Pp!iKTtQgU6mrGJ&qe2efs|?fjbE{t4LVg9*-^tz)ec`&QDZ z#GKy{qQ#qHPZv7|Dcmcr$?IoP5{hbdY z1+9nRZy$ixXUw>cQH00=*l7y1wy#S~W9>le@#X=m?pArq-J-(DfA#xk7Om%nkj-%> zeg~oyS0EL5Fx;iiFAbRXS{BFjAxLd|DW4dxBH7D5hP*B~0gsGtHkP|%~k=T9u9cFd8RwYBQfxFOe*9r3Tm zkWR?U%Xs@4ArfhEt$;L7ZKo9mdZ+inPR(f~n^2oYo67w41kgA=y{*HX-#+#Xh_v-` z1?@x{cZ~v#-hmLe?`p~pv}=<-}6xJYfdi>LlqeB(J^aIjJjML09kk@*kvY{6OWYwQ7dkJ+A8o`4| zH*<)oWtzV=tO6M)jqJhydi_g5O*1XfTRT7rWBI}+Vk$cNMm@boZtaknWHcq$DL2 z=}wVu*mQRzAOg}2N_R_1mo$iUmz>$}_kQR6uIpUq`~__G^E~s+tXZ?>UhBT+K=zqL zE4EM|3%3ah*R-~=AT9zTb$}hV936xK3!{PQ3&D+4TXCF3GVRvcq>8J3+kHLOIhQ+d znH1T4DBT$D#$%g6LZuMSin>o)pMvoLYL<S1zl{a zJ5L|S$(FwB4*`NPJQw3YoS@_Vr1y&VrQnUcHkO-&*BEmDSB~bvv+@+DO?XA$wK+9N zcll$?0S5EE<`PWO@fJTIf?r=8r7_`5;J0_6Il2jUHg~Mt&XWPjYBP~^fgou`{=Z7C z)V*W~z46cbaMWdsD%0v6%6N#?wel5pyER(-;VZ<+j$A_?6q~3V0(F{s=X#A81b5&T z&xo|B;<$n+NSUXh;A^|F{u=x+amjy{LT~>!Lr;j_{t{)6N699B%NX@05=RJ|%jn#)RjC%o%@CPj|ZIk4@vns5}j7i(fV3w)F`IW0%7-k}HHy!cIW7<{Qeo z*9>wrD2W2Ohuc}M*$)KX@MvlYD1qo7KMJ4@V3MS^qjrdu!W8U&k4H*CEBa@fPFD8l zz;N9YC<8&zAEi>PnX871@@z)wHoz1@b0-mk#EbR z&e!k(_FnBDa`be^6!J5#ePo%4q^phFIK;G+N%7Ndj2VlA-&%?2s@z1 z4Tc(W+`nqZ)K7+s8zS%LjwJbHts7?Dh{_*viV#4aODV^M!l$r>4h`17d;TnWudkoa zXOuW$1!;o$IjU1FCRjOtXo$XtZ{+bUdGZx-aK@Zxt|PR*qb zLdPiJac|1gqrbp6^!!!%cOz7nV@Ws8j%o%f7?0DRzFde5Zo{UOTE_2(!Q(g2Xz}@9 zOSlZUn4)_9=!m(-*YBy3uhMYP@2J-N^-_jeVAZvc1s}`%6AkE?XKfNGq2QvR{QgBU z3!_T8j>v{NfjTjY`N)i8yLF9TB;ATykLZwC3e|v6kphA z)?hz+3@F5uDEP*1? zP>L=5gLh#o*HE7V`WP?xK)W3OG_phZvu?xu#y7QxMGF^WEk!S z;(aTq9%Sip9BKuDyQl>I)@RgP$wr(RwRHl-DnosFLoupK&#g3bk0MS`Fn%RH@K%^2 z*uUr8HkicB0qCZjbfax(re5}ZIQlgr6^ef&)g7zt_R0HV*Kvq|ZXRA|D>cem#r0}# zU&9S=^|%^{DSZR+e>tv}mi@9ce;keJZ)m{^5d|=O87k=R%yW1*wDw0N4iLScdJe1x zh}8Yt3GQLBSOr>=%R6ImVx}Fi@>4pDTs9CnlwB(OOE-eG(>psJ3~Ip%F+bWdBb~V1 zSOl`HoUFKk!Jm*YOJuO?>dNS>q>!T!dC}O>(N952TZ^*h-`!sKVW|7v`;pTPKX-t5 zdjBQs$NnhYNFUJ5g-rzrMSmV6f77FO&65v^5k3%T=% z7CuDv;p%HJ5Lyw`%kL0_`V3VS>A{~;a&7GY1qd1lPtBn?$=gW}FwJWQ2*XQXmdUHDa0cftXp%GJu1c z&=-Y~*6>e?8^J2QbUD%QEg?q-Kh{?)2KdqJ5DZEsSri@bWQWv@Pe;j|9W^MOk&q5p z>^M<>W4@p_(Cee%Okx*;?})@CCn}OqwEq%gK9&1fu~&X7^*&$GXSUc3U^W0c!-9#s zLg9f$6Scj!J=B`oYYnC7HQAuVS}Ylo5sH0Q(Mx5@d8yb{XV@=#2#)$tS7CciN{dijM$=cMH{b_{R4g_s@5e zs{j1_ZQ%#M;Nc^<;4fz^QWhMJ{z3WvTp2|gwEnZ;I4^uam)>FkH4cId96(oCRZL-LH24Cu6Ukq4@uRzo~iTXAdYO9^@7n znAM)W@qj}LJ}6TFp#iT#|NXIlqXRvFGycXA{oDBe*%Xi*IL)($BdWYoOS}{W%K(Jm&bQHZbvP-Pav}4r)dw*vMLmt~dtH$WYMK(w9X7 zf`naZRqu)6D?nw9BLk`xi|~SMKnhWS@5vkEXkTg-+e{Ty$NA*%yK1*;-dkzB{4Yr9 z4Vjl8)VS5>zl|!Kx%n|eb!+!5uE(`5&favwh3sq7`0<{H+7>)oB@C4{SK0Umhx`(T z^1x~c$8fCh{k3Ab#`#F6G)GbWYf(UqOZ7KSzs2K=x5j3c6PzaVkdOk_3v`_+7D%Qw zJu|JI9JewG-AihA&xR8Dw4%6dF98iMO#fyEODzlFL($}?)bSy@5`!Oa%-D7<Kq+fSj_|l?XO!!VeGC3MIBl@m%hB;-*wiyX=q&nz3hU z1=(yr`}wQW5a(s*OG0e9Z+@0E&8;vV)7a%lHMeoQ?`G9jxL;NzQ@YPJ(U>X=m-UrB zc1$RpZ#Nf(Ca{uP5|z+7Gk8BPPU8N|Rv|xM>T}WjuW3o-B!MJkd0wQ4`S09?q-wG^ zx6@&X1DNVlbP(MraqwErGZ9+rg%>dKX_VBKj2R#8d_`E|fXAbzTrsd6;TZgFjDutG zgn6NIwbV-aJdQ|L%x_MVUe+2wN^p zyri|IjK)#jF?!l7z`%Qzc zm0iK&v4r1{Jp9|KjfRk)UHqyw?{*ep$7`m1GATLjkuIv0N_A#zBKkk{XVo zPS6ybNamcvSDb6(Qc4#w@R^Wr^^{{UVYxNH%kQ`byM>9Qe{G<2RQBF0owbtd)Kl zaM4SGH*Z$~h}H02C^=Vr`Lf-2B1yS2)IyPqJR`6cv0@GNfehz z0tYz$Q4Iwshn8O`ttsG?P`HA~)_uk zPjXxC1;S1{K#T%tN>9$$=x8{+9^JKosfNUbl+pntA%>R#O8QSj3+YYacnO@J`yE8; z{QUHnfOXgaqRl3_f+0YJJX^Dh9!C^nv^9YUWC^ax0GJeAi)Zq>$MCojaFX0BCILF0 ze#V)!2Z#JWF1G{NY2xp#!w_3TBYe~5di1-b!bM$)H%ZTR$r&#A8Lv~Qb9#io;pbV6VRfC_w8#OSU{&MUw9h zK68Zu>a_&Wt!(*QOF0sUZvdbZWrow+JlK-}6XwVL)p|_Yj!{x3FuG+5CopENfZL~~ zsfM(+UR+XsLRJU}Y_#eWq+cWhYeoE%($&o~6g7v5VBiBCxFkHuD zk7p%R3w47CFO{zsKOh)+*vm*tXDmg+bt?`^ zDq25)4f#8*XD%N_LGDesnWeljPxz=EaS4t;{{Vo<|Li4_Ev9^odU5@Hj1{g{OZaBn zmkLf$s>eZj3T-p>cN~eFOdut=|rSBm{4#mreo!V zvso*5qTn($*_H7q{!9q5Q3;A%VGqXu;$EM@o2H_xp!0UQRV(>0ILx|t`?JcW z0kORy--j_AwRT8Fo4Sf<9rIP`10YgJ4h?)Oz_*|50(}j+dq`gbB#}FxfVa+lKo3qK zXH|=@k;BTQwt&;N+E#$L={DKC^=Iyh;;wWNn?jz1 zZFb-52&xP?T?Y=fi&C179)SQQ|LgOb>N3g@kML12mOgD}g7MXu*M!XK_K@@|Z>?Xr z5$>RP#{(;|2zV?8(aw*`0;`bsc5oq;fjS_x#C6D94fIe1L&KVT2$Na63MXQ@&g=mP z?c7Zh&!OG(iENAN#SGsuaj9%MU@yIRxU1$S`AUkFaA-;lixe4u_>%QfXiD}4)&lc@Vuo3|Wpm$)4M`?ABkVGIFN=Pv9jwYUn8tBRIsrEr&9hNQkZIlc39RW`;hcT-!c>?r!Z(B zolexR@43I(qS2UyR&53RdMWF2xA8h>{IqdTWR!)R8aXrKt`iU^zJ2|SPYuwe&FLd| zL5k)Kro;jv%ygi?b?`^;j+I7%q5Sd>xg>(dZn5G0&2~l2i_7p32crumnRR5OZc#w#8q&L5E*ZTYQ$B>+tFU&i0&fY2_aA5FlZ$0h{UXAOv5W8J)ie zk|K>j-|+MDYnP=%nZb=08-L!+-a_42LFT9;N%kKdtn@5r%p#AL39&p%$;}(@<&}4G zb{9SF@m$n)s~_FWPLwhLoxJ5(5e0Ka17gS|62>dT&UqA6D@MV0OTg0 z)0!T^R$5=%9et9kU5^HoM%)f$9#Ml8`&fX;GQ`as$E{Qd#j^%s}MXbRUd3{YN-d?#|&VX$u&v&A;s~PMe4aV_Ra%@I&=UbJF){|2p z-BJ97an^M1r60~M3dmb@zL`iI@%^c{APEMu8GZJ>F4JT^yR4-JeW$kxwAY5|bf)6!Bhde#43#bh}r!l?K{&no{D#i0sfp`WT zC%_-3jp3WR2m5q-(nr7CBksp++Tjjzkhnch^RU>TGj5?2^6n5ZViRFYum)oR#Um-k zbW3@XSx1aVr^=}3YxISq99K3sIGwz11I4J<3`ZOuARF(EBfN^l9v_(o-0DV*M2dxE ztJS)MJF$=QNC$>-{#?wXVBT(QIs*Miv8u#gj`_&J_+)kpIRjTc@)IAQRmNpZ;q;$_`WLkq%yjUAz3(<%_F0fmE%>5f` zDHs&)RJR3^B)D551J*kHY_L@jj$Y`;N21D$xxY9T;V~Ncm@ASmK&Ml;u?17D-im`A z0~g?e-2*BDOQ?jKE%GM%`2&R9Ql6SCr{zJ3>yElIP)|@g&NDf!T__^!%}=4qSjwG$ zPd`1lv6D1+QIbT6mr-kUUY5Cf^$jd+E4#jmeOa4C$>IFR#haD4i2t@sfOiUlNA zkMvUN;t2Tc4V~{wNn+L^@1DJl8?#uGz6Ij`$3moG2g8Q@>+N*Q{2*|gPsJ0brwXYpmFlI7ByL)=`aYg!#0VlR$e+q9r+tOjTB_15S%=j zPJJq}Ojt{nZJ{el_nwZ2F@jFV(y>;)Z%8>B4MUdD4C7{O=jEF<1|0)VMFYuivY8w1 z46L=8C&6#NS8L~}yLrlAan02j1VQ^cVoA ztCW?gEj~T2oS0}R#t}_OXznb1uB;oqt)o3I$|K%E_D6B;U%Px8-AoNJ zN`I#De&)xFDy8V-M+Ij6Y0dm0@ZIfbMURJRp}t`Zl$P3Ru5tC=xO34oYJ;bHSwZj3 zRcz2|4qe`+^ew3CI)$NTJQ4XoEl+Kx^OD-s4Y|`bv%YxAL;4mreWd(rPEy-~DH-tz zV%B-8(pS`cmK997CL-Audu0T)a|w?BH5>cYQM9}ROeiwG25mgD$X zhk5R@-_V}nR0p4D@}{>%Ek>gceG$o!!r@X(G0h^%>bG~lumH&f3Ya+`Mw zK28g1AUecG#(NvuNy&3(_W}Dy69Iwe;gx%4NV*LB(GSA}C^loVkUuZk1oA@vNiwgM zF#Vj~OoqGH(3s#^|E59cAsg~bGj-WL`4h4E4i)m&+4xx~%4y8~Yo6401 zF-Eq&0SK8qEQb8~m)bDS@2kONH=HO>(Fc#Av|kM~U%pANj{3nZ%Kr>ORn2TO>CJ_4 ze+bDa1IDP}R_bSDiOGMw@L2x~Ictn9I)twQady{=ZtQ|VRhI$0{z}L&HZD+q;jxy4 zXS2*Lm*XI1AuR~uBsSuiC4If$W!Eq;PS`65!E*0DiuQY(!!}JHN{IJ+lY$E&o%iX7 ze&u}XQ0<{>q*#n)k%znu-wAujA%nnb5I!22N~J63g+&QLpE3;G8-w=0Bfv^w4v$H*uOjrF`eO$%Pw-R1mwm#D5W~>9JL8&2x(zqdP zjkJbj(|eM+4n zQ_4UX93Vp#AN7m3x7pOz>{I(~A2BR9w)wPKs@_Fnxbi^rG`oZsdEyUk{DEZwFqVPS8c38^7fC}ZNz&PbiqyzE0qh(Vct6H2V$jC~MhiFjz(|D^SDmMT`tt@-p_ z7#cF6TTv>qoGu9LmxV^iH^fO*oNr7*Wd871R$TYOR+94%joG}8A8k>X_)6-l3}u)K zk$p3*XR_87z)Up$)b8YhPHT;bY@Zmle3rVAk%h!QnBHKN-l8}JhKsqM*?_l{{`2qu{@hBf-7p{k+U+D)`wZY5`X zW3X*h_V4M*w)w+#hmB3{zz|>K9C5D7$EJ=O=B%}_ha)GxKh5IAnvR7zE}tJoFh>-l z9v5~e2g`eR(Ee~@E`E`ZQK*Hjn|s?DCkx`0VK?&jY+7PV;*WQWgoUyRC!Ky$dE@ps zeaOfa)P&VX)6XNB_qZ8TvB>S6LB*Xv``;OWbl+%k}f;XeL=(0am+H{0FSO%0_4JAeOsLDPWQYP%ou4;;( zsM8HM^m-sT%D7>#s_))6Lgkqud5(KTs=-{TE;>_CaM zD7jTP>U~woM{A1CsgjWIob7T5x-2hVtNyNv5xSn1| zHQ1myg^6NVcwAjkVoX-hUVX<=5LO5EGt~dke_h$*{H}`Aa?V2x(+sbb@<(D z)m;i$>V#VNt6n^3h!s6QQQ!>GF5w_AkuTZ%T7d4UG0nS`5?3kO1FvI8CFo`Kl^it z#-2GWdxC8>nRLOfxC_i9%R>9#V~E%d-&_$o4hfOg>~9So7U{;P@=bLkG@IvH4GejM zhTa;7clV>8FA}*q!Y08l1dS}(0WpJ)M2ox^>K~Ac^gMIJ=@##*%HdeGJt-ECk#N0e zfq@FzoMTgyRZE^>!{>`qc)^+q^D-2uHblTe@5}Rzed{$A`Nh0ET>|%l%~B^)C32Bt z-IwsRa$LwE*N*3|beu0iq)$jyg}s+maq->$&rhyFm)OSShtaPi!5ndj>S3X!g8@i+ zSiL}($%0%z8M{IE07<0P;Zq&i(X1aSr?_`1iJLx08>h`52%F6iN{R($Wo6_hYQ*JYOYrQ&tQt~J^efvsZgY}z^jP-3%6b@ua<6EsAKCSPhtG#Uw%I5F$`c4r4uJ+Xh-FWz}r9*)SC$J(fUl3aZ&_y z#Tyyc!X#cmVUkAA2`t033Ap9cE+J3KB~#Dzd6Z zh>`pm)(|XMzRsKzVGOl1Muw;>@^$3cJCPfki4R+p!(OZTKi(eCg;vJ)(0{7s5XQjI zh#6Mt{TZ*FA$C5AFts-GRQXYeag%;*fHpb%O^OWzMJzL zB<&}~C%A1P>0KqLFD1e*B^Jk~E?pV-diB#>u)VXyHmxmI&gNjwAk`e*H^Y(Ycfe|g ztF88B^5<9$Z89{vIKsbf?yYUtN%}U* zN06PdN)O4g(GGI_(h1lpk_?;*yPsDJ|+m23LwCE}|4vcz{HAL!3fG=W-2`tG&vl;sAT;35H@r{DoWv&?x&G5Gs=8(?I+~u zXwKbP#dGq{(Vxo(v+28p51S%G{M%zzzw6-48fQ}$$BVdC#7(D;>R_e`% zg~VASqVJo=0!BquJI1jcOq1`Gx#CS^7!zS5A9j`u_}3~2j92@_(dB6(9`aupjCdL5 zu1f_-1Y!2`SfT|uB6UPmbtfAKZjyk48sWSto&I|yRmv#bAYq~H?q9qRgn8l9w5n7?O7<;?oMwX}oF1Woz2`{U(!aE|=eU*+x^hvIdGZ%)IQBe2Q*t#Dd~_nah)6 zd-`u%i?Fe}!ap4!)C`zMwo`tf;zE+_R32g`%GT1k6IhXZTZX!7#7Z5U=6XgDmR+nX zCrwOgR%lbY8fy&}jbu-7oL9Ova;f&`;Vv}q&RE9QjP504alJ_Jp%96S_i1f8LtuScJNFOD~{fIa&p=tE$uqbqb~V)_okT zrkpP;RL>N1;j(Gyo?Gs|F_g}{f3bKeb7_oi3NtWZk`=AAit?p}uNcG^DlS(V)@_K# zF#pc%6v1dBhC@_CYSs9d7Bo*v?hhm{r&UDoZP`r*rW2Bb=$=ZYv`27U>z;-jn>{Uz z((U9A@hFZ<(wR|@Ix|`75;s?_V&MB6GqQlx{kV?z4*Ii_09>kwGrMKY5&e|f$ z>mB(P^)wiEUzLHLHu|gYGO?A+5Oe%Vl|;Pv1=hxO-t&u- zEW56H)`PJKa#1q*f-fhGVKp6HQE_jHWe270-8e3|JZ^>x(o$eVPqV(w1u8MHyQZtB zSH_rCN@yL$_qY#MjvWV_An0wKaoE3VS?%&O^vA$+s&+R!4#=DNxTUlW<^{1qBrQU&hn6qwvcG(#J*+lFd9QEFnY>!?M5R!