From dcdcaff3b0927f51f16f76c9d1af776f307d9d2b Mon Sep 17 00:00:00 2001
From: Janis Eccarius <eccariusjanis@gmail.com>
Date: Sat, 30 May 2026 13:23:19 +0200
Subject: [PATCH] feat(secrets): add initial configuration for FluxCD,
 including sealed secrets and Helm releases

---
 .gitignore                                    |   1 +
 Passwords.kdbx                                | Bin 15925 -> 21061 bytes
 cert-manager/htwg-1/cert-issuer.yaml          |   6 +
 cert-manager/htwg-1/kustomization.yaml        |   4 +
 htwg-1/flux-apps/argo-rollouts.yaml           |  22 +++
 htwg-1/flux-apps/cert-manager.yaml            |  35 ++++
 htwg-1/flux-apps/gitrepository.yaml           |  12 ++
 htwg-1/flux-apps/ingress-nginx.yaml           |  20 +++
 htwg-1/flux-apps/kustomization.yaml           |  15 ++
 htwg-1/flux-apps/metrics-server.yaml          |  27 +++
 htwg-1/flux-apps/namespaces.yaml              |  24 +++
 htwg-1/flux-apps/nowchess.yaml                |  16 ++
 htwg-1/flux-apps/postgres-tunnel.yaml         |  15 ++
 htwg-1/flux-apps/redis.yaml                   |  33 ++++
 htwg-1/flux-apps/sealed-secrets.yaml          |  17 ++
 htwg-1/flux-apps/secrets.yaml                 |  15 ++
 htwg-1/flux-apps/sources.yaml                 |  53 ++++++
 htwg-1/flux-system/kustomization.yaml         |   5 +
 htwg-1/root-ks.yaml                           |  15 ++
 nowchess/htwg-1-prod/ingress.yaml             |  62 +++++++
 nowchess/htwg-1-prod/kustomization.yaml       |  53 ++++++
 postgres-tunnel/htwg-1/kustomization.yaml     |  17 ++
 scripts/deploy-to-cluster-htwg-1.sh           | 164 ++++++++++++++++++
 scripts/deploy-to-cluster.sh                  |   0
 secrets/flux/gitops-ssh-htwg-1.yaml           |  14 ++
 secrets/htwg-1/kustomization.yaml             |  12 ++
 .../htwg-1-prod/ghcr-pull-secret.yaml         |  17 ++
 .../nowchess/htwg-1-prod/ncs-db-secrets.yaml  |  17 ++
 .../htwg-1-prod/ncs-internal-secret.yaml      |  13 ++
 .../nowchess/htwg-1-prod/ncs-jwt-keys.yaml    |  13 ++
 .../nowchess/htwg-1-prod/remotek6-certs.yaml  |  13 ++
 31 files changed, 730 insertions(+)
 mode change 100755 => 100644 Passwords.kdbx
 create mode 100644 cert-manager/htwg-1/cert-issuer.yaml
 create mode 100644 cert-manager/htwg-1/kustomization.yaml
 create mode 100644 htwg-1/flux-apps/argo-rollouts.yaml
 create mode 100644 htwg-1/flux-apps/cert-manager.yaml
 create mode 100644 htwg-1/flux-apps/gitrepository.yaml
 create mode 100644 htwg-1/flux-apps/ingress-nginx.yaml
 create mode 100644 htwg-1/flux-apps/kustomization.yaml
 create mode 100644 htwg-1/flux-apps/metrics-server.yaml
 create mode 100644 htwg-1/flux-apps/namespaces.yaml
 create mode 100644 htwg-1/flux-apps/nowchess.yaml
 create mode 100644 htwg-1/flux-apps/postgres-tunnel.yaml
 create mode 100644 htwg-1/flux-apps/redis.yaml
 create mode 100644 htwg-1/flux-apps/sealed-secrets.yaml
 create mode 100644 htwg-1/flux-apps/secrets.yaml
 create mode 100644 htwg-1/flux-apps/sources.yaml
 create mode 100644 htwg-1/flux-system/kustomization.yaml
 create mode 100644 htwg-1/root-ks.yaml
 create mode 100644 nowchess/htwg-1-prod/ingress.yaml
 create mode 100644 nowchess/htwg-1-prod/kustomization.yaml
 create mode 100644 postgres-tunnel/htwg-1/kustomization.yaml
 create mode 100755 scripts/deploy-to-cluster-htwg-1.sh
 mode change 100644 => 100755 scripts/deploy-to-cluster.sh
 create mode 100644 secrets/flux/gitops-ssh-htwg-1.yaml
 create mode 100644 secrets/htwg-1/kustomization.yaml
 create mode 100644 secrets/nowchess/htwg-1-prod/ghcr-pull-secret.yaml
 create mode 100644 secrets/nowchess/htwg-1-prod/ncs-db-secrets.yaml
 create mode 100644 secrets/nowchess/htwg-1-prod/ncs-internal-secret.yaml
 create mode 100644 secrets/nowchess/htwg-1-prod/ncs-jwt-keys.yaml
 create mode 100644 secrets/nowchess/htwg-1-prod/remotek6-certs.yaml

diff --git a/.gitignore b/.gitignore
index 9f9e64f..a594a2c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -108,3 +108,4 @@ fabric.properties
 # All secrets are SealedSecrets — safe to commit
 # kustomization.yaml and *.yaml are tracked; raw *.yml files are not
 secrets/**/*.yml
+/scripts/sealed-secrets-key-backup.yaml
diff --git a/Passwords.kdbx b/Passwords.kdbx
old mode 100755
new mode 100644
index 6723c5bdd070746a8301b64f52f1b1e3644b46a5..2841000139e7af5cc21ffa8866e926da7892b26b
GIT binary patch
delta 21041
zcmV(rK<>Y_e8r>zkS`$TQIJpY9k;HfP$c2OHE#7`D$tC>L76VH*bbP=m0U-WPnCZJ
zm^6SO@Fz8Qe;@M?1v*s#1ONa44GIkk0u=!)rlBc|xJG#Q$A?o9K}3NB1+M=rV18zb
zp8vele~2>Bd87o{Mlx4%cFGlgVegT5-6cKl-6T)rQ?`FUmz$Cdh6ix|!T}P^n*Ojt
zR7qza8!ZVhmapb+vwsTIz)%1HBj0~Qyu{5J3X07CwyUweD$gk<IDx-qrKrga>Q1$9
zwjHg3(|8}wL{o+D2aZyhYcL?~%K~nyLAVk?s+4S$CY5x~<<&GLO{pgcT%-c~@tnL!
zeq?0vT8KanS~-NCR&+APjl@B|rWyB*N)3mDc<uNhka3Glgf-rx=I)QHPZNLAKZ3HA
z670}ynW`^SbaNIK=J61bV8}w<gwPXtw8`$&z#pQy$+$|&x#+`=8~H(+IFFBA2*U@|
zx51Q0=|CP+o?T|KZLXTbPr}|PbFQ&AeAPFY0EK1^Wyh_Fqo(1}nHMT1Hjh<2*SQzY
zH90`|M83Q)`5Q$X@-A4j9Ib!fwR)SAJpo8VNXte*zo;DTCjP)XwH~Hme+ba_W9LvA
zHYDnzMx56WP8;L!6PQMSfcQkCt>{sS{$T$-ssyUR<}9H-FiyD-p#E#aBAr2(NI0mj
z@kvO}-4-~L6Lu1fGRe|=N9zq8;-EfSR#bLqtyx~yYs^sHxEh6kTfcwG0ehKZi3%#^
z^kfWmKhz4C(3?zr$iP}L*Z`V#5I@qUthTJ00^OSrR(yd-e?oy}^Z>^d$V2OoEb%HL
zp$39b_fx~6<`qO@e+av&>2gynT&?L`eqZ7Jy!AV#ea_zV+V$)TW(xx^l5pG4{uWbb
zTX@Ea{!UX}crdRaF@AqI?2DZYvRl`emA~%E{sJY+<nC9_pTB%f_y77oy?YAsC5bJ2
ztvMN$RaijJ&Y1^|x+f9JspEKis*P2x<&Ox?MPlojl*b(8zZ!oDBR29p>q%cX;Bxn!
z*E(lu3_|w1bwvb<4EmLPJQPbQwKh{ca8?S(SG@i#H<k+afN6i85lT?H{1=0Og5QP_
z;}#WC^oTwp*6i+(kd44O8F?+5J6TJbl`^|SA5@tP{i1}&pkuY9t*9-jeEzFJk=5uU
z-#58)BFd3n9RSE{$rAc461hJ1D2FWp;LRZchA%gEbcHUc<@or5a(Y<p_=Z0ei%W+i
zc7s*?i+U(t|3ZI)<b7L6$s-3f_Z7++Cz?zVdO)k_DuFI*C%*oqeUTyz-eW+}ZUrgt
zsTQWzqC+bies};N77~viN13jC+qIU9mbY3;Q{?T1vtPH$wnWXbzwbDhN9Gy1U*^^p
zRC}=6?qRliC(0H}iQB*I-uWl)*FF>~_PPFtF;JAE(NKS1Po_sCb%#=hBT4oBr==#(
zM00&wIegkvyHhg*WQ#a?xkV80k4Sn<&Dt%<4)s8@-Z>_!hKK*v=n2-AbN_^)U9Ep1
zHtk{szhWGtct&m=Vp^3l8puCa#Ze{7=0A~xkbVVT={tQt<~M|~`)7|6$;?0o1X{;}
z;q^a2{<41$gPc@0NTbv-nT8w%7|Tf5jMkqHwvzY*F$WBN1-7Qk4$CSbgnF62)q`@#
z8%a*Jf?lgx2cP=Slx8tlEx{0$8q<l>XW+T?j}?}rnKXdDydXjPrEpZOyCeeQH^zwA
zuGDA{_IH%I>NDH`yU5F3hvt4Z6`<lvjtmVU40V4<r~v%Jut_GY<jSmvt_1svBQiAg
zMhI1vxr}+d1Qx8ll8{xMb81e&Q^Cbaq=wg-_%PVU#6g{8DGdN|1zFy~Kyy%!RyZb-
z&}EJID3`W6YV~dt25W?$BD3*K8w<O6$LTkFBGspY`^Q}iCvlm-weTJvu1WTf1&ooV
zL)w2zZ={%(Ba?JJ<B63e%P=zTwPL{$?<wKuZ)w6GN1+#N=V`-$aUg?o5>bN?a!xPV
zk)eBgR5f(7%o>c~G3!|Y=sBU0|C@Lnxo6*B3H3z){GkCFoUcjquKfl5cEo}6{wJ_z
zNw#w$<4rDFk#q<#tj?eCj;uB;4Lb(`y<LA@p=h_$4^C4uC|5>)0!uR_K1*6pNG`fN
znj|Dc8&>9PN}a1c!lbBhL?b6z<skL(IHs<bG~H|3chG_mkKl#*WSUgqjbU@a0O}IP
z9aUI=aQJ%-_rR@y(1fx!=a11+{MK=F{T>V{B4utKZ+QdG#XseNs%8L8O^l%K(L;al
zs&#95*?8w-6p_(?S{8oiSw61Bgbcfc1=5{np0uf})wP`cH9<)f(S*E|Y7ISZ>L>h`
z^KnEOVD>(Tp@=-`Z08MxfbcB6^xhaxJk%@>^NpOiG}D`$PPhV310VB^7V|QJ^TF@C
zt;V5%-LPOaZUx1>wRSgcMaEbLbFP0B%UGHcf-wp1p7?|lZ!OrSC5bSgf3HPUf=SCt
znKrOSrPRJqd4HVjwZc>o*1l{v(*4?!&%k)~`CoWfM|Q#x%~TR!U-fbYe~MV4uVZ0_
zCJ3wq08SD*+(<bC=dO+hE+b*1SGQ$170l%fyCsM-_!c#Z|IVD}sF1E1_2z%C9jV1!
ziAR}Ngc~5;S*KicWHwsn-mg2&q(iYNGKw`!ITfIjW~-=@Qc)AJ&8@lL*^h>QjWJ_r
z71kWqh8)kJVsw<*&G(rdmOcer>iW2Dqj!}1%5!Sf)9>qA8-j4>rGWV+v&P*^#X$v=
zQ0w&mGPZX!PzsM=#B7Gk-aUUy3u#UZD?e(4dDgd`3KuTn+fleO9|7Xwkz{I&fTktw
zYyI0uJh{_c*m=3b4|D{KJcGBBOPMhC&rV<_jB}KB%YbX=EZv{@;-oX9v#M4%j534E
z>vN%IA*HHB-w-Mrnj$Y>+o3-OuN?mfQ*kd&T?2Y;WH8N!vR#fkd~$yRysy)=YIa$w
ze;|%QqzbDXuK+KHCA<gr1U2mTMA3yMP}vk{&_4UX6dc9PI+3+ZP3$XDygrEDsux96
z86V`(!rNA?R;ptAc7*~zb+=e8PpPBMXjy^uH}N2UYU-==v8nSxCvKN~gzH&JLO^D%
z7yB{N0Ka^dK+T(O@$Y|0n!>mduL1_j(UwByu5y(_N%mjQVYrOtw0b*w*%1BDj3a4e
z<;@7tZ1<4C6B5?PThqeb`9?LK)2SDeraHhZVX5cEc)j<J%aUg09mAgqcBUQ9hk67l
z11}svn`=V7_6l{ca?Xc|NsI;<%Rp-q6c(fRAy2bN11m>pn6`g8*q=XRY2Ug0waPR&
zu>R`7VOM;><8@pUlpR|k5<+UzYFfF`QlRW4g~|6LQE-Z07gO{Z`K`CaOpDApV^0`3
z2akfHIM<2M?oYmJwF7G`-1L)9Me9g*=P>S8;r)?BRo{`Hy|<49V`H%=O68_K-{%gp
z=<%yCU*Pr4Gu3|yROt~BiyS92w_i*QM0_^pa%r&>hcB;3M85`L#dJCozBO+UGLBo)
zUV$1*|A_kel@!*G3eM<+_XcUCaNV9!YG(kP4YW1{XpW=lc>u&%NCer)VH5-CC08@a
z)hE4pDj_xGIfLm1oXtJ>Z}r0ThV)%$P(B*xfZsuSPJ4fWJj2n7@*SZbg~VP6w@dF^
z`S>jXQB0YpgN1Kk6+W|zULs-$-cJrdZXWNi@S8P9_-BOo(Ze!&lZ#f!3JDnx91c(-
z@U_QPomKr$+G*0_SDSk+QK8RSu>-nGhY}aCa^+Ucr#=LqMSnY42?ersC!$Vw8!0zl
ziCl500-S#kber0iBuGk4Q8Hfk%MK=U!lR%jY{GP!5M7AN%&j@HDdJkFJKtKJ>{j2f
zLHBJ~oRK&iiA)o$xElv}=t#XU=)7;VhX*pDBt7*ZnC7<I0HOFN^LMM4*|b801IB!7
zGT(dSs9T{t`8+3#LC?>k^l_XvbkvTFI<9VIi>ZHa%0};%?JGxbt7&_jv9ZGJ3a#6%
zic*p%tW~WhETPxcx2Z)A@J93XNtOW~Uodx&+J<heyZ*QPT+}cU8PXbl*AfGo1Jvc%
z7UR(%K^rzKr3@}Kl&Le)w=iY}NjNnEHKhO@nR3ojgTL^KW4*dJ#_x&|Gg{oJ0<JMz
zt_gplGXN+c$nXm`NH(>U24rlOH9ohJJJN{*_Cr*688<P*l&(0O_9c1*;D18u2lJhZ
zC>e<A%#!(0#K4wnce4}$V4=gNHXwCAIzffgQzjeY*<NgdBmdUVMxYPV{i46ll4!?R
z11Z0oW*%f>)3tlII>PFsO6=0-YY#b~ToHe($<Yz-@;M5^<wi1T&!37$KOQW8ME&|P
zIC`Z;K%H-WW7|fb;jm#!FrG-ax*c=GX_hnu!j&Z|Wz1w^W425G4=Eg&&7bc5-Hn<Z
zsR&gdIq3G?IJZI=QCUvnT4rNI4)GvA=mUWyl$;II$t7!(ZShfCVt)jW{SH-al@@<Q
zfZP4TSWM@W^v;7M!N?)@H&W!LNq@->XuL%l?hX|IL5AGXHkK}D;jNq_M1F2Cazinh
zZNTUyjDi~Ga{=z6u(kC)1VMtX>Q`jUq$Kp)-huBCSAp%<>v;-UskDSErnBuC@3}*D
z_3poEr1ykduv7F@1HfCHYF3~*60Cn{e6!-%f!TP6RJ-5$<TU55{sxdW5)WSZtxL46
z)RL~0g|9Ap(j(`dUi!IPk}%}V3#$)-Q>?yP%(WA+?52I|#N{B*t0IyT;DzO04P<yt
zMlVY(8ke!+y+Paf_k8n}ui7rVH0n;Y`AfXSuD||9O_?AR@Rmxvvh{-`Ul)IXs?L7I
z$!ddI_x%J}{*5Ul*Ugd2%y$a1xzh58?YkjkCJQTKNw_Sv>~jLJI^)EfB*W$U8U~eX
z=O+`HD~T;uHd%_4%7c4%ICV}d8vER|v0OKM6n_pZ<d<S8?Oz3^d^_Z>;lFo~j&>)}
zj``0-qyn0GNN$y~My}Mbx^#d1yM5~F8~Hcm5nrxQD`cP#&<W;VAW69QlQrJFtB4pU
zxas-4D{^$jcq|eCl}Xl;l1IjySXX5^Zu5jyFE89GLr{~E!dr~fclpzG1=|lXIj+K)
zi|;oY?jwPmT>32R&>#@1ex$p(T3fS{(NV$<mZ$TibNqf{kap(8mnVO^c_)1^MdA8}
zeaCMVg2ABCdw&@pH<MYE6g_w3H6jp!&2zDk2An06$L(|e@5=>g{m79{E-%cmP)}`W
z#GC-yYHt%P)5bqo>gil)GPlfroZ57}vKub20Z7u&Ia&DvxGP<c0Bb!Ya5OW7uyPjg
zFNwiK1^++?%+L!iQ9ysZjUlgnLxO@T$aT!dNy*|y#Eyf)OY`oC^pSAz!ZA5Xlz_@9
zvh1WHg08}N0$7fq9JOS6*`2&<^wV96(8q7L+P2C~saq6Tp(h~MVi=KGchNv|)dGb6
zt6afpoJpHn^%L9-t)+d6-J`avmCOD;);!pTo1~i$Nyv4KjnIEpnq6!)k$FGs`LpjI
zQlGAoTwUgCs|<E8qZ)5Ku(u8u9};}-LZ}<#?zki9OTj!>MojI?zBp#31C<eCJK=t;
zYTdHjlB3glZT8Srs<P1dg8lt4Q{Y)M_;p<9sz28Wc;iyW48i08rg92SFHz?UaMfMr
z{yxL;RaE#tS|fh|vi3$}>k>OKE#_!eC^HU^%sLKG^K4S)`>;c&$m$!~QXDg{fMMX2
z)+1|I(JsZ5uV<OIZ2{AbKOG-4aZ7^?ug=F@bLTdSH?yi2X`#S$!qiThTx67wx&T@)
zf>1@L)Z;ILa!V4tjt}So=-r<!xZ<G~j^qrNy4E+r!?=GyrD~qODh<<Dxr10gry6DK
zTPwc2--Q$33K8veSJx<y0(v8ZfUXzE;aQt5hG?`v<`!SGWyY89rx9h(D01l*ID|}~
zmABNRB|?P=$6K)wnq|9qLO>m1lKhsAR=Wr(a#CmAu{i#El`qCW$^IeFX>lkpsR?XM
zonNa+beDg9SU%Yqo08cLy6D}(yoYUxsZ$x~RPv}RdL!Onwv53wAyC<?S}+Y?asG~T
zc18f38f=cs`S=X8G_pu5k20gt4Q=z<K`4^_u~g^l)0qxp&l(Eb8e*;NDWZWdiAEvy
zXVLCdGH9Y<%siCGn&X)luRHbp5p7~m@`q$C_vC-u8&5K^;?C<}MYduaaw}92bX;&9
zOwXgj^UG3U>;~?_+oKBzGE`DgolY`4?Dx7`UwN<Xs!jlZl6z#<_1b7gte|3=5A4%}
znP&2g51W`{SX%fE2TkXZ1Z{<oBHao;1OzWDGooPkNJ>Yu(fM!d9`4lPKHCJot)Ref
zV!D6J;FTPtTf8;F>o0zA3EFfj?3W9ACH@lTShQGYTV=o@qlMFFiKmON_*jmfcyNK-
z(KajXDTMvxo6c2iAve>Gn-r#LYBwlANWuub+-Dgs_**!Jx|a|&Q@_3BN~AA_HOhPf
z)HYtg2^w~FwOE%kHv69VjC+6KF75!#u2FxS&Q@}wQ{!=64;4&;J!Sp*hR;RhB`&^u
z-#=F-A}d^c4<`#SB_`zRS_LnO@~cQ#2CIEDmW^dpdM167pS(;TJNAUk3C0d6EnI&b
z6Ymh<+Tx^hOx-Wzgzm<A)}~c-3N=OsazOYpATx5;ik}kI2)&V3pYc?4$#+uju1<fC
z5oOv|y!n6Is|aJ>R8%GOc5fpqW0$yglw@OL5|sS2tf$DD(y`(5UU+W$K?Q0`ms6?r
zsOlYz{z+DKMBb&b<jsjk<y$MB@oXwgiT`;505>MO%cQU)1)EdO2>%UiViE$Y!5YLp
zvZm*7SW#+H)9YD=Yq?kfyrWNE`@4S$oy`4^{ARI7B^=;p^Plo$;)~cgJDAqS$_uob
zzwP3o#peMmy@O2p4R$6KPlR-;*eZ?;6XM22v+!C}nakj|wayu|eFAntGMzwjcjrCc
zrw0tPT~nNRQ&2EOY!4kORe#^H5~i*@`32EaQJ+VnABM;X|2yuFx!Upt_<n!#)X=JE
zXpSTDqSyO@AfsJ=J(qw?9y61%z7K~9t@p?9wyovBLyh{QQuBM7e^d<Td3byxIWK8p
zdoSe|ZAJh<Rl%3=DPl}3H2kD;@CgOjqX+ooCf&T>-@7V7*VE*SaRFc)lPFx!%2|*e
zm5*mE6q$=H+aMzNFz0&J-06P~r)~#VNEWe?7eZ6^i6rx)IaCntzQ{+}4}$tF>G-FV
z8cTkR*SJkyxpz&bCtUkI>4m|=dPME#yHVzS%`^LYY}w&Xi7bzQ@_vk2GER_B>YIl&
z<pLF)?bf8|B(|<=y(QfKtLH<9C1xxfgaFkmdylXxaLz~)sb|_2g4=)4Jz)e9M?gTM
zJ}`4WMF*^HxV4?s8nj<d+z(I;yg?3VPL%Lfh6W_m@zC}y`Sz&!9jO&;zztaf8Dw1F
z%8mZ_ajNNlQ#0=Wo$%AaB`pS&Ngj20yJ^a2l5Wb>8UbUbxser<LVE#$F>)&<8eaix
zLUSd{Lk)oDlrbn9s_K7tFqtavY`JD;&@nM_^%q-)kni_OQKAJHo6zHSURki;BP?%!
