From d2cb40c680b2430126face5506b309115f85d8c3 Mon Sep 17 00:00:00 2001 From: kumarvna <36370570+kumarvna@users.noreply.github.com> Date: Sun, 31 Oct 2021 12:28:45 +0530 Subject: [PATCH 01/13] updating private link config to support existing DNS zone, VNet and Subnets --- main.tf | 39 ++++++++++++++++++++------------------- variables.tf | 15 +++++++++++++++ 2 files changed, 35 insertions(+), 19 deletions(-) diff --git a/main.tf b/main.tf index 5e4b7a7..1b84e19 100644 --- a/main.tf +++ b/main.tf @@ -21,12 +21,6 @@ resource "azurerm_resource_group" "rg" { tags = merge({ "Name" = format("%s", var.resource_group_name) }, var.tags, ) } -data "azurerm_virtual_network" "vnet01" { - count = var.enable_private_endpoint ? 1 : 0 - name = var.virtual_network_name - resource_group_name = local.resource_group_name -} - data "azurerm_client_config" "current" {} data "azurerm_log_analytics_workspace" "logws" { @@ -316,11 +310,17 @@ resource "azurerm_sql_failover_group" "fog" { #--------------------------------------------------------- # Private Link for SQL Server - Default is "false" #--------------------------------------------------------- +data "azurerm_virtual_network" "vnet01" { + count = var.enable_private_endpoint && var.existing_vnet_id == null ? 1 : 0 + name = var.virtual_network_name + resource_group_name = local.resource_group_name +} + resource "azurerm_subnet" "snet-ep" { - count = var.enable_private_endpoint ? 1 : 0 - name = "snet-endpoint-shared-${local.location}" - resource_group_name = local.resource_group_name - virtual_network_name = var.virtual_network_name + count = var.enable_private_endpoint && var.existing_subnet_id == null ? 1 : 0 + name = "snet-endpoint-${local.location}" + resource_group_name = var.existing_vnet_id == null ? data.azurerm_virtual_network.vnet01.0.resource_group_name : element(split("/", var.existing_vnet_id), 4) + virtual_network_name = var.existing_vnet_id == null ? data.azurerm_virtual_network.vnet01.0.name : element(split("/", var.existing_vnet_id), 8) address_prefixes = var.private_subnet_address_prefix enforce_private_link_endpoint_network_policies = true } @@ -330,11 +330,11 @@ resource "azurerm_private_endpoint" "pep1" { name = format("%s-primary", "sqldb-private-endpoint") location = local.location resource_group_name = local.resource_group_name - subnet_id = azurerm_subnet.snet-ep.0.id + subnet_id = var.existing_subnet_id == null ? azurerm_subnet.snet-ep.0.id : var.existing_subnet_id tags = merge({ "Name" = format("%s", "sqldb-private-endpoint") }, var.tags, ) private_service_connection { - name = "sqldbprivatelink" + name = "sqldbprivatelink-primary" is_manual_connection = false private_connection_resource_id = azurerm_sql_server.primary.id subresource_names = ["sqlServer"] @@ -346,11 +346,11 @@ resource "azurerm_private_endpoint" "pep2" { name = format("%s-secondary", "sqldb-private-endpoint") location = local.location resource_group_name = local.resource_group_name - subnet_id = azurerm_subnet.snet-ep.0.id + subnet_id = var.existing_subnet_id == null ? azurerm_subnet.snet-ep.0.id : var.existing_subnet_id tags = merge({ "Name" = format("%s", "sqldb-private-endpoint") }, var.tags, ) private_service_connection { - name = "sqldbprivatelink" + name = "sqldbprivatelink-secondary" is_manual_connection = false private_connection_resource_id = azurerm_sql_server.secondary.0.id subresource_names = ["sqlServer"] @@ -376,7 +376,7 @@ data "azurerm_private_endpoint_connection" "private-ip2" { } resource "azurerm_private_dns_zone" "dnszone1" { - count = var.enable_private_endpoint ? 1 : 0 + count = var.existing_private_dns_zone == null && var.enable_private_endpoint ? 1 : 0 name = "privatelink.database.windows.net" resource_group_name = local.resource_group_name tags = merge({ "Name" = format("%s", "SQL-Private-DNS-Zone") }, var.tags, ) @@ -386,15 +386,16 @@ resource "azurerm_private_dns_zone_virtual_network_link" "vent-link1" { count = var.enable_private_endpoint ? 1 : 0 name = "vnet-private-zone-link" resource_group_name = local.resource_group_name - private_dns_zone_name = azurerm_private_dns_zone.dnszone1.0.name - virtual_network_id = data.azurerm_virtual_network.vnet01.0.id + private_dns_zone_name = var.existing_private_dns_zone == null ? azurerm_private_dns_zone.dnszone1.0.name : var.existing_private_dns_zone + virtual_network_id = var.existing_vnet_id == null ? data.azurerm_virtual_network.vnet01.0.id : var.existing_vnet_id + registration_enabled = true tags = merge({ "Name" = format("%s", "vnet-private-zone-link") }, var.tags, ) } resource "azurerm_private_dns_a_record" "arecord1" { count = var.enable_private_endpoint ? 