-leDJ^A&j&|C_@R&8nc(_lzTXL z0!4S91bNIy6<$Q1L%@77B1?l zdn^4#mZUwdV>*lL#G>}jQyhYp+-HAkaLDdh=}K%6i74L4dGd|GG`W-Xz14THr0>k=O+%dvxaYSsjPHy-#qkm zT78LM*i`Rdd}*G3!reZHVSKhtzm&Q|w4Um26hit3>xysw7CYs#U%8G1c?-=6TXI5V z;0PD`QBa;{OZF0um~QyXSFadG>qVCc1ZJG4b>T_k@3)vQ!FKo%6GR^s9weV-v=FU4 zTJEDWt!WhHsc@xLY9S1#^bW2|a1|WAoE2Hx*IkDzy?l(}Wp5U&BNUSje;rKMuqtFT zI(PYk^cDKIPX3<|J!FJ&$+k|1j@QV85+9FROqF67ELDtzgRY%^@0VGhzrgrbtQjr! zsCB_>Mt&sr446N=Q@m8h*g@Ek3@JaRV?({{t^ZSmKIwx%B&7@NK^l;WuT#_zgzBqZ>g79S%;lDlAR%FbxbWMDC=r|7vHE-f`}a&I?>9JSV{i;dc( z9g3VPMrMsQ5yiL6|BUg-x~MkvGBEDNOW0w(-cb+<&LG0U<3`}-K+~vF zQS=&!(4}Jhaojj7;;ztKCan4KFu8ddtC-j!!yIy9WW!C;Uh-I#1&uTFr0XU6D65vx zdQ~@$nU|K9a~@@aS$0^YeEr{UJkr^D>_gA_UbjstG?m1&m&Bt2u#vNAq3kfPOwMJ` zhMgW;rk0mdFLOCXi!9JtQjcr%i5p$Ce`$${GqJSLkhJ*ksOUb5SW~^r$yrhr2&;O3 z(oCEB=S$3&?kz9sK5fin+WM8_lt4R%?5~Q7mdK;VFjj{2NGKuY5nY%g|7>xpm`>$o zBEzz2DF=-*x7hI?L*A$>)^R8E*wh5Vr4x?a_o_UrU4*i3)K$8pzV6xUNomT93X0w9 z+JUs!N7HmNhd;0Ewgn^le`wLbID0vdWrLrvJpaA=g-IQMz&aT((6XTA8}X;v^liE| z8+#*>b%Kdo(N0gwLzDW*=o8&=Q{@wixN~6!1+nb+tgJmf&tV!qeUemq@mPTs{AV^KzQU9#yxqFB1m z&xUg*B(KlM2L`Iihy2S_bRs|_ecNY!0oqEt8h7rq@lH6L-FX~oOJi}!E0B8nLaY#J z?lDfpA?23l?i14k?^fGX*W=94h_laI-#@#3d7y0LJjvWjs{== zx;@C|<>q#pDheO8J1e@W`P(9=TF{`3WcA{WLqJCLQgF=lRqh~q#7dzkgWEuj$JpKy z4r1}~su0u88=IjV>e|x9>gtZD;9EYb$VT_5jFb5cELppD)&0>)O0g{+)89)@=!leN zrA0Y(g)ta0c-jmuUaHU7uR?CZxGbT;`_z!i^}nH# z81%B7!C`_gH!tvvCV1bl4d(Afv$%E1aqO-dXJa90P08AJ?Y_}!+oq>7LMcKa;#k)i zXi3Y)aG=O0Lpcmowg^8ze!Hp@xOb5AIhHxb91ky(cqZfuM^S%*adX4{CH3?NQ5$S6 zPZ|DR6dK3mq?^)9I;t+k<~7xh-92oGrFxrVNK2LZ;WM`zd}bTJHzq;{IGfvs0TfrW zn}ObmOB1$?K1id}wPW}X%1wp~!hen4;w-Ot6X5JITP7)9nSGu>}w9xe*Nd&-CC1-*xx0anA^~dv%-lqn!JNE|a1&_=G&q2k^wT})i-z9HnWd%KU$M)0_=~#F{ zq0YN^-gUB>b+}cguF3%GwoNC95MmHpQze&I^!vtnLYX#O@!kvHfi_C$13!8~HL_(g zpUD9CU=ek zIY*rQHGir~4l`Ax`ur(i9{kyn?4?odToGz+KYq`=N1^&rID#q094nxgx=LhPm7l>e zgS8~eay0o_RNa4T0j6kD&sd~X3s|d1m>UKUQD7P(-D!TbwbgZ&vAx^!CJjkVxDqu-E-o}FBC=yCbZHV$_*c0$37vueRT?Eq!6jNgD` zr0XQvZCR;MA$0JkyJHFKk7O2qE>xz$MERL&`q)q6bEofQNMzFPK38vtS0nFsKfSYm z9L^;ZSDR^xXApsV>lmiqiDr7k6ISYIbaIwET$b%VZ>W#T6D1z$9BAxEMDJ!%HYs5o0+W!ifDtd(^ipnwC{qjYBoyZ)X zzo{7UNMc-I^9fEO)7@Qn(OqpA-uF;%wU5-QGHI4Niyj$@)JRufuppuPqUR;0t>At# z(;w(xQ#_VQ`>m~)0I3Gr6s;vppP3R&$uURNFQ~H`{XsWDYcrYge$_sTzNMuRE5yZy z-1%d9{kqUfsvG>m#BJK8=S_?HtEb*&e}2Qqlvil4sxQGsOVvy*K%d=z7q945V#jIn zcIj{aEYD_p+6d41bHo^?`>ma7C&L5!CiZE1tTXnp+sAf2!(0zW5?iyD#A7R zZDZZk4)tf8I6)r9y;;U4{1|d-rmlthXdBxENG~*pi5s&na;94V)%gW4ld)?-vXZKq z)lOOCI;0ri6rW32Z1#_jF}M#;uLhq60wSsg{ot6N0F_#zqxdTW4lp#hFJG#6!*Fr% z)jp~V6fjmQbD(p!1SzJ0Cn}b9d72IO)_b6u(B&{C;3Uq`y*5S&=i=pyR@$S3Upuml z&zUO?3Bq5(j}GSwN?nk&k``AjknOEx#w|hx-$*C!G?Ozx02kr4pQ@oIii7_`imLhx zLQ&~ynDTcD95fP{yB7)7Xc08Sx$I6$<5q3MA;H+M6CK^;a;_n3$$8Z+8c(-Y?y8Ki zioxru(`%!Z_;Hx=cQx?FG+(5Hre2XddA3M zt7?{MZj!ydF0gq?n^dUWmkvR~Nj-a)acRtB?cK8ZY)~MWe#{F2j9a*e`F5Q?!QoZ$ zjh4*&lan&fzm6+O_cv1&rB~6KiOi04`R^`Xl@@Tzq&VAosy(y878GRK<{X9_h5*v!A+quMFZ3 z6ZzVjhCEijxE^sZTs;`(BASg155MKLI?^D?w9?QEzHhP18>S2N#l;LPA90dOx<7s+ z{Q%mTV?p9f^SUSX$4O@9*<8|0Aobqw-p2Z8d7|sn`_5B1Odgxuqrx=}DeLv7+F7Q3 z{%VO|?MijkFHwNebPrIi;1%rRrJi{fzsF*5=U4h9*P{D+%d25BPqAg##(I$9bq}Qe zkC=8VWCB7y868r9*Z9M^9B*ql4bRSNoh)SK{=n66vOr1cP|bY4f@zXOePNs#yGSjO zWV*!>vMw*<=lEMAGPRSMLd{flZK5&4B;n@^yQ~CV@qZ@!3NeDR0h#eLvh+AVVuFe-UPH2G*(M>}kROE-Lj4~@@J-1{ad!xT723@;O|~eh7z{02 zuUL+`v~mHvPs**&i$|&SMzv3KKivxIi69EOKHUxh^};lnpeEIDf4Fr+R|#YGaq89wod6lO6|HNYJT zNPkSLA%a`-as((bCHmzl<_fTtB0*e05q%}7rVL&H$08UG#M2vs^BOS0p*6|^K*Pa$ zOeiCk0r*9?SaEmIXM@Jp1Gq)BpoK!ZJ$y-$;J)~!ghDdlzUnahsV}&pRc1g?zQF;U zMiIiMSD&c+DQFwa=7djaZ{(<1z;&hh!;Jnez*Sg=Q0&VffeT5f)4r&Jdy|?zCu8x~ z0v%|XB)G3Qg5u^oHB8O-5`i8MEM+8>Ju@Mo)!sIS3gPfK!+5C>=Lb2#bC^i|_vVKc z|NoooaXhXUfS(0s2>RIU3mbJG;fAXu0ere4xBP_qq z;%dlB5(mBz`(rR@u({$=TJ*EQkG(%#YD3y7J^$cDgX1m0DIAQj|C-al_*@2`ZM>!o zB$G!AGH)d$-+o(?VAe260lI$DaNV_R4_JPU+wE-$)1(jCLf2o2fY7Z=L(@Bf>y3o2 zyX(`gdfSCgAnw-nd#Z%M>=`MKGARp!EpHaxulp(anuT3V@D{t3$4%4DGHK;H&G+}3 ziI#0q`>O^B-HC#r0KN-U^y5W~ob*el&NaI`2>{KFF1Xr@OF=wxOhRw`V?D1zR5xGe z`8$`^K+rQn7H8!yI;sUF$@cbb1g7)WdY;Kqk0`mp@fmLfKqX< z7SgJr@ zfo%;;*X+ySwp*Kx=gAoEPJCHt;O6|Q^X7iN<9;7KS6?V!HD?D{qlu)1d-HpW%=Cf8iFqvJ@fZV z=*7*^&4>I|XuloGrT)LC@S8--FFN}_ArNe{tshxra2?#EL*EBs9a}hwn2~8*0U5_( zVrLdUMVj0GpHswARd%$SnY6Rm`lX*XH#pljB0w=L*>OUf=554*$m7F`A6Snce~bhs z(}%IVc>qji?q>f_Q=X#mzEuSsP}5Z=%`l)}nAHF_rc{@?pWN;SMxu9pOY@G16${V}d*s7E;{<_x`b+S%u=K;a9VnVC)n^$0D)E2e0 z9)ry^I;%jj2ffB@1Z{7o0;}Xrg;pv_*Pt?KpWhZeZogdnEer7e@;UU7 zR|KXaE{*h`^XZqsOb>(Z_qqTlfQf{j@R0`^QOAmj=Btl`pk=WF!6 zBLZboVH>X|eIf8h6F7SQ5G$D+d{qW9Ieb$q)4d=3vZ@8AQaR3#@J)5i)r2)3`@7j( zG`pX6{%eU;;Na5}2cW3oJjL#A)El_FjPdWdJi zr(TTlaZBR|1a8kV@WIb{5x(-rkQ-F)W=5^@ws}90tiU-Y!<6$egfUGGTRCZyOcIxCxpTmB}I0QO6RRqI|1zSnb?+9S}vv ze_^{)nwFMUB3t*?9tIfLx3wUiQ;cXnPnH0W$0$yoGerPLpgPT(ro8I}HTiR<7-=`< zObMt7X>=U$wYI9#Jq|*ukfWh0YY*#_H+B9^`L~VC{x`Txnu%ZS8*FuEP0u)kGDzOLB(j(p}@tpc;T-mou+MZ zdpy_0fa{=H5vEl$au0e$;5prE3V*%DHA4TxjHboS=c^M6>`znPevn^do6vLwmioQQ zTxp3mr%>_I#xABw2^ez0g4~1e;a;s$asU2%%{iBeGF4L>@8aUaXnzpNr))w&1|);g7$+3 z6JZScKk-YRCXLAfWqC^H*F%OWukFuswPlIh3P?1N@`FWN_2p`70S4JT71>Wl)L`FZ#>^@$*cV7c;j$e;A@tQ@kHM&gmoBad z{X%t^-$1j+(1X?#Gz=wl6a3syOdJg}0;cC6Ty#_y`uSCeg2edxsbE;YTp2gx5n#!_ zEH%25`*xYG>P)8lb=FmFBLMxocan03Fn;Ku5tZ!*>R`eD}y^wyY)mARxMjFfYmIbVNDL{ZYbCb%-e!s4Ohwg5IAu+4K9F;53PV4$o{ z-MSHL<9}u6KZ*srcrRedkXK`mg@HPeQ%7292V;cPBbMeNG_?E;u)GCz}J7y5!mcd+Yl#h^# ztJ+w@k1GH75WqYL`2HnP(g!*Qg%@G}{Ec9gOk(Bmo|o4tMehq*y|h}8?zmNi zx#!v-4V_p!UHN8lRkM|CI-DU#fgK zAQhBY<#SaOJ6d;7O2s_WJ?TF75^xZF2~R1anmXBYTjDv{eLp-$$Hw_rwr>;yWF1+~ zEC!s3E$dVWtN6HH)9B(tx85b9&5C!`Z<|B+<>ur(_Bg(5cLGQUu#sOYk678}!ue7K zA{6RDlfoG2hfF9zfK`AimKrlpxh%C69%VnM8b*x%{CQ0X^7UWqb*2=3t~gZtw&!{#AC~ zi$#XR=Tsg;%wqCZm}7Z()lg^fkun4(KhWib>8f=M3kBdG`tC3rt9*F}E;^+c!;_Es zxMQ(n4elSSEHZPRAh7C*5G9Q?2Uev)TzjNI8kOyS zNQaWV_H$o58+zceYz>g6%wnYDmnuk!_t+YHOa{PqFMNxwgAQ2)VCIa*s3M=_RT$w` zj#7}fgXkd8RhklIaD7mj?5v>LH}uGp0MC2W;Id+9x)tzSHS`Yhgzowsfx1XY2$llE zcU7FIvV;xtf&;tswy5UH%E0Q&Uhq)nmMJ!{7Jz_F6tFb3MWj&gn`7;AZk9EHi(Eg&vqWQMRV=X)VTKL664hN|MK5LhAxBVUdOl&zIL_& zz4lJ`r>2)qkSk9r=N{u%Hw$dDD!YT$w}dJLSG zg`{a>hB_r;#tf>%W0D>jEaj~(eHt?P$xi-s_z5=7K6b1-MhWIPBF`PkYMguO0H~ z1(06(*nJ%oT#?ePfU;e~HP6n++#$%8PZ!pYf#Z1EDeP3_38a4b%s-^Y$St_hv!!U}5dNl{%p|!oqclFh|tPSNejlgrVNp+ayykiSUiY zHs!(5t9{){H3m_OAmxDN3&0G?Zj!d!vVL_|SN@3^uG=CX^$bX7mnYuo7_&@`5$%~ukqzvN@in>>oObhQpLb)+ z7}t+wy{;_nn4LFQ*DlYVeg56j(rC=?jqGR1%8WA5_py0zay|bd&&UtvXT8L>f_I{grh;|&baHrw&c#A}#RN%`zsy$C;m7!Dwq7g6jZdxxb}=2bx`5V6 zkh#F*GVsF8?+)~?)1yfb=;BeBi8yjB@l9HQ!UQo^9@8i)<;SZs&-#Xf`N9>m_dR`Q zWnh-^((;eHj9_JDlV7TXj6&=QJN(@*LT9ITp9Rg`>Qq<=hYb58yM0iZplnDPerRg>9B+jdn>E+(#U4RC_^p-f`DRCPM2XTRy!e11B)>YWh( zPU7m!5iSa!YkT8*ji*gw0b_*B$`pL--7zemwyaTHk$2xyBil?fKI+$aA{z{g# z+am>Zix3)hiezRG{RaPjwbz-GKAafMb-tJ)N_GBG>%v#Sqc(F!gFez(r?@gs3wU6N z&ws4?>@uDk8Q6>09m6`^w@uHgqR}?0!I6R7S{@Cmh zx->t7&-?^-fw#(u@w5K(?9&RPFWY1&O>%+g=ovSPr-&X&aATQY0()Ao6La7Y!X*QX3$VVniG|xm4o1Xs=H++QV zTsuKHnw?6Kim6!(|FSK5#d=b{WyPos6kP7d9I3rJbM5xi34X`UA8)K=luK(gasw*K z->v~!cx|pWI$8fMO^ery;!7{0jwY-k4agAQNztJb^PCB()FzGZnQje;(NVBE|Nptw zKp>UL&G*N%xf`M=y4g?m2O-tDPsO?kXu(#yZ{25OO|E?(L?|^{a>s6yjk=`2B+yMs z(J>!+n2Yl|`SpG;A=`ns=OWER@~B30do{Dz>G@fD!ElDQ7>eO*0+*y*`Z@`FixSs@ zrAbo~syI?Y-W4~Rq>pM68=G3Z_8LVtdB|#i%meMwb8Z7^k&mC>^ym&SVssgpa-yIl zs5-JQf;+5dK~QB!LGI3cGr+oi?3?hN`mV;pv-mm2VWOs^p~?EjT0GJRga+s@&jm+Y zryHAbF9u&g5>=9_bJ#~NZk-2 znCUu!7$YZ*$?xx*ros`nmys4^!7VQL+3A>O6RlNoQ-l-!_u;h(RSpwdBcC1vk$Eb2 z4>amhO?X@9zt~L#GO5WYhEGo6-AhJLh{Jb^{^!+`W{JlN6qU( z8}nQT3N}AnD~{UnN=bD&JF(5{a`)nQ9zEpP(`K7Gf{{gtBnd@x$LJaOgdrO<2!n++ z@~bDfggG)5JXIUhxF7W22B8N*4LKVl!SGjxcAM!72WUT0%7c#jNRo%Rt!=~LO(vY^ zySnny8`5ofBa&o!<|+Cl)(+JulA^xb&$jO^_)zdCiASB8e-xP=bt!42?W%SvL!QQn2#<{s$eoXTV_h1S$_cZd2Ocs%q;+p#R$upW*#(WhsqQ){0PO|8&%6jmd z81a|PUrH^`O}tb>?zk%v@Eh+=|19uNsBf>2ATSl%gT`rH&o}xtUJ1}?v(mEWTPjz# zNxmZ?VM3y{HO}Y(KUuD19v{?LqH8OTz*JvpXKwTHOlBA4ZwFeIqCQZ$qIH{kQ03Vq zbJUzvzzP@~x;eP^Kqz|VB`v+aRmf=FR*9gBup>c4nx0*N2V3jl)Ok!Yp^MB`Zm#6U zt)GI*vxu(uq)rv4x>M@;xVD+QTBA5h?nZ6QG}8#G+!r5ZGV>5 zL>cE~I#c;gXvsw))CLt4y_tQn_G-*eWM!r}cV3p3W_d!zQo|N#!=sPC{QaJCu;?>t zk%!gyi+auUI2i4SQOtb!X8C8}sur*lOA5ui{@gB8`{I&NhS|<@7^l&w7)(&mjxRWF zlDvBq@ggHMxi)JmkU@uH%}n4s1;=^jquOg0V_I0D4p%kWG;1zRvfa@_hEB0XKia|P zLdrALo$hAyrFW+HKgkvW&J`|0Ui3FbfD<;ah2+80RbUo4H22!(W zZ5M^B2kIH4(RR-V|Jq#e+RCob%zROCJ>xo2k!RLL(miCmnCmW1m1_Lsz(blCR7~I0 zs*jWpgG#X;%X2}wV=&`$`wpLFzJigq$$3eq5bZ=H=0R1&VvhyE; z=?iREc4}G@yo}u);R0s*9o5@a1sp_-uNnY6(}<=A~i>r zk*RRs*`IE{U9vWQN|NY&D*N5KZ0R-=72e7T*=I)0w?hzW3R4cu&Yn5iYH+HEf|oj9 zHro7sSmlJ;MuG{ZdkQp*O0QKfdJWXmp{pv6*@aSmT6iavt`j?