z0KVxUW*`v}^kJ2aAwMpGgWl|)Cp_DC5K<ZFUS*GfI81)-j`(<jfa%^YNJaLdEeQu#
z1k4afA~ruL1BOh}VCGUrW?tccr5k;RrUne?`gq}DOjT`Fp;CX%S=^$lf8$u-dAHvq
zSHv#*<9t-G=$e3$K)fU9)IkVIt^HCLmvooO4g;I7Spjn~SA_;3DqQX<@j3$MpG=ky
z&+KpOAxe@CTs%YCrY=*jdG1(c^o^Bgv`m<ucpj(|#OaIvcj2VH^Y&}4qRDqQ_5*K{
z2j-=2=y-VTCvAT{pVs64`AN8T*U>tJVxd&R`K9FE3D3Na$VADpFrOpYMUM(+ZDVv;
zLq&2Y+u3Bx&4kJN3zH<Cl;F0WK2^#{B!zvn0kR2C$c60Wqe)IQhq_Pn|MOlr7cI*k
z$OZ6nK^ejUrPur`8(S<~&Z)!w3}V!wCb0^Leyg^u)?$D9J}MA1mmnaQ0AHiz{*JNf
z>DI=F<cIMxjJ<y9D>;lZ-?G<};5>kCHVoeiN5x||o9sWap<v@+o7Vpl_*JAmOj*1h
zw7BFW%=Kg$@1aJke<pq@(Vw8%nAYg<Y}9tu<geI>zdjoSj)=0E3h=s@Ku$&GTl&aX
z)-VACHc)@52q-AQ?{aG&zD2G@KT$W5=4(6r9@Y*Y$OFHE1mgr$$u<ZlJRm>bbcgQ0
z&-G}(N-T@a;dPWmf_UOx`-T1#r?pw@24To-d@NAKz0C!z-$+{OXmq+v&)nA31Pa|I
zX3R@Fz=*hse9-<#3Zs0{=Vc|;3-#rs6DS%wKW%>vg2i8%M{i!|NucubPD&mR5EtB5
zLS_%62vnT*S_VAx(fcZa;Zt~7Blvh&0jkpF%oi0l4F^$zzTToW4}H*^3!&iJh{N~y
z5vHTFry(5D!+1p}h5Nq<FJ{D1TqyH_^`7QMla?JV;gH!-b`J*H=~~*@Ih^rrHmrJ{
z9&vy1wP-*B3hc~^^YI^W8emZYC@fHm`w>=CCxV#4>NxaiK$naujm%Q{3venCX^%aZ
z()U0Lzul1rkii@ni#_ugs)E$pUu3=tDs`j{*+?n>k+3yP=?!s-^4ZiNqg>5VFi^`E
z^qk!=Mu3p)U}pt~;FVDw9-~V(=u=Y8a0Y+#G$1Bk6cg5Zb~5MC{dWT|=3JOKmPd3F
zuFO}?i<<9F$9)wSpqa%K=PslW*M9G2hv2sF`RSk;e}OA|{x@saW#kBOjk@e@nLgLO
zn9tW)a<#^`W`l|zz@>}|r6S%0yFca+++`-f-1-3qGi6i`l5%zEwA)9)!t#lSCOdyl
z#NuyO4V3tJSgfqWBK6Q5rXevAdaGqWwdTBEH~7Ki3D6d}G(a*f=9h4b&zgVEw$d~&
zpXYt0+HqqFB9*UTm0*jY9U~JMzy*A--lW_up&OR~1z)O}&jlLSPUGN&Q;}lT7yH{V
z6{XL(#@L*zaVp4?vTC*daH9_9=&FAev++<Tw6`Z8B-U+21D5%6o=zqVDfI3q%E3wq
z_i3y&4fsmW3e4+Yh>}+suX47USx#<6TWJaqdOMSdFQXo7!Jb`l4vSjYLYX@LViC{t
znMQDXdPE~|nc5!~5NxRXzKdY+=RipmC6;@ShE!C?b2XEL&Jl-L<E_*_AQ^uTWVd_o
zVfe^CAFq$_oJ?gRv3pr8P=lQ0SF;rqb>bCjtUq|xLNf9(<h77ZL9|~qGT0*%uEnjB
zofzSk@()aWa2%%^=s4Yy$18Ru`QB)6PinrpO-(Sj*W|yB@cwCB+ay<G!QY2UrMFt}
zIISnA^qs|Pl$m0T2P#bSXfS_>rWRG~H_p1sLvRd8A3MX9FoyzoNO9sv6>&YB1>oM#
za}IKKh|DdCt}Z0Lo%Mr?y2mg0^7i%z^Z#DO=cTvp5G)K>KUXu$s=rzYIwHHI%D2`W
zBtxz(5@0-tcN&{*w@$u%IT9v}1JNLHJTegOd9erSOk0WFfY(ymf7gHEAU%b!uRR;2
z?CTvmP9|O6Oe=JT7~w;qo?D8!9G2Jp4$KLD!$(%0i^i60tyYjlfz7(nOQdzG0cqkG
zSQ&<rD;P_1-9&j+53j20HC>DExkgF+h>E6wg>0N*0DW6W*PcehFKVHF;@R`RC!#Q&
z`EB#&)zpjehBRo|dHH`wOfDe2(Oq)XHqz>Fo(om}56(?PzXq1|$ToOrnXdF80MCkw
z(h&sxEYYD2xu&_hv2u#nPL?`KZN1SJX2~-<jk@L-vDM|eP>YC2_ur?foFp0R>sfu0
zaBvwlZxy8o3&iQHQEUI#A9geV)krlAX3C|qpU}7UJk$C60ttV5bc?J>kNPodT#7}=
zI}A7*|9V>CsUXRnh}%!o{RDvI=w6VoIl)C;N2hG(|1CXU!W*rf=V?l+aD<vm5bAXB
ztZ=^yn9G&0cZrGBwXa~8RKMw}49{~M6%$QGZ(iA2&(Nc;Yd1pIk79!@TG)`w6ZEGt
zS=7#trkhFCv3`FJ3RWw1IhqH`lnsDd<k5x^`viSLXY2LrItZydi#V`|750sK;3%r8
z9aC2pdhT<y$ub9rf}cIhx`#PAD4>c5<LggS86_=wADn*3PMI>WZJXt>{r=Dg42WNB
zvtg6zQKS|3S_SQ3d2<ow{Nw~Vu_(NVsBEGSOac3JiLZaE_rmbY-=yU9ha=y{T;xh$
z`*WaK6kR8?%x*P_n}+lDK}DCD#Kx9#Tww9s8a~rQj{>>2x}Ta_Va0JW@B<;wABCcF
z`EtI{m5ne^H^55I1R+e|fqHFXeXmwd@{yy1H8>$^_hoCmNx%+x&Ule}M|zaoVk1>e
zMz8~1E^>dkND|-hp+nq`SCYYH(xwWp`p0fqREn=O*8y|&g%63A4z7IE{i^wsK`@%|
z@eX{p3eA7SRCm|Ml<kuD=kYmIbX}QA*P-E=?5zY#Z74+O51+JM&)KD(76)fWj~}B~
znNp+jA23FJAl8oy=rPwWL`-eiqfUuq$=zt8?y-L;_*!Aa-WYNOB$F}h3MY7}B6)*5
zO^<9#4@$oh+R8LN>W^iQq}4U&4S@KD^tcY(G5gRjVjf(rODz?$BFAP2f43A(Kokv|
zBPylXjGjcTVHna_AY&XKzNq6*rUxvvfxGq#=Q5Zp(`du{=0?Cwl7n%>tmQX*BDU77
z0r!9Dj3~J#U5j{C6KvJrN|fT-v0dVSfXY-K37l*p$#15g*Js8%@=Nz#hNem~$F-IN
zQzK5Q=DAz(B|%snTBigNK1F1iOUEG>7xO6s1nq8e1=5ug7S$;vse_F6!vD%_(Gnsp
zD&hGWMUU!h8$1DUaxY~(v+AEQZo;vD(HnnOgwo^4gdpXbtOU4-Y)m5<7*n;c*~4M1
zxc{I#jhE9T)Bfn(d|bCTpl9SfBorbIoxo@rEt3A)N}9;l8YsF}=wlw}t7QN<s%?I*
zT^>W7u+`Fc%GYqC$Oeox6xn*kfe4rFs18a|qHC%kchJ^*13rQcjtaT<1gJE>(_w#f
zImXuBw#a-UXYI!R-O%XKBVh>Xlkl*IXTy5)kgA+nf}lvE&+s_ckJmL)amD>HfR~J8
zKAwDd<{b&gDL2v<BaP*OLe?53AeLdmgfo4@IsWSR-Ni&%NQ5vWJv?>sz1kAf-bjMj
zo1vFPIzxx$Y7JhEk;-67JkQ@ngF1g}(lJ;KjGa!O91RpbB?eWx>u#z>@4yS+0L9{r
z^4Ty()z3}I3cNBLc44<a!yf7Hg%V)82RdJ<vR>y`F;1Z_yAXyTko-@_T3~|pr0i9M
zmMJ4l14Tm$#W=k)IyZXF@-y2m=1-S#!%V?ZhtN$i4b<wm?M9YXs!I<g-Qa&Lfr?c)
z4s3{UQXd??Wo<RU3UZaRqCYx7Zo7y_Z>Jh7A(3nBFCI4?CjbV>RamS#Yq!0fLFtNI
zJ@+o0K$bmsFmJTQ+fSSFQ#yO7*v<gPLl1a_zqs+#33c5ZIkfYb3viIjnsZxtz>akH
zsOPr{xL{v?RSu(<?w?BBZ_|H&clHPJas8Q}>zNqAr!s+AV|-@w*O+cucc7RG_b;%k
zD#4j6qnTaa*wyRG9?XR32&ky%*DlU_dZS}@Ndp?UxPe2V>E)t%_@Te<XhmNE6q4e?
zVxoyOj`8u_I^%Xr?S^TB)?9s7tQc-0qy6c6R8$Flr=p70mu;&uaYcVpRog8->4vme
zishu-@R47OKHgA~4K*1P1WZPphycjt6fXV#NG_p{M0IId;YP}H4@nm)mGW5B3j3y*
z03|aMKq?o1C6f2PJRso^y4$Q`nV)s_&>^=*+Y>*qZ1}^pr#W8WTYPQYzTw?#SMAR8
z;E;ODdnLrY?c~_*y#Id%_JU2Y|BMxw)~l9G#6C)D?yv0x<PGGB9@cjpLsI<RjGztP
z3>R3_z^F(OTZB(WhbHVzp3FES$3&zg67Kz6Mu*&eUN!Mo7@|bE^WmDt<8R>4{EJ*(
zrL?-+Ty!@Uk3N-29z@rR;eZ@WxE{|HsH9$*y56V>cpAI#zpZ~L3|EaRy{|qr`+L9#
z)?n2N$DyN+(TXu4TW}-jWNY<o7anxt$zAi=C(+b-jjd<<2Hr0D&H2n1mRdsYt?fF{
z40XVRZXs008!Gq7LxRd|0?JX7*fSaW;66b<r*Nc{w0#L=sT<{#B8^c`k*&xgm!98b
z?q7e}@Zgxx@f3e`P5j#Ht$&q4)WFmNtfnqKzj(Yo=k8V~HdcFI`K9SnK9E!80rU-H
zATe`2m56d=_K?*Z4m*FiQ;8+XADY9vg_?<Si5U-Z(?#C!*?t?h+#dpR$kje<dV(y6
zJqxk;l(|h?yW^Z}ONnuBKT@F^LWs<IBewhY2=0em!&HA9r`g0zv6xUMG3p+c(!cdS
z(5%^Mdfi+PC2w!Ot%fxeLu@7zBMv%<Ot0|4URlgmE#=j*K6B;%W|a4#4r%?9f*6?M
zvlhXY@au!gOK{gS%gp5AU?`z9q9D&&VUEJjB9BSt;9pc{4EU!P%!oxSTID71AsK*!
z<w{w9&ZB>zgZQLSu)NdlGOB{8ly87aQM!ur|08v6ZTWbQQ_+$6HbYSLORi2qN!c;K
zYHP{HH#0s$iXbzpV!jl8gjH;j=j=tODu+sD?S1;GoWkMk$ngk{HR!wrWa)IlI)ARH
zSKj$A<4QYW>3jdiG=W;mV|e!M&CG=)8z1d(XeWPz#V?p^eK$O|K_`6JI=4}&v(zY)
zKLXhoJ=rIk89Jc+UJ8A43L(NT2o^8zvkI9;h!YFsK*i8ktt=70+zSDa^c5gNs`Ont
z@ah_vhH(FsJrci)FPqG6>pC*faCi}_(rmV94cLgRI9=74#yP>f8JEy0(E=at^H2&I
zVxE5&#9qKWl<L1=;Gcgb4(LMRp@$__XpMEGi<Bju)+bXWf&mM@L!)H1)!k&29Z@ld
zp|Aj7^%C^QWI$4^X#9b~*KP+5z>z87hk{*3AK)>Ywq?XIe^}`$zaKLkq(%NlnR*xR
z+AY|@Y!4$ruEHU9_mfLk%pjd``-MT}7d?LwdAXB|m*)7uF5r>#&p2sBjpgdN1E9^x
z+(1lta$6~#6Zt6w=!_EN>xkRHeEcGab27LZNAPJs!|Sk~%_DD3@Ad_SzK%6jB(raD
zzXV(a`u7=>n|_PnCW3FP!i!`%XYYci^$r-+HEvffm|YicPj<h1WLQw*<I_ndvP6H}
z3~=&LKf{a`jZ*}0Vv-CpRP6p#XX3BuLev3|7s0XW`1@nKDE1pt%7qf6{~>Ndrk+sc
zIBF)a<pFALt@<g}-r_N86&^WsaTc8bx`yP)9=Px?*O`_$@k{#~)5EMOM?Q58AA3^)
zp`4^Qqw$aj4{5p^j3gQDU}1a<owR?wP?1pHu~B5wU1ENwSMY?%nrD<T4N1J*4SZFG
z#?ep#MwCM=)}V^9{V-k2fW{%z4$ZJTx6p4%P+2C@Fz=<dahho4T9Tvg>U`<2r7AOj
zh^MLradmlCB`)JrK}7^Qv?-Th9q=;J`C9S-l<%d3=_FvTOE8JTFLncWGB<w+&PxIo
zJ#|}zHPX&-W6V5PNyv=<YNdIcXAl!Q3+H2*;;|njrTJg2#KSCgs;8b9tLLvh12t?U
z`aoL=e-C+vN0EBW=%ZC{NL1pO-n@w!vKqC53~s)BDu@D!iJkXbS@FdI(^gQ`W|RE)
zEx3;%3p2wjV&b^$ZA6)8BshP02z(M5JPCf@R+B;(EB15!!fgQd(<7xQ{I9t8WYfLH
z1zmajJ_NO>+h+;l$Q?)8&-|J7dmakK`E=51lq!^w<<}Ou^garmUYNY2J(-l^&2^WP
znYIj%-2o=V$}Tdq9GKBgaWYAae4P(-nP!~#b+S8hTWL*@yc{$2@LPYmpGWeFRPC>t
zX*Mbyb1N(AM7G;3NUb!@ZBC#SUCwbRBsdeOWC6h*NMl_a?vxLm$L~hl8|)~<xLYcI
zaxF5l?xRe*p7bx3)C)ZE3NkSxXSYI0b$lIe#XVN!`Ztlzs-qD>dZV9J0xLZ@`9~(A
zQm}NIAHg739DS+|rL}(oS08N#yc*KTwzRkFsc3=}?C<$XMS7OqAsQOO_JKQPR1N1f
zfoz^fvL4+9&_u_V`OdT@Va_tlW2RYvYr<VwHF`^TD$It2NO{?g5Tc1M^*e+{D^GM-
zemKJ*pA0pkn}8Xxkv}-rbg+e4X!+EAvU<yNcM!zXQw@^<*N%TTwU)GiacT7T_cm~s
zf{&D;3Bj03i-z)dTb;LqT91lm6VA(qZtGG~f?-<7SGZo!b$a@<St!CwW9CF=*dipp
z%XeR&jR*O0L4-k3Ze(~EsUbyycrgLp(dV@NkYD<gU+s~`ER#7duKsk`XYXwsNXV##
zeF_jjN49g>0LFivp-+V!+kZj-);8B+nnxwWEW{hC)%iJGKxu*#2S?*)-DAY_A!v&;
z&HgnG_$01zeJ{Uvv+P@aH%|d#5R+eF?!8ZN*}r705hMSsZp==e^>PtA>9-m^&jMeB
zMe<#z2Q);rSJ>(O1^gdnR=13lB4#}5zLahLoHkSnnO%QEYgiQYB{(85Hcdo?%Dnqi
zM20pCj7FO+d5qV%P~bwP{H;RT0HnYF`)=sM=3>t21}Dm0an-FKsT-QhLJQ-atIC=i
zJkf&>^;h|oq${I7hehxCL^{rl<IlOT;qT37>WWwY#C{Bx+v_qmq1b;5znxBEka|xP
z>A3Sca2$WGr`W8gs}WgHF-_AOs#X?vyxo>isq8GFRpDYm7Y#L<tYZ9egGHaN3!T-A
zrBLL5F;vJbYKlfir4A8!9g^d<gh|XeSe`fkSBEv|aSzrLzTr~fq=)j^oY~dh6=jlO
z;bDdc#uW~Y#3Ib;Egx!$v~x(cTi-b+Ptp5hWa57mGbfFNKwEI&^&lKgl}JMN+A+wQ
zaCcIhrqWGUgFm}uAFK{-w|HccmQ&cA6cMEAhcMI2+(2x16g#RoWqQ0lhmKH9B9!;A
zdTb--)>+Zgy^YjEfu!qYz@AC65yft<6o%pAvzy~AO{9)lA9K4Tg3F;5pnib*auN)?