1 : 0 name = azurerm_sql_server.primary.name - zone_name = azurerm_private_dns_zone.dnszone1.0.name + zone_name = var.existing_private_dns_zone == null ? azurerm_private_dns_zone.dnszone1.0.name : var.existing_private_dns_zone resource_group_name = local.resource_group_name ttl = 300 records = [data.azurerm_private_endpoint_connection.private-ip1.0.private_service_connection.0.private_ip_address] @@ -403,7 +404,7 @@ resource "azurerm_private_dns_a_record" "arecord1" { resource "azurerm_private_dns_a_record" "arecord2" { count = var.enable_failover_group && var.enable_private_endpoint ? 1 : 0 name = azurerm_sql_server.secondary.0.name - zone_name = azurerm_private_dns_zone.dnszone1.0.name + zone_name = var.existing_private_dns_zone == null ? azurerm_private_dns_zone.dnszone1.0.name : var.existing_private_dns_zone resource_group_name = local.resource_group_name ttl = 300 records = [data.azurerm_private_endpoint_connection.private-ip2.0.private_service_connection.0.private_ip_address] diff --git a/variables.tf b/variables.tf index 5b4c617..80851bc 100644 --- a/variables.tf +++ b/variables.tf @@ -141,6 +141,21 @@ variable "private_subnet_address_prefix" { default = null } +variable "existing_vnet_id" { + description = "The resoruce id of existing Virtual network" + default = null +} + +variable "existing_subnet_id" { + description = "The resource id of existing subnet" + default = null +} + +variable "existing_private_dns_zone" { + description = "Name of the existing private DNS zone" + default = null +} + variable "firewall_rules" { description = "Range of IP addresses to allow firewall connections." type = list(object({ From 908a777d14e1c003650a06f9b8b7a9910c06d8f8 Mon Sep 17 00:00:00 2001 From: kumarvna <36370570+kumarvna@users.noreply.github.com> Date: Sun, 31 Oct 2021 14:43:43 +0530 Subject: [PATCH 02/13] updating examples folder README file --- examples/README.md | 341 +-------------------------------------------- 1 file changed, 6 insertions(+), 335 deletions(-) diff --git a/examples/README.md b/examples/README.md index 9e41427..da0886b 100644 --- a/examples/README.md +++ b/examples/README.md @@ -1,342 +1,13 @@ -# Azure SQL Database Using Failover Groups with Private endpoints +# Azure SQL Database Terraform Module Terraform module for Azure to create a MS SQL server with initial database, Azure AD login, Firewall rules, Failover Group, Private endpoint, and corresponding private DNS zone. It also supports creating a database with a custom SQL script initialization. -## Module Usage +## Module Usage for -### Simple Azure SQL single database creation - -```hcl -# Azurerm provider configuration -provider "azurerm" { - features {} -} - -module "mssql-server" { - source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" - - # By default, this module will create a resource group - # proivde a name to use an existing resource group and set the argument - # to `create_resource_group = false` if you want to existing resoruce group. - # If you use existing resrouce group location will be the same as existing RG. - create_resource_group = false - resource_group_name = "rg-shared-westeurope-01" - location = "westeurope" - - # SQL Server and Database details - # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 - sqlserver_name = "sqldbserver01" - database_name = "demomssqldb" - sql_database_edition = "Standard" - sqldb_service_objective_name = "S1" - - # SQL server extended auditing policy defaults to `true`. - # To turn off set enable_sql_server_extended_auditing_policy to `false` - # DB extended auditing policy defaults to `false`. - # to tun on set the variable `enable_database_extended_auditing_policy` to `true` - # To enable Azure Defender for database set `enable_threat_detection_policy` to true - enable_threat_detection_policy = true - log_retention_days = 30 - - # schedule scan notifications to the subscription administrators - # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` - enable_vulnerability_assessment = false - email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] - - # AD administrator for an Azure SQL server - # Allows you to set a user or group as the AD administrator for an Azure SQL server - ad_admin_login_name = "firstname.lastname@example.com" - - # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" - - # Firewall Rules to allow azure and external clients and specific Ip address/ranges. - enable_firewall_rules = true - firewall_rules = [ - { - name = "access-to-azure" - start_ip_address = "0.0.0.0" - end_ip_address = "0.0.0.0" - }, - { - name = "desktop-ip" - start_ip_address = "49.204.225.49" - end_ip_address = "49.204.225.49" - } - ] - - # Create and initialize a database with custom SQL script - # need sqlcmd utility to run this command - # your desktop public IP must be added firewall rules to run this command - initialize_sql_script_execution = true - sqldb_init_script_file = "../artifacts/db-init-sample.sql" - - # Tags for Azure Resources - tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" - } -} -``` - -### Simple Azure SQL single database using private Endpoint - -```hcl -# Azurerm provider configuration -provider "azurerm" { - features {} -} - -module "mssql-server" { - source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" - - # By default, this module will create a resource group - # proivde a name to use an existing resource group and set the argument - # to `create_resource_group = false` if you want to existing resoruce group. - # If you use existing resrouce group location will be the same as existing RG. - create_resource_group = false - resource_group_name = "rg-shared-westeurope-01" - location = "westeurope" - virtual_network_name = "vnet-shared-hub-westeurope-001" - private_subnet_address_prefix = ["10.1.5.0/29"] - - # SQL Server and Database details - # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 - sqlserver_name = "sqldbserver01" - database_name = "demomssqldb" - sql_database_edition = "Standard" - sqldb_service_objective_name = "S1" - - # SQL server extended auditing policy defaults to `true`. - # To turn off set enable_sql_server_extended_auditing_policy to `false` - # DB extended auditing policy defaults to `false`. - # to tun on set the variable `enable_database_extended_auditing_policy` to `true` - # To enable Azure Defender for database set `enable_threat_detection_policy` to true - enable_threat_detection_policy = true - log_retention_days = 30 - - # schedule scan notifications to the subscription administrators - # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` - enable_vulnerability_assessment = false - email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] - - # enabling the Private Endpoints for Sql servers - enable_private_endpoint = true - - # AD administrator for an Azure SQL server - # Allows you to set a user or group as the AD administrator for an Azure SQL server - ad_admin_login_name = "firstname.lastname@example.com" - - # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" - - # Firewall Rules to allow azure and external clients and specific Ip address/ranges. - enable_firewall_rules = true - firewall_rules = [ - { - name = "access-to-azure" - start_ip_address = "0.0.0.0" - end_ip_address = "0.0.0.0" - }, - { - name = "desktop-ip" - start_ip_address = "49.204.225.134" - end_ip_address = "49.204.225.134" - } - ] - - # Create and initialize a database with custom SQL script - # need sqlcmd utility to run this command - # your desktop public IP must be added to firewall rules to run this command - initialize_sql_script_execution = true - sqldb_init_script_file = "../artifacts/db-init-sample.sql" - - # Tags for Azure Resources - tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" - } -} -``` - -### Azure SQL database creation using geo-replication with auto-failover groups - -```hcl -# Azurerm provider configuration -provider "azurerm" { - features {} -} - -module "mssql-server" { - source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" - - # By default, this module will create a resource group - # proivde a name to use an existing resource group and set the argument - # to `create_resource_group = false` if you want to existing resoruce group. - # If you use existing resrouce group location will be the same as existing RG. - create_resource_group = false - resource_group_name = "rg-shared-westeurope-01" - location = "westeurope" - - # SQL Server and Database details - # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 - sqlserver_name = "sqldbserver01" - database_name = "demomssqldb" - sql_database_edition = "Standard" - sqldb_service_objective_name = "S1" - - # SQL server extended auditing policy defaults to `true`. - # To turn off set enable_sql_server_extended_auditing_policy to `false` - # DB extended auditing policy defaults to `false`. - # to tun on set the variable `enable_database_extended_auditing_policy` to `true` - # To enable Azure Defender for database set `enable_threat_detection_policy` to true - enable_threat_detection_policy = true - log_retention_days = 30 - - # schedule scan notifications to the subscription administrators - # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` - enable_vulnerability_assessment = false - email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] - - # AD administrator for an Azure SQL server - # Allows you to set a user or group as the AD administrator for an Azure SQL server - ad_admin_login_name = "firstname.lastname@example.com" - - # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" - - # Sql failover group