@ZEncf&bY<)Pf_3J zgq><7{A{TjSu%;r+|TrVoTAvTBj9=h_Ql;cz`3&H`F%*<{WJv@r;v&prhVGEJY2Yg z#L7+86ODI0r|`iEaau`R=GukRZmL^3kPp$QgS3p?#mMjJ+rlL@{`QD>%q|5&BaOS7 zLMrLP+&%oVj)Z}B+VYR6ID0Cm*9j)Tv@OW+ToKjO!}zv7=n}i6a*>2x5>dz<8JyNTt29|S5c6i8lFXPuCISjE!Y^H_Pu?2 zb~iJjAK4Uouj#K@Bj%Ko>uzyE%SepEG3FniIhzDGF$4?Ajv~#Hb|#x>wz3{w?ha=W z)oU9Bjq;vP0og8jBHb7Ny2$zKqTw@b6m=m_8*>5fR-FiIT8!1V2!Zz$FQh^R+i*d| z+U_{H4W6+)Cz7t^qewyN+BX;+ov4#j9gAQ{UWazrjckS2x6nxXr&Emkj#NJW8F%qZqL$PbP zy#X4A>oui2 z+l%<)hfJ*7Y*(}_OhhKD{dt5+%%nv(c`#^CO0Xg$|uG0XyMzV>t6+> zgHVoWjy(+c4)q{k386pG0%jqAjD~I53;2golr<>=*Bif$)CZOkxiXeEUSp9Njn9e8 z?yV&cnj3AEBSG2mHc!zW3%~QB>y+~DeOl7^5y{Nks;p#Y6edhD z%vN8}4H+3817%OP#}Y{HRj#>p#UYvJV@p!tDK5OnYZs$dz2Dx6@Djw@+^CqvIBc{! z*)k`fx#^8M-j?GDh4HqGPIoaeqpDKN3{r62s4U%w53d~L?00mHmk+*jI-MsgBPOMh zOq#m4SbV(k)y(4~52pxd9lxX!ldm89Zr@WG;YusKZNgfF$-~WWr0r<4emNiSL=&Yx z!8RI7y^%Ab7+*$}5pJ&NZP9yB>8A3@W1gEsUGai|ZBDb`eC_8I@fi1w$gucx6Slx4 zoDP)WCZx0Ml}-zTH%=V1@EBc=l;qop-PUqKAn(mbuWf@E7(&`-uUy?2rMuQC6T5o9 z1!nP(gSb4G4|2fXjnn2Q;{<1Q+FLYwMe&JFbHT0If*Y!=SuAfT@@-I>r!=V($%?U( z50rIsK}n&tRG<5pEc`X!#*3a~r!r=7FLiykoN65AZW1+Kcl)P_ zW?Rn2zwn}Sn=^YIPlIv&>fok1dWZP3Rg|wEi)cH7hq$2 zB5}91#_#sM<8Vgnx9d|eRYgP@5%0nB9aCCfEeS4d*3YlLl<+o6w9mW^HhGpXOxG*V zktx@A^o=w@p^@j_dd_x&>f28uS2)A+66uViEjrit%yc+T<@)NF_8}ECK*Ut3h8|Enf&djp4W)-i*c;L+FYuw^!#?D;Z30gm<#)Y=56JuK3|z5_uD(x2BiZQUxymtkJ&yZ* z3+s@dL!bZ?(eip5+C%D7N-uyV>|>(xeLwMSfNnY)-o=!C1siqVbQ2u zd$d?yifM$C&Ut;I%XTO`TUTWxQ{p2he|OTjsz5abtrWK>T@e+%XJZe~aaTrmceVK> zFKz5ND_ zCS93&n#5fsAMv~9rO$$eH$9vDK7JUDHYHefIVLR8+j%QzkdOLga|k_^Z}oYi+Wp}| z|GG_t8*33Y@9T1HB|3W|o?X^%F3@%?nt7>2PDtryab&oj&E#{)^-&JFK62SQT+xL` z;6)%ilQ+(djJ{_ICu>$XTb#>i(#_ZWp)hl&nKe@|vAL~Nk$!+>;uOd7t)V#~PC7Ry z>(GxLt^zzdoJW-^3o!lJcvKjRiLiE~Mif20*5(T?vzrNAwXWYEoidqvGUk{bXvxz( z6L6iG{N?e$UVjObfieL*O6GiWDRp9vDp7gXMh`>379BokWuTM)LQ~?v4ceGpV%%ncdA~d#U{a@q^EKx>qNE-_A_qw0#E2Q_gjV#k9f{17K~a^#ZO_Dlu9 zZ>3kxH9``c3>=nw%?9=foDB;9&5|{IdnE8rGEhmf3n6n9G;Dqea&ZgxeKGsM{T(%a z+e3v9JCO;_2Qx}yB>_p4YWN(b(`cQG<9tVQfLG}%@D87Y49x4gj|?C2m^KPUBkMs| zm+PQ;s_=2p6ZVGmqgp)mebLA|X3fFfFea(MU$KvX>n=|r)%yyF6k~2zdfD@X;|B?P zb#Ybh%#n3EIr^e4Mg}H1fyq3f7Ghux>Spt6MfZ`_`qz=1=P~`ZS z73Hng5%>cp7v1XuzIy{BrQ4d&h<4QSZ2kdon28gyb09IgFBu8*r7}Z;US?$~Ov%FeS zX$J9RAZ!rnQrGl454C(UvX1FQ2=lownJa57^-GYs{ws0^4m!0p^H(-<-<6ta^wSHa z@@*wvcNV@^$N%uM{wgv^pSaNil4{Vg1O1-PBv++DI(h796ckQ^i0bcos02;#2^EV2 zw1q%nv^Wmz^*{4N&cQ_z_&ft5WGF4<(D--B;B+R%oI?3bp{&VGR@>-9b!qC_VLgb%To+b==1+gaf0$X{;bgtaX+Y_Kx1^W+u$J({>}PI{*xzlXa!VxJQ$}_SfvX)#gn>}zq@@e zm!;43@P1eMh~;`JBE*bE+(aO%=IlS|#p6?l!94{D0q6M<*?%(YnS}ob+~WY;dDAU6 zgzRl~1{bTUbBteEvnHOsJFhhEe~4}hp+sgj2fjN(Afrd9n}K4m=)Z^qd&hv#rYkDM zPBiiZ6q(KM!`2=?c5|?n_^Hat^i~q^MMHgPes!>204%-M2o>TCR3yOLZ}mG>;9vAR zFhm}uWP-voIKCYr)1Mb$;$X-iN^9)!RG=;Z(6x_ND0ieX_}YZ3TMoe*i2^&wq!=#Z zH`M}=oRYm^1O@s2kmwUM0N`g}r>>C!NbAI!Usf8n(#d(9GeH9>M1RO3fIn3yGe?`j zy4lx}=R!dVwGEr;8KwGnF8LvJpy{pFEVYP1c5aDR^cdJ$^J8(-{|*Kc4hQrpnW-T= zaAnHgYOQnWc`3AU>DT>Wv|6|d-Q9m+g7PvqtUo^(Q|$V9&C;uZ6TzTSSj}lY5e-r? zxJGq!a?;{^|MT-dpErQSw@|h)%sf2b?;o51s7TVjNcKO6@oST&%76*xa?TYUg5&Rr zSpbe)`FLdxQ|52vM9x7Z^5z}t5bgg>dZ5|T4e1kfIU0wN@f)~*HHX7=`Wx%IzzAc7 j(s}=!z`vh`IM@L#zdDVlb&oSQ3HU?n7;9H+Iz;^+nYodt diff --git a/images/tailscale-serve-funnel.svg b/images/tailscale-serve-funnel.svg new file mode 100644 index 00000000..bce27a89 --- /dev/null +++ b/images/tailscale-serve-funnel.svg @@ -0,0 +1,91 @@ + + How Tailscale Serve and Funnel reach a ScaleTail service + Serve path: a device in your Tailnet connects over WireGuard to the tailscale container, which proxies to the application container in the same network namespace. Funnel path, off by default: a visitor on the internet connects through a Funnel relay server, which forwards the encrypted traffic to the same tailscale container. + + + + + + + + + + + + + + How Serve and Funnel reach a ScaleTail service + + + 1. Serve: always on, Tailnet only + 2. Funnel: off by default, public + + + + Docker host (your machine) + + + + One shared network namespace (network_mode: service:tailscale) + + + + tailscale container + Serve listens on :443 + and ends the HTTPS + Certificate for + <service>.<tailnet>.ts.net + Funnel: AllowFunnel + is false until you + change it to true + + + + app container + Listens on its + internal port, + for example :80 + + + + proxies to + 127.0.0.1 + :80 + + + + Device in your Tailnet + Laptop, phone, or server + with Tailscale installed + + + https://<service>.<tailnet>.ts.net + Private and encrypted by WireGuard + + + + Anyone on the internet + A browser or app, + without Tailscale + + + Funnel relay server + Run by Tailscale. + Cannot read the traffic. + + + HTTPS + + Encrypted + TCP proxy + + + Funnel opens only the ports 443, 8443, and 10000 of this one device. + Your other devices and stacks stay private unless you turn on Funnel for them too. + + + + Always open to your Tailnet + + Open to the internet only after you enable Funnel + diff --git a/images/tailscale-serve.png b/images/tailscale-serve.png deleted file mode 100644 index 56bcb5fb17142117e84443ea552c5c7cc4422e84..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 49607 zcmZ^~2UJsA+bx`gAVE4Pgx(E`(nN|tLX)bXB8t+BBE2{1y>}Iq&=f^PKtOu$AXPwm z2SIuO>Fr-Ra=!20`@a7ejG-hXd+)WLGUt5e3cahQNOqp#JOlzEQ&y6{4}rj;5D4@E z;v9HIbC3HF`~!8kuP6)2?P6MlK-eJ4@-h!x^;VLJDUX#9aj9}&uzIQD{^a>qPR4@~`Sfo;22W3`kJt9mrd=Ix-Z(s) z@7OHU&)cf+*cxj;^y*4ncFt1!?@yGE zJVXldpRaSopx|7vxi$rhH~-~LHY(|EA4JH1{LB$ULm_SjKc0O2FK;Trd#?Y-^}(0B z$x3rbr&v0o`L@#h$-lQeHSK)MC}Np-!{Mj=R&?#VTj85FKc3h?S6|+w}buA{P*h& z35cF74b-gS9k{$SJnokCDLr?%$+PWv-c#{s;UP(nEAoaL<)rJ~C0{y5{_`Nxb_m>Y zxy@v?piQJI-1XP1M@G&WB;dpU`J)moor?CnI*@)_mP0!J(j66>8_LMXC<$es!~j0W z^KtMHvo+Zo3A1x4O%02?65*oi8gx*qRxQ|OO8Zbws93(%IW6a$OHPHI!3#H&yX!yQ zdmpiGNDaNe+ws}-KXw;<5&@%z3K=m96aSYtm88IaWSM@U`p^56XX8ZdNqU_pY7JTK z;regyJAnYmh{}0E`%h4{YQPq-4pGN{`qYaJ>iiHZl_2NJ5PGLSPU0@INoSsU8EOo=6NHQ83Bp+Q^vZ@zj>H-pWFR+dhq?8it-D8 zBiA>MDh6>^$g5oYY-!I^xz5EZetEIItP$f(w@@2|!eg)!RJWgiY7S9_Fs9gvS3SQ_MBE0D8GU%ect=XMxntP{Yo+i@wC~G=C$t(>PVW zdn~?wja>OXz>d6;)a?8xjpW%V zh?U^24R;1XLc!(P5{PYuyz7Zk$a8zXL@Zi!_r*WxSG_1Y-d{*9HtW0OV)aJospVLy zU9s!NOkyHm)t~z=BkD;vojyl0OANTtRQ~BzT`RhD=WXK(Co^4!g&GBVFKxAGP!B}Z z?(oaY8nUXKthG5M6Xu1c-Ok>$nQl~RF6$H4-JdnH=XWf}%bj+9CFs*;w!a+jD>PM? zSg+h#*=*-8DVg+=csl#Z_}@?<2T|LU{?Yw!0tmgX?Mau*xfM>EzCZo>v`b=rXi(qV zic!@1TUW9~#je`TMK0|cFVD~c88MmNwej(+^@{cC*yIR-#css~7{r@Kl?;61-rW$!zF`~eci-B+Nqi%k8lds$vvDg8b$JNnX z_^UY@eb5T>^WxGhSg&sikqoySqjysn5f`yf^}>iU29c&H|Icr1nFs^;!<;8Y z(zna?r_>}?=hWVbd#;ZZS;Q_+yjaf3@j5ZN-1I?>OSmpL8Tafs{~!=eBQju0%)iq6M!DFv zLT^_I$^%NvxvOH!Ukb6P+SQUtYjw$ufOb`x6rXaZ-`-p4mDa5l?y=f6QaShC5f#73&J)1oHW%wW8!1}8Ch&3tQXB5? zbok`}o4XEDWGx_B!%6qGW5s?X_bQsNw8&9N&F#?UQ66x2LxL)7LgYIL zq9F{jwN@qL^OD@(UthD>TIhDU$W9qF#6J*3R2xLbxB?2Si$ehG?Z^JRH>da6xn_Po z(l7Ep+0X3vq7eT2w^@1N7ijV@?`JrGG}3xhwcM-(UwPCa5ts<2lg3{jy&1|~zgr?J zyiZTo0^Y__2C-KdcE!ru5G(|Z-%5| zCXCk-Gz2wxttYk&gR3Q2+mxTDH&dJA!g)F^_BOrd(>0&a@H>gdoVX^)v8T+dxA+fo zyuSM6TWeWYs_RTB;mqs?x$B=FisKBF+VdT6W*ey+Db(6IHBC#`%9pVcp7+{zlsdHX z^rT9>Z6&9C2$uM;rL5DmJ=60OZ~q^Zj?CDNsz)3cmP zabGKIX$_>bl(B27IjJY%7o!Ni{au%`dt!;qy-w!8Cym-?Sj3X%2cn{10m zjfzfs7}M$4$~0zIs)}b8A-|poV~=21l|G)p-NW^oiW+xLd?@j$ja9rg{^PdmN~)tX zEm(X^j9GX0ty6DI9okwy>%FoLW9Hd8=aIicJFfR)ZJ(kjAdx+U&GjEx{n3*7`d^5` zG)@g0g2ateju2m*zygR^3|w7sqv~40I&={Ss(htG4v{g6IA$&(XRz4d)R*q;flh^@ zu?*AH3n}i_N^l>3@rx-Qo60V6>PIJk7W>9?T+ODQPB&b1y%v`MmDD2frWWyS@mr_M zhjfS9MicAJwv^z^iSu2TJpTm{+;|w3kzI}NY|?O{FbFYD>|*n)il^S2I68DfmE8%Rf@XbgYYt)PqSfcMj`Av)mneJ##pp zn(orgZY75q5(pELm7fU1TFi(=V~|gRC>0bmBI(q?_q8p z(lDk6<_0Xn@-aAp$TXJ#x)&brA4ET3UOHhO^jxcuK8{3R2u z=V3Dbnmh+Ow?zjuz$yjutwuJRT>95&4wMC7|Te~11&?uu* z!49*=Nn>e;^Xi&D@)6!^s4_MOL+b!