zA83DjL&Ai4O(uU;th}}Hskt9{>=nXT{zTP}bKAkcV4XGP)z2t!GR@Y7<C*$PA}SGd
z8)V7@qETh%TT+kXVCr5DY|7j8?;9gesWiOodqdqPV&K*(0>bJc4i#F8?2>`B$U0J;
zV-qb+_s5L3#eBDR8wsKxDg60N&Gu)yRiS?@0&G+F;UBJFGoVWJb)J(!>UZ*~Hh<%;
zIVGk&eMX6dQ|5TX5Lj5YGo-wFXw>QEifb03Qe}6<g11<T1(VW(G59IYnpxvO=`MQT
zgTmxLZ7bu_s?j3@$*ReAhl?0G-rjY@PJCd%cH2NHpj4@n0T(YhDdl&=<1p3}`k8+b
z+kPE|1;))<Bn!e31c^`?=orL4m!M;@0hTO%1tjvI&WU%kh&i||ud0ks`|zW8Uf6!o
z817ihWhT}AC}YJkIZgK`<({no<_~3Xap?wNvoB=h2SI`4B66KEuUa2xS)&c#xF#{Z
z#mQ8(na7)KrxFJ>Bo8xRWv8}IS#N(^!A9gp)xCCh=d)2Wh~AgN@M=D!;bfgIbG!u6
ziRQ~D8N|=Y(gd|@u!D^fkL$~LxHxA0f_Fu4lJc(~qWAiEFNHZmTKIMT9E&BF3L4#Z
z(bS-%gfV*Z(MWp$?Ilrku74cPjbXno$9{Ro+GVzye4&Egs>>6f_<#Vj{rrE*<lsN#
z3(K?j_vyU-jKAnLR1yY6{-PZT(rjB2ykz^8t9Tf4Zc(an7QVLMFgCsft5~14I!I(W
zkQ5r_6sI!8mHJMDa>#q|vP%9Y-b5FgTHu=&!)CBfuwUM`SMw6Y#9QPy{$b43poIBv
z0Fi8p+wlBI8I`2ovVadzQzU=PA82+<KMVtlyOA=4{D?{`n;iNAFzr*@$<lyI(8+k!
zHivDBA^hz>gLF;l*U_p)FqRI56{gQ3`p3JP3VorIcnOMy&G}Qsy0Z?Fo!Gt3GA1$<
zP(@Xi83Oyau-o|72<PLLYi)rBh!{EoTcU-0Y(p9lg97^Z<X^xB0dRjHq?vGAuujLF
zSX<H*F?9AaG#8!&@v+ALF}#$Y(sexVk@3<d*KVY!z;ZD8pSYH$$_YE?@y`4f{+`~U
zsXOgZ*Nucm#q*@Rqe0glDMP#DO=TE4w#xWp=2vp=ZcP~9$~Qo0sLEmOca1D|@z6S6
z1iBW|SiWpdThPva^WA^O)A!td=V;e_jOD=MOl>Fpf-*k#sR}gSx+7IVlb4EZp1j^F
z^6rOf+jdNlEuiFp6h)zWooG!QAg<JOLB*IMtzg*iUghVa8t$BXx=M(w^RKa#@2%(J
z>qmJO(Juj!Grre~b@4xoVnkI))cB7PvV%ZVejcAS=wO;U7$bie_f@u6{ERTT?6FsK
zqJ+f`Amy*L%0u)Y*w?z(zce8%qye1)tbi0yv=Vl)r+8cRG7lKPVz8SGkRp+Atnz&G
zpCcEMuOtPfI!9=6LXgn=Dqde!{}hM!I0%J^>Q8CHtj1f5z{!|WxH?UI?1V7K&%lU5
z%W(7$wcWhjJ_vtczb0ru>kK+n`_WGrT^P2K({&xEL$t60UXc3NEVgW}AGy6{5$jNK
zNH(sFbY<_4!J)*mJP#vk3l%A&o|f1?hP=F7g6x%X4h<Y{C18tTI2v!fUq1{Et!M*-
zkThM&c*0`uF$zDPE4s0<A=5BZti1r>7Noq^;=?g!#_fOiyMN~!YHZfzO}~Uc8|dsX
zc$=V6;_Fgx&QyXFO*d{_<|D<QY|3^(v6z%nkd4FAH$M^R9{uF|wUse?8GX3TTiG38
z^(plv!^Z#@$`(jkX>o5I)@+Ora&r0z^C3&ke21P91}#&U2uAxDK$^Aa21am)i1TO?
zGc~s;LkxfCX!@vPMo{#>-8ph_!|!5}xk_#tKw7o{fX7d;NOBwj-4;>2K8adTm~#4<
z>&~ZW(8VUjTcX^$r^@<zkG7;7jnU+@VZ{mUv+^D#trVTFw>>gc7$SxQU>re!O~O@<
zP(T6kxNF%J2MQ9SpUA(Qe4|#mEJc)v`Rh|S3V?sk#Tx|exZKT{L{x*1!l3<yGi-ki
z&$V-c{rS{FPKrj<7*YA%2LaoCp$n2Wtvbc?wT7MlRdRrao2qMM3w6pJ)nH_>dI~F<
z7V^8P?yp!iERP*zW7<Nivp%3%M-_MrS9Zf<a87M+CO?a;1@J|<2$|@)+CHrr;y@cA
z`?G&&2|Ipe1)P-u=m<)J;zY(wj0KIKlhc9{O>*V2dz2v@D)nZ2mp(nYS3hyD)t1**
zE({n=7X6ZNWNC<HkDz;~jn=l)=W4ws>%;qiA(8SEmA5jX-fMCaWjcX<-?*ufn$4v!
zZL1v>_E?jn)-U1Jngn60I1r&!t0+RM7|?%MraU$ZL=hjX%O7+ZM!LOykb(?4cr1S1
z9H%$yHWlF(?bV3?eA%+%CYyyE^VG`8<dYV3TKHSgQ}T6Lzr#&kguPvoley1hVuS2&
zv4g599^qglki7R^;%mwDVvh9pggg{l2)d>@sXLvqQ3tNi<M_vBmd(keA)mfQoTPsz
zrGECiGZ1Bc8$}F~H}$UFI!bQ|%vw=J+w6pB<tu2#>ldWml9_#0U&|sj=N06V{>hs{
zL~zAk>`xYNdqo<JWZsaw7z-h2aN$*Jvoh{U2Y$B7iUB6oZ2l%Rk~jk#AX;<!7NxiH
zek*&!W4RORh-{HFiH`U;sLOG0yApr=*j%J!l(QPj8&?xH26B^qdXmL+<CagPsKfss
z*)cYM6CS*vVsXM}J|o)y(g|hIW;`SOXbuSL8pDG1V361Qd6^_$-fywm=(M|%Hgg(5
zCO~QVZ!=S<%!Ww<Z;}%em9ylOUe7dA)b6%mEa#a!iex5<O%$WeN`vUMPF;Tmd!3Hk
zttqaK{KeHh<NGT0Cu4IVhZR0?3qKuy^?m0YUHQ$-R8skYz007qroTu_B!DUW6`uR0
zjsX=R94FT-56nj;{Ym&KVde=*H*7(5@qpmpMtSXhq7?UmaRE}Ul3YU^0_J1Gr%h4i
zu%{l0>TN=UGHO_r;C{wuk+y#!@S8*o2lZd~JTXbXv)c5M-N}y&s3}#q1hKjbTM;39
zM?~`Hkr8qJ6!qHT(-Arj2{W5kno{LHC(QetuS9mPvqWo|)xzyB#yri@XmB0Ee?(@Y
z+$zorD85|y$#Jv|iRMfdJ&pdTH(@s^j6>lx(eUeW@_DrQeg%d~m=}MR@$Zt}CCTO-
z^eCzH)P<JL*y}9N%{nm{#!53aGOI#sK&ERe^WkA74LGeBRp^W1@}KGwOp?LB|Hr<j
z^Q9FgYw=okOFux-chJfMtIPS5!a(jn=l%QM3q>d$b6Qs%B_-(`fF!p7Ae219$!8@>
zZQXJwTEz8NbQ%}fx$A!^P)hr0lL01|3O<K0uzD^*_^E1ui<r<WV9z6)Q@hYctf7+9
zQohm{{<MM6p5-SlGr)T4-(2E%CZ~co9&pz;nl-LYCAyuf06JY8R<3@<LhD|fr;jdh
zE7_@<vH8!NQpLNA9oJ`p<Z9PJl|_=#knT-Lk>TC!-b1$RwPt^Mz?2IBxzci_UcIFT
z?$Ey#f3ib7-CDt@y`%Sy^>6{AfUv?PeVLZG&}Yuw)`I}M%6xYr1R)i1A~mVsW{Qc!
z63u5|QPf#sTHVmda!*v6a(^s}484u%hEN1y^sR$H@u3}WY8EXOygcu->lY?_7(g|@
zKiH_93CB;-lHq?~#Qkb-bPz{Io7jFbI_Te6Q2V7HBQJc@dJ<1RyMyoY=Y6za4&LiR
zJM8SIAM$PwZ>*pNY_}*(YaG|G+dalmxR0rAPdt{dJ1PpHz5`F*pYf6LZr1+3=RXF7
z0)wU_Rd?rm^^_L2z;tucCR9HVi1+Q)GU4zm$btT}wg7)Tlm;gL_*Jh0j=w~WAH>YW
zb+Y6Dq6!n6^4kDGYgd2pqI=KBigQN<gNV?!pUPp~J5`>iwNs2Kx%p{)*05J+qK&Pr
zQ%I;Ue+b`6!%okFyHfPM?zphw-#X+RPVMSUw<2&GgzQjwcnC;FwLyZLU6sQ5ejH^Y
zVd0f=MH7FYkY}Ui_j>*#AvFrP$>|0ub94v&wfON@1crjCf@!}FaRYIpx(9*p|GpA;
z9nT-6z7xj)-|{sZ6K!MKndpa-a11;84Kq!pFb!8I&en}ZNmpyp>#636o!rYAm<7zj
z@7k98sei|@-8Q@PQlV-msL}NY<q>@*B4oo*OhSJ<GfRT)kGZD5lQMT@PU@PmODod6
z0Z^cIL)7{BL|3jZ&18F2Rd#YmHisoArz~1molYtmjPxWse$k^#^|+Q+Z57tHs1pK!
zHJwLYH(~W{x@#1k9XvTc_a3kTQ(O%jmH6_{?n=%#>1K@qC92@CXxf^fwN?ajXm|~&
z4WoZUEq;PvjaPrGKCA-&O|4d;(7nu~ue!s~3U?j=B3=&GBZQz|b*-!yurJ7v)czY6
z_&&WdN@r7IsG9NYYAj@=1$yYs08$74x!2i>C;)DsHDi<n9u3c|E)!~dhB%Wo+Nj6r
zrhL#b<fyP<+P2<~mgAT1VbPlifepGfAntzwr4JWvMai_7X|fy|5ESXubU{^WFaY!&
zS!N#XM_C|4yjHRrp~M?S9&FvXT_DXqh}=VoMw%^I9WdA|c~x8J_~_%`7}4GW!cPBn
zHwB>m1sZFe_pB~Ceh@V4>09+)zg4ebH%bxGPT^Jk*rb{EVP_J)0xo+HmhJRVZz6xY
zTC;vK$5c5lhHT3L1c7-kVE!;tMR{L`^L2&%$B{+dX3wBIrlKtU#28;|#i~qne&*Yg
zJq2q?{P(5xm-g>jS+8M~mnR@4XDNYQ0mO`MD9}z~Hzzj{_B`Hd&F{faCMsX!h^@z$
z4p5Pj451YS8A^2sfBj}BtMFgmCfa{Xrtf#NP;Nxd#ZnAqVjlJ8Ql<4_)4%?x>#hp+
zt2GPqw?Nt-l6?sB!HETO=u%vzJehAQ_vQXFv8iZ*Dl$E5_{BHgWX7s-;t7<s7(lWD
zEwTu-{dQo(I#NPvIZ6hFHvlrcW!Kwc&Qp`#Co&xTdGPCI{~AR$IHSaSTgrb|Bb(4m
zm}k_%Y{{FCSkS<%FJdtMzPXg!LD&eI=_l^+%Jw6|QS6loi|jE^tb<+^M>o-OB$ES8
zF!#|V%FuBy?RY-D5Tt7<t!qB@Ovov48?KRcB5n5KG-R*WpaDZKZi_e0;|pM`h}ck_
zkeR}*o>jvq^fKa6YNrP~z*~RdZ@5xq!j<y;K6ko~o!E2_ynT}sh>GL=gQts{$w#9p
z*Vb%W2oGD#02VzVWEe7xNFu+8)4jtgrl8}P(elUAud7Y{1e30vL-T<l4Z(yi_0wWz
zq@JT(^pGy6Jxkk6J=|7ggcy?}NIhyr(|F%i&g%g7qq{)BFo@}1J`R5a#VtTXQfkwf
zFi#fvFgAJUe}>y(NxBZ8AV;ZS={sB_+3r<fmiBznu4?J)e(E90JcG*bu4utv$O8Ra
z4L<GS00Cdorn?))+MgdmkYqc|5%tyV#h-UQ(#I|6@CfzrEQWU7GhccMN1wE!=l!>H
zwQO7acZ`B0W(ngdfn9%nHaw{HIKF8{0?L988Pn4286Tq5GoJnXqL1F*r5t|iRB0ar
zMNP_BUzS-ns*c|x9qNCK3`Yg5eT#CH;XW`By(Ii^$Ck1MN!ZL8tl+RA<xK$uv?F9E
zqA>#-Hxp}N7qiA5w9tPWtOfcBq%2SIBo)Mth+stAZvBOf`u=~tc9D$CkfUQ&ZV*L1
zPUt3}H1ochsdrMdByO&kR0vUc9uwF$r^o$QFgr`-cLkgriWaeB+j{IO$z|w(l<%;T
zc@QghMYHEJ-z7is0TNI*0(}~~_RiP<W$y7i-U^}s37x9)hgkh_x4K1SlLWOND&NtX
z0F+zZUB%|BY7u{OrENNNq(C2UnHNY(n7t8@Kc#c95U_YwSnCL^lr(S1>?QkWB9xm)
z2kR@!ZY8K5zT0M(5dd^%2^i63Jti5=8K5cKIw^%g1dO=xV;nPu1=8o}&_lpka^gET
z#zAh!U#Ae!n2hw>r7m4K-L4q8b9%W(MFi9lSQApMhJAlGcF6P4zs5$^p~%3$81ffI
z4D+xKO&4l#E14`w4?CA;{(WrlB_+OLovm!Rna57P*JGo=B043x>a4Rn_j1bp8R`XK
zt^TFBMQ)MxTEVI_lSD@6NBaIGp0c=D%65hRqE)b|E{K1mUjst0Kr<MC2c}ON7O5vm
zkG(;9H1dD!-FI-iKuuBMCT>P0Kx;ZkPgJC7`Y+LItpzBo&*B$ZIq8{v%v>u#h223t
zBPu}gnp{yRM^D4M%Yg!z4;Y@3k1YaWs*G)~59{>D1qR<QmpXO0kjUnM^FwjgxqthL
zCRZ;D>-Vc!e9A^;J;`U~*K25QZyHg2b}>v%#0-C)%5@n25MRL31#5bEACm1zhs6;v
zkH8K$ge>Pd&JRV@LYT`F9I*=yfZn%T<X2ovMvYSd*B5J-_}j{~0*Nt{Y^Y5d0kNVz
zLhfzG=E>qr?BG8PhVuvCmQhQo>EgX?_;DjU0U#3J?U&4?-=LNWp09*o)<!b~b;7>^
z7cY<ghMcB<&?~(z5$3-S9BB_%HHW?Wq>Zfv9*xn2Mg0G{^?5Gbuux)0QcIYgubeA{
zmj27kvUyY+is}1;rUx4*pmFg<db{K+g-6I0B-W-vpn_kC(jA=jagdNxfpRmDqo<Rf
z63<d25??!iPhUbJ$aW5X?fcOSK7kjFv8h{#*U%V$ZP!bV@f<S}Q!e|RAAQbQ=Yl4y
zhzxTRgQ__#ApLjvyv-Pvu(90t6z8>qN3I6AR$JC-)oVSo1(i`;(rHkPkq3mDXo0fg
z(|XR3@hWCabXHIcSzHDggxB9cJ*Qu?DTnYalw>8yoOs}<Njf-*q-kTiZ77CKpPIY%
zoO1YoEhj5krlE>uX8jH68$cwMeL&qTGJn`r3wCwwD!(-_mtQb3SvrfQEng|lToIVo
zFmIy?V1*D{R+!i6r5T|nE3`%a9?D<7VvJ#&5h7XNOVYW8anCSvKENd_p<VI-`p0Ja
zUM;Beu7E9g<<tDC$+<uh;9%%Vdj&D>0FlanWI%1`S7G)xQ-wW!B4_Qv{?U)|M>svR
z(zNgCw4+m-K)<(djE#*%<mtmxj7}gA>@<n_k^R=gpIvczo|g0*#J;82;wup&N=?2&
zZ}{<#FWCN`^qa7&AOo@aHwG`Ki>c)Gj<RFRT|Zh69B4WfOruwWK<hzYq4^tcC#Fq*
z#iyv&YP9Uj2}PM|C<expSiZ)4Jh74Exg3Z-2I?d<J%;D9PzprJ^EFMs1NuZ1Ifbz8
zX;aDbHK%hYnEE=RtM#C$+Z16T{V;V05BcYrrxxKRv;_kW)ffi9N?dH<iR3c(9Suy<
ziKbEwKGDQhmB=;Q-YaGpTl6XDi09^iq25+TPHvolR;TPA*E2vfkKkEi4iej8*R#IK
z8~{AAE}C;=)H;MMYsXKhVqYBt@PwI_<@Ej7;#tqQjqBv|H?k<oMij=^5areSfJgK@
zcI}NJ+rVTT|H+WAI6_Ft*?;m{Q-oo)RRuu?y3x)b6f)Dy`-vTG2kkmDjwD`xzSAkj
z;TKREbk`md-+=zQ`h{UsO2`Da&p1>73wI!*_r&ag0US!`-}Qm^u?~WzT9r4#(*p8H
z05v%A@5x3|5C8$PUeGoA>!f9VWxCdw?k4%k2orbRq1g_V<s5`t5fpB{?}Xo<<r0JI
z#d`m5Q?>MQilG~4eU56hj@Z_JARBS;mVdAuTG)B1es977t)`*g&+rtxUrOb?XJ=Y?