}fkzQb1_c<>t=$QC{y!0vp4p3h;`?lZP@RyP7lLV=^KVrd~o);{%Ay%@GSj>E-4deW!T&)GgsmK^Vl zcK`B`#uC2>a-|~3huZ|>nzw2l1fPDtfU>1*mX@>KFeH8;`#+_#myL}oP56_=?Z5eO zpPljow0?Z`IH1y(4lOfwBFM+;z9P8$+J$U47x#dfZE+M70E^k?NQcaB(-gOl;p{E9 zm^oQR?Ppp%d1M05U&Ly^0H{j0Kw6%F^cmdmd8GJMaZ0PC;DNtGy=@C8tRa`kBUGM1^ylwlTG_ z3j3JJ(kLx=F)Hn7Bmt4wb(Z6X>xpfwa*Q$@zngr0yRd$dWe1HuxTl?8+7s-#bY^;0 z`HN~!Pe#Y*x1^`+eA1{UC^;y(TFGRpp;zt+oEk_Rt`sus|4S^DP|(lQIM2Z5UGfwC zYoA|b-T(0YqZZAd&#>Hh^E1{JqYU@UtZw`eoG@yfi)C?;y(1(A0_Dh5`5lIVd)pSX zn^~);RV&am)ezEj3p?aJQ=f26`3OJB8 zOPmf~5>o$sKA?LsMvmMrg+zD;=ZTft+IYIDM<8`PHk#BZ>Cqmp z?Cic8FQ|9xLY$;dkG7(S#Hl>E0}S5CH1DQUPdgA}s!;j_ZO5go6i`yDN<<CYZ z$56M(sO2oFQ{o|(tg@Sq(;iW|(acCFPbx|LJE<{@%YxL#)s^jT%xEo&Uj70bDuAB` zNh;cwF-g^V>o4Xg!K2{SHOD(U0GgDi;&jOB+-k|7mnJp?7q$GG&vXi3OLov+w4GJ9&gkD?ymE$GsHp)J zl=Ugs{bynSZ?0Vs2q>N9@a0a8|MI4a5};?q&?V=y^8J6RBCWK5E*Ct_6juK)Z}PB% zI?oONH2SyBpB2QvS7y^jfQ@~f+$;G%ZwjSA^uP4Wv*{D#l?nZXT&Hm9hk(DvXpVkp z3;QdM)INi?35($64972RSp9qPs!e0@rSBes?ZuzfQPJvfno1Q8X}?;>vNQgj@wOHK)3_z} z{+hE_LZpLee)nZYf2eN&>k(vA`4RP(u6n~O5j`2o@kiQ6r#WJ}({MKuEfOF?C^7gx zK$IfKrS&vqb_L(+G{?G)Qd(t#U=i> zM)40`KN$eKV8i0CPV?Wc-ooti?ag)5k=;pe8>`XcYp=uuDBc2f1R?M?05M08*F}n_ zpX8ox%U>BR3w8Is0$GxX)!XBPyo9X%hH@JEhXh>`qANlsZR-f_w&Rz=d&M)Y ziievSM6E4R$&PW%o_~H2zIFzR*N7h>$^9ywZGIRBCCEOA6vKb4#ltfDr=viK`2srD z!wP4sZ0(ZVRRHI2#qG~VW4<^o53J3Ve+ml0fl|bnIS$xFAy~6XT|EF^86}**fNLoZ zWIxJ_7z%Xk$dU~_@7yK6P|7;A2l!^5ctdJTz~jPa^d3J!VyXm#0?<31d+#h80jW`f z^W6BuAQlNXANXR{`SwO3jha{;UM}EJY<_wQ2y`*N(*amKm)pc>02pVn^>{hQ`nXwU z@(PfrTm}t>oPYP!JqDb#e4xGPYz*|5Q zo`JF$Lw}g|_}_pX0k@#UXioM(1uihv)}jAFPT(obD)Ru7ynvwbVOGmwf#|J4W@a{;?}gt}|Mb_y1(i5b0iIP*qh zEIClu6|mOfYb9gU)N(k#M2xrBh|wu=+a6fVa0$ zAMX`MWr&zf)Y1DHQU|}^7XwkMryyEv22rv2F==es1?Y9XwlV5cHK)gU%j=28QTfZc z6}de~WVh73;#*FuSgVij4;K$ni5 zl}VHX^6ARw?A(F`eXp_}Y+GOtkO-2{p5>m$+k@%5hV6Qm6|2QNJEJzEkMun+?!ItJ zN0?lP^26|y>0oCy>CXo|^W00{s3-&45=RS<2H1#BwAL+QPq)xpO6z!zho^atumkT0 z>WXN}+ONEzXvlM3Xjos$&U04y<+(flh>M)`mRgVCh`5zrk@+hJo0h_~PXh%{RT+g$ zLZtSl{Mly{u~5@wr-#2q>WL^()kmAE6(F0faDWwJzm@1WvL z`Fifab0xpUvLT2py`7^oR8-kK1nSv;Px0b!yc~F^RSw$V(UT@aI3M2Qw{a&#K7+P< zD1@zK;zc&i1Kb=^z(D#FuZlpg=$BRr$QI6dA=%~0dxc2LqrD9gvtF)U5kCZze>%za zXB`3&oHwXioj{|r_Y5vVpEWuJpmNgD^3^nAtKa(YT3GaDnCt9yES({I44)n4B?2ab zYYSb;%knS=RQK`Wu1m@}WFGo5>-shQ>ao@sR>@c7tPSqGxSQf6udiv(HzG!E4C)y3 zSK?%U(|)GVar|*Bu=vJUAG?Rz*w^g=?TW92jRd6TYB<3}piRgpT{l&0ZNf~L27QLK zu(*F=XN!sWAzFXEIg;^_^vh5eOHvO>2{Z_TyRwRKEPwT0edq-s=DHkFJyV)TT7Cg> zxMt6v448XYJ2Zc$nbF2EPmo^{!UwL8()(sLI$(E~##iSOD31v)k1YNz@d(f+e&@Hk z!0>2X;tt<;np(z`uQPM3{(G6JUiQtH+(YCCH2c(q`??i{B+f@-V_`0JpxV=Yc_1fg z+^&V0j}gs6h^(6ry z%lSM0@Bq+wh>s;&vjHk#w+kAhL`tlD*ln$qgWJLVQ<=`K@UpM~3Y3@4040!T0XzH@ zzr$`WMI!&R!<537O3yxCg6%6!^=qgX0UmKvj`7h3F6dsXJ2DK*G5b*cegD+Ta3P?j zvVsa`?koAh4%ZhPQ#4*MG>g81Ri?LDjM~&xCA&|&tK$NW%}m7`{S{cW1i zH^!G|nx0$8ImZ2)6sHcPJ2H*Rd$SESdhwCYbYn1HSuMI(9%J!*PAe_I801H?m_HH3 zotDM?Uhnp@7geh;e#Bv=D9n2Hph|e0b~zwBw=f9u3d%D|Cp_XGzngoAO*8K36Vq(& zY3>{sC4FJk&#U=)PVJ@LC}uX|`q(HayDrVuyKuyg`ePZj?c<`#U`BKb6uVbqG1x^+ z8baX8ByUlgdmTlMvx~bko55)4f1}4X)~4@cq^cGYjjHKV#~k;&QS4zMb5{)bG&0p9 zv+ZHarhGtLj+&OD%yKh?$t79P&@)cYen`->A9wz%?>u>qkR(^KozE6r0cvsAmS2!! zvuUd5{E3>Z(tN#FY(!5&w0u9kxV?!lJnr$9w8cA)7&h>P#IU|!|Mu8U5XL53Yi4V0 z9MY8%p}2Qt6^HgN$ez-Mcg>ph`+&S8-)Mz12F>~Qn#7k;0-Hr4wdv*qs= zKD(2Eq-c0;3sq}2tF|=U!-gCy3QT2SZ%-gcJ7UES<-f1u(Ls7+5ZA&i(fg!$7q!!k zmp&vNVs569p;4<1iHWFvs(Qw)ooRXjPIX8MlZ-lIjooCXmVm-Bl%0yUG&=rN$&kM7 z#YBHJ!UTZNa7eZHK+Y26P4VH|=)XmJ0uKURv~vj+*`~4y;OcAs35KOJ&MX~F-G|s1 zVX^pbp$E00$DZfARB-mIgK6HT{%}Rr?w|JCHOo1 z3Z0UWbO3qkI@^dG5nVkar7$(~XgI{xHfERYzMKx?g*ls8Ej!Qin0TMYm=$i=c^1lQ zcEA45n(fE&VPxhUG1>5=b&by|a20s#Pn6>FUp(Im#*@$j`%&RVE*c!_xG})tNsXDt z^!cAyS_)S582yegsmjcVcwnT)eHS^*sj^8_DU7&F@iI{5fy zQN9i2Vq?qob8RGMUTP*yD7}fi4Sx!>Z5fHu(!#<8b!(sV7q1L~5@im+q98T5kg3|t zM%W(s-pJk{Y`?L`;p^6+>JI&TnPGM21S@oURJMp>Fod~T=U*n60Q$;==2e4<03x;{ zd79w3BjjfZDxMoKJ-7iZtCfO_Dy_fxApz*fa|}=wIVw42>QC}x!VZ!C0~$hLZB&}o zT^7zkXAZ^lTc$op>U;}I!koKFzcrYrum4+UY}50N^g*L5IYTn?6>H?pd!)_@Sf+3^&Y6Sp&}L^ePLqhB}&woTN^{S$`1NaUETddgZ_ynNLN!GwJP( zn!tH;VyK5T%G#GCH1L;wncO4!&t=a+BfNFw6eEy^Kmk_|q5JhJR7#oP#V%hVz)CJ--*8(h9%alf3Z#l?SX}hA-@c5i%K!-%e>CY zhf%v;DRyH9!z2M0;sQPtD8rSwb^m9?`bHf9==t^7XFM=*bvDUDy9~nk2cZS%P!WDu z%-AQu@wPH(Ww~Wc~fxbqn*s z+~gdse2(-D(~iV@X-q$dO;dG^2o66cSr>3diPZ<1cce&F)Ot{AQ!;u;t%UQHx1zx~ zG|}NwM|i=VpV^N}CaT;kHgy9KToT$_P$H%&**j6<^GMVadGnWzahl?X7s=BO-+f1gATCIeXczAu=5KE)3sd}fHJAF27Q zc)k{Ppi(*y)#(p)Q*VU4ue{$Bc2Vv_1ke5!0BC_i(?qBsQ|LZaKi!vBvl|3z(I4sTxk#2X+~=-*5Qo33jAu^BL~=&RgL&FlVHo z8|+rL)F5}j&J7YMryNZ;h zJVia5fS+PCi|%t4>7z82Dk*LP%H75c@ODb3{NTSNcnx1mD%`VQg-So976WiT`JUqDP0|`%Gx25A zG%~hSg(lwXr{<%w_*sDHyXL!+EkYnz4`YvW+FxiKNmUMRE`54`eoT>CQkLj>X@$e) zol1!t$!(?UN!=1Y?7{h6i(=B!BxGa2$+;ieYirFZs0r#p$;^ z>k|R_#@)b2tpM>oF}Y(Yf1&b0Wnz8RiW!i`;;z7ZY=i}Ub}1!2)_i6{prEB4?PU}E z8#dxWPH(%48vo2%`PPLc z`trI@U^_ri{iL20gJ(sntB(t!9$eC$3y@^*4ZrSy4#+x%-JiZKpvFB4&o7O^Mjz zN_jthGpZH`*!~FM=;IcpuW252zo23X!JN*;tLr=`cuFRiq5MpVS}xaf@k7Fx=SJhh zec}{gmJqR>s*Tx&Moa}Grx`a6Lnx6;0hq?w2{mFx`SUd*LZh>?6qrib6y3y(p`v{y z5sParvDC}e235bB*~c=QGO~Og%R~9^+a+pGrp)dF1C&dSXg@K=0R2+a#AZVaDP*GL zYqq~(^eecw9j*{UBS|B$G+da;Yo+`gYIH%C`W<<}fPda4*(2zt%i79!vM5%}MAJb_-;7~!zPdMFPG}{l4GwWNPRg%TM0mGQ zqJ# zX|+PkB1Gg;X6uoO_EzTjt>o|23#+f>D_+=qij_%9CnUm9Gv3_W?y1TIX&Z7X{= zySXPS3lS%OUa?XT4!mB*>3p7-YXCqGu;*%ACYBC_&v)JQcd5Xw&ohsOytgH>)ZLwEQYg<^6{qY$tVdIYTWcOlCTR+6&uxKE2$L6q#_%ag5Z zI$ZC#roNf=VJZ8HtwwuTCPB^I0bYtxW|uL;xq#n4vlF(sfDFkzR;VE7V|2_#nNegt zKGI1+#asEqyN7LIGPaRcRs~36c|EJsyBi93?@Cj$!OzjU684k^dzw_wbt1YM|7jkY z|5x*%d}`xwVDEBRRG@PyCd{5SYd+BK#h|WBnTDoNov|&|ZfDlzb7YzCkgn)_=G<{K zXC>w`N+eZd$)F(z+vq;w#A-||M`Ik<=k*zC`))nH((ntlo{tP|Th6FATK>G0fzG;{ z&nF+H=|f!R0&=u5%{?Dt%w(Lr8G;<_2=9BAit_1O6?*!;)XS_xoW;eVo)yW9^s5cU z_yuG3Gck!9m2mY|y~oa6P7(lXvny zT9Pzwm^cCHMACG`G}$^tUZ9?*@;6v2s*&=CXY(%mXaEb5Knp-w*I9=-yklJcab@wc z!?zRFn}ZKJd1<3{+%a!O6}TuuwFVFLmn^BFN_zufJ9~(oGLC=sGc_d-R683O!T(9k0L=jvG9Sck^yrFOPxtrWp|r| z-}!Ws*qQx?7LH6vkQh68UHp!gLs(PP;bRO3p&<=go}-jDx2^)pPrixVQ}7}rJ;o_K zhxkS8eq~GW*>y#Pk?XWvmdHE_QJ83FPdxP*gS}iN5vddvJ4P))CoY9N!fm6r@)I)- zJX5q&Bx;@k%f_YLle75%TOpXsh7@3$I_r~%N0Z$Od9x6)tzk14uin4Na<4Zg*mdx& z6$d2fGOBc1;WDaL-)sNF^$DfQ7Gl1&er&JtQEakQCGayGqk#)n$NuId2mL5A0o&{F zS%tHD+?~?4zC(EvXwvHe#H6NgyUBb8A+HGD5nn3}UkARBu0%4C`KZ`CSvL=Al`<$& zIejdY!xZ)4Y9*e(35cP2)d%Ku3sJ6hX2O}h`3$*hf9SeiAL3q2J+2%2D4fo}NXM5Z z&)ASKZ!8tUyHTvQ@;mtIiL2n$Hq{?jTp9I{gxVo7BeBQ;48^)udp$rgH1F$_lwke- zEoursy>ke{2T=yyW-CM!S8&|-QcYWiLPT6Y;7s@0Bqs<0uE7}%StRLhRXw~f<7{82{+DZmS#(O8c936jW7&Rg!1*Cyd2(*oDNNZWY*RNQ3Vb{n)&#Cx}Mv+eY(-r zu1{y?g$zcJW6guRlb5MflsH;$1hc&OM8m_AN~hl7l&s~l#!UgOKYtP7x7&x=ClF9- z+hkR55NJx|VnL?>)1s;5N+QLUE*LhYXHkBvGXriY67kR$+vvs+A@>K`h)au{bu3RW z47lfaqM=+Ung;GoTLI?U)i|=!U^P&%&d zD$)=ll0Y}SlYTtqRB3`UsExnHAuXw1noD&yq8{T0Sy?}Eu7>R*iiypIl`iKhBf{i8 zB8D#)+1OY`G+W9U8JVtZgc+N$OOG;%_-N6^fRch!vQWx+$ksi7Z_oU$4nP05hv7Wn zH2d5R#UXOYlMsdoMKR)iO23U$ zlPte8$59;S{SQmO2?PZI7NQnz8)w8yUkZhw&yBQ59eN*P#D6pvG1F};-RSEJxg!@U zokbPWf?N2OibV#nu)$-tF;oqhQn66ThvJ_MT4x1H2+vzN@7@-?I!*h9k{d6E#vY`Xfl2-?-O#}awe}VOqv6ZxK=Bbx`aGw z#Eh6>3@^XTiP#1Il?3pnK<@u4gOE^2+3tgd{jfN0SffMOy6#KCO~GeJHSd33jsAAS z6CvazhD^okC2mr_qj__L3#KC1(n9P!3;ZNFF!2r5DdaSu19-bbgEph+SPj$j~_-x zdCJA*NyFLtPI^D6t^${s9d~p6_#eRmFmJMWzvK2U=aYu#de>EB%)QU$dhlLFAUYgq zS#bT!T=0_oraXKI3`neiCvWWn013tP8%)pYu}_N3e~tABzK$OT9#K={mMAA(7C^+z zx?ikIL6umVLnW-6fg`dI`0mROrje(Z)1$&{skJ6w+_s|7pR%Aqr_ZS!nYTPcr4K;O zR>C+${(Erc%|9na09}NuCy8`=9dAEM@VP?s#H^c`ZcmZLjf?yClVVFVxgb)zL;$3W z`?u6gw^AT4DI0Kj>-qIPzy?;A!rW&u_vBJ1plxnU6uH@-87SR$RM z=Ejx3T?2lOAKJ2mbf%TKIu#+Wd{izYXe66a5QQfni{GIKRgJsev|gc)xc??e4R|X; zAdO}Tmo=J;N3A8YA7sUaPtVUe|1)=Ycv6L*x_jsS_Mf|7{WD9W2(N0;AJ+wVj8U%2 z>j!x~DN*qUsYt1mfS~Lk)wx2_87C9ZuEtgHfS5kCr?)6Y`VzyFrtxGG~)a6c@h7Y~g3$S(mE7f$GLW8)vU{-~- zwVKnzsFaQk5B)`2ZGQ`%D5~|Ec2zjSok21YoF2%S5zjYyMD*!#;YT1Rb-eN&0khq3 z?Dcb;8zYVO@nexeqP0_X{<>yGT4Z!CI^$;GbVLC#xArjzKQ}OLjqFPP`5gvR&jz$Uh#M@;&QmNinn*?)9JagXDMA$PhlEa=h;n|Rr}8m)MHW8J7R^1%9D<(qUjR}6vY%1UQ&zk@hIsF88QOg7a9J?Xz(1l z-)Ir9oIJD_uXeKy{eRdDtY@F8W3cj*K(-bEHplnm+jzTpH~R3)xNXBc|I=wJfUcc_ zc-aXWJu}Oju4l$|rGualF>WRuBwK!VTs`hIsQVBQ?B$W7Y|oSZ1#afgwa0h|!RUJL z_qrJKZGo(>{cpfTeFUGc682>O=BpjB3{etlewKnFMcx=kut<%#(HSs-vjBg62j4@6 ztN(Ewv|U97lN@=2vk9VIf-OwO;C^(|1w+DHBz!Uc9E8(wnL#(q=+vPRe{5=w2Y{vj8fTy9yUxO2XnPKv9H#_2^EBWw*8cnDz=5y8 z^>WiD447+%!GV@HzrXI_kKi1U1L*acjQQrbo@3hpU`hqwQ|t*`|HRSv`pKxFabX(C zq0(J=4(*`*neeY(K1b;rgRotcKAcJ}iK`ZJgI(|ye!~H2X2~DM`*hN&1kd3Cor_U- zo98{U*;pFK2xn5whzBaC(~s{y*xFdfA7!}%^c~%iJbjD=aPZ5P7*cYodF=m6a0VU+ zx}~V#Ko0_$dN-pRNDGtEXTgO6sxGU4v+5?aGtN?4_#;lQ4V@HXV|@s znvR&7I;>nNXdhb?y%vjKh{GxYA9l|+?u1hLkO^Ba;L%Fnm8~S(@VR>ID(1=#StqEZ z6?1FBp~1viNAKJdf%KUecDWUBEXpA-zCR!I+JSesNCxS4*#h>c{dN2m8}S-tv&?PW zPZqGvzlkQ;5CRe5iFGU-55|DOELRr3e5*%UL3OY&DWdE%kh6XN;B9_h^9=XSV9^Y_ zH1%+WHNzs`YL2asUu&=7T!t~}L#L&z%#m7Og5>nb9}E)$7u+ajV@;f+rFIf40`B|2 zEO}3;UbZhPxF{T<$I!NZ)A2W@5ZW!WV;}hq8*-?iEYlbO>T!VHR?t43zK5Zd`;Ma~ ziHET@+C}=^7HKNY+8@M)2?JD$7tp!c2aj-#Uin_3pCY6yF?{>jqj;{Ec#ne`Frqjw z*r1A^Cts}{ik7igRKsnA)G`vRAvY0F1P|z>(X$YLKqz<~(AS3Z{c!