zU7QC4u9eeu;8Qnb32%Vs4eaF++e@@6!3tNmW_NE$pw%n>ky@Y!QYo+VR-6(e#;+A+
z0)j~=TJanMXM!%d_Q{qqp;r&4d^q4KJrArd&aSX()|ZuPyF%;FGA7x712^iYH9Kl<
zfKv^@pEDTritP%9_#?7bt6dgMkz(UJ+I7S{bIqEEwa|hf1$DyTt>n*F{W$D{z;oAu
zoTpOeL{(UZvdiQUIJ5bQQ_A2E{`p}5*iMMMsU<Wl85=|)27+^Si}2<Z1}+5@!Ea23
zVRN`SIPXXr!VY72V0bBiOZESZJM*24+JuCUK`sSh`q-&S+*v<A@un4SRca${Ij?|#
zIcB~O_qXdhRAtJ~;38)jJ9W+gWdO<>0M3=&Rh{CAe3(|#nl?>M<Modh0Grmli&3NU
z%6pu<Vi`SqH8ma;++jWx$%9NoP}r<(<kuTn)H_*um``wj;asSH%-@b5XXcB{Iz`|&
zfaSOdNvVSo$f@QjbLD?`eF2Wx@d7mfNAoaN{>TRLA~9OI#UN^B*SxF!Npd(TbYPdw
zlAIM#rY$GBOr=e^r3R1|Kgd61@17DvI|1F|^`lpzuK6KVxMWsDB$J)g7ugnhJ9S@I
zUL#OCs0E;rbxToyir34C-dDi-la7f-_0B)@OjWt;=yNheM6m<uYt&L-_!>0yQ4IoZ
z)TciVW3+x@>Ox&dvU2Atxg(?I_?e>-iQVs;o}u9R3UtqXn5d13^R+~<3m2~T>E{f5
zlt`Z_rA3Um`HCd!QySDSm?vw$O{M!*R4K8!$-nCt9F^>UF?1%fEe^d?*g$`z0#P8`
z@V^@E6RS@30DMgFsI;N)V>2&~9AZ{%T$&=_yf!d8C(H|NWZHTC+>LJN%Z9xy3!l*`
zhNlwP9y`oeu8-z^W}TWf_wNVt2C;9I8R`VQxj~DmV#O^v2Cawh)G%ukGJhNUkm+AY
zgD;u#Kdz&H^4si5YrCyp&4MpOxW4?pUbzz?Ww0%e>a2UuOtc_R+}ILZV%v<bb*0$7
zgJ){f?QU^3p+WAXHAQkx>6v%}v7@)$D!4x#_;xUY+@Yx`d_(u^hB9>AAciHWcKCBa
zzyk0KdiBOWJwvdfP31uUi8cYEt!#`D7oo!25P=wf71K%%XgA+~Xu$JJN__<;UGKt4
ze)On%$frU{$^+W{D<5JvujY+xF(9kb`-zYi(6c4U!%X12zWq&=EGYi~P$B8wlO?;k
z1j@X$Y}W6VQQT{ZRyivd4Lj@#v<R0i*5DMDXp3esnOW|WVx~;PT8jp@y+JKdd2muC
z@R3=6c>-jXrf~oa0?wDu!S}^MQsb)Bv5nR?!v>b0!A`&t%z)@pj+{fv>GN(V`|pZ{
z{XiFw)cb1B)UkxkEzPZM9G8miTxN?2bZIW?A_E=36+L+1D!*`f49AElO|$!Eyat`>
znS)2B8HXFXv^)SUeGM)?H&VpjJcz5OSc%tvB0EeWs6|itpa5Th>f!Hhn>=_7^}(9+
zLdIDT4?KJNJMMOY2o+o%Es{`&k8%Ip)UMdsNg81i3J;1GeKA*YxjrSW&C>YNcMA@D
zHuhUhwXr3_N1|Gaza3D%pXQ;qjW3~*4BwQy3K)jri8*iuz@T?MCeQBgnh!ct^X4Ca
zXfQK@2bv|h)|WY|dqnh*D&}!~jNxLwSo_y_+2b~XaV{7eHPw$mgbvJKW(h(w11dJb
z5PS2w@2)m7QH^d-2w4c`Vg`R^x(4T_TST->?3A(Bnp>a#ay{{KqpRYEv?FLF5IVVg
z)9t~~WwVl+9JhvNJC*JH1|K(EPNs){lRv;~akCc*%pl8_VDw`{qJ`@HDoRAaR*<JE
zofvQ(%=l#YxoW2pu1xF}!=tzUsRbGY(6<;@%vzXpzKJSmEjV@9RJH}Iv-G}r336X;
zg*BOe386We<=!<3l`kuV%*YV|u3FCB_4IWEI1IR$LnVyM2_X7!>Loffah6MeKH6!u
zen4KY*N&sc#Hk+c0Ezld)b{pia*AE&@hN0eIvBZ*)~CB}^h|2YoYVPzR$%Bmz5B4*
ziIU7b_lp)pc$g9oB@(&Fnalw!=LUyEPag`h82WtEp0VdZNo!Q!Ns*TWttI7)d1uvJ
z1;w+ij{>t*cDG(H(GAB~@&C?$h;atxzfzb+q#jVM4KlLBwPWYK2XXni`V(E+A$Oj^
zky8;ux(O;}s$^KPPSP}AakS0mj5IWlxyNjq`dyQ;I`X7nn=MP`G*q3-4hy!6c&W4_
zt*3i*b!UMAHQSqkB{9O%f=g08A%>r`$-F-N0qw%HIYrkQdXr>MbMWDR%1+o1wff{C
z<ZIx^*1~Jtmx$bU<`%-<&Dj)bxAw~7FC%_z^Ms%LRVE2%F>wWu9q87V?(rC8-i5d0
z$d$OL6r!q*5cxF-T}*59zxUSk1UvIr0{aK*h0<B@Fb@`h@MN*b-Q`VWs0SHE;2<9B
zqe*Dk`p+D4#dbp8v@wK#Cth2|c4tuh#F=iBsgTAw-?+|bCsZ{=;I<c!WvuGJx?KOD
zt<lJC2$(ziHm63y?H3u4W-E3vyn@#_2D}p*3n<_zM+ZJui@3#-IBRqXQmXnp>r{iI
zO=H_zT-ZILtQ9%Y#T~qft+p^zC>u@rbwPQx^mGmDe?5k!IDlt=o2FZB^pD~Y*ye;Z
zJh9#BaYX&)wfu#JZmAIvtov*pS!bjWoMw-e3<+q*KG~r@o}wtxCG1;>`jB)(-005?
zs`0@BhWj9f1Md~VLX?tBar`%{e~Q@66?mC^ha0wzf9j7-XGb2)QO)>pJ|t?H=!O&r
zD3(hZ)6a@AM5@An#FEaT^KmqAgFR&^=DA{IEGZ@rS?x5*qqMCIsC-AzC7LALqo~NY
z5ohJdGOQ?Q3r}xd(H3}~-FJqC=g(hm(})4NwlI=7BJ^AhqU2g>>70!8$ifIj=|VL&
z;gPMwiSd~!<2m`uWUFoQxYmHu%$Io2b#jvLPxx@w<e-Ru!c=eFn%rtD6^SijUpWrX
z%G1Hxot|GfJOf?^b>NU+wL~k7Wu?HxHM(zsb}DRYSlv;mTiFG54=BX9hK4IBhz5$G
z#oVU`tJ|{uR_-yTpyZ3><Gxz=8my!EGN~YOz|*(PD#5mX%(}=#*PFBjj?iOiE<<5|
zZ_3si2m#uEi=l_uf(6pc$B;gPSkBLIsh=(yy}`Wh>_R-I*b@k?Ge$xk;`z)>gW}3S
zikeu3BLUSy++L;5%+n7QfPb&>JwINq-07l5Jjgrir$-53DIo_MN3ltD<?Te)|4$o=
z=W3Ff<-P?Edyo@XzoamRwdoyo$;C&5M<kGaM~*&!tb!SR3kQDdb%BAJhCV;-!`n?1
z5+#HM0hhc2S6cIjYOlcYsGq7v@{@;qQXXI>PKWO|5c;F06|=27+c6FmP$CtIalqNR
z!j&?Ab{mxpcm)(^U+0WcjS%6z{JD`a-r||Y-tG@I1Q_Mp0Al;Cv?o@Rkb&69Dh4(a
z&JnDCkF#=g{2+Jq`*)AzHP~#myuTmfS9&9par&UiD&^a(D1g4*(mdJdx*W~9PM62L
zyQXiG4Q*w&{)Sm2vQ@CbRN%y6my}Qhjy{Hy5YE(KV}kL9Dp1X*U9R|>m&WjGhR9sS
z363xRq0Ea=P6@N}$PZ0(q%#10kG`)CXy-+L%>;#L!|B@|VDWDTi%AJ?Rd9~Pz0$ml
zTNI#g?8l$3-Ez%}ch3m%8|r}MuARL(Nc3Qteka};LM`GtzPzxU{v*vjH3qXLhoWBb
z2SuVjiR^|=iCRjEbY@enFrvAR&%Wazikoy~_f+yfMYZ2XWW(u;xEYz1SZnux%mxsD
zJTdOw<v$PrnLle}mpew#i3FZBV&Ak;?q;*m)DZjz)r~J}{yEQyJ58$3ua<K)+p?@Q
z^%)`K!t$LL$~_6L?OqD#Te1l%^@mW@Y>BxjXF<5gM&S8uLXRKeML+V)Hs*<0u=Z29
zTu*9C3?oxGQg$3_L<AS?^YFtk`Iysx-%?Ne(nS9t(?~P~-?{fYDvy-{-`<3vLl3wr
zDT1-P>Z@bF^g=mfvwn!HgosWmeYsk0dBEmcN)Y)7baXaKk)=?h`aBSEy%{N|Tre%t
zrhFEV!UCS3(m!eg4Qcu4j7qHcZk7wrvWNExVmK|YVH_8Pl-I4r%s*E-G5}hCOX<*~
z>@F?brmJm1WT2m+e^|Ybyb}aAWnqE~gFoMfBZ&YZIw;ZsT6@Y}n=sueRiCR~ea0GC
zi98P+>{zjnqxfH8IN(`DMW8T7)lH`EHx$GZVQ!eRZBp9ul_zC3$&4B-;eLhi-6qH|
zHN45vG>J}Y>OiI{aCO2Hr>9weL7FR{u~b*mSNAver_v*Nl(0%fFo!dw*#+QWqze~f
zfA}8&(H2J7>rNDH0fU)od5GkE9Gux$OYR7PwK4#r+aCs!V0biYSEs0rVlYuOpXU1z
zmNjtvuoY15$<nH^Kpch;LK&{h_O*!?tCSS+Q;goSls~|*Nd{&Gm|(Mi(r)SF^QD^>
zt(NH|FnFrn4&LR1VXH&&R5q^Onl#xSPBewnwVbNocEne$fg4tgKk5mzG_EWN=nQo&
z%C`sBQ{3@gkm!Kk76IYo(B_f66?~yV(9h<!%Br1kjI7~Gw`!E}QcJ9C%^xbri7vD?
zA46P8RScd8$F|H9Hv6i7(LKCN0IhkR&<ryb4p%J+_vH|+wtmrw#sB)a)W$EqrmY1V
zhf)&uuDJjMkZ0t?w@=1d4^4{fwUzEd&x(&BA!>I*JD|<{2l35j{L6v}{2~+uffI{Y
wj}AQSH)$Z%$67c~ULgyPZRwTT1t^n*wUse#f>q+EY8cPCFlv|uz5oCK01bro*Z=?k

delta 15864
zcmV<UJqN<Yqye>jkS`$N6GU>niMJQqWH>r4cBh7SZT^SC2_h(FJouTonH7+cPnCbC
zl^<Ao%x(kmiA~mT^dl?)1ONa44GIkkd~T>hv?}gkAYr$UI_H-R#7#}J$Fvh(pkvu{
zm>SOYM>w`>OJt7BS_Y-1C;?21-jN@9X_8i8+Oh~4$nRm7h)>9@h^e6j${TVU*6x+n
z-9no=gj{{54RHSDXEp0$usi?&$Yp=elL0j92>Ge^>79TzY?*0=Vlag1PEaK}&IfD7
zBiz`_xa>%Zvh6i+Yv+Aw)5})~W5JKguuLpaF2L5X&ngpTFmfdrqZj|m@J+#W2$m6r
z#*lgd2j9to&Auu43EN+$ycNP~ISy))8~;Jq1F(*#e-@TnITw9KupjzGwGe+Q!a1ml
zuLcfsP(od)4NZDu4>hkGz`ekpGD6OXBNO^Xi%|AH69|83e?15eCNi2;rZloOL>Mk#
zHmqy9j<@Y0(JUJI+0iGMQ|LYZ@O3^QPibe)64)VA4(5qyKlM81yS^?kPu{J2pB{Ii
z;%YDG;5j$GHSB&QDIve|1DJo3g<m2P-{Q}pXOWdJD2BYD-Nf@lXZwTDjhVH|Du=4{
zQ0QN5gurbmiqnQg`{+kUhnArl-EBTWdZ?d*1#_>Kno858Yhc<4mJ*^C-gtwz4Z-l0
z)z(FbKTy9dc768rM=7>#dwr3h6f7oP%n>p1imLSiNS!lyl`N~2m>qw;G)8M?%~}24
zRzk19eL(tA<OxWAnwTjcQ+cA;+FPWaG|S>jV~a8ihV*%=Y<tUvP_kq8fGrFgN6k!<
z;xbY{#kRqyOCM-Afe4%1-GsXg4JA-$niTx=NxBO$W?QA3dl+5{v`+d0THYG9{Nmv%
zSMa?XY_Z!u2(*rhQwV>!c;hE18x_9FJes8JjH|V&D$<haM6&=xs6-ofo>UE5{#OFy
z(HZc;H3y&=qf<YsI0$t`(bB~o5v@kOvVtE^>n(_VjTgT=#_r(cb4D<qo*ul7PQXzh
zjldLr`#6m|W;<Usy0pj3jW?!I>Wwr)_4H|QF}ZKTSyXadBkzAof0u|tOgOpk+v0mV
z^i40V_ZS()L3F67KMxh}e#VG7I(y(Fj^`IGpX+1@7ZP=fyv(3cVXix3QgehBR#7?J
zXy75~nLFM5P6a8$*M=?WG7YA~z&!GiU}P@z3BzI6B$f<Hg~$uZULq$I3mh?q2;@P9
zF>`Tf{i@iZfAN1!*)r`BA-lKmYsi0sMj;f)aJLyus39o%u!7+2G$*W3z3KU>+i=z5
zICa~P!1^yE2ib7M%(uu|9Aa~=ZkUg&OEN(x2m8`!Vgp41g{6%fq|<aqhOK%lULhWm
z*PzCocQSiXs@`&lTS__{ReS%3(*{p4*W@6G(#&R+7omTeHw(+-=<VwUkLDt*s*H#5
zLzWNP1ec3jCaac1#dcE&Ll}NvxKy~D%bxezKv;pq-jdZaC^PMWNEcefXT{T<LKQqF
z$3!UNqaEA)EH__tifu>fKx*TcY+R1#4YFS57}qWYCS`b5yZIv^y4}dO#DlNcN`TCL
zO6x?>&I*4be0#+gyx9%q^m2<*=(#-{&Y(l{Na|ioPGJY*jPF@iVdg#W@9%j7Nis5i
z9?)+L!mYZA^Kw$d=2ESGdBRRxZHc60f(XTyPi^s-Id;)*RuabWa=oGwyUVHR{iM7L
zwsYSEWhgMNpkG63rs+ZO83paWoX0t~B{lh0NA!P=9F=u`l*)GtDqs!(ppvj>1saPs
zcmDZp5<&nc)dBzDOi!Jz{p56oKo*!(uiL4FfL7Pvc#$c4Do#f2_(FVVb>=V_&y_}6
zv-#jCUnHoYK-FtU!ZMXN>!s~i>X(tsB#lCgJU4L*w~C5v?wT+F3d{Iz0!MrFG^}!`
z+6R9|Si;YWzo{UeVYTV}2n^Lpw6IUgF>St<3TILZD<br1>VDw3ntq93@W@F)hXO1?