+xGBLT-paduf znUi^&l#dJakcQ$+*RPA zNedxU4UUbE64ZLGCmQPZ~@cs|TA+ig}8suu~)+bQqnx$W+z-CJ58 z1s1chEcEt@X9F2)H$?5Is$F6R!b0@p3I1W@Yfk&rF-2e|5o`~$J?PT;sFuv&@+-iA z2Qp1tI>PB};4wSwLpc@cR>QK%jo)nGk>fW_BVs&`&GV)4@(x>1rH~Z&+W$r8A}&tr zH*x-fPi?!u!X`KdB?)O&o>INVF~#-(9)IigpTaA;-PXzrS%(14{J$1DHdBgADP;O5(k3Kt2~KI^$lZHod|m9Z_vo9i{FYY}}Lvn`Cx z7&3x{ArI>P&Q#1~Ak5(RKL=eh-Ue+%YafC`IAb+HDxAWA0nB)f_on(U=^l{U%qt1iD!n=%_F{xe+92O`!)O`!Sy#ca zBkR>Vg$ellY7#%anAM2z!n<`whu^&)!f7nDL?PO&%}+n0>J+bfqWs+SbO=(Y-^dPcO%wytyWw)c^t#o$FX zQf&3(mt9Kxl{>xcDVX;Uzuc`mIa=ml5d3@zR;B<-B9+8ja!!=)(*X}BpXWDzi5FdB zVoSWkBK*JJ1k?{?$HYZ1FtY5@+CFFAGwKs>rdBN&6}r6}BqE3_t#-H{`PHZ5Fj3H0 z)^07fn6Mk_Mg0cl(DZx|@^^;zu*Y7(E3?Uox50!x9+xX;`?X0H1RpzPw!xD#7)jrYZK@l%0 zEGEHOoiAg>qa!xHa)G3EsfB%?Gz)_wS)Iajo*aieExMN--;224B~GG9(oX!BBLHVZ z>1VvNq3@$CFY2M^9&Wme=fiYvRC;K77}O1zRm-j(c;wICu<5b)t8!etKkCpeCHDae z%&|+&I9ceiVIuXJv4QEk^*SLWZe)4~?>!2RFtR~jXEB5!>q9%@#a-nlyF+j9pTLuE zc;V`Z_*|erVIIxLuJ#13B}Zv4jpPz523&$VHC|OT;v4{oWY8E*>ux{hJe1{-Q8~8D zvjJrLY8`FIaIG>124P`Az(5;wVu8&$`|NIYW7bs^1^|2yBx2i?r}3lSmybUiQtT_U z@xX+E1&^EZ2)VDvJhfwySI|Ii{rrx)O}tCy>;11g?8p518gG*g7M!bw9(u$_AfNv0 z1vr&c@k;17lYwOlW9owbjAD(mtV;BDR$WfBN4Oqx#E^iPoC`%rdtmr}AuC@-gbx%C z8IhQ##S3DdM;t8MwNtz%=CU*B`N;${&y?Fc!u=LHGi@I0O@UKGcq5O)x_*(lX8L7z zNlJ1`<*!O6Dbo%{Y-4L1I<>0oK-+7v@X%*3l?Jo+w$gf6HhPh9HQt$zpCX$cNG>0Z#^gj~FV9Ac_jWEf-`g!cwJ0ol+BdSl zcAsfrcCEB+X|*CcdGdYqwbS|0mzJ7EpEYw9?*)&doy9j%RWP%Iym7W>;YZJ%CLwo|ft4PYN3PE1F1h29&n$brPx+T@ zt8;Wqx>!7o)KpSJ;~dLZMMj78eYqyN7kOjdRSzAmy*f-r1iR*vg+a15mo(LUIGl}u z37-!PP^Mb8C^Kdm&b%5YG>vzd6L#N4OgeUi$2;n5P)SiL)|0I`cCc$2v(>Hur*T*N zG_cY+VM6DnLPSJ?7&&rdn-^9FruVh;RV%|;Rk}U%S1a5)s&?iIw>Yc?^b^gRj(a_} ze#)(UY9KF4NgykxNbq17lyh92YLDdaNFZf+7LGpP%5}eQcdz=(ag6`cDA^-D!@TOU zp4_q`+gBgo4XIU}@{LwKBa_&!Bv~E&>hBY`(k7y9vnr{iX6;=?dKPahcmlU zL<~Euc9!23IUBA+`Ob;|5b>CTSU9f;-XnXhbiB{s{%F!QsS5YqB9#2i%jH71RiyqS zy@A2%!)e6|i=)Ow$#XkvW~SKwvE(_2cd1HS&3f?~+M_kfxRFnHt1FAFoXV3&mxN8_ z4|bNcNmhRiPJCm|UNg9!`l9&3%+#Cimxs+mY7!5N(EfP^yJ#LQ<;zsoO;yfAK4|CO z(3W9dn`$fnysCU@(Hq(8=5)nYvlA4>Ev6VNeUG9sw-=HUr@vxaf<@0yyNyci(z&Qm zt#5TVy;-do>Goy1dotsg51`EWYB@VW^4*J;ypM8_UQ&ZYtsVAs$@L*iu<%h3RUyU0h`)AE@fdkeY!tEOfg!SKs&@Iv2LPmRrcZd zxEr&x*!xs@i;34f@O)9VaORBbBd|ww|99?F))Ez^4n!7SI`OdP(+KfyBt}1PFIWB;H9Mc2z54t*E5kxL z2mK_W)WMKChK`*6PP10*L2a7nUdp|-oE^H|BK`#L*^{nHzN$Tr1-n^B_s!olg;rf- zbnk*lT;Jnzc4>!;N+!%66xNEJ9=iWNM!tT(u9}%TIsA%SHDh~i zpe=bt&ud%BeKvXb-Gqu5ivnpgY|uDH-aP+6*~I#mZc?WO#igilZkVw6i~!wvpC7IR zf#WNw-XaNiqB1qd)5AJbj?!pC%6BRxQ?%dd$&rVQ=9cwVMf-ZL`^T^B6Xt!mwv&1s zg}R!*7#lpwt;_G&jXJkB6WvFbJ0oY2;=b{;VrQTem|23iaV`<#hb(VryawOBqL8$$ zDSw#hd`)6Lq+tc;&!{jK4;F)gLx+QmKZ=vw%4E*=_saE)AmpS%l3uk=Y^82iM z<24wQW9`Ynl+W=>(#6Tqr1i>2Y~-GU$u7m&eCww1tVxD>{2qe>VNo|%C>I_V;EtP$ zPpc10O>Ks@ONLbQs_s3fZ=5bcubQ~8go+m*jb2 zuWqXRsdDc>)4?O)=-z687;7eLB>Qs3;e71c>Q?!7feq{;6!)!eHYmu)eqm@sWcUB$ z>Mfw6?7Fz`VHjX2=~iL@L69!#krEIA1tp{u6ciAU?(W7wkQM|~LO{BaZjkN}q)R&H zJs0=m`@QR1>t5VzxhAeTvCrQ7{P%A+>b7+-x<2VnGH=n-QHTfqs@bAQ~1V$v}(F$)x zc+jLFTk(osOrmX**7Zkc1ZL_`w%p96_Q}zJ*jU@AP`XbxQFEayEsC7YJ5<2#)3dUJR8aGj7(T!4G@Pw_&9 z`Qx%H8*+RLV+~s^>&q#8F|rMWVhyLVr}KB$WUb02lli`|e7IDfje z5vykp>QTC$+5CqZNf7r{&uJkF6k z+eS^;B!%G;DO*xm9!;hun|BEb0y}1(X}TXyt%sT~j|1Ol**H>uXNGiDNZz&Vxv!XXeYViynVZz^QFB)io4zFu`Iy z0S0hf%ig%~%5sWzQ-0mp@cBX2583P=`{mp4<=O}ap>so7hnS73k(7gzi7lX$5EK7I zF8}%B;&e=G#>?D1WuTExHMX|?)YaABKMY%&F=W_dpvvZvhxs+Wl`Zu@{Gv9DGQXze z9th8;N|s5E(512wHt}aZTOD6GeumG!ekx1GY(aG7vKwXHE2>%%D2rEKY3k7EPcgY{ z?A5HF{5noZ&Oe1!+t!4MKdx=KZcSZMFH4omaLVnqnC)&j%Uk77T(A_P5s>K)P=Z}f^ zs+h#b;fb`sO zaZRV|c2C?by?gXFB_=m2%JzyDY1w0uOI$= z#UNPdkT|U9a_ySkS)BN=L$My4P)u=QuyElbo2s8YFu=PuG^I3yNjoJ1Se=c?z^$?0 zO=9j*l;(A&JF2axxhtA?o=D=4cNE4NH6MrOvNYr|pFK2aRCDQx=Z?hZUL zQ>nVsYr({?Keo`U<7G?Ds~-v!iVLtyijTDjOrD*KO}dtSMf=>f-~KygOydDRLdm3= zi<##rhTlENKQKbf{!HcjS%;~Wap0<%k#V0mlC*I$G!{0A5mL3=^Ym!+-0YNALbagq zH(REiJ_)^cH*{))e==I?KH!qUAeV;*DXLjm+#Nmh?o9xv9$Ox zRvC?Fuz~d!?*;!a9&z}sP=%6;ivxikm%nqYhZ>1bNu+nntKO44_@C~FNnBG`;G=VR z_Wds2Q=c;Nb8Q{oI3;hk4}WX!CkrBl}fOeQWsz6yeeH^ zF=cAflUOo#nz^!KP0+lf_278Ueba%FPD4tltgqdX?P$_|JvO+CfN=j{s@2esrl)N} zNqk{OOqMBPs>hQzvNGD}<~+PnY5Rljd1ryBdx!t#aj3T8Pg!|Ib_5T8r*0i~=%c)P z$=T3gu`O)BuHQ`s_U?CBDL?7NUx{K*6{9hh`5Aa;?#Jtwdtj4Y?L}?)N5|jVVSNBt zNirkk#~!=*=v43HhcwfTMn^kj-ufjK%-Z;#tK7+X?Hm?cVn)3ZTZtU#T$aO)lkUDsplXT35K?SMhixvO}N zN5#K;hHp@Ifo697Tt;Qai zzLu%)dPM1V5*;goT_$KfbVqA{h`G1PFP_aUDOOq`Nu96M62D(L_p_&~oj16c=d(t6 z?A%GEebpg4Vz17`*k}#BTWQ@- zj%lVylVW5=tnG6Z?-}qGd`fx0XH!5 zW9y`)hKwX%iPh_CYL&}9sJrr;MxQG0F*ui1Ww&PeZ+yadtX_C6rsGZUum)As$^LC~ zSk5A|GO{2Fnhg-*11qC93UhUJ+$QaOc`xfbuk-xuncl~{6-v8C%)=P4TEd@)SS*s@ zZ*m+)CLa~v^WJ?iqLCR!x8sq|zI#kr{eDOMyl#G+A?Xh6>AJX~Tcu!nZFBLA!0oIZ zI5>t(z%jI-m6Ki+1|37=y!RdtIKP}kZS3r~AVs3=4R*5WEFB{XdsQ>i zx}6SgIVIJ;yd*6n^3Y>y2UF>T2z!HXh0c2WBPIcwiC>=v?jCfpzM1TteOUW)0$XOJOm>~gI0kt_jvE4EJfx|S0&0PHM7%TVb!o-Y4kOoklY%=cWiDdmNg$aDxqALH z<824@&#Kdg;K@ANF4I@lpX-bJPa4Ask|anrW+p(c!^3wuoPe~vudJ>-^=_XY`TOr) zc-2Q(TP&emiq;=OL+^aHwoRWl4fek?vjdM^gK>FB;}#?lCwZQq*0fw z)AGG~ z+n|2W8t+qrMaly5%>}sE^ZWUut zO!A4Hn=Uh1cP{V0qo)w(b*y0JQ882a#8e@E|ME}~ncm(TX^eQuL17-Zo2*GEvL*J0Htv9=kB@_@-*e zVj7!U!c>my^<~V)H!wCe_6G>w3bA8%a3An7v!{l(wY8Du&LS* zee}7D`k*(+dp(PT(f)8QS56swn#1L%Lg&ZXPRm`duUDql5BJvyyC;mB7&N*++7#5B zM|HNNCu-$fC(H{ZhHDm%)oqb9Y-5kBX)R=YGihW!QeZX~MbRVEPTBW|W;^blO6(9t zGgfn0(2!hRt!D7pn`3SGLUFM;8P3)Gj4o9E7OhNner58RJ!%1*b2M zhNOG7-=xVdKNB?FTgE>o)2*`!pd$V=2L9b8NmJ3!d@%UxcE#|*0JmIkvPKa7w1!lw zWvGXYp`)HGE1Qqgqt;jHiwSHu7mME|Ar`N1^Q4?dEf=#JjsR7noWwPh57Q@&R2cw6 z#0Y-;Y`G^Ag`|x4Ntv3D8}vlQFd=sJ5J-9h#SKyR@fP)@^|*!Z54Nd7wmnsU$eqKZ z6(gN6B4yJnaTfh;^)tIirc*ObZxUUd*Jf|fkKAvxUbhyzwUBd2r6b;Cs+pRy8D1$H zxFCTEOsHG%ny~p}t5eidru=M+GfPQDhS)muuD3<1bZMWE^8wB3~LvYT2H z`p)bQCdlsaZh`I1@Rw|@AElg1gu=pKt_$p(h0qv;cZzkluHkL{HY+>Wtg6a%aPf8V zM@{k*PWw+tGZNK)Pnq@)q9UgXnY$yk%Yoq#m2OcYqSsuU)DSQDv}a&4ouq2)wBH6# zzm=4)b)C#ED!{*CA4i^{5f7g)kJg&pMVF|2HxX`%8)-{4G2?}q3S=aevtP)mG8}f@ zvLl=33)*7$4-$V8RhY277)Mhg-s$G_atlGGO3i5Zr-Ao2r@OK)wvuq(t(zJWWi_1` z(y!lT$m!!`+4KopHt_<5hRastjjhU7tAeU6NX2swX7{*U$e5*C127T91)}7=%lfEP z4H*FzD(%lwGTbE!Ter#2x|X_K4kW1u9cuYNJiOr$1_MPrD$6OBH_12!fPc!alygOa zIU7IoA>xD75aS2>if_6v&@Fv6sHCsl%kBd0giIsF0S+zvFsd z+U|AqB5RIOy{Y^lJ648n*xGrLQxvCz>Yr27?j)3(JY&I?h*0_==kN0Lzet`XANpNs;m%q) zYp>YCBeQ5MX_f1}{q6V>r|~qs*vr|;iNk4ojpgUvDpGq(zs@$CXUbYrJigTDif3_% zJ7zs8^xod#DD`X(8#ck5%LRQDOY@8h*d~2HTkSW5`^RSchZrTN=}H0n{pCCkI*tFxzs@&S zYvlsW3dzc#&wFA(;UE+nZz@Ewv)TL;a*H;=P0cOxJk*5XyTQ{jZUCN|NEIW9q8 zg#PEietA$))afs1H*Ol(k%Q_1G5n_(+qGqyUa!^@!+Rr8fD;1(ocueQ3;%C`6OEP$ zhouPOl57ro2s9_B7U`5XQ+zdc48CTyVY4R3Q4Z*JKk_zS{iT-lI&| zs|p16SwkpKyH=j$2hZjNs@T*PekJlPln3{EIi=L>^tcBylCO>ddtI9TVZ$W_Rn%ZS z@LNttmA6_T8t=L+xvJ0mcFX7=kBBIrRy9p^>(%ku(BzT~PyRl$H$1?k3Hb zAB#(AhHP1bdwah=x^r`+wT5={Z!p=_+=i!b^b|fZG<|n(C6q&j*UfM|Q7CV;o^UUr zeE770ZSt%J`9jBdcxI=GKjnN3$(a*WW~3<8q?XDuTQh!no#j+Fg5g!tl6iv&@0$@wz~VO53ewEME#gA$gs!@A-aLxqV4hRR8%@a<66Yx8$~| zv2_qL5OQq0ioABt(oaAtfV++~N<|+RrY^IJ12L=eimnj-6^eQv-i`OsPl&R*4Hm-D zwWOdPnSU-_Mf9Q{^Xyd*PK(SKlV!uZghl-jm~c_ro$zyj@^W@6aW=_hN;=SN^TJnSV0XPFLgL-oE@Jp4T-J;IU#zz{`NF zJ9yc^@;^A5GOMpc2n-Nk1REz`3tVL`fA}j@Hog6R{!b>6slD9ad*gdAQhz-9pM(cI z^0`K`(tmGldvQ5cYK1$4=F7qwJnH{`g$f!4f*Ug#jn%vV`zJM&4P^TK5XHX&dI6lMmk^viw z7+`@P@zM5B%n59%mIk8NpxWESsKu=mYYVsg0 zLa+MzKSrOP9C{A+gn?bd=ceoHVv9tm;u#AYR~P81SbOyS(A3tSKZAE`viUlM!W!&K zAhg(j|LssPC*=dw{mx8G{ksnQ7}!n2#0kVI0E`1&Y%!2T@GQx(BY!Gf^6v#dpeq%8 zh?HXPYb|tsxKxjrQTS@JeeL|bZ+>dfr0ApVay3W6q*RvORS={4j!O?n|2BY5uoTcI zX!Q3XKyNUUS0Ny_cb3k0xyLIM0?O$1+h9qNf+h7j1T4?1<7zzr!4<*SK(_|BO)90z z@F5D6(@(NHqmT;Cm&uCul#u#nA1tO|?+cI9MT&R7+E?(D!zp};Ad}Q2rabtMazqJLUCWiPO1R@wQc-V%QK;0q0D!Q8 zHUO|17p6gxdNpc9VQsNP+&|66+fvv;SFR=2*n;YGQr~aTr>&J~68^(7J_S#&Y2{EU zFoF-%iM&dmyFNwBjPrNDLh)FSD+;_}^<~;K~c*n2Zhg%6M zX`qg{bi~MA51>>c`D=jWy?@$c?;fDOCqak-A&xvf$o!!RkOAQ^kL%Z~Y9MRHyRcHH z_KxeJXmet~mT<}y)BUVN#WYU1HsPh*Y`~`h(!&GlRTQM5S4Y+-$87r;I!_J#CYYr+ zmPWsW{k4L|3k6nULOFM$))(Z_AO`60^`YAK7!B6%eBy3wu*|UP6DlBl*9JyS(9vAD zAOc0&MY0WedgGuq#5(vtWP2(G5slc@wCH>vmtBO}FSrODnAd6)nAd_*$pRV%uajO( zf5^V&@VD;(?bMnN_FMJRr)CJe!U4YjxMEA+(GTGVKm-RW>tfHlXm!YZVtfH-hMkge zwn_=f++*9|hf@l~S?t$TV=8zdTI4nG#$3~{DMJ3}l0gih9*lyDmUU32Dq5}j8wZf_ zvLG^EW;__@zq`X0dTPucnCgRZptcZnhp_>$RBoR`4)vrz0oY)+cd*lP!_ikDrM3LW z+$>6z4@|Sh&5@&TA&*AtoC9n2n_jVY)}3BZq>DC!HrL2RK{JP{&lwC@-C}^v_&`GF z0>smXVo0n2ysJPF_b6Na+QQusKK7h#9|e^)H!vXD&@NG}T&)tue+!Zspgd){<20@; z`12rUV3I5nkS=3#5#;wK9Eq+#np6JS2Ez$E>>1z0v)7aC)-Ki$+ZFWAUuSdQCK3%9K4R>;`=6ACYuuebSus<=ki;RsP=R=)*=;v)>s+A56u`(C4Poyd`womN zGDm{rHIu9~NL2zW4zq)?0ek2hppfNzvt#Z`Ja+`YE@lC|Wbp{s(lwWLR^ud>fFE!o zP#*|@m)u1m%&vt8* zdKRY0jz$D@WARmk0Jd6Aa(ivAa4yyldyl{2grOfnHjZi{Qw104a)?>#{`mE8Y6=l# z%aq|@t1@G3BqL9hQG^LVcLRZy13Yz!QYw)o^>3865b z4&?J+P8Ncw7#)PNu7ulPi}*JRp;&t_*NR_$2k-bFa@Gu@jp~&?Nqn_QibkeIn1D0P z3Y=Pnpq^Fn8N%M&{RcVJYzEj8Crjb)7*?>&0DRMOrq(kZ`sVD`%hn01klMeU?h76n zrzln&;U*|yb(#<57zg_Gd_lkF>$y-h)I3!DX!M|xcM5^3z`T)i26Fe$1Kums#E~3e zxI3ZY-ram@ttXFuhA4jiRro$xn;ZD%A}>Pw*I2QWn1?5P9A*09fQ8it1FPc${}aER zH|tBM*)x}YKWhK8u9Y3m^cun6PXJUl<_1Dri60tnQr}4k^jCH$#-O8B8 zKjB)uC|L9!D}Mtn_(IU7&^+)+X1OlmV7(*j3b!6cDW+-Tg9MF{W34vF*9QAU*d_)N zc?Nk`Icdu20r;oOvrwEPt^#k&#Vs3#c2^AW=hKiwv&$+^B-%`W@G37WYim<*o zJHGT5LFbo2K_+70yu~m;!`346e2wev8Q)`P^*zvjr;Qy9+v^u%Ki(&?&UPXJ%)TAM ztFkJ+9{TdI=hm6M6ZIQ(FmemKhnrdR72GQaRv#{yl0euyLqWpjr@SI6D+nEfNj+BQpch zC4znd$gYoKz0@~#P433?{s2udSb6sPnZXOkKtO?Z+I(EvGhT%OkggeUoKdS@ls)gJ zKizI3v7RiqQ@x1K`}h@dvdws)wOZwv=psYT`6Yt61@kkM;vEMw6BALM9)cX=++yig zmM9<=FN{$hm3olF{{Yflcl3QRB~vB_bE-zHv(E)ThJwY~b%&LFtxZf;r}3vt5B@$x zInLH#dR*;dH}K^6Vx?T=&2@oOC=P#j?|c4ka?9Y8Z?%7Gk!IY`>KINQtX53>i~k4H zKQQBOkc@S?GJXI$WtD*_TM@gJHE_yGZRg~m9yOB~d&j*WykNk-vG9Wdv>Yu=S3$HT z@(d~{&U%AIs;S`*#@h~BGFL>VD8hZ5F~HhXK!gOt+9yr8fH#`Zoh&)>yz2wmSHc>= z)P+_GE|{|cn4WwHnhQTC!h~z(iw#-ZJ!tMhk1xxIGRMYXrt`pp?IH9T^p3-Lf(ATL zH-z{CrT_Kd5rQm6glFGPg){~57=;Q)4#mht=%jWn`+ehaVH_rlC{F_F=;ZqrI%@?> zR&@~r8q5z|V8yy+uaY~EpS>l8GmvICeN7ruB9b$&zZXG3Na2s7&1x%eMb`Qiz|My( z6DJ24@{-|%JwygR*3B~j^ms(qkmL<7L6e2tO9KUqEzya{Oh1?(tkLJc0#)=9`M(2z zokH8u=dH=ZY?P+3@3x@d@6LFVDIcABEe+{sLgqasAfh6;^wL7ma0KV~553k9;TcfU zbU}UIqz2gOR^V_vI6s`JTF2}Pwl8PPTWTogirfb@F(^V{aK2~XLkC${p~ty_muo+l zf)l7y!D?4-$EbR82wzs_wn3Ix(A`_ON{Ts6(9gB7T|eW}IgEjgVZafxT66)iA%VwB z$8~-Pn5k8R7=XUbw8dT3|1bXh2o3n>sR0A~_da~AqoDd`0#wUI@;QKazcyZ^WQ-}E z$Pc`9A4Bnv)-h0fDo|cobs=gsY66j_K{t)Be~m-&|APVn3=o)Y8;u_sH`&p24N$iN zb-+%A+5#C~&9)(j7ddE&SYI9`WLQ7vf!%lvmc;LiR8-6AB^u)OJK$~^OzGuuTjB=< zAJ1xw|kK^oSu+z-YwI$nm6I#b>)q z@&Q;qX%P2{f|zECQ8Ox7-V#`mkej|8jTkVHMUTH+t|l}m7z*U?Qi}(um_(QydZN^N zW7eOf6mZcVy4+sD$~|7W>{ExN0OLV8_{xG8dJfHTaOk}~xOnNvuAT;7s&p+1fY|#D zSwUBun$a+J#M`4KOIPqpc6k#}oLL5XW3@*~?J8RWlUj9R1G&JUSk)aMWew+a{xz#; zqXIvm0+s8fkQRc7Gi1GGH?Qzf%C*RIr|NMHLkP=+zJi}~WPIhx7j9^rNqxD1A=YHKa#KMx-b1fo z%}q0Pg9Kfg6!a?B&8kP20RAUXBOWWsjN=e=6jJ*-qOWEE`!zyu3Vdfk7~KRG7A z8Vo6@H^5qY@S=G-dULAku{h>2^=ErFGG?`^^a}88_{<2vjcEZD!C4d7ue%;i0b>T@ z;JTc{tr=N^H>#$hAy~i-xx1hueVKgfzs~RQM|0tB-VvBoN^cTjY_c{_G5o;TVFKDqK(;Br^We|>ehAN?aE!#0PdXvpGk{#X-3^{V<7!)km zO7}-7FxwzJ-0C4HbR>gVDM-S#w4j*4M*1!ag5!^p&abAI(xNWc4-=vh1qV|lw}DY5P)PfLg2C&97+zU`l%sv1E(0i7 z2Zi`$-AUquzzSeOp{ z;1hwi<+}om0Amf(Y7plfG6+16OS=}&dpB~w7}ZoJI}YoKzM8zn@lE?j?3eq1ZrAs@ zdIO|~Hg87K3N$9O{;;5!)$bD-)@=f0h7k)sHoRiMIK>VT-vpg7qkIAQH3WqPtf}3I zFcdm5`^tsGWX`;y=!Dm>vh6grb)jv8Ktp=}E%(!jyvJn`cjn)NER{sLXT~*$zS{t< zQ}=9APfq%=W8CLa0Bouv2%9#n+Hb+cidDURCrFWj+`DOu}xjcYg zgk0>$pnYQvV425OlE1IeDsehkA9DhgXXXw$dKf4x3$;0MkCp*_0W&{jdwz-(eT{np z3`olTx)m9ZSzo-$or20$E_cvAA+9!P#~Y+8Xmr%?H-P$_qq}!pGN^7JX!}Beg6Qh4K9B$w0C1@`(3(JKUkT9shOtJ_q*8wd49`CnjiQPP8{UJ97v@^_pcLl3O zC=h?SH`NAMT#*N~_QL?hLVw^@2y7IjV<51-b2HnR&P#Plu51tB zHol%)OCkw-{IopI&)4=r+uzVHMOPNw72wRUegKc~;t+jj`UY%zLx9ovZ|75jFEz_423XZR&{pG>!K-rRU${iHCQ!pT-eA73 zwV-$Az=uDVT^v8kcjT!6GZqC17&9prN+?o#xQw(9cLB0>F`jIOn$O4z;<30Uf;OYX z-AN+gr1#xriy4dNtbX&BYSSB z7NAiLh+#xA9a1NYFDVp#>uviLX~u>@mDz5&Kp40quot6z3S&H{6MCL0 z4|AT?8^nnaw2`&n#*z>C2r@g(EwaDgYP~)wE(L4B2{0xee&_*L0e^l5F?pZ$d)}A# zLk8XU$F0z(dHIkP{X}^{k91}rm-zmV`;F)CA?q6b&%~y)YU*jjqDujqP=B^mQe9n6z6)B2}3z4p4r^!A9f@P3JwgC#lDOTYVj@Wpg_EAp_#A>;5> z?eX&ofCn*bbMoks!NG4|u>p`-_x%W=o+A9Sd@zVC|A8B#mT3OUFveTI= z6p}kXDGX0=;ZkG>mp`Cmm%%Am^Mdq}V@)Af6&U++3}iiyY{i~?EF?;1;AHfzjudR^ zz7h2cA^SZ1!%{~lX1AHfxCC@f5mnRTZZiO9Cc<9HA9&2jct&d9UG}uUKD$%yc?O6K zG_wv0Htj8!wS#LK5zBDzi1%<%1MpvezvK{nAJ*L#4m&IAHYk3fKs}42PF35}i$jo{ zB}kr|UAX$?>!U=SEA~Xwkz&)M+e!=Xpy~`Od`huu;6NH!$OOHXh$QurDx}>3cp}BD z0vA^4SYHx<01BCY=#*UmGHG-fx1aHli4j>z)qmrA*hIQ~Js331=>i>PY2B*@<&%VQ z1Hh_2ZUt8X)~8^NKOiPMtp;sD51^-9>Al`qayeqeDw>~T$rI{81JY2IP>+T@kiJ&0 zzfH+T9^j4bao6#c|K6nQa`Hx$u5bHkRFo{%|D5A_Lw7`y^K- zlK27nR@&Df1Xg=A195*hEn7qCX&2(X8`A|!8po@VwwIIudTg8m&L=yR!%Z;xE`a3> z37^b}{Tks+zrZ%?fs|}{*K54ADk1kPSELYhr;)U|-qjk-w6(k8$?Ev+-bYbh!w9*6 z;H$4g1UTpwkLGa*mXxKjFV+~8P)hz{^PErH3m4jY9ut_T^r0#Zbe&;>U-RDUBH+{cRe#)EuGwFGhk=B=VM#aTTkDzj`k@<(9W%D*%D{*MbXOgom7J+8iwZt7gyqTNrhJdAj{ra z)I%C|kOuB$)ysFAQ7aVw=V9FWw##`%OE~XSq}?Bp?vbW(ervz54a}r@H7bNaA296r zBVh=E)dw+7F+CNLsf3MqmMUy1nZ@S!y+B9!BPR{;=RiS-+*cXoif4nR>!d_M)91#d z<3P9#v5^oJal}ujmvJakSNKCJEONv1GI0F^HR2KSIBJ$A;NgTH9nbq-Y>f!WI1zW~ z?K4rba8V`pZ#nK1GlFwUZrClh&xje3*F&%x{@`pS%sdU}nf&qkOp2YrFQ_%~EAe^i zj?vy8tzCet>D%l!XJXnF=R_PXlOr?MA*^EdJ)zfzc*0-N1_uvG{uCW&dh}$WhMdCuOcP056gbC_+ ze^U0)^0<5s^_Z0!)b)=R-u9!JS=LwKdw+Z}AYHa|iZ;XQN3NtSI2;IY^+FMcI&@xN z9@TUa<(cXKv;gq4jAp*+GtHq5tk^Npd)f%qIP_-}`q{L%RB?cI^i^@ew-uOo)+sbt zNRY^kUMBD5YlVufoGio!H2?_ei>@YyFNNFF4y)Mwe8y@~j%0H_ zJ6+SUFJ~E2W6h1myjlzLKn{a9!+(drR3PqHRm?9s^_aG;;VnLjmw(z{M972kj>r8w z#>>90kjt+Q+s&m5T@@;Pp22m*$8rYU636!Tx@OF#*lcHznrRXtmCX3xn^RJ1E8F-8 zb&os`(YQNTtkz>KW$*ov+1s3yry~~{-&g4qzYsCVOUlA1ii3|DG-aC0`#7 zQ@iyry;xz|+xUz`o|9`DGrI(^_Pv5eliJ)c-Mr7fq`53n))HrK6aTTk2avD;kX@oa2!=Uvt~2=10kTC{Q6_0xaV zm2}02B{7GTA?Vg&sSu+G(ZGuY+dY=G(69!arZE9Em8R_!3vaLEv9LdLpG5rTagX;s z>b^t@RJ@8+4m_$pbT~2NH5#3B9S)KA(GE7*b3Iki-(EJ!!``x6mL^bh^Tlh~IaRzz z=-r7O%hJ&2EwkX>K#x!9!6xWae1{+?T6?EV7;!9QoO-1`_55Mv8O2uyku6u!!G zHDlte{lwfVMy?gOeOZ$4c8!vI7O-zh`7{6orH4J1TQ#2=3J+X*E9-`@n7Z|6DDrlF zd<)a(kE;*vKRv9u?_(Ear@<&IE0$x+wAFo`3dR~u`WKJMgMVmXa=8nSH8sdNadm5_ zd)c4ln#8Xo)$C`DJRjbZ{+)a?61_dYcNoe$>rUG&Y&@3o7|TP%%{b;&y$=@e5BMC8 z>1&`}>FN7zHHf!$baJJAcwz4(RFm1zui_-^EJW~3E!&Q9l;S5`?)ZfQ&+HHoemDlQ zkiI1i@r#B1a@y|Q5%0fBsl&F~)Z-1q|<}eZ!2!Xcb$jm>ko-152Ib#ht zntzvx%gkw81@8{m{B?Dkj56T7n6U@9m-U2&NK*)Q-+!qfQjJaG+3Qye$68GOkMAfG zG7DxTB|@iU=|5*S_If?ZGr4{J5(_f!r6xa8_)&T*O~w0_psPysLD#`WfhIpZ7ihMo zG5p5o@w{k0I9uhG%zY->a3}&Hv^j|Mj&Dz2mJpIFx)I_8f%Yr;XlFd41Xk^vTziAH z-AU>Wod(2iP}RoXxd0cmw-(;z_?pOgWmKONi;mVK7nTwmO{2tHs3JQTqa5?=n;0U} zgVRI$!<9klO+E7$tOb$e_xNHbtW!R=-ttTJh)rO%PqJE zYuABunPBw5dEz< zLt-l+HG^4oH<;}Fo`x9otLP&lE&K@is{1a^_B0MLv}=DuZv_Z!tr>1#X^{z}_55;& zU#__zz9RNfy*N_I(#4MRK9|b%Wzn{G-rgY&K4dFAMw%+kwc0XJaF_h{Uxc@d;JQmP z8!RQe-EOMgU*Bd^Obt?@D9r?h{SS@}ActaL3t#B&JGoY&A+Y7%ls9&T{m6PS-xQ1%g6??n zuu>W8Wp8rPe;{dG1#&@VW#;}ZrmW3#lKfO#H>ou3@?OQJ@}KU}BcczRV#4aSr28co zYxaKc)r>KDku`G?(0f*g-wvj^O2XHx#gby{NHnBIzd{z^J{Y1_KYNHPXt_AqXD+d) zVLoX#Im+~a(S%+&-?J`+P`f9)sJ4!r)W}0tCaj?j+kN;=&eH8K$AUBmA8cJCF0{L8 zt}lwC@R4g8L!@rXI4toOV8R{Tk*p|GTzA3@OUM%QDw~nouIaA07$uqKp8_(Xp5TnP zA?TE6&+MNWhTwWhpUFPO&82S0p}}}vUw-eboXWhK2JRbq>FWu#a!20{EJI<)$A7WN zTS_b{;+we}zn&^EmmvI5F!3Q;v4F}2Uv?52)&k1c82KtJJvAbE=i+Wrp_e2v1@}Un zo&_0yZeor?6vXY35hfgbTE;}fT0{XdhDY_!AeQoqiOpU=|G1s#c3^f&2o;Kw9G|D+ zs%)}-__n+?aVo)WVZXW){&;(QcVp-&Zoa;|d|J-%{F{ei-e&JF_LFG-sr?rpO7;(jKJql@n;n9}v z!=!`IV$;l%g03uPYX7+in!5;X;ljl-T|!Da8#n{@@YYU z)rfnl)s>PZ;R&0e3b1QeLAED}LOI)F7U*x2@NTCEh_@D8QDhcGkh^01D=>hf?ReOC z7r{CC{y~gDJmjiXtn>1D{(jjFBCyWRGlHob`yK@Ss)0Hzx`Eaa;NuIs>nNAstfYYZ zuV$?@kWf`df*Cjh>Y~xRd^L-^?hl3e*%&^*2toTI+4e5*>@g}>X@Po(wqHJ7KRJ6! zZ0bA{BJQX0jPRpkoZ%JZe6Ly5&4l6&B2sNe6X=tUQ=(6F*nE1RTaz|uG}}ZK2FZL; z6w1HPNtP~xRS2cIgkHSM2?tAS4H=}mj_)1{(wDu!(h|FP zGdDS)*X9IBvU|E&z26>y#0tpG!1n>LXzIvQII zaM_2fBub|F?+e|O6Mnz+T;;fm7*DqKyEc{XPXS|t2bgL!3KNFHo{SSi?Z!cq8bzEx zCLw57(wwf-I&iV+4w`~adM>o*pA&vUZl8UMPK>DCy;Y~5g$xJ<>Hm|oe)jv^ z2EAYH@7rg=xV+?pi-TwZ0i>-=K4pk-rHwbU> z!F|NDqW*^lpFt+wZ_pA9cr!~{j?cX9NDeB74;~8MbQ;{6x{c8Wr)V|Mu~^3cf)Ja( zkXP*nRGf}NITBG=8Kw4t2?Yv1jkd#_;1k5zd`SCBtshHn*JI}aW#^;f=iRzn;WT`u z0B1Q4pm+}NOs*t+(iS!RscA*v2?nR}?c+eOEqAvU-08d(^vz2Y{%#~Tm8tCWV0!W9Fi3h6y0`%i zI(!J7!$_InlK~H_ z#-ayQZD!3OOU%F@iGvUYA2o{=J+MI^09{ksTW7J;A3#u&lI{ks2$A?;o&(HSg^9_K zq;1dU>atug6xtESzt9c3Myu*W^dVq!l7|4UhPSUUnEFa%zV4OFJ-U(L5)|%i1|#{<;FS$hWP+Cy;ox zs>E_6({p{iC@XoWs;oxPtD3m(bdxKR#$)CE=~kH=gOv%5)4GLhZ)&Qe_bRg_JhE)O zgSYP7X{3E6nCVsL#W6?Km3^lkNYEfY5Vs0iq^nqGQ$xVq5ZHYz>+ur1Ia>znl77_@ z{HSY^!=Pi(4WK{zetvPfwaqEFT3)n;*E)D*CVsnLjTL z;gT`*UWm-=tvReLGj>^`b9WzLJ6-DJvj)8jAFkW|9(iPFEy5uDJYw(XLafH{!K96> z!ne6s8Ff!YJ>ksfuKwVNEu5m$xVq#wI?i&(2rtzi>g z73p~St+sOi)(YF>YTGA|)|B^OPwfvEfA0P`F?=sk*FT7OYQg?_chP+knLoq%&z;Uz zvKbudEohup&18E&#tXa`8PV@_8aE}ebgai3w&>*HuJ$$xzEb)p-dJ!`h=z~ZssG|+ zuh+mqr$h$i+=)HeaKX|JwH{ytyXv(f^F!