z%ymS4`o|2GvTlMrh9&TNani7QiVaPV@#LW$ZL(DV@J|Z^(VOp5yjhpmpNPo}B4gyr
z-vv2qN7BX$QC!4^Rd!m@{MkyGN=Idzx43`F!gYdqA&e%r?^oCpoRep0R&FKq10Xe-
z>ljm@jyZoM_P<Vhr&{Z!iK;lX3p4`xE6Mw;VS%Mq%UOmwzp3DR@^K0x3k;O2{1^&A
z5-Q#D2U0k83!XBL#+VFv+uGrG$7yA0zb_N=g!{xJPct-Nw{CDXzGh?%Gx7=L)A@h-
z<|`aIUeU|pY<21FC!5{5kYpNPhWGdB?xUue>`C<bqz9^U#0O@=7zj!B80I=$C%eEl
zUc?^%f-VgSH{S2`SR1%Y%vzx%TYz+BhpjgmVhOCy_|8g2&RHdx(`UvS98C@T!a>gZ
z@MU({T1Z9wDFiaw3A#YM0W!$bvE_e$B>Bcr)ne}ssq!`h{;%NIj{t}Ruqa4{k!W%2
z%-xy~_puP#PHp&%oluL`ua2PF$P^mm2~R%ZEAogzDa3G#9!<3aUTmhbN0=z@?P(PW
zqQcXj#-cCZfxGw9{vC~)(>zB35!9TE41_42546aW#G!dIz=hF6J#EO`NppXrHq3lU
zJpbjSo_b5yxx0~$uM4K1nv|_EX$-BtDqnYj;TMLx;k88TXn|KyL_f8IxI_<PlZYHX
zs8Y&b9D&vRsSROD>^_UhSTUftVv5eY^0vqvH2Vt9dPS1nZIjwYy1S~AS5P23FJL%`
zw7saf=k;aZx)Hf_SKX)B>85`Wn`S3llYL38`S>WX+CadVI_LEVB(0xq9uouw;t_<@
zbD%Gm-Zs<|DB|I5vrG0CQ%Z1J-=Xj&`H$YRap!x<!f_6#KgeEqZ(0Q)Rb<w`i5lya
zt&YSuH0rmou%Qz!0WWf;bXen8<n{)Uxw7AV^!{^=TNidRr)YiMGiHCw(LuUz0#l}{
zU2_WqpW^h@?(!L+Zk_JWA%4;L^IOokErcm6mpkKf6--JuRjS>&iBm4QDT!q!tAav}
z{3Q_lh+k=2C_&DF`2ad<1V>chKA4kBpsG%b*Ec*&#SC)6W7otFEEYr!N+$#DF2jx)
zF}%^a#J|1#V)OMZ7EOPKz~lZMX>~kv^Oi$*!cLz~0`iwrV}R*kIIJGlI2`O=y{p=J
zu6V<l*K&$-KMl}Z-euqK_gpjE)sn#M*j#*`-K;tG)GBI*yw?SySXJWVyo&%(ZV(YI
z47WkEa^-=#Zib1uj`a?#Z1Fw$fsR#URISU;gJH2^a_IeRJokU1#8IAFbo;IbMmG>G
zIRb`Pr%y~gRcs8DX&^wTf~T`h@6hC|p&<uE2H9JLPSvk)x3XOT5nt9?c|IL!gYggL
zAHbdg#vTyR*<`;<g23gcFX(jA8r6!5_g!rvIjBA8iV0dSOu7(OcP8SXUmIHe)|xkl
z<`}eoywixm1_6IlZVn2j9fVHMT=iWs7uAjvMIFd^=K%vEEN*P$IpA{%2jkUIrYk@z
z+peDY)2`>In3K_k90j^I6J4q<m(($520mO6?11Io`R!!Lu?2<oo2cdLDWXmDWWioM
z5--7i1I@go{#J6>O>E?(suv(z9ex7o&O=x=xS`{uzEyvc6xI+gcFw5Crbcir{RsF0
z(-`pUOX(6ya!*y$A=54OiAobOpolJQ_x6uyV`c&;k|r5qmO~>p_yj&e-Enh8w70eN
z<Q8^&GIOTbQ)SzU&VO-_N!Sm8L;Uxd{vC1(f*#vlFbHz=YaB_eF*DWL+MzK>PEvs+
zz+H&6le2$hRB+U5A(?;yF<Jz3IJ}!=>q}aPv-4LL>&w04$U94cG>ffX8RR;WPLW@u
zA7m)#7kS(3owt7spe-Ehk~rupHa`5$0hrvHffUU!&qy+ISj;IxDT~qqp#aCMYrZXO
ztAp_{Y+gSk)Y29E<`ujYl6CeF*B<g4Jr@!>QjdQoGh_z<aMaHErrSV_)iigR2U}}V
zwRx?>K;_<9ZLave=oQHuL6^u5v6!IvL<E}1o(&<a_zJL0M+Gw)_1393m01?=N54~Z
z#@g0)8BSL*{O2!H4Ma9xa0Jm>(B9I>tUW7{*J;wh!tSqCKrrD99L<u&rBnUcgL0FA
zEv<iVll(oM{MhRkh^>bitzyry$6&w^u|!-8zv-YNeyn+VETaiGTM;s4<=@lb<@hpF
zs<u?T^8ysmZdG}cI~9ObNd6&pKOI3^37H{B7Ra9~rL+(WOl>4zJQ_z3Ui=IeQ%oK`
z(-M?f+(9+>nljZ{ot{#2OhDKfik+lpD<OYyFCCyUk*MHNOx`{9aj#wxP&qkggmd3M
zgM|bGbj4us$rA)js-dOKnieykV|E9}tWUZF0h#U7{^KYXgsw12BA4fSH4dtgWMF#f
z@n8jN8_uEv4HYuyY~;?!<jX$z8@#aBVhf0f5q<XYEfYcQ5O5nS*M(kZLPKZgalU`w
zP!)EyFv)tK5qXhw(4Iu%HB77~ng#%CX`##)JYafVJ5fh|Apxa!OdHax@Jd<K^8~E;
zyI{_-M5$O{S{?@;nLJ#arUjNSkC8MK;#8_dEN|Z3++~VnEpW%tm=8R56BM_s<9ln^
z!BpDvlJ8+80jBJ|jR++tb8znMI0k=<GwKtVRT_djV6tAgJ0+m;t(#V-CqWvLm;t!_
zOV987@Hg#D>QS_ISw0H^|DUs-RZhwm3~11B?k%?vR>tc*00o^->E2rXzPpx}51-pR
zJowU+5DgM7pIF3};7Ekl63g&*>e`xGkPN%=Sa*d|Px~$G{K9L;he>+}%Rhf0l?1Wv
z7NP^j%agGti1#2}SH&>dT4@&}E+WTvBbC!~q^-ol=$f7ZI~i<W&dE{&8O$z<YlF3-
zABc5b{~Wpdfn<o_2iQcE22<_eSt?<?bVK1<T#c&!N5%nPGm3dj)&Ny%xB{@@=_EjP
zWuQGv(-6*0S|^*R?qcxzTh)IBAB8gg|Em7P(byvoH?eu3#DtU>){H`~XMHZ3RcuWp
z2$2)`grkdyCDC{2L}U;gN_7T{ipB(`f=vE!wPQiR3*7FR6J_3Z`jpxi(A(u4o`FYv
zz0RBh*D{RnqidnlACA`OhYTs9ZPH$3Vb23~##>Jp3+mxzBy<jk4T675A(Q!{xDv>8
zIZ!tCW1NZ%C}Q0)^nv_4p!R}2-88LZPg5pay<#O5hW<^FCG#@);HbOnZtug%ijDR4
z<5(2R+9+<~DyIv$t5sac1GJ1G0rlilhwdkF(Xc?{tE+?5wokA~Km?>mZ3$O{rV{Ia
zA3pPHhmwE8a~~YCcX5B%u~}~yl(d1#?jPN^wQDn?8<3<-Hz|c!ATOSG6Un?C+Vq?e
zyUf06QK>?Oa?Sc9Q2*X_eUP}>P&vMJyA+bexYCvUD<lkZ7@HS2IA9#xM>Rc#Nh-qI
z_f)1v*mWEP9Oj)YvReUf)4|*|&ZhQCc){aHZKau5vDvTZqbq-W9GQ7r@ZhRhr?q|r
zWpvSvdEQ{8)5ek>SR*ZtH~3^BN$hY1(5xV97={`6MF=X{2ys#HPy933GucVRUpVi3
zQinX6nVTWKU7_>i%<>yT4v(qyox)(IHay~110I;lY+^=kP413Yi1PE8PTlMYimUIR
zi5rLAll>a&jj4YQ*-L~FW@yonBloX)Z+Ny!u(WM5`1>^@-Qp6y_IlYTDd2akBe++a
zIs%$VY_DXz>$2Hw-az<<0o3yC8!dPq@WHi`Iz`{dvJA-XdzC=|(+qa&TLp3+rB5Uw
z(Z>aMAFgdmWXKCjeUu1#wz&<r;jNq$#6iv9MKYp6%zJ-)-IdtK&!Y4OJqCSU3ufgC
zAd-Y;2X#6?BCG`-15^?D4s8L%qNaeED>u1F9O`>z)U+*P7_jrYf(+}6E%gbL?JcV4
ziY-k}%4Q@q-m(yfWR9Yeo@tVwJY<N2wZ?za6eSGY$#6WB`iQyLz>{b1VH?Hd<UNx&
zil2EDJs*Dr{wZ}%AGUrHkfwtDbiSrqVJ?Xr{TX7(p>-UMV|1Y^b(8oYMzy;-xa&I?
zy41Pe-8}Y?fLZ%3!V&ci5>uDy#{izQ@0y&xjx|;j9Z$C0`(ju>8$_y0lK`rUcnN+;
z=$HV&gMT0ktiK-=G2vol0Pv0&boZh<bSSYzI(2{CWfuNG>uM&5gt5Iu&BhX>#q(+B
za4n%ro(lfeaQcB+>u4fVV2>Fq6>y*hK#WcgKG|sQkWOyr-t=Ny74`;0i^u1j8F=l}
zt6xoIlh-{wL7I`D*8cWW;!dpTrl_9ANBtunUfcaRwGiit&`g1H$*0^tcWEZV^ufNX
zx6FV2G=3C+99K&lVyZKgJ(9B~z=owa)#Y0(7ew)CN16yoo+c*Lm>7ur-3dy}DS!uu
zMm6o*XIO?fArVw>CbQZstK)w)qL<=;1Ww<blR@gQjEjOA4SGVCI??_&=C~w&0xYVO
zN-SU1UBdp+Hv<C0yC5KlEUts-Pp>Ys3z~n8q!HPdC8GA7W^*ahaz|9geg@sOXNTM9
zjON+er(395$ZjG!T#+{6qQxu7O+qXWP^-zbc7Tp?)eiL2J!y#|dksXGx4#;k!Thq9
z!6EJAq>|i0I_|)jEtj&919#0S?>q`g2cRfKZ31IH)SPRT9GUU3w-&c#2$Lp5GIM{{
zhMD=j?}*lA$^v7KDj9=aPGCEf<?JXp-FXD)gENr<Ei;T0HDb@mLq~))l<Wl({+k2&
zyAc+WSr>nZ@HcvTYSsn?y*Jl{H#h(CT&klYk1hseMvTz&+zyguIkA5`p>Zl-Zmd<h
zWhQ>hT<#ReGp%|}`tckOiXM&9;~alMxFYui@pSJf6Xt{0Tc|3Du<PFY1YKj1fT2VK
zm>W=><jYsoO&`d^HEOa>OsMHPrke+GPzo)s5_w;+Je`SHg~E>^QHII=YsTG3isO(K
z-K<#!sLyffIJf0SZ;^UGRMxaTThUUo6VLrWVL9u*=WqkLK5NPg0rSY=2>gGVV6ZY@
zI|P-Hd~)hm(N7xj2|q-jhTxQg=Tvf)8!8oqwJ8FD0X9U27a`oQw<A8zEKKka8>ch~
z@5iAY8z8zZU&CzDE{RDJe^;aRcUue591m?LC>4|&P51EOXh<X|Z$R@61i%fF+iyUe
zK62x~R1DJ$SW$#>Pcwx?&r^Sswg?;v^J!q}zb(6Vryu+<0G!lxY4f#Yi|4CtnrI}>
z!Kl>~-LJDZ`QEEuwwR>bS8{%l%<@FU@QlxrP#p!9I!Oe(`$g?=N>*gQHnOqpuQ#Lo
z*6jmv%pj4xD4#;^n3}Di2dfFGvksT>lKkuw=;VfDI^d9E$^^2*K-hmBb3_drmBSt=
z`dg-)){(n*TZ>UaqEzOBq_kUB7Yr|E4>~8L@xrUiEhsmA0EL*9rQW&%(y-z_o{Rsp
zeIu3_1ciDmTAJ61J3BUU=Q85dNrJ#q5%_{*%G1q>C^fLwiVM@|3WcL4{-d-&_a#rl
z%7l~YPGBm`U^FSNwfTRUdGTo`<&eEdr8u<D0!dmX29+u#AtJuh^to#=n546=Ez(=v
zeeeQeA(8Xe%x1=xh-8VP2fs0&-G)4S*r_~rVBh?=RTbo?j%D+krztDbF~tupt<kRO
z@UvE<!uiTWgmL<BFv_mr9CX!%mkZb{Yp`5S?a_xkD^Flwad3Y?M2v9e)fUb9>GSpK
z5=nikE;=9W`OYzWd<!op>Ci_Av{IvplU-<@u%b7D1lpwjM{SI6qDu$^743)##*loY
zfU!Z+71RWz@1p-<-Qp1;<5e&hWG{5sK`t^PI8qg+-VI-rx^@ME+#Dg@VV&eCR%he&
zY0@=@(?3PC^-O<}WrIo1tVaUt@xuRjfYj7=w{+szUuWPXSZkBG_GQX>`Lh_JHEiwL
z9gL&#E)lMQ&-3)6dlPz%E!Ixm-K+k6+M@J99#Ek`^#!1A*A5pmBU*x+ep&F2(<~Sd
zL>-q*_r0~73rcQ_;Z^AjQ(cF3{}hCK{#O(^TwS~Oey4vm%@GS~LM#v@*a}q@=75{B
zgJxidB%+%;d<YT;;d(5MSh_&+l@PC5x-rw3Y)toF@Oy2y0O*<3jaPw3dAY5Nbx_Rn
z-}38%E{|B60yf5^I*~>VHjX;6-^S9!3we-vQ2E|PWk<wUAVYP3-%Bg%eydPab}gak
z-wNtU-hF=@MFR%lpXs+3bwI?(1pBB(?1ZbAk3>e1{ay6}GpfMz6y7F9fW%!)VFh`n
z|CZ^NFlNYOj}lB?fm(1rW#S1CxMl*+Rq1L7>K9yWu|eYt>vTTN-hBl+SdnQg_%w5K
z)`sx3W?cVPKwHu&>WZIZ&gKed6tFoL^^is#yOw_|i>Hl}nLa^%#(`niY=qwRFosvH
z10SqykmhGPn&8pU)?v`qQ&0O@=`gM)nnq;X$KL-fzsPRK!D)9-J+jdUd*sYza2{s*
zIb+NSHyok=y&!U1g}q``zD8=xJCx@8y4*xwMff-uuD3{qvSc^t3PtuSMI(@)x<E)6
zqQZac=G4Sw93=o7A!yJ|<G*fW1iqc0@#IjeH{(U>A`RJZM8S2)aaAsiR}!}?yFf7w
z)-}X}q#GR7o<AQ*Z7_1dp1iZ2UXvQ9%tNz($~>wd8Zy8=M^f&F-zc26)rE#ieK4jW
zw981fFxf~lB%*Rm#V4PT^|}5M6C*6qoiKmG3zoC}kw?GauFZJ-zaav@hQCtgIeR#}
zXb970f+~Pd9)(rRR+o-ksFs?;rijkdsWPBhqXm9CFi{;{4WI$>WyqUBkYKX9P7P8<
zaNmqhFI*XRR?s{wN_%hsf6+cS{;5r4>2iX`zQ&3w-H6ILl?-&VcCw0#k=-MgqYi()
zpdwO~Gkc!mV_uQh+qpB8Z4N0O6NTOicud*4s9+W6Byn=*I>xxwxUgpgEK)x)`COO$
zs+zr|6_9>-mk$6@r<=U@S%kO+Pze4zeEU@5e}EECvB(y&<G_lobA;)#jNCvWtIFx8
zfv5QcSd~D4(p1Yh#gMzD-C!s;hkAc(IrR$;Qg+jd440&qXXQ;(zSX6$e>Pjll}MKK
zHV+6CT+e$N5*|V-oL)CDV6TLC|Io;SP(#dG2WP&sQ1;n8eC0DK7L8j9@e;H}186c|
z7ubqz_l{N6$m#~fw$?ka=5bQFr#_zJW(<4J)v<~grBPIQVWs0gsP(c7|CWC}RZcJS
zN6ZX@Nhrk%1uqKDi!1=!uXJVQH|!%v0M`TIF7(x5jFsy=b|Q4uYjR^#<E{av@mNx$
z{(v0Ts3Zr_&8Wp6S`QUAu9=GL3hr6Q(T$er9ZwB4#nfgz+zlgp3ZnAQ%>tV}4KeeL
zuKx2Lt_hyEON7qhYZ=L;Kv#bf0rX=Q$(98}vvsY(AQ^f0YiWSq59U<JP&%H9;hc8l
zb;o~XVgrjuma$*W6kUUI{REGs9@XXuMBL9X!$u+G5{8sFr$_ZRAxG~{^$Oz9az$Z4
zf#Je*2(L8(3%u^#ED#YPs?&mlH5y2fEv?U2o77OH!RqKsMd1IKT1$WCsRO)h`J+#T
zDDQNiu8a;}f(07ZeT4K@)M^oUOXoJ(aCE0KMfD6rND5Pw@a0YM{u{m8nP^RBM$9{Y
zIRcr}(gJW-=M`Mr<UJ9s+zO9<0(+dje30b-xSTy9r)7!PU7Y94vQ`p;Rz`BgsyHHJ
zvPwblvRGa6HYHLSM!J6-v&w&y@eYn|qSxd1MNv-kDFLY!TlwIhvY>xlK@zCJxXZWJ
zJwf7?g&^WzX+H;NjNvMGTU)(+?N?7^D?D@o0+|p&caI5}Tb=l(_|>W3IQUXzKO<%_
z^3ev-+&Y<q2^?EqT`~5kLe-&2`6qz&1FZyY>o*kTM3S*wjwpW;9Pzu<V>3^R=O3;8
z`AmG>*izijhbrn8I#<b@V63^Yp~LWIajsPQ<f7rwB~}WXv3cEiT*ZOB^0UhBShuGg
zv!CU?NeF8zjm=cIJqBeVVnHR=%t3-K(mDyTg4_xvC#D;pO$t`@ZSTDPQ$k$LwdzBs
z_Ct7g=B4uqo>qUDN^%N2I7sfZaXSdhCG!STmu#nLH4boZ^ABe?s%bl!kx@^IREIhW
z+|Rt$@#UQ^=a6c3VZ>bZ@qd)!u}#QtT=6v;24@?YHSbmQY<<bsB6}1UMb78j(3z|;
z9bLz6KU6US#FA+Eb-R&NlHd_L7((ehnz1C$>+IUjCZ~V;`;9NACJl`62S$8V8!H_?