@=a7wO2nZiIq8dah;Du;coI7HaB6F#yu zl<&*0-=1=$x_;iU-)?x9B38Xik?Ph_i#b{2N^Xx7o%)qux6F8Ybbgq(MWw^G@yYu1 zz-cl!yRy+oBa(LR0k$$(nheYlE@&;^8fjnPAib-6%B?8vr*^V*)wF9^-~Qg=_@fCM z8zfigcuCnzsn>|nN0meN)AeRh#v*#}W99xcuC8x&b3smjc3K(w5e*0P#l4lq#~@x9 zXW*+b>jW3UvuC2#lcV{YGc)-2bR4%*e%LIgmqk@bFEtHRAHtZKnvPLC>%CPdcNW42FS z_Gm6%+u4}5spLS6L3k|Q3Ou(#27@nI3oQ50v-^#&uHy6Zz+&{pggrvJ6I5Qv4fDPJ z8m#b!zk4B$*AOi4i9@Ad;(_|kmp$$WQ*7mx*dEtF9;UZ9=T>=bp@*#%AjkpCfb@RP zxj+Ye^UVqfWmn|VLq%2}Q&qpNhB;b}6b>&IH&48NN_CG!yzrUbkKDLj8;8nCH~tB! zM5WqJo_xcSN%!)Vt$LQ~mk#wR7e8M_q&;RQBrBs$^Oat4J4xBDF07xL@>?qyEy?D) zLcCjOl%Mdlen6|tZL(?~^~uQI#GyD&X3Al{gSZs7{9M_&r0#6k_jvX>v5QfG`UQ5^ z+3KRYFMj9eG7F#gGB-xj{OWekAN9{vtxx;$idoNUl6b{qz{a|)QJt|;XZM-yl~2`E zUi$!^_4B1#Bu}bw_s`O&7*MdM$zm=iYxlECW)y-vckdODnzGa$q@AHR${!0%j@Xzx zjG>+}!1Z%ndR=4g6j`=pDD4k_7swIq@=Ws!a{KAyKAxe3cVc<`>;!qdM|>+8cyE;| zEKsfaO}g%X2ds$i%-)8mf^s)M->q(mRGdHx zqpo6XI&L`MY?}U>NfGUngDL08S~<@zPb<&%dpx{O&rhB%M$v!P;Er(rc3VO!Mj_3Q zAE3>jU)5$)9fOfO3JJ| zDne%i@1nwlmL!TaS>E;Iq}$N~^)Xitqqd~yg34S32WOII4A6dWV<3P_t*G8^cv$_Y z+aww%N~%sn#iX(LgT;(l`P^}{yqxz>hx&7dHQ!X%k<$1oSC>#b!5xTI>2BqcF?h?h z_uPHQni11N$vgDeyrx-8vT>o?o1d;I-RCeb9w|0SH4cx6em9(L95bU#^c zzX5OmsGWsN)a&|XB4Flx9!4#33u-natw_vKSa!U+X`*Z6++Y<`sX;L9mR$R*llSo% zqrZhuhf{l{D8)4SyS5mHhweQF!V}4Ayi!KjJh%62+OuGS~1X-PhKk?(~buqD@Y!ds^v} zfi`+eZPLpO-tW6-pO1$lQgqo${kd_nAc9$fzUZGQBFyGm5zx}ED|Wy$xRmC7w9tcd z(QD+u7W^=$tFipD+vHGB{ju#qJzX%}EZy{1rSd6TOseR&_m@m$%>79&*SoZq#Q!V_(U9nDUw`Bus{u2=FlbcE4z4i)KM%bEO1 zvwj~9%Gr3~aP*#~|J*iL76gwGb=k`G$J6pLcM(L}aGZ^DxrtYv&v7H+COa`@n#;<2 zp-g{IC;arHjF=pTfcf~x0~5PT4}40+z{cPJ0gW(di@s?rOA&NllV9lETQ6&$lFS~6 zw_AJob%4jClW3YNN@3K4c{bqQ>tu*+QE5V{G+I%mV;h&y&daL>W}pD46ASQg^_;HT zl!CIT#`}=TkA6lk1$lY|L}*@=52DBC-tO-`JhXCedn;nuTwJ~Ru{ceIf)ki>7gQh6 zBMegk5A?ui-{~r^FMp#aS{OkQ5LP0*Qn|F=sF<$dzG}Sz;;Ye((^q>2XSveo))emE zQ0~M_Uc|Gw1aX^i(pa0WufLrtJp{I2af`%zhVn#*au%e8KeUEE0s|SYmG`NMZf|WB zeE>}u?7&!cjAj)VzW{M`Mj5wHSJg7;WZntwUe6FlVX#m}qhK5DbbG8xu-`>1UIc}| z-G=>rix#VFpZz`!@wH@!6y4}IFMlkkS{!=B3P}e|`N$?3{90S8S%DE8{MuM6JBft7>&3p9TtaDS+8|ZbzmQJTV}LhZZhl^^u)B$_-g3(vnBqne;M&7SEvq-y z`|sO3wH_laD^by9mcuza(<>z zuMiAjc3Iei_VL;NsVqDIbYhXCX}o zpBV^3Uqm9x@_fn+*c$eDY`Sc>@=v6x4>sYC0A0CT)&!-TVM!{Yb5DMFr8>3USfN`v zANLPa9zBO>Fi}*;L9~xz>wK)>p|tVlo|wz-lJ8DOK{3FF%02U>w=hhzVPJYY#bx3L z49CQR=;kze_A*Hvjzy*XnB*sCG~>9~*-5p6OEu0MnJ$|u!;gNxthfBl*1ce7h~L`3!LFD50Is-_hF^ds zhP?o*8Jzd9<&IaE0#wy7O>Ymwa zz{lLY8cM>SJ5zg+#;Li)ch+^Jau2_s&PIZiX<4@VjoZd*7Ku%r!g-3;ByJkJf*(5K zm`GJ)M$C6R5wX5>v^$_?qtsjEM}+4J$cybeofP*rJ?DrJPY7x^KJ7*T1c!QQy;dLX z-B0T`n#wdTFWAaJNff_e=-Q_w5qv;exR_Emu$wk!-kYBX1-x4MWz+1T&?tm}v5DhG z>9F-uYO4GBXD~HEdXPocOKFBSzQ`-;KYz?IPptXltq)Q&Th^?mRGaG)B3>NhxvmXG zPClcUIGIVTJ!xayn5-y1nUQywTjf4k>s6Q}4I7=gcL5G(u3BO~sI46@D}Aw)#z=V` zd4)Lr*J^*OZ<3shxOZ^WL(D1ViJ!n8`a-|KVo%yrszK}N$}CE@cRIJ>ikX@kE==J# zeG?Mh0BoM&54{r(sZz`EPtMGA*2?&jo$OhU(Zt{yiO1X8-3gitl$a2ZI(z1RmPRJ#H=Brf zGM}OJT5BYS6dL*CfoJ>W9+!>UQYEr$dBn8ozFx*^kZ%X|D|ILLcF1#@dlZ5we7+H@ zBL$Y}_j^B;_DH)e5j%WFY$)ui=SW=g@%1idR&kWCTej4pnsvFOjQ&Jfw`Hd|bF|oo zw>5ciq6)=vB}1mkWkHV4le6RrE5GMct_C4Cge-i4hK~E6+c|57dm|0yS6hohIs$H1J#*4! z5+&BU6V$Lph=SWvSOjUl{M6VLY5i#=CxQH%e@6o%#1^b~)ufY9fRn#i_jni#iE6Af zde9e=bFlme)n!8fbRpnkBce?cL}oc<4Y%KzToSPnM0e!3&uoW`)WrF^6q)ji z1uUusdpp#PP5J)1yVSQ)I>)0zyon7gbf=26zvr8&1_MmeJi*wr^H z0B`qINlye3tw%w6WcB4tVH&!oT5yt(*m`lNtTROEP*ij$e(;}IfLywrraXvZpXA3S zy@$-Gcu&2YhH~=`q$6qY%WssNEyN@Ewclhl3J-U+&hHTlI3J$6?eCO*=Z{p= zY%$x_G{)~Gf9T&AQ>={I5+~rsKLlLi8-$^`MSe4pgA^aNsm5DttBu^OQ52R6o@^HXt2_Yq`!<>2kdV(pym1 z#!v>h>aTeY*kMkKHmL^LcUpR_MgZOa(^TzbrJ4R)M-ER=r+;>8@ zajG#%syTKXiqt3aLufV|IRsru@xP;qnl1ucRA~%u!WKv#b-HhrI{#h;0aBxXCjc8h z|jG9ER6jQm3vJnEo)!4y*pY?S-e0q}%AGi=3hGhmqSfN@Yhn8~X7 z`FM_tM_|a&>8}0|i@dr21!D_MGpAvrO&)ntbz6LL4u4(Ew+aL=1q?L|G0}3~(n0Od z)qtklw5iXz=ZM(sRIrbpVvOCmV4?T4^UZ6)a(&3kM1NzPsPAt*-V2qjI@EmrMWp}b zK%IubsJADTSKm&%jg3w{ErJ$Rf7Hp#FUlPBwb=+^6ggZlX%|LEsUG7-;8QGI+eFABEM>>m@dCR#pqDMvsYf2yVda4V@1eUViLLg7BQCdK(I{0IGmIf zzrlO=EcE~;A=)%^eSGGld>d!FUth06dqVfFys-b-z9(9i{2GB~uKX{?Dgc$vN5pdP zu%$f=x-H@Q7@Eh>N^t_rz(tCEo{?-pcXxeQ9J30cA)FKxVe*-&E~nf3<1aaQFQ{d= z+;yKanyqQ2ZJFojO@Bso=c0}2vyV^C!*oX;cw|l@r+w@J;jsd>n$Md}jCOyo)Evq` z6uic^J4voXe#d5o%J=&cQlCyR{aOBSxvKw1r-A$6L4ByjdN%^c{X;L{CIPN7J6lFq z?+wF*^iRvvpb?(-XJ3!oJ#8)Z`@DpKM~c!p%2odKfQY~bDV{N$Mf!T@}&N&Y&? zdloEs$@!#@PO!zqE6ZX}kgMt&=5!wt2b%7n9!RB==I*716O(n|c^t%9m78^Iy zOkX>B-F{&;)6HX)SN*i#*${)MEmgi-ua_qcUbb|pRhwFA-PD(x-PEe$16 z&F4-8;9{0RZ=U!7JJ8yCV_+hym`0R+ z3GWp=cIkr7!BwK{kB1n5->=fA3C_b=-Yao_nN(4En<&ID!%X2o$Q8FkWl24_lfgi+&@?}R z&#bH~;hND)bSUA}dre@E&Ei1!aXVTr%S-Mmi)hVKd%Bx(6Jpz3LCjKhok63YO?=wz z{)zjTFxMj}@8$q)A5(E8#<%dCZ&p2&T}!r4E%q>sXj&qWY~-$`K06b6t70i;hWb_b zqOMi6*pq0nVNK)HIH#i>SKPT1r=@2{JHaPP)&zaDrZwoTlxKyJah&4WBgIF51ymW#1gSY4RsVIC*0)Lf-}*ABCF zc?PhizW$cN2o$&Z(Li08)nRtk^Bh$UhJ4R+d~_ws#K`01wL$2mz#oQWi~FCDtqrtk%z$P4_fu*jm*V}NpY{Dlh~vEDeh zy)Rt~!)fy?FfM)4d_m$XmOEx#ZohGkrAAf@&S6b*teehxRcOR1%$I*;?yu(RO8vBO z)uV?v*AO-CQ*SkEMid`;1ElQGY2IoPC+-m^&=ZOQ0t6)@x$$u^o>wokvgntrf&7cx z>0a4y7T67cUTCF~d9|WN&P+2f1x)_lj1`|z(*=-pMT%l9eSe9 z0kp0Ao(&v~q}W4;4i~HP13d%Yo^_`E?NUFci7GW3GpK{ey3d_He^Des#EM;|*y!tC|K)DkOZh5nnf_Q(DxWi`Q z#nX)uvjN{CL$b~OFYl|H>}LbY$ zYh9^_S-jVUuo+ai(WnD3Z!OkJl^z2u9h!(E79_e6Yr5v1%WY%OVfQM_@nt15NwW{= zc`nrFB~L-hCl1SwwBG_?O7xRzl5QZ%r(8mvgq6IB!?Htn2!fFw;W%v5thcqnX3Yfp zC)V`|&3w(N6)=xvY)BPVySiAt*tldA2cwG}{SquF4Po2mt*2 z`e%S%QvwK8`gt*eb%5X(Rh=b;eNcnIgJr1`)AJSx36>Zn<$*H8VCJ%ufD0iMbj|lh zut5wUc$s?4;@_`&_SjgYt-^ab^Z6%`;&YqwTp9z?BZYyo4PYb&$gOLt`M}pqW?)3+ zq(;^MhkZ0~H-_tAO@N3=Wi6XQBzrXUaTVy}tz2k8kGY>J?fL|`i0!vfY8!&2W&sFc zWA%F~w+4WPt;pI~Ne);YaxVl|_B$*=K~-Y zu?W(GeN|E=?vt)>Y5`4ZxY~UyYU;vnvjrstc=y?!3DnDWb%;uUUVVuJj1}4nr$4IF zT(ooz@|yhBTGJhYmdqcNK2_EhXh(M%V5KHo0EVE!PSZ=f7>Rl;aA@!tfb+g`+)T(e z(FI&`5Qt~AugFXVjHvxaLY4|gG*EARkCccf#L8y5zmW}{2V-pl`YxQF-~z*|>*aTS z-B8gIZgG@#Y&XnjLO%}yH3sSsYcufJwBN|-s1pO3^wr@4JD`>H*!YBHJ?a@{zm^SX z%@Qow4GSV6M(IuhpOQ_NK6d@X_T=<$Mq_~TW&-WN=Ed3=9Z1fG55YN^5#1w?EpvFg}3(Lh0-S zhG`kAgKmjwQBtS0qqU-X6APs%$>|E88K9!(3U2~Whb^i-ru_Wuq$rrE$Y-SR!N#Qf z^n-7TpQ2U(;C_L$T{T(|N!lY&ci1G@f{N_57=`PbfAu?@eSWvlhny){{^ZvhLT0@< zNaT}Hv5?!TUiq6VMMU$vRmTNq)1GY2iSv9vBAX4JsO5y3Ll)3Lm18QiTOZ zy}OGQd!hwMizE1bhBKZ^8KV2T`Cu^SCWnyL$ZXXNL}Q(6r34(ng!T#0sCvSFwT>S$ zq0%D`sNCKWD-eu;A&8t3=JDYRlSdPZC_V@4m&i*W2nO&kt}FemLu9Nw{-Ka?rRc^8 zS}(vm#WHlp!A)P6KWLo^%#{ahgKFTH8vlW>n7?V@sK_Ck)RD}Kb86|3Z^tgX2&l+O zs)wukW6`386?4Q~QHSbIvNhAdu{GR>%p%w(;?VYh_QA6_%KJ$6BoxpkagAeYRQEmO zEvmV6LSqtxWtL##KL$wd3>lb7G1m>{>NXRJ!N?kq*zP&1S40R*F8Xm(F7^)jz^K0c z1e4?XerqI-DR-tLtM>o^__+UqM^(G7EfNd#bJvB9Ub;qlT@@#*1IWNlc0=k4YWIH@ zlCwo4$hn#T=pqZm&W_9bssoY>x;UAhl-WQ9FeXT=|cMs70X84@! zf0hT^jFs&82~7OHzef`jx%HuZo6C>y7iCn#KqnTTy%Qs|Sz+i@3$mKhN_dbDJkdAK z230eLp;9N`7!aYm%J16n;z&nKT%sd&lvta_x9s@Pq)3V^oAueFrF64d?+J07twYf_ zfF>~9V-%;|X*BobIY6So)_PQ}Oz-0dx7l<_RvYykF27rs{xP1(NlpdXtlN^mpM=_L zxH%9lED#!{c+hA8vn&3UmxEdU9RbfeLxy-Rs zc(P5-iEL5I;)7c=SzWT)1yoCC0%6yST9UKSH^vPG1c~CLE>q31^{5vz>i~`REL2Wi z044arp?DOz+ns8ztdAdcRw5WeADxR6<%B_G3C;xet<}yb^_}I!xQb72qX90C>_BH>A6hr#$8GC141$n24Q@3p2{1L#U@iWdk)G5Vbdqf zrm#pD`RM`=*?0Xn*acmzIK&ocfNC-tjLC9SWIQP|CczF4_>h{s;P)qUJ}Z0lq&b|T z6FHR7>DJM94?m!6U`2uB@qXKwF#2i4u?2cSu;scyLoqhbn;O?%>MXD7*AdJ1xg#iu zOuj<7)i0gFKY(eEhHxpk+z&m|xOtzhd=GHz*4k?}JPN)o^k$zeDPWx11EafH7llw;l}9d^~YRk9+n}}_;dwyYoa^bc_}fO5nQKWMHO*7ytgCoz;j)G zK9!Iz9qk)sIu$MOvVAB-a9Z513?tkNN;WNvdSxDa_cZsVLJ!?@=(bd{%(Km9R&h0rToGKTT~ zp8Ff)BO$dYwtb6D)k`xJZH@;7n}BaKN8Iu7XP60^d9`z@)$x%JU6n_3JQ4LC#e8HO zNpmNIIy{vBB%pEAPEwH5ZeMD*@gSV4!G-ygm?FP?9ArC=MX<>u#|;`?X&%Ndn60N1 z(}CBt^Eg}j(ByOmNlq+ynkX~(y#BgBf}8;P6t{;`T|OFfhqo!`!r?0z3z4E(_Uj+y zkQv8Oi|3WxRL00)^$#bexl7G(-0W)8^tzXuyNydg%HZDXk$YZT$xy))_1FeRCrZ3I+ql2RiW`Xbf#V3C3YlyJTcN7Kh1rw)1e=v0N*_r;Al<7g zfRmu#&eb2N-X|A9Z22tyrdi^448@k*k?c)X+%}sc%??@=Bd&(A-4#>cZ5=$w zuOB($Oi4fIz@2|?CtiC4+7X&Ig`JOhah2XtZRJa34Ft@n;Wz|yc(rTLLu<$Akd59G zLWhDMgou5t`00+fqX%)Klr|G{@JZ_M)d6Lz`VRv0%g{JtuB)iFMKxP!zL@#wvx+p;l{T+Vp9ZhS9T^43Wpckx1N+@+~ zRzAeC?z2J<;V;97nNb4_(lC_O-os1$=!s z%vNoK{N8wdvZgFdot~8{HhBv)YZYB+_9gR)J7KXj=|wEs0*3efn_N}7TFPgBg=|L& zqJb`sKd~~QCG0USRlzRqcc4JA6(L>*z%xyEqdiK)vsqvIdzNrAz@gJQvkwmp$SpOk z1W(}J$Q}In3|dnY5c9d0whuRjy+;cETmbpjcB=K%q~4Dz zzOL=JidQF)v-3BWsvC~+pnjtW8jS;&%DrB+>i51=2j@lc;o<6e-iMH!aRZy8btBnD zs(1Il+VtIsiGA~;Tz;%}dw#>J0@eD$A-Kg#)AH?cD4Pd%Iqo3Q#$ho-*U+f!M)&R% zt^O9RUhl{9j?Riwz_WPz@blFg4SwmV4UmLDOAWt>i~5{?OTXc5tNCql<}*%jetC!K z-ey{b>`mN0oWc7IGFs3OiTNNG^)A*C=Bago*JnNq>autdM9xE&oNBmwsd={)o?q87 znM=UWV&Tc(m?61&M^(_&qx0FivTXW_fN03u__jY{5{LEq{zrgNkTwvz(hK(Svtu&d z011la`ulG`02?JkrABL9{459@CI$goM|N)_)7L`7;yN38hu#iKuzLBc>qA2QvSQt% z5LqmTmcBqV*s)yr5FXWd^r`N6wNM@>@6sTvBCFydYar{5?vdxLJ3;Wbx;BaD%9J5u zk6--mg~R||9PB_Va+Y`%K+U~#v0EH4IEE=|5jpbW;FE`&&d`K&f4$|G8Qzp6s)6m- z-1uNS+f*Kzc;5A!hcp-k3XMHj5zs&h4ILI%!(d@V(0t}Q@T+glRD*x&pJ9LIeogp) zF4Y4wKh#T!!wm-2fB*29 z5|e^2vgf$lUE`dVq0naj!-YR&lL8z8%9i|vPgr_L{ewK9GYI)pO zZsdBk=nrJ>pzqtUwa;k4sszz_B!OMNCgm&U{|Fib&@)z-c6NdmtD>%mZSGxCK+{;N zv$^+2LBQX~mpb0S6zg?ufX+>1lW2U85YH!eGOt$L9oI*>-!sdE1Ayf?HTBK9eU4Pu z>rn31VFT$3Re#6L$VVLisSZ4rGr;^kO4O{+>W|anU-?75h>r<-O)C~rlHZXqY%q)m z1j%&N9KC)^?Ga;*egYJ8q@q;)MU_^B{`?lu#NyJ?vRFSNW{dfm$CD!$^K-i%pY%& z+a~^1`M+O~UjQwi^;tXVj~?^?&u4ublyew16!1S60&_Vw@ME(c|LE$Ut?}nw1}8TH z8>Uz>W!L|D>#s}pVYL|+fh~by5V$db~STp|h!ik{k>Tog^Jp7kZ0S(vGKOTbr{})hr ze#Zn$Z~c7({}^b%-&k0N$X`YHuNM!odXtGyz9#%zyIq1jBfxg-e;gUNK-Ib9qlbk7 zy!f9V0@+Vmf_s?9JcO0E``-f}1h+H%i^X33OO2`Gv4P6|k%wdg!TwPw3%JgUERDh86bYcDMyTuZ$Li+)-wldG4Aj|8%^WLZR#aSWnI~qk^fLd5 zT4bKbz%I;7K^mny-MF`8MOnRyg9DMeuBxP8RPV4-(jWiF#X`7rK5>sW6@8Utr;+|x zDVcvu&NeT#1i8gqrX0g8cPFsmccWiT@Bg=(&Wam{6@K5jpNs#$T`x@03v`L>_UqdJ zncDulb1Ke*87AzM#uoCAN@M>U%M5ziic`PdzkCLyBrZYV^&!UpeYQVeXJb7zyi)f5 z?bfTNfm`3 Date: Fri, 16 Oct 2026 15:28:36 +0200 Subject: [PATCH 2/3] Docs: redraw the Serve and Funnel diagram with a clearer layout --- images/tailscale-serve-funnel.svg | 147 +++++++++++++++++------------- 1 file changed, 82 insertions(+), 65 deletions(-) diff --git a/images/tailscale-serve-funnel.svg b/images/tailscale-serve-funnel.svg index bce27a89..32fa2d72 100644 --- a/images/tailscale-serve-funnel.svg +++ b/images/tailscale-serve-funnel.svg @@ -1,91 +1,108 @@ - + How Tailscale Serve and Funnel reach a ScaleTail service Serve path: a device in your Tailnet connects over WireGuard to the tailscale container, which proxies to the application container in the same network namespace. Funnel path, off by default: a visitor on the internet connects through a Funnel relay server, which forwards the encrypted traffic to the same tailscale container. - + + + + + + + + + + + + + + + + - + - - - - - How Serve and Funnel reach a ScaleTail service + + + How Serve and Funnel reach a ScaleTail service + + + + + 1 + Serve- always on, Tailnet only - - 1. Serve: always on, Tailnet only - 2. Funnel: off by default, public + + + 2 + Funnel- off by default, public - - Docker host (your machine) + + Docker host (your machine) - - One shared network namespace (network_mode: service:tailscale) + + One shared network namespace - - tailscale container - Serve listens on :443 - and ends the HTTPS - Certificate for - <service>.<tailnet>.ts.net - Funnel: AllowFunnel - is false until you - change it to true + + Tailscale container + + + Serve + Listens on :443 + Ends the HTTPS + + + Funnel + AllowFunnel: false + (true opens it) - - app container - Listens on its - internal port, - for example :80 - - - - proxies to - 127.0.0.1 - :80 + + Application + Internal port, + for example :80 + + + + proxy + 127.0.0.1 - - Device in your Tailnet - Laptop, phone, or server - with Tailscale installed + + Device in your Tailnet + Laptop, phone, or server + with Tailscale installed - - https://<service>.<tailnet>.ts.net - Private and encrypted by WireGuard + + https://<service>.<tailnet>.ts.net + Private, encrypted by WireGuard - - Anyone on the internet - A browser or app, - without Tailscale - - - Funnel relay server - Run by Tailscale. - Cannot read the traffic. - - - HTTPS - - Encrypted - TCP proxy - - - Funnel opens only the ports 443, 8443, and 10000 of this one device. - Your other devices and stacks stay private unless you turn on Funnel for them too. + + Anyone on the internet + A browser or app, + without Tailscale + + + Funnel relay server + Run by Tailscale, + cannot read the traffic + + + HTTPS + + Encrypted TCP proxy + Ports 443, 8443, 10000 - - Always open to your Tailnet - - Open to the internet only after you enable Funnel + + Always open to your Tailnet + + Open to the internet only after you enable Funnel From ba6848661b1a4fa720d73bb427fb6f43979caf10 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Fri, 16 Oct 2026 15:31:49 +0200 Subject: [PATCH 3/3] Docs: simplify the Serve and Funnel diagram --- README.md | 2 +- images/tailscale-serve-funnel.svg | 150 ++++++++++++------------------ 2 files changed, 62 insertions(+), 90 deletions(-) diff --git a/README.md b/README.md index 280034d6..c557e1ae 100644 --- a/README.md +++ b/README.md @@ -290,7 +290,7 @@ From the service directory, run `docker compose down --volumes`. To remove the s Every stack has two containers that share one network: a Tailscale container and the application. [Tailscale Serve](https://tailscale.com/kb/1312/serve) and [Tailscale Funnel](https://tailscale.com/kb/1223/funnel) are two ways to let other people reach the application through the Tailscale container. -![Diagram with two paths into a ScaleTail stack. Path 1, Serve: a device in your Tailnet connects to the tailscale container, which proxies to the application container on the Docker host. Path 2, Funnel, off by default: a visitor on the internet connects through a Funnel relay server to the same tailscale container.](images/tailscale-serve-funnel.svg) +![Diagram with two paths into a ScaleTail stack. Path 1, Serve: a device in your Tailnet opens https://..ts.net, and Serve in the Tailscale container forwards the request to the application at 127.0.0.1:80. Path 2, Funnel: a visitor on the internet reaches the same Serve through a Funnel relay server run by Tailscale, but only when AllowFunnel is true.](images/tailscale-serve-funnel.svg) ### Serve: your Tailnet only diff --git a/images/tailscale-serve-funnel.svg b/images/tailscale-serve-funnel.svg index 32fa2d72..98160f06 100644 --- a/images/tailscale-serve-funnel.svg +++ b/images/tailscale-serve-funnel.svg @@ -1,108 +1,80 @@ - + How Tailscale Serve and Funnel reach a ScaleTail service - Serve path: a device in your Tailnet connects over WireGuard to the tailscale container, which proxies to the application container in the same network namespace. Funnel path, off by default: a visitor on the internet connects through a Funnel relay server, which forwards the encrypted traffic to the same tailscale container. + Path 1, Serve: a device in your Tailnet opens https://service.tailnet.ts.net over WireGuard. Serve in the Tailscale container listens on port 443, terminates TLS, and forwards to the application at 127.0.0.1:80. Path 2, Funnel: a visitor on the internet opens the same address through a Funnel relay server run by Tailscale. The relay forwards encrypted traffic that it cannot read. It is blocked while AllowFunnel is false, which is the default. - + - - - - - - - - - - - - - + - + - - - How Serve and Funnel reach a ScaleTail service + + How Serve and Funnel reach a ScaleTail service - - - - 1 - Serve- always on, Tailnet only + + + + 1 + Servefrom devices in your Tailnet, always on + Your Tailnet policy decides which devices can connect. - - - 2 - Funnel- off by default, public + + + + 2 + Funnelfrom the public internet, off by default + To open it, set AllowFunnel to true and add the funnel attribute in your Tailnet policy. - - Docker host (your machine) - - - - One shared network namespace + + Docker host + - - Tailscale container - - - Serve - Listens on :443 - Ends the HTTPS - - - Funnel - AllowFunnel: false - (true opens it) + + Tailscale container + + Serve + Listens on port 443 + Terminates TLS + Forwards to + 127.0.0.1:80 - - Application - Internal port, - for example :80 - - - - proxy - 127.0.0.1 - - - - Device in your Tailnet - Laptop, phone, or server - with Tailscale installed - - - https://<service>.<tailnet>.ts.net - Private, encrypted by WireGuard - - - - Anyone on the internet - A browser or app, - without Tailscale - - - Funnel relay server - Run by Tailscale, - cannot read the traffic - - - HTTPS - - Encrypted TCP proxy - Ports 443, 8443, 10000 - - - - Always open to your Tailnet - - Open to the internet only after you enable Funnel + + Application + Listens on port 80 + + Both containers share + one network namespace + + + + Device in your Tailnet + Runs Tailscale + + https://<service>.<tailnet>.ts.net + Encrypted by WireGuard + + + + Anyone on the internet + No Tailscale needed + + HTTPS + + + Funnel relay server + Run by Tailscale. Passes + on traffic it cannot read + + + + Blocked while + AllowFunnel: false