zoezTCv;@}LL>^*4hG)v%Z~7Fv0<VnYCaM*4=!s*PZ8O;?8@zHVlGpDkEwr#m8GW3_
zP|XQ{zX7XAU=(L2VhoFXFl}^+#+)|+XYSg5%qAY>lykaK8LAv*dd*<+E@S*Ph{x4F
zkJ~bXsV0AE?7UWW!fOqD<fhZpzC0nI6+yV`HGy<_2UFz|V2<q<1|0kXxK0w+DK^ZW
zI}mGAII8^c6|tDBrxBc7as|=eI>0NkSoa!QaG?yx9s4bW)Ph1M%k-$=F{BXG?j%4%
z)d6PoAa|)cNH;~#0{lC89_<3z4l&R=&&CpoOzD5%r;}c#b;5c7XCde}2XWs1%ayJ+
zWc7MKs8R<Fg!vY@7J^PRBe{>TPr5qktbd@Ko7L~$a$K(J;QEfnwL*`wV^k0c+q1YH
z@&X$aQHSuYkz`*4A_rE}<)b!F;m)S(P13`cAl+eQ+mlB}A02zXEvt`>c((hz$}z{H
zOb&nT0iiV3mBee+Qh)LL&MfuTIL-X`);6i3H!Ivxv{eoIl8{w}B8nH9xSH7ig=8~g
zdbo~_A#(}TLgRZx1V@I7&Vfm8^VLbAqxYY|yY4_`UO1`=dL%T}FiKJ2&uB>`V+Uy_
zfDdM&yE!)$ClN>_%s<AVo^Y-0UnigLT6TZX=E?f3B7OAYz<}H<#Qbkdw1XIX_TYKD
z!0rvQ8Jae9#-*|ny?#VWNW&ys;_M^Ii0z*_wG<c?_Gdu&H=eUAS-L%cv8>#(@gn&O
zzT&c#-AV^cfmo!aGJsxINn8{U$)d4c(+Mfjpn?p%hH{D1FHe8k_rEZ+-d?x*R6&0W
z*if0P`b!H4snQ<yLs;KA^@s=?hADOZk0pE|C0evj*84l&lQzPge!#)OPohqAWU=S(
zKD8}fX82(MY`xCUEiPLW=a}*Xk!u*f5E6UO@wW~H+L%U^BoV;7a5D^bH|*i7FDbl&
zy1@NfKc<+jZZ44Usb>$Pm)tR@CE9-}xG$zHortr+*reji79%r^h<7~2oBj55DcYN_
zF|bUQNjaw7=_lR{7jIVKBq3saP7(u>E^}l0&bGfCGKys1Kb>2HLI0g-jO7o>EN*o?
zeV1M?K)SEAED+6ueb_78t_ZCe=_<LLOM|_o3F?EH=I)2Ufjoqwhvzi;Q#F6&5Kjip
zLqm5Vz8rle?1*vP5AAvHCyg6KrYGZ?WJYoJHJ4#(eb(gA31n0@PY0+kjRL-rKZ%E~
zU&RvMVRhoy0}wsZN#-Y5pYBuVfI)+#?N?uhO4@M14UL~7MKqgIV5b$3>CB@o7Rd5h
z5Tgb5ptkECm;h>+^h<_z6vuygl*@hY{L^v!XCv;IC&Zn1E!Atki#*ygPc|XXmrO}J
z%aqDXu)tb%mkn&hXJQVez7cEViKl9|_H9x7+rx!9XA6yKk(vt@?p^#qA$p+>ne~PA
zGUY}i5Qpkq=;w4pehie5;QbkKY6eB*Q^Grg5B5CE!meEYxF(mS$hdz4#Xlm<1&@rA
zbE0<Bmw)8Pt(55)puSaQ;Gp8i@-~RtLoFf@(2<!j*HimX#nF#AbSY?9q+`n%J3sU0
zEC*ebd()aEC4o>qK*eqi^3}1dq3t{%%akk0UfNyv>91eUA9F(PAC2GUwpp(RzdOlp
zdWLNn`RT-LdRDK!`BZ<CT=f9k%#6h~lStEiq4{mc-w@S!?a?4gcT96m;OqUVAao~n
zArnDIbVgX%<aD+(V{}UzCO(;GY>3nvbx84d^YKinc?BcI)6YLidhpR8vf66at1w4l
z0*f(>aer;PHe_j7X&_Zokr=uC;?SP;b)<;}pNt60G2RFZq_}@Zi5cbW2U~3o(34$+
zBbsjg5fSyA+S>d2)sO)rj>5!Q2N-lbu3D!@)|BIg{O*np#M%G**+}_|s-ol0@-ZrW
zI_NY(z~)<rkSpt@c_Nq7gdNiMR{Lt1%noW(M21QU#wHDTAiBeJF!*>W(L{rLIt8LX
zzE@OJ^rquAvps*YTLm%ii1>1F;8IUoiHma#L}cS`ZZ)v4?pAB90DL<tUaNqU4rnog
zfG^`qq{J@E9CPSCS0WLAsQ1Rm&Y^86!uo!aL&5n8RRvQ2emRn|^mrH%(H&d3p!x;J
zH2WVBXeT84{@61&lg%+y&FUHHa4e%G51-V42=f6PK!$&8h0o}Jspe?)oGdM(!uSlW
z30wmL6{)g=+my46Nxl3uMf~h+3f6PAmLuM~zp|&5rG$!E$`CWqrnu3=_yHZmcRC^K
zuI|@C?($`U`a7YjU&124gQ+FGyn(%RsJ5<}R(9`Kx~Mzztg)r9q4EObZ#5=|h5MAw
z_P4TkL)(8ygTqAPsZ7j;Gn1`_Lac=S6~Vp1@zW0GB+H)+XXtCQ0Sbp{Q$%$M>a2Ba
zAi_a5D?M4iN4;NnMDH(qix|bo<SseOsYN$xv+r>8Ojr}+nB;WO4zWwk&bdEsIVpxq
z(JJr^o_TD8_UtM0B``tCOs^q+p52?-;pEa8=9hmAepBQZq(Y(TdQTKzw6eb>5;%Uq
zuF9TmvdewG<&gaV3iNM)@$AR8Xn-Ly^S5dyzjq_~5J}cH4CxLmcJ_RGC)GnSs8bJG
z_40<<+}vy{B3;S5y1XesDat+}B}8yQw0nm1tEcaPHd&cNs|Lxp-ez|h%4|!*LTwsS
zHo1Rbocx=Lg+y8zqo<5`-Y@oY?EuZ@`EUl{Y0-pEGNFF=L3s3ei_j#NKEPGU#HSCy
zWOL56XZkOiLRMrp!1`dflK>I=*Nh&5Jd#UFHS5neIiov(I?|%2^D!7LWOFB@R9oSL
z*aa$aAhsYIB4bUi6<zU(sHf}?sc21&=r@15MJP`!1<~$gIWEyBj$LJo+U_@yCu5-m
zTu;#2e)qRC^pjFlsngK0ZPFb#>-czQU+Nm&ll-2mRJZ{M@kupPHQ3n*-;aw6{@veC
zPocHCDj;`WL{9JUW!Es>`M47>y3R|L*d-zFRQtH3vh22MmNuSKk@oft?VFw$g5G~f
z5qG3QX%>OzGN6y>l7L#6+K|2(dvSx8r)=}-s9WRHUNQy6W^4HUy~=ZIh}gs5okpZD
zUfPSfBK7#{N~72-ut$6-Ddl3TH|Hs=eo-oC!z6dbLGo}rbhw2@H`4ujE{<c=Lh@%d
zxk{eDYu~=$jwQ9(lOmcCH0DavrL=#HUDaz<k<J*LxHiw3_S)!dvia`}2n=-+DMYjw
zQeHQ2w<DcqJn)`oaiMs;3{T7=c>VwCqXXcK6-VCYGc;Ed`K0qb5Hlk0?`)JaU}m)~
z?M34G7cYQF%}$h3w8aEJ-t=dRIFJxQn>Wk+;7PYLigKeSg;)?{`-?~g=sbVKP79$G
z;f~?SiImxs0|UgVK53K$KTvyb2Hf7ZvjO0SNz`_q1o<O%UAx)70#Q-ln|*fI|LIiB
zBj6l9?<XApQMiL9$2A|WIbd=D2mX|-Xfl92sNQ=DPfe(d-&d)4z^1ZHUJY9yfRlv0
z8<<H57zjw4HLb=gY-B=SDHnfdGC~@P&wXn!k?XE<4Kxw`P@qBAVtsflc!Am#{KV~E
znxtGEqLz1z3a2A|6)j~cQtuZ!>g=_^-XJpN!|gi(B>*tZkcR9<liE6CL24%ks}qKz
zMQz(&;~e+gjym1rBJFn1HX)=w5KJ@rw^j*#h)`jvc|oyL#B(!4ufl(vG0vx2YWsEw
z&+!!0pv;>Jy@X}ATZgIlC5}TZ6ImmF&RI&z-K(l-qT|h53_c`y5YnD}MKC4QU@F`y
z-ym7jt?T{nI1`v&Fd?$AZQXv>=@1kee@8v(5dVx7`6IlU`ndXp6q%?s=wWU-R0=S|
z7^tc(s+O}8E^P;;<4J$FYo;7*FFlL3q5ysAW4N?Qc)ZEZyQuSpmA_f*D4oZz3pJ)V
z_<Ujn{S1yJH!33X6||eT%}ESH`|`R5ye~C~=5WTNuK8N?Y6SL^=Krgt+sXnKvwpJO
zX4oD=3gdyv71#TtJcP<8vG=OzZBb8Q4(V)-pqA2@MFB^|HzR+@o5#Y0KE&~=42W?(
zSok1iJ0E_cAJj76tSvg<X`UBaC))`vmcHlK0!W3rWohl@CQGfB73uyWow-Y3qc>~?
zv`{-Rt*Fn3z2R@wZRQeM+A;2!)m>UVh-aETwO{zvx1$Gs$h5!NS{wEYHm2$xqHu2k
zHJYIjf}pcA?y7$@_relx(y5t)d48{o?dsnynSNGV6Z}AAJ%|cj`)0#WQLxT=)YKAH
z6szq;Y3|cr!dc<{wx56CP_x3gmvGGH1XN^#2+ZX91Lsss=QTVtn|dv^ZiNv@J`!l=
zn1V-|wqFH$Aqdks?6gp!O9Fm^{nqMR-DKN%;QROW#Ls_YrNQI+58Q4Vq?I#bCIc=3
zOgtXakm!*-LIG)Q(c<?4i;C;j*HmC8F0%(lSnpF-P<(-FbO-E+K+T(2E|J3xMT6p8
zduF6c6Ye&S)wzVr<qr5tF{x<he0y$?%%=@p)S_P>ve|$y<2W=?yNk4%W;BqtW8%v{
zM=XlesSJN;EfdOIgxd{z_$Q}H2(_vSSqB8eFEw)GBaW(!a28!P$-8|*qN|#X+4B&d
zA@?ZBk<7tuY+m*__?F8FVrIMx{NA4v@snRO*PCmk0O-!0gf$sok+=i=c{8#Y6DSP0
zr1+RXkuw(gTHus_K8khnU~|Io(>NS`nSKggVyS;w*7{wusb;~$U%Q>~hb~y}u;`Kt
zEcg5iNDFw%6H$&wU1+%+$Q!6+kOv4EX(ypZatP3chDSj@X|-$7K&0J8huZ+vcvS&i
zGFEAA3xMXtG|__N>MzB0Z7X{at2>KQ@F2A`a0!b=`~l>fc>QCTnJ~**QBklyjtp#J
zk>!6@nFD1Gd_d!qusI+4J=hHotZ>3mS~ynQTx;Q#8ZOIPi?@f3EFZ?^Grd0o2c=#k
z6>v;y#lghN@~C~umyFMd8AzDdNwN(E36K>lc>CD`BXagW7@OZOKL|daN4uha!S-^|
zGf$MjiM!PV)F)66#9PKgQ4xg4c`y%d$*O;J-w!3GJ3HbuKkqw%&;uFLnMUP{T9njZ
z_{G-<%5w`4Zko^?lp*=R+QvNf_seh0mt=6gKaUsaSIwMY>~R1IoK9G&$VLXZttIP_
zIx4FoRoihUUWvv(BE;k0QxcQ0Z%AmUkTHU73tYeqs(Nm+T<$%4G@9RC*a1VZAx(d}
ze>@UcY(I1GfQLv;%PMvbWkPxO227}27|IqFgEU-tp|;j_qT;U%9*yF(R2!oL)DizD
zQWM&)+ogJJ4R?9Ugpb{!%Q0t_Kh*(F*h-JA>w4GU_gW-}9?+wJh*6?yUUSO9M3C%Y
zV2h?32g7mQ(R)O;o(pDKi9@LvkduEE$@??+i}qiO7FK0*G#P)b&CGM~)JR<zPmTyc
zW!@)O#J>u;wY!ctrCF<Qh$JP3lA1&RZRDRSYXi51Hr)ix#_j2A4&4eknVT_0tJdDG
zIMhN@wm2Xdj|sUVLyjD+6KReHVqk(t0(wiDeT3P(scnoMhs1}UDVP5T%5HyhV=25b
zqTi2`7Todd7(3j%AK<sPqP?uoFs=eorcQv%BP3(XN29GMe91}I+HH?9A@@A>KKR{U
zmRdYmSX}%xL<f6-O0!Q`85Y`zMim}t%;2nW`H10*1q53q;d60aPGr#~m|6=HRvwYu
zf?eogw>TW1AE*h<UR~u6?lXUOdN-_c`4KsHEw{wIFl1#|C{7e0K{zf)m33{ModAt*
z_?y!p2(fNWICIR{GQmBmH=*LYOuh=w@;hH=P;_Ia^#9OoL;d!1v(qRMs9lx=7wOd6
zl^yqO(s^V^3z%#h>h=*M6-^tV+~Z#>-$%%+?(@Kcca1RGxyuz6$wPmQ7;fk}=7G61
z!QINm8|xwOw<Y_EwBUSP_2fc!EYt0#r|wa=PY!RyJjP2G8|Z%p^4lyUL#a8nhb(Z8
z45yzd+}=v4pT5(meibkn%H?PJav_L2LLYVjQFl9u!8HNdVhLZht#A1tDcp{xg|n(E
zzWr7K%4cOTon*uE@?d{tcACV=3R99g>(N+a(=m-2YN#5OI`pXZCN!iqde%<W;q&5i
zR8O*PPkXkv=Omb<m6yZd(lAGX7Ao}&wkKIQGuH3zS6<Z3(8cq{z#BDpGjGNg9nLtO
z8bBMUx|yqsW?xD8HJXK$=^W0Y_kALVS!8!I4{Gj5eO*djSUG=>W&5#+MW7sckkjJp
ztVjMAEU0qJv@FByi7@c@lZ|IW6@{SD0?j2p3oMUmr@OCmH8v>GT>~ubU=_MRqYvwc
zeDkNqdCrCi^nu9m5X>!X=uG+tZQ7&gEye!^M?BsPDp8fmfYfej=PXXmRraQdBiQ`b
zh~+(Xyv>ZTh9!TO;tV=1Wj%Skrozj35}k1)bA$r(&#?|lgkWS1Bg&KHptJ<n%W0u9
zw6C|Nn^o~)_j;>}Wq@2s!%wwFghQY+=X71BOunr8iz$}Uz>eF-K5pN8kb-7b!Hwu_
z$_NUkCUO*KASlT0?vBgPvO^qD4-bq2?n#^EshLIG%EW&`%FTPOZ7U!TOn!m}L{b-d
z@vh$7uMSVxL2uVHr;$fusWS>hKTyD62t9Cui{bco0n0(*<uogIsZ1fJwrHZTMsE87
zB2n{eNllkGf7(8wY$yneUd1=Tl;+wJ!QlFb&OE>(ua5V>ju6)^1C%W71i=rJqY9e}
zJ~R)?FByOEhd49Jt`g)i|Emlq#p+zg)3^dapM#V4W^*&E&*K13GAvM}bpqehs7GUy
zuyPR!^TnSucYSTK>DcMAX8@iww1^+SFoE&7Pr~O^p|#3B!Mc+p-<uuErPtlI+2Zus
zk|?8-nK*JKrbqPV(>;MAK|^@HeN?k|-KAeI8G3(|<~-N7c2abIpHTp0;U$Qk|5nRj
zMK<QI#Nn$+Eop;kRx0PoKGH7a?Za`Y{`&$y8oLhsn1l8?G5cL>)60`fY>5T%NpB%L
z&IftL16!rY^Y@mZ#|xJ>&5VX!z)JTV7?3C>NE%h%<iBrR7jb>y#yR3zpF<L6%YKM<
zfHZ$TYuru!e6W%Bl8j3?94R9rahAK7M)w7Jd%MLvV3OS+d=rzV+7Q(Gm_c3El*;EK
z9*@05PLT~|^}a#-Y2R$u2L>kusvWnQYOcN(%x-?+r3oc8V^D`7wVJ`Mt413+)2M=S
z4Km?h7Bv&1Kdf%DZe?Wxj!XbIcK~a>PGo;Os~;sJhZhN8;lE~P11{Vt5Sv3O0EYp?
zSr;V^!J8RU1@ufztI;fuje_2tx<9MC5HnU574eslr*;EZxQc)NwssgAT#w=Ms+c%#
zgX1tVs<n3TW5g{MJ+cxt(bu8SN+j$3zUrvym<T(ysutqm<U(0PV4Bvm2;Q_*|IvR%
z=UM!yPo-r+%-M>qVr9RJ!EA=zMk!BLL9?fz#WOEk^~9ekd1CV%!(Hac-&82G)Q7xb
z1yZZNt(fW6r?j|25jzqI<p81s)s+3=Ixz+%#Yi}P1XSA7??EvKDl>o+Hk?nNQr`f2
z5hcHxQ26T)>|Xfa4a`S3S&;ERw=jRJdlSvmaw*$dGtw+rN^fbWZuTsGbx#7nsb`?r
z!|{$CxMk%Xy>fdJGmv10NHCMG(~=O}fB=Wid5C{9aI<*IrmkNXNTnRvvTvdZ4tisO
zJQbni88ASO@62ps^)7t$z5pyH534qWWNA!w78i;Fn@EHq*@)hU<gNG#-4%aDc$r61
z7p=I|+1C6iBVZ+D)_QORPM)g<BAJDYpm%4))I1?=8ii+goGBZZv<=rY(a69zIGBVz
zfM;qh*$=|R<=kRHvv^D$LN%x-5?8RKhYjL21EWy4>+ZT@gVeW&;Y0r23CN|QcqQWS
zTJ-g;puFK@Q@5Ba55@zpWhQ^8^f{}qaxzoq&MZ5M<y+tyEiFubL^$_E7sN8lZKw-S
zafi7QmS-%BIrTWkMU)a1+x&+UHYM}jfQ(pIU~*~cw%r(XD9a{*&luES50~}?AsS2r
zNtxCy_TeVcsGxt#)j2%F0$(~#!ZR_CGik?MagB<cvD=V4+y9Mt2MB-v;-Yf^nE+9i
zhr-+*WJ<dyIQBf~)O^TRA<S_UZjmU$;O4BMcwilt;jAS%$b|4muYDCWK&3za1*MHJ
zIb&$kBoLKo!T0895jR4m{#vun>D|8lk}(^QD}484F!WPKZiOc_sTCuu2hFvAuhd2!
zbW!01)|yYi{#dJa_S1i7l}ivHknE;_HTG_793CLjPeM}w#XZy-j_C7^(#W9}2^37D
z1+s+2sBNm>Kup?!m;bf}Z^YQO(fUP11LY155^SFL+M2SACnv*KNCN56RgQp42eidt
zvRIS&-CT04voHC)hW*TR`?eOMNU>O>YCP4ny3>}Bj<A8AXq12S$9V_>cTbr(aL3Qm
z$&?fXAKZWLL47V@#oag&#VdexRMWR3Y#ufz&q7EG@O@kpdw+^-If>3NNO);@fAe%K
zuR)ZYK#f&-Ai#Jk%o2X#73u#Q7p@Xl37nUc5~mgAme7PJUC4>=)uq>6-lXsToS_0h
zgvV=8>$I{)ZX$npyGXfDw)=ArRv(ronp{0Fq(I3y;?vTX4huG2NEUzA6<gwHs6Df~
zi){So{#W7$&JoPc^Id{%7+MebIv_V6*s`iU0p~nIG8ibBCU4#tdH`Mz-m!iE33KXs
zOb_lOBjY~g!mIb02R3>OEdQkDP4+ka#vxAslsdX%hVOqAF$u%fYt$d!7T~U@l$^Tw
zMdiY~k3L;*ije<HXW~(p=+9_q4%`1BejnF;cvZ}-=uUp795mQaoV?j3+2jbqEwCmm
zSApvy-6!_e#h~S0;kAWooxptiD9@!Jf`9<lk;Xh5$6^R-W@~@@<EQNR`NTd*9IU{M
zq2M;{0h52d07RJ-gxw#+PNG+#jHCE1jxmi^RxW)T6La94;Zec+sf8OBcaCgW?W)Ji
zP%vgh^EnC{3OT)1*ER!ou+QQ7HYi^x%g8iCP^fe_AxmGnti_y>W6MFHF}l&uSar%8
ztVZQ@S^7^_;Dm!m#(-j5-dN>q`A|l8xUjNYEdqb(v?NPNJO0Em;k8mYp=53K*LX?7
z*vp*#HY44p{Wkt*h!f&adm>Ev@o6$C9g@&iaZ|xxtKKWonT>UQsnu=ZN5^P??hq@n
zTC-$<YKqD(SUCD4LFHOBhb+HG&4xrV%I&bIE33o~Ywf=QTx&dNJ+M|L{hb$7Uu64L
zI7xqiHdU1>S1>p1o<slS53=@fBpoUho%HViMa#AFdfF*OsX}BLpVPuO5^bcSqq3u1
zlvWUuWoY2@i=E8@A6Qt@d@7>PDLc3L5Xkp(zP)_ZZIBD%do}rO(-9?!_FEJr5201n
z#h%PZ<8R<_BXQx?U@xF?HMm{aJqoa0t2lqPoy1{Vox+6s_UFYCQ;m}QqYQ{$fSlqX
zF#E-S#4Vsal%l8XWZj8TgLTN)r%EK@04zpk22wpw$*A~`=b@C+DuGotb^4eB5(6cu
z3e(HXXHMI#pM8jiMW8DMALxC%Rg4I~<ITn%KfkXm(fFKaB0A~0>-H{(EYFv!M~Z)U
zK>t5H^m{OQK8vS_bJ+MTg@ZTmBnHPOxMEyGwunsXVCNj?^5&r9eok(`VgFFsYyHCu
zbI>C)-#S$^bQyCkY`RM&qS55ZrDPE|1KBdedcL5Jzr;&HH1)XZUDEX6#pLAsI?b)R
zNq;Xahk9Wh5F40wTe0HxGaMhKNY8)iUrC3pBx762Z4a$z_la2Dg;HT6C1;b@@67JU
za6KyS^rD4>Q4Bz%8~?vG@O^ZpOzc9?{QS;EBKN?LC3dCk@jT5{dZU-j)m0txRaqIs
z)&uXlq_FSh#pLQVDwU(ch)-djv~-Ze-9>edpLwyhhxio*i-CGJ>!n}~`5b?G<@H?x
zMZE3#0><3h4>T(G>_3W?Es}vg6agZA0d&anzq<QOII^dPU&$Xp;g?bC7D2(oD{S2q
zxqG-vom9MEN2O(yIKFD_i)S&DvF9>?z>aH1mkaw|$RSPT{#;Y{4wsnb<~mPzb>vC0
zZJZ+OhziOpc{Xy!j=05u$>V>zpR0wc=Q1pAf02JqW`1PX$W^>7`c+!llw>5!Pu&<s
z8n;^V-OJ<d@`SdTI38leqZ>PmHhg(2yJiJ$a<g}70UQ~!@!hfe)Vg#%2czb1)KvWP
zxbwu>IIO^vCXmm%$c7P%#y;qYiPH&oUK}6_LjyX0_T6Y8WIHvqfJ%SM{TTWPA;NEi
z6xcBVI^*G7nq!9HK9?n{Yrpb09+;GV2q}yb-229dB-!$5)N4Qnqk7|<&FG^Cusf&t
zC25NJ;>dzI)1NI-Sjr8p1FZ-iv$fA#r$>(gSu!!HncU>%0H{z$5w#p$0;T3~31X<D
z`FMa|6>EavuxJss)|7uqvEVu|dxVeFzog~PkTY9Qy!xXnl}Tw#k1_(;CWsTSl1O^=
zD<)@sAWryA|Mi=60#UgCZTc7)7Cl&8!-iY-nI`IE;0#93i*|yvc#$h*j7Bmi7Cl#N
z9{{vt@6%20Zv8>oqDa+hj@9NO@@t+h74$JH#k?Q?R!rAjj`>VNQ4b@o(N=Nq=+3>(
zoaxSAmGBqZ$|IsIAvuyI_788qwW%G}yN^<(e^uU`85jZYtr2WQft+2wh=q!0X-Itn
O(cgJBAqPnS0000=7{5^f

diff --git a/cert-manager/htwg-1/cert-issuer.yaml b/cert-manager/htwg-1/cert-issuer.yaml
new file mode 100644
index 0000000..d61870c
--- /dev/null
+++ b/cert-manager/htwg-1/cert-issuer.yaml
@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-ca
+spec:
+  selfSigned: {}
diff --git a/cert-manager/htwg-1/kustomization.yaml b/cert-manager/htwg-1/kustomization.yaml
new file mode 100644
index 0000000..18dc29f
--- /dev/null
+++ b/cert-manager/htwg-1/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cert-issuer.yaml
diff --git a/htwg-1/flux-apps/argo-rollouts.yaml b/htwg-1/flux-apps/argo-rollouts.yaml
new file mode 100644
index 0000000..3cd4a7c
--- /dev/null
+++ b/htwg-1/flux-apps/argo-rollouts.yaml
@@ -0,0 +1,22 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: argo-rollouts
+  namespace: kube-system
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: argo-rollouts
+      version: "2.40.10"
+      sourceRef:
+        kind: HelmRepository
+        name: argo
+        namespace: flux-system
+  values:
+    installCRDs: true
+    clusterInstall: true
+    controller:
+      replicas: 1
+    dashboard:
+      enabled: false
diff --git a/htwg-1/flux-apps/cert-manager.yaml b/htwg-1/flux-apps/cert-manager.yaml
new file mode 100644
index 0000000..1ea8602
--- /dev/null
+++ b/htwg-1/flux-apps/cert-manager.yaml
@@ -0,0 +1,35 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: cert-manager
+      version: "1.20.2"
+      sourceRef:
+        kind: HelmRepository
+        name: cert-manager
+        namespace: flux-system
+  values:
+    crds:
+      enabled: true
+---
+# ClusterIssuer is applied after cert-manager CRDs exist; FluxCD retries on failure
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-issuer
+  namespace: flux-system
+spec:
+  interval: 2m
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: gitops
+    namespace: flux-system
+  path: ./cert-manager/htwg-1
+  prune: true
+  timeout: 2m
diff --git a/htwg-1/flux-apps/gitrepository.yaml b/htwg-1/flux-apps/gitrepository.yaml
new file mode 100644
index 0000000..d31fd0e
--- /dev/null
+++ b/htwg-1/flux-apps/gitrepository.yaml
@@ -0,0 +1,12 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: gitops
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: ssh://git@git.janis-eccarius.de/NowChess/GitOps.git
+  ref:
+    branch: main
+  secretRef:
+    name: gitops-ssh
diff --git a/htwg-1/flux-apps/ingress-nginx.yaml b/htwg-1/flux-apps/ingress-nginx.yaml
new file mode 100644
index 0000000..22fd2f2
--- /dev/null
+++ b/htwg-1/flux-apps/ingress-nginx.yaml
@@ -0,0 +1,20 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingress-nginx
+  namespace: ingress-nginx
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: ingress-nginx
+      version: "4.15.1"
+      sourceRef:
+        kind: HelmRepository
+        name: ingress-nginx
+        namespace: flux-system
+  values:
+    controller:
+      service:
+        type: LoadBalancer
+        externalTrafficPolicy: Cluster
diff --git a/htwg-1/flux-apps/kustomization.yaml b/htwg-1/flux-apps/kustomization.yaml
new file mode 100644
index 0000000..c486311
--- /dev/null
+++ b/htwg-1/flux-apps/kustomization.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - gitrepository.yaml
+  - namespaces.yaml
+  - sources.yaml
+  - cert-manager.yaml
+  - ingress-nginx.yaml
+  - sealed-secrets.yaml
+  - metrics-server.yaml
+  - redis.yaml
+  - argo-rollouts.yaml
+  - nowchess.yaml
+  - postgres-tunnel.yaml
+  - secrets.yaml
diff --git a/htwg-1/flux-apps/metrics-server.yaml b/htwg-1/flux-apps/metrics-server.yaml
new file mode 100644
index 0000000..51c298a
--- /dev/null
+++ b/htwg-1/flux-apps/metrics-server.yaml
@@ -0,0 +1,27 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: metrics-server
+  namespace: kube-system
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: metrics-server
+      version: "3.13.0"
+      sourceRef:
+        kind: HelmRepository
+        name: metrics-server
+        namespace: flux-system
+  values:
+    resources:
+      requests:
+        cpu: 50m
+        memory: 64Mi
+      limits:
+        cpu: 100m
+        memory: 128Mi
+    metrics:
+      enabled: true
+    serviceMonitor:
+      enabled: false
diff --git a/htwg-1/flux-apps/namespaces.yaml b/htwg-1/flux-apps/namespaces.yaml
new file mode 100644
index 0000000..6e3e40b
--- /dev/null
+++ b/htwg-1/flux-apps/namespaces.yaml
@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nowchess
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: redis
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: postgres-tunnel
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ingress-nginx
diff --git a/htwg-1/flux-apps/nowchess.yaml b/htwg-1/flux-apps/nowchess.yaml
new file mode 100644
index 0000000..d2792f0
--- /dev/null
+++ b/htwg-1/flux-apps/nowchess.yaml
@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: nowchess
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  sourceRef:
+    kind: GitRepository
+    name: gitops
+    namespace: flux-system
+  path: ./nowchess/htwg-1-prod
+  prune: true
+  targetNamespace: nowchess
+  timeout: 5m
diff --git a/htwg-1/flux-apps/postgres-tunnel.yaml b/htwg-1/flux-apps/postgres-tunnel.yaml
new file mode 100644
index 0000000..5b473e2
--- /dev/null
+++ b/htwg-1/flux-apps/postgres-tunnel.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: postgres-tunnel
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  sourceRef:
+    kind: GitRepository
+    name: gitops
+    namespace: flux-system
+  path: ./postgres-tunnel/htwg-1
+  prune: true
+  timeout: 3m
diff --git a/htwg-1/flux-apps/redis.yaml b/htwg-1/flux-apps/redis.yaml
new file mode 100644
index 0000000..4272aa6
--- /dev/null
+++ b/htwg-1/flux-apps/redis.yaml
@@ -0,0 +1,33 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: redis
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: redis
+      version: "20.x"
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  values:
+    architecture: standalone
+    auth:
+      enabled: false
+    image:
+      registry: docker.io
+      repository: redis
+      tag: "8.6.2-trixie"
+    master:
+      resources:
+        requests:
+          cpu: 50m
+          memory: 64Mi
+        limits:
+          cpu: 200m
+          memory: 128Mi
+      persistence:
+        enabled: false
diff --git a/htwg-1/flux-apps/sealed-secrets.yaml b/htwg-1/flux-apps/sealed-secrets.yaml
new file mode 100644
index 0000000..1f92998
--- /dev/null
+++ b/htwg-1/flux-apps/sealed-secrets.yaml
@@ -0,0 +1,17 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: sealed-secrets
+  namespace: kube-system
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: sealed-secrets
+      version: "2.16.1"
+      sourceRef:
+        kind: HelmRepository
+        name: sealed-secrets
+        namespace: flux-system
+  values:
+    fullnameOverride: sealed-secrets
diff --git a/htwg-1/flux-apps/secrets.yaml b/htwg-1/flux-apps/secrets.yaml
new file mode 100644
index 0000000..a3ba062
--- /dev/null
+++ b/htwg-1/flux-apps/secrets.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: secrets
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  sourceRef:
+    kind: GitRepository
+    name: gitops
+    namespace: flux-system
+  path: ./secrets/htwg-1
+  prune: true
+  timeout: 3m
diff --git a/htwg-1/flux-apps/sources.yaml b/htwg-1/flux-apps/sources.yaml
new file mode 100644
index 0000000..cd8a693
--- /dev/null
+++ b/htwg-1/flux-apps/sources.yaml
@@ -0,0 +1,53 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cert-manager
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: https://charts.jetstack.io
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: ingress-nginx
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: https://kubernetes.github.io/ingress-nginx
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: sealed-secrets
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: https://bitnami-labs.github.io/sealed-secrets
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: metrics-server
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: https://kubernetes-sigs.github.io/metrics-server/
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: bitnami
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: https://charts.bitnami.com/bitnami
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: argo
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: https://argoproj.github.io/argo-helm
diff --git a/htwg-1/flux-system/kustomization.yaml b/htwg-1/flux-system/kustomization.yaml
new file mode 100644
index 0000000..a4dd62f
--- /dev/null
+++ b/htwg-1/flux-system/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# gotk-components.yaml is generated by: flux install --export > gotk-components.yaml
+resources:
+  - gotk-components.yaml
diff --git a/htwg-1/root-ks.yaml b/htwg-1/root-ks.yaml
new file mode 100644
index 0000000..797e622
--- /dev/null
+++ b/htwg-1/root-ks.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-apps
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: gitops
+    namespace: flux-system
+  path: ./htwg-1/flux-apps
+  prune: true
+  wait: true
+  timeout: 5m
diff --git a/nowchess/htwg-1-prod/ingress.yaml b/nowchess/htwg-1-prod/ingress.yaml
new file mode 100644
index 0000000..62ada79
--- /dev/null
+++ b/nowchess/htwg-1-prod/ingress.yaml
@@ -0,0 +1,62 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nowchess-ingress
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - http:
+        paths:
+          - path: /api/board/game/[A-Za-z0-9]{8}/ws
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: nowchess-ws-active
+                port:
+                  number: 8084
+          - path: /api/user/ws
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: nowchess-ws-active
+                port:
+                  number: 8084
+          - path: /api/account
+            pathType: Prefix
+            backend:
+              service:
+                name: nowchess-account-active
+                port:
+                  number: 8083
+          - path: /api/challenge
+            pathType: Prefix
+            backend:
+              service:
+                name: nowchess-account-active
+                port:
+                  number: 8083
+          - path: /api/store
+            pathType: Prefix
+            backend:
+              service:
+                name: nowchess-store-active
+                port:
+                  number: 8085
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: nowchess-core-active
+                port:
+                  number: 8080
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: nowchess-frontend-active
+                port:
+                  number: 80
diff --git a/nowchess/htwg-1-prod/kustomization.yaml b/nowchess/htwg-1-prod/kustomization.yaml
new file mode 100644
index 0000000..7638894
--- /dev/null
+++ b/nowchess/htwg-1-prod/kustomization.yaml
@@ -0,0 +1,53 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: nowchess
+resources:
+  - ../base
+  - ingress.yaml
+patches:
+  - patch: |-
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: nowchess-env-config
+      data:
+        QUARKUS_PROFILE: deployed
+        CORS_ORIGINS: http://141.37.74.142
+        NOWCHESS_COORDINATOR_ENABLED: "false"
+        REDIS_PREFIX: nowchess
+        QUARKUS_LOG_LEVEL: "WARN"
+    target:
+      kind: ConfigMap
+      name: nowchess-env-config
+  - patch: |-
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: nowchess-frontend-env-config
+      data:
+        API_URL: "http://141.37.74.142"
+        WEBSOCKET_URL: "ws://141.37.74.142"
+    target:
+      kind: ConfigMap
+      name: nowchess-frontend-env-config
+images:
+  - name: ghcr.io/now-chess/now-chess-systems/account
+    newTag: 0.18.0
+  - name: ghcr.io/now-chess/now-chess-systems/bot-platform
+    newTag: 0.11.0
+  - name: ghcr.io/now-chess/now-chess-systems/coordinator
+    newTag: 0.32.0
+  - name: ghcr.io/now-chess/now-chess-systems/core
+    newTag: 0.45.0
+  - name: ghcr.io/now-chess/now-chess-systems/frontend
+    newTag: 0.2.4
+  - name: ghcr.io/now-chess/now-chess-systems/io
+    newTag: 0.22.0
+  - name: ghcr.io/now-chess/now-chess-systems/official-bots
+    newTag: 0.13.0
+  - name: ghcr.io/now-chess/now-chess-systems/rule
+    newTag: 0.18.0
+  - name: ghcr.io/now-chess/now-chess-systems/store
+    newTag: 0.22.0
+  - name: ghcr.io/now-chess/now-chess-systems/ws
+    newTag: 0.14.0
diff --git a/postgres-tunnel/htwg-1/kustomization.yaml b/postgres-tunnel/htwg-1/kustomization.yaml
new file mode 100644
index 0000000..7913d65
--- /dev/null
+++ b/postgres-tunnel/htwg-1/kustomization.yaml
@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../eu-central-1
+# Patch SSH_HOST if the postgres server is different for htwg-1:
+# patches:
+#   - patch: |-
+#       apiVersion: v1
+#       kind: ConfigMap
+#       metadata:
+#         name: postgres-tunnel-config
+#         namespace: postgres-tunnel
+#       data:
+#         SSH_HOST: "<htwg-1-postgres-host>"
+#     target:
+#       kind: ConfigMap
+#       name: postgres-tunnel-config
diff --git a/scripts/deploy-to-cluster-htwg-1.sh b/scripts/deploy-to-cluster-htwg-1.sh
new file mode 100755
index 0000000..44572cc
--- /dev/null
+++ b/scripts/deploy-to-cluster-htwg-1.sh
@@ -0,0 +1,164 @@
+#!/usr/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(dirname "$SCRIPT_DIR")"
+
+# ----
+
+generate_flux_manifests() {
+  clear
+  echo "----------------------------------------"
+  echo " ⌛ Generate FluxCD manifests"
+  echo " ⌛ Install FluxCD controllers"
+  echo " ⌛ Setup Sealed Secrets"
+  echo " ⌛ Apply Git source secret"
+  echo " ⌛ Bootstrap FluxCD"
+  echo "----------------------------------------"
+
+  GOTK="$REPO_ROOT/htwg-1/flux-system/gotk-components.yaml"
+  if [[ -f "$GOTK" ]]; then
+    echo "✅ gotk-components.yaml already exists, skipping generation."
+  else
+    echo "🚀 Generating FluxCD controller manifests..."
+    flux install --export > "$GOTK"
+    echo "✅ Generated $GOTK"
+    echo "⚠️  Commit this file to the repository before continuing."
+    read -rp "Press Enter after committing gotk-components.yaml..."
+  fi
+}
+
+# ----
+
+install_flux() {
+  clear
+  echo "----------------------------------------"
+  echo " ✅ Generate FluxCD manifests"
+  echo " ⌛ Install FluxCD controllers"
+  echo " ⌛ Setup Sealed Secrets"
+  echo " ⌛ Apply Git source secret"
+  echo " ⌛ Bootstrap FluxCD"
+  echo "----------------------------------------"
+
+  echo "🚀 Installing FluxCD controllers..."
+  kubectl apply -f "$REPO_ROOT/htwg-1/flux-system/gotk-components.yaml"
+  echo "⏳ Waiting for FluxCD controllers to be ready..."
+  kubectl -n flux-system rollout status deployment/source-controller --timeout=120s
+  kubectl -n flux-system rollout status deployment/kustomize-controller --timeout=120s
+  kubectl -n flux-system rollout status deployment/helm-controller --timeout=120s
+  echo "✅ FluxCD controllers ready!"
+}
+
+# ----
+
+setup_sealed_secrets() {
+  clear
+  echo "----------------------------------------"
+  echo " ✅ Generate FluxCD manifests"
+  echo " ✅ Install FluxCD controllers"
+  echo " ⌛ Setup Sealed Secrets"
+  echo " ⌛ Apply Git source secret"
+  echo " ⌛ Bootstrap FluxCD"
+  echo "----------------------------------------"
+
+  echo "🔑 Restoring sealed-secrets key..."
+  read -rp "Path to sealed-secrets key backup (leave blank to skip — new key will be generated): " KEY_FILE
+  if [[ -n "$KEY_FILE" ]]; then
+    "$SCRIPT_DIR/sealed-secrets-key.sh" import "$KEY_FILE"
+    echo "✅ Sealed-secrets key imported."
+  else
+    echo "⚠️  Skipped. New sealed-secrets key will be generated after controller deploys."
+    echo "⚠️  All secrets in secrets/nowchess/htwg-1-prod/ and secrets/flux/ must be re-sealed with the new key."
+  fi
+
+  # Install sealed-secrets now (before FluxCD bootstraps) so we can decrypt the gitops-ssh secret
+  echo "🚀 Installing sealed-secrets controller..."
+  kubectl apply -f "$REPO_ROOT/htwg-1/flux-apps/sealed-secrets.yaml"
+  echo "⏳ Waiting for sealed-secrets controller to be ready (this may take a few minutes)..."
+  kubectl -n kube-system wait helmrelease/sealed-secrets \
+    --for=condition=ready --timeout=300s 2>/dev/null || \
+  kubectl -n kube-system rollout status deployment/sealed-secrets --timeout=300s
+  echo "✅ Sealed-secrets controller ready!"
+}
+
+# ----
+
+apply_git_source_secret() {
+  clear
+  echo "----------------------------------------"
+  echo " ✅ Generate FluxCD manifests"
+  echo " ✅ Install FluxCD controllers"
+  echo " ✅ Setup Sealed Secrets"
+  echo " ⌛ Apply Git source secret"
+  echo " ⌛ Bootstrap FluxCD"
+  echo "----------------------------------------"
+
+  echo "🔑 Applying gitops-ssh SealedSecret..."
+  GIT_SECRET="$REPO_ROOT/secrets/flux/gitops-ssh-htwg-1.yaml"
+
+  if grep -q "REPLACE_WITH_SEALED_VALUE" "$GIT_SECRET"; then
+    echo "❌ $GIT_SECRET is a placeholder — seal it first:"
+    echo ""
+    echo "  ssh-keygen -t ed25519 -f gitops-deploy-key -N \"\" -C \"flux-htwg-1\""
+    echo "  kubectl -n flux-system create secret generic gitops-ssh \\"
+    echo "    --from-file=identity=./gitops-deploy-key \\"
+    echo "    --from-literal=known_hosts=\"\$(ssh-keyscan -H git.janis-eccarius.de 2>/dev/null)\" \\"
+    echo "    --dry-run=client -o yaml \\"
+    echo "    | kubeseal --controller-namespace kube-system -o yaml > $GIT_SECRET"
+    echo ""
+    echo "  Then add gitops-deploy-key.pub as a deploy key in Gitea:"
+    echo "  https://git.janis-eccarius.de/NowChess/GitOps/settings/keys"
+    exit 1
+  fi
+
+  kubectl apply -f "$GIT_SECRET"
+  echo "✅ gitops-ssh secret applied and will be decrypted by sealed-secrets."
+}
+
+# ----
+
+bootstrap_flux() {
+  clear
+  echo "----------------------------------------"
+  echo " ✅ Generate FluxCD manifests"
+  echo " ✅ Install FluxCD controllers"
+  echo " ✅ Setup Sealed Secrets"
+  echo " ✅ Apply Git source secret"
+  echo " ⌛ Bootstrap FluxCD"
+  echo "----------------------------------------"
+
+  echo "🚀 Applying GitRepository source..."
+  kubectl apply -f "$REPO_ROOT/htwg-1/flux-apps/gitrepository.yaml"
+
+  echo "⏳ Waiting for GitRepository to be ready..."
+  kubectl -n flux-system wait gitrepository/gitops --for=condition=ready --timeout=120s
+
+  echo "🚀 Applying root Kustomization..."
+  kubectl apply -f "$REPO_ROOT/htwg-1/root-ks.yaml"
+
+  echo "✅ FluxCD bootstrap complete!"
+  echo ""
+  echo "FluxCD will now reconcile all components. Monitor with:"
+  echo "  flux get kustomizations -A"
+  echo "  flux get helmreleases -A"
+}
+
+# ----
+
+generate_flux_manifests
+install_flux
+setup_sealed_secrets
+apply_git_source_secret
+bootstrap_flux
+
+clear
+echo "----------------------------------------"
+echo " 🎉 htwg-1 cluster bootstrap complete!"
+echo " 🎉 Cluster IP: 141.37.74.142"
+echo " 🎉 NowChess: http://141.37.74.142"
+echo "----------------------------------------"
+echo ""
+echo "Next steps:"
+echo "  1. Seal secrets in secrets/nowchess/htwg-1-prod/ (if not done)"
+echo "  2. Monitor reconciliation: flux get all -A"
+echo "  3. Check NowChess pods: kubectl -n nowchess get pods"
diff --git a/scripts/deploy-to-cluster.sh b/scripts/deploy-to-cluster.sh
old mode 100644
new mode 100755
diff --git a/secrets/flux/gitops-ssh-htwg-1.yaml b/secrets/flux/gitops-ssh-htwg-1.yaml
new file mode 100644
index 0000000..063d30f
--- /dev/null
+++ b/secrets/flux/gitops-ssh-htwg-1.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: gitops-ssh
+  namespace: flux-system
+spec:
+  encryptedData:
+    identity: AgAOzHL/nvgowOSUS8s8OooQSxNrFEBHDZYca7VzfOJLlF+nehigNUS4GSqofRQBJObgPL51TfSyTVYN+Sg5Ddvq8+JKtySkjNil4MpgiT1LPpiL/PylKF3AZKqhpmvwzDxh0TiJFHijljW/YqbnuTo4y3TFs/PKFErrE5WCO/WufG5fEO6izEFnC4YsmD2DVrMewqn9UEokdxsj7IyMtY3hHMBnGoaLsMHeH6HpwWZ/75Di/Cf7Uwl1sEYesMfz21QOR33uGpmQmguIrwrL5A/FQCzMtldZD3fhbad1biqs/uXqn3im5p8o+CCj42dvHnp2wSB3TC78iwdvGGArwVRxh8+GuNAy448JBzh/HveUsrCnzyLKgBwCON8k2w83ZNr0JjoNCmL8MiA/WhVPmF+rj5b7BoBfQ+UZgb1w/Yfn8vD0j8O4D1GINVs8Us2SYsjJ75maBOyU8nOEHzl9ytEUFzCA5yCPslp6Btr41njIVV2G7obTE9hqReea1oIl0K9XxRm9etEIhfnNbPynXTMaHlIvkf1ufRpNH4F/lNVGuwHPLD+y4LXoydu7tr/glL+vKBN+diDKR7R8ilnLbkCNYJ1GELZfGyjeMG5mc/bwXod2BbKNjMVxxZIdw/CtVBTnJE+vGagofNsn/VlbS4iVbwAdAfSazYdTK/HxgmypjxoRGxPNoIdPrFLRL25/M8CcY1o0SUZg6eUtET1dbcw2Vd0lxm29TvKD8RKVsPahque7EVw1aVh5fUYBthbAZ7gzlWpbq/nEXPBQwQSL+yt/4C3hIzbZOV1WRtYpPJK3BrWILfPF1HBrdvSiDwm4H75mms8qon2qbmmeJo6LYQIgG949quUXSeA2Cz4licAQxA3jjDwefW+hsfb7zy9pS6yZscxkpRNb+HjGuIcjZzqT06oRQhslBNqX5CmXqf5ZLg9gfG1Dgq695HjDG+gdFuSdGiY6H/sqbLp9BVwBGMLnwa+iMu+L86R9Y1nI8Hel/nwB/KoeQBzXdVWE4Hf1am4J0soyPgHDClNYwMQO60rxXcD+HurrgZnUOFq281ba6DEHIzY6ymg5soWWlYJ6veck7FS1jaj8Ihbg8ydlMzjUBnBWk4ZKs1nI7vdfvbgTgpA9lxTIrdQRIXxx+o3uUawL6DaTOubTZhyExtn3zhidfHn+cshGSipvA+OZctJ0J9aoBQdWLkhqecUdCJFiwwLmjVbIk5yBEaLQuQB//cw=
+    known_hosts: AgB+ku9oRGCXi2OCTd8gY0QZ5P36YKb7cKL7sItNEvT2hKrD8DtF3eQK2vx4TXRsj8iuBnCTRu0m5ID+Rbi7I+mDQq2CZodpnIyu1iKIwx04xQROFPiKXQ6EFaEl94by6r5jn9cyCrkgG7HifNDD3Z1jXNPgWn94msNH++lA4oXhqzhCzN3sgWrcvEFDv7CizRZ4A2ARaL5pY6tDw7JnqejSsz+dwg6Ar9WlLPtJYAE5ZMtOE5M4tCUZ326z2waisjed86VbnORAX2uu1ARpnxg+jhtNni3Ixk4xZokzknvJfV9Kyq9wc94c2WzVs1MQjhl6IPoyALpii2VdvPqmIsmpLefmLPT1/8/NyHGzgwf6E8BUINr/TN9y2WjIu7/Y4NXlqPV0GI8bES3Y4U1h4yV3Sp6KifFPCUavx7a/D64j0CDC/ZlQglke+qVo6nFTEzgnBDLkaqPnN2Inl1KvhwdAvVCT5eUC12tdbfZ2A9uQIhT0k/A7cn30zcIA+LGT5JtKu9B69aElhDtrrpRksyJsclSzC2YTOSzHlavnaoOPqHM0ywSN5w3l9XIPiHyjKQNzWjzaWVkOq3MQbrPU3yM2zq20KqzIv1eBYstVie/u8yi6CDgumWPEYVzg0gAXlN+RZtoLBhbwrn1Bvlz8bsSYfggmjlFj4RUGkkRGliMbZsLkNGq4zca/437bqSB84oAt6l8lm4RezAg3ZOl9l8pAfmPxKTzy5r6YjQKdQ8lo8DKcjad49M/92fg5xbSfw7MqXclu+L5vPp1DrObueAG8j32xeOBn798ebWTccGag7/h8mwyLmQ6wWQ2SIyozNLWKFGUybZj6tb6vYQ9qW/c+KMXcexvkSMcEGYs+Dtk5KMOkBk/EkWLvbHrg+w2krL5V81WAyjJ7bYPKtArdagpd9c1pvQ6tXqWmqpPwWlDqpj5YmO8xH5LVtXoYPKuvk5qFrZJq1PpTU6zSozGWjOtiA+tNunZZQNOqqe1Q6SM5ZW/7YLTJpP2O5a0dih0X8kjFBbAVLdGQ5aDjnUGLUzWGb4imsNM+vknD9cPUfXv/3x/MY/xb8ghoGby2W5a6dZJO1GHquIfNkTjgDVqdbJvRM4dJC1MsIrnUyeviId4FkIecSSZ7iq+fcKMHKGU6Ljrtz4kz599paL10S/a3Tk3UR/bhCDncr9koChudbKQWdUMwwletTSCCIw/F0qC+wsLS3ul55xYFU3nsKXIm5suF211lutPseOnDne+iizW56uePDpUOJjMlGDFVza/rBaKKtMftTseUM7bxOw/NDcmO3rRqbgPom5UPUifCTWPwKhAVDl7xVlSAK+ARdxOvWs8kOd3DEUzqp4FFl37e54QiihiowG/BYOYiJyFmKmbiMsMLUwH18wM90Xptow9XnZLxYt1Yo4DvOMrFN8qi+hTn/Ddmk8WvK70QSBz0dW04Q1ZleeheN1MKjcL6F3/4+bj80JkRotM6aGgpG9XsYiY0/p0MG6gVLWb2xKYD+3gb8d0y/HLi462XldO8nwlD18KiB24ECV6yw1p2uFrewYsa6qbtMP/yPZbd6mqtj1hrvp5ZtIGLQ+x89n9O4wWyF+4Bk3GEH8VqxVMQKISdrqpL4UJ7rvi9gcRjSHtMsF2H9VlXaPJAZ/02peJEZwGG4zH7+8g5/Zf/nz+i6o89hIvp6rYCCh7HtSPG3fEX7Y19x3C9OtG8harNF9BzDpcLDMnPsiQr9W7aaAc9EK1hR8nwpZf4n6B2B692rzXz9ovHivW/VtaTdRq8AEr898iJ7D9gu587kiyjI9RZwT6qqL+z5JV/pm5UZQV2R5VYbkNjZ5WdliJuWYo+TkE4YSpp7Ut+FJL7+GybhFVJvVTpF5F0VU1FxZJaZ3+9Isw5nk0U9uwIzz1ODePH3wZ8cjuNAkz+1zT8nCGU25oXDLv2GMKSv6cjuZfNvt6Or8bq5FxNm9g5Gdhy29R8VUPWN1kzKLElZE7Ydzsu5ImGFdQ2Fmso6xD42EVw9yL1q2E0kLopyK0ls1aqcdYZ12+o0kvtEn7uGYI/FmbJ5LM2LBpAuoXCRghgv8zGZ+WpDQYssJLija2NSopqV58o+fMmSehqUmccLS1Ng/ZMVnmHa3we2vHV2gDsszKPgTIqBRTBjQNrkpGfQ1bbeN/q+apkYUX0JZ+7tD6c8dcvYI2Qr0v6PQxGhhf+X5VwXm20t6hvlmKCiE2LGADXZNwW71rnQh9y
+  template:
+    metadata:
+      name: gitops-ssh
+      namespace: flux-system
diff --git a/secrets/htwg-1/kustomization.yaml b/secrets/htwg-1/kustomization.yaml
new file mode 100644
index 0000000..f2f49be
--- /dev/null
+++ b/secrets/htwg-1/kustomization.yaml
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# Seal each secret with the htwg-1 cluster key before uncommenting:
+#   kubectl -n nowchess create secret generic <name> ... --dry-run=client -o yaml \
+#     | kubeseal --controller-namespace kube-system -o yaml > secrets/nowchess/htwg-1-prod/<name>.yaml
+resources:
+  - ../nowchess/htwg-1-prod/ghcr-pull-secret.yaml
+  - ../nowchess/htwg-1-prod/ncs-jwt-keys.yaml
+  - ../nowchess/htwg-1-prod/ncs-db-secrets.yaml
+  - ../nowchess/htwg-1-prod/ncs-internal-secret.yaml
+  - ../nowchess/htwg-1-prod/remotek6-certs.yaml
+  - ../postgres-tunnel/secret.yaml
diff --git a/secrets/nowchess/htwg-1-prod/ghcr-pull-secret.yaml b/secrets/nowchess/htwg-1-prod/ghcr-pull-secret.yaml
new file mode 100644
index 0000000..1173efa
--- /dev/null
+++ b/secrets/nowchess/htwg-1-prod/ghcr-pull-secret.yaml
@@ -0,0 +1,17 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use:
+#   kubectl -n nowchess create secret docker-registry ghcr-pull-secret \
+#     --docker-server=ghcr.io --docker-username=<user> --docker-password=<token> \
+#     --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ghcr-pull-secret
+  namespace: nowchess
+spec:
+  encryptedData:
+    .dockerconfigjson: REPLACE_WITH_SEALED_VALUE
+  template:
+    type: kubernetes.io/dockerconfigjson
+    metadata:
+      name: ghcr-pull-secret
+      namespace: nowchess
diff --git a/secrets/nowchess/htwg-1-prod/ncs-db-secrets.yaml b/secrets/nowchess/htwg-1-prod/ncs-db-secrets.yaml
new file mode 100644
index 0000000..8cf9e94
--- /dev/null
+++ b/secrets/nowchess/htwg-1-prod/ncs-db-secrets.yaml
@@ -0,0 +1,17 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use:
+#   kubectl -n nowchess create secret generic ncs-db-secrets \
+#     --from-literal=ACCOUNT_DB_URL=... --from-literal=ACCOUNT_DB_PASSWORD=... \
+#     (add all other DB keys) \
+#     --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-db-secrets
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-db-secrets
+      namespace: nowchess
diff --git a/secrets/nowchess/htwg-1-prod/ncs-internal-secret.yaml b/secrets/nowchess/htwg-1-prod/ncs-internal-secret.yaml
new file mode 100644
index 0000000..f47b83d
--- /dev/null
+++ b/secrets/nowchess/htwg-1-prod/ncs-internal-secret.yaml
@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-internal-secret
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-internal-secret
+      namespace: nowchess
diff --git a/secrets/nowchess/htwg-1-prod/ncs-jwt-keys.yaml b/secrets/nowchess/htwg-1-prod/ncs-jwt-keys.yaml
new file mode 100644
index 0000000..bd4c720
--- /dev/null
+++ b/secrets/nowchess/htwg-1-prod/ncs-jwt-keys.yaml
@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-jwt-keys
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-jwt-keys
+      namespace: nowchess
diff --git a/secrets/nowchess/htwg-1-prod/remotek6-certs.yaml b/secrets/nowchess/htwg-1-prod/remotek6-certs.yaml
new file mode 100644
index 0000000..8090b7e
--- /dev/null
+++ b/secrets/nowchess/htwg-1-prod/remotek6-certs.yaml
@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: remotek6-certs
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: remotek6-certs
+      namespace: nowchess