creation. required secondary locaiton input. - enable_failover_group = true - secondary_sql_server_location = "northeurope" - - # Firewall Rules to allow azure and external clients and specific Ip address/ranges. - enable_firewall_rules = true - firewall_rules = [ - { - name = "access-to-azure" - start_ip_address = "0.0.0.0" - end_ip_address = "0.0.0.0" - }, - { - name = "desktop-ip" - start_ip_address = "49.204.225.134" - end_ip_address = "49.204.225.134" - } - ] - - # Create and initialize a database with custom SQL script - # need sqlcmd utility to run this command - # your desktop public IP must be added firewall rules to run this command - initialize_sql_script_execution = true - sqldb_init_script_file = "../artifacts/db-init-sample.sql" - - # Tags for Azure Resources - tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" - } -} -``` - -### Azure SQL database creation using geo-replication with auto-failover groups and Private Endpoints - -```hcl -# Azurerm provider configuration -provider "azurerm" { - features {} -} - -module "mssql-server" { - source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" - - # By default, this module will create a resource group - # proivde a name to use an existing resource group and set the argument - # to `create_resource_group = false` if you want to existing resoruce group. - # If you use existing resrouce group location will be the same as existing RG. - create_resource_group = false - resource_group_name = "rg-shared-westeurope-01" - location = "westeurope" - virtual_network_name = "vnet-shared-hub-westeurope-001" - private_subnet_address_prefix = ["10.1.5.0/29"] - - # SQL Server and Database details - # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 - sqlserver_name = "sqldbserver01" - database_name = "demomssqldb" - sql_database_edition = "Standard" - sqldb_service_objective_name = "S1" - - # SQL server extended auditing policy defaults to `true`. - # To turn off set enable_sql_server_extended_auditing_policy to `false` - # DB extended auditing policy defaults to `false`. - # to tun on set the variable `enable_database_extended_auditing_policy` to `true` - # To enable Azure Defender for database set `enable_threat_detection_policy` to true - enable_threat_detection_policy = true - log_retention_days = 30 - - # schedule scan notifications to the subscription administrators - # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` - enable_vulnerability_assessment = false - email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] - - # Sql failover group creation. required secondary locaiton input. - enable_failover_group = true - secondary_sql_server_location = "northeurope" - - # enabling the Private Endpoints for Sql servers - enable_private_endpoint = true - - # AD administrator for an Azure SQL server - # Allows you to set a user or group as the AD administrator for an Azure SQL server - ad_admin_login_name = "firstname.lastname@example.com" - - # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" - - # Firewall Rules to allow azure and external clients and specific Ip address/ranges. - enable_firewall_rules = true - firewall_rules = [ - { - name = "access-to-azure" - start_ip_address = "0.0.0.0" - end_ip_address = "0.0.0.0" - }, - { - name = "desktop-ip" - start_ip_address = "49.204.225.134" - end_ip_address = "49.204.225.134" - } - ] - - # Create and initialize a database with custom SQL script - # need sqlcmd utility to run this command - # your desktop public IP must be added to firewall rules to run this command - initialize_sql_script_execution = true - sqldb_init_script_file = "../artifacts/db-init-sample.sql" - - # Tags for Azure Resources - tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" - } -} -``` +[Simple SQL Single DB Creation](Simple_SQL_Single_Database_creation/) +[Simple SQL Single DB with Private link Endpoint](Simple_SQL_Single_Database_Using_Private_Endpoint/) +[SQL DB with Geo-Replication and Auto Failover Groups](SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/) +[SQL DB with Geo-Replication, Private Endpoints, and Auto Failover Groups](SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/) ## Terraform Usage From 5821453ca916f312509296d05b9f4e2faa0383f1 Mon Sep 17 00:00:00 2001 From: kumarvna <36370570+kumarvna@users.noreply.github.com> Date: Sun, 31 Oct 2021 14:44:08 +0530 Subject: [PATCH 03/13] relese update for simple DB example --- .../README.md | 22 +++++++------------ .../main.tf | 8 +------ 2 files changed, 9 insertions(+), 21 deletions(-) diff --git a/examples/Simple_SQL_Single_Database_creation/README.md b/examples/Simple_SQL_Single_Database_creation/README.md index 7752f82..d39c33e 100644 --- a/examples/Simple_SQL_Single_Database_creation/README.md +++ b/examples/Simple_SQL_Single_Database_creation/README.md @@ -12,7 +12,7 @@ provider "azurerm" { module "mssql-server" { source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" + version = "1.3.0" # By default, this module will create a resource group # proivde a name to use an existing resource group and set the argument @@ -23,17 +23,17 @@ module "mssql-server" { location = "westeurope" # SQL Server and Database details - # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 + # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 sqlserver_name = "sqldbserver01" database_name = "demomssqldb" sql_database_edition = "Standard" sqldb_service_objective_name = "S1" - # SQL server extended auditing policy defaults to `true`. - # To turn off set enable_sql_server_extended_auditing_policy to `false` - # DB extended auditing policy defaults to `false`. - # to tun on set the variable `enable_database_extended_auditing_policy` to `true` - # To enable Azure Defender for database set `enable_threat_detection_policy` to true + # SQL server extended auditing policy defaults to `true`. + # To turn off set enable_sql_server_extended_auditing_policy to `false` + # DB extended auditing policy defaults to `false`. + # to tun on set the variable `enable_database_extended_auditing_policy` to `true` + # To enable Azure Defender for database set `enable_threat_detection_policy` to true enable_threat_detection_policy = true log_retention_days = 30 @@ -51,7 +51,7 @@ module "mssql-server" { enable_log_monitoring = true log_analytics_workspace_name = "loganalytics-we-sharedtest2" - # Firewall Rules to allow azure and external clients and specific Ip address/ranges. + # Firewall Rules to allow azure and external clients and specific Ip address/ranges. enable_firewall_rules = true firewall_rules = [ { @@ -66,12 +66,6 @@ module "mssql-server" { } ] - # Create and initialize a database with custom SQL script - # need sqlcmd utility to run this command - # your desktop public IP must be added firewall rules to run this command - initialize_sql_script_execution = true - sqldb_init_script_file = "../artifacts/db-init-sample.sql" - # Tags for Azure Resources tags = { Terraform = "true" diff --git a/examples/Simple_SQL_Single_Database_creation/main.tf b/examples/Simple_SQL_Single_Database_creation/main.tf index ae6bdd7..54f7fb1 100644 --- a/examples/Simple_SQL_Single_Database_creation/main.tf +++ b/examples/Simple_SQL_Single_Database_creation/main.tf @@ -5,7 +5,7 @@ provider "azurerm" { module "mssql-server" { source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" + version = "1.3.0" # By default, this module will create a resource group # proivde a name to use an existing resource group and set the argument @@ -59,12 +59,6 @@ module "mssql-server" { } ] - # Create and initialize a database with custom SQL script - # need sqlcmd utility to run this command - # your desktop public IP must be added firewall rules to run this command - initialize_sql_script_execution = true - sqldb_init_script_file = "../artifacts/db-init-sample.sql" - # Tags for Azure Resources tags = { Terraform = "true" From 926b58786ba74310bbb9ea838a6af2eb6045a4df Mon Sep 17 00:00:00 2001 From: kumarvna <36370570+kumarvna@users.noreply.github.com> Date: Sun, 31 Oct 2021 14:45:12 +0530 Subject: [PATCH 04/13] updated example for Simple SQL single database with private endpoint --- .../README.md | 195 +++++++++--------- .../main.tf | 155 +++++++------- .../output.tf | 142 ++++++------- .../variables.tf | 0 4 files changed, 243 insertions(+), 249 deletions(-) rename examples/{Simple_SQL_Single_Database_Using_Private_Endpoint => Simple_SQL_Single_Database_with_Private_Endpoint}/README.md (79%) rename examples/{Simple_SQL_Single_Database_Using_Private_Endpoint => Simple_SQL_Single_Database_with_Private_Endpoint}/main.tf (75%) rename examples/{Simple_SQL_Single_Database_Using_Private_Endpoint => Simple_SQL_Single_Database_with_Private_Endpoint}/output.tf (97%) rename examples/{Simple_SQL_Single_Database_Using_Private_Endpoint => Simple_SQL_Single_Database_with_Private_Endpoint}/variables.tf (100%) diff --git a/examples/Simple_SQL_Single_Database_Using_Private_Endpoint/README.md b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/README.md similarity index 79% rename from examples/Simple_SQL_Single_Database_Using_Private_Endpoint/README.md rename to examples/Simple_SQL_Single_Database_with_Private_Endpoint/README.md index e1b3b39..dbae24d 100644 --- a/examples/Simple_SQL_Single_Database_Using_Private_Endpoint/README.md +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/README.md @@ -1,99 +1,96 @@ -# Simple Azure SQL single database using private Endpoint - -Terraform module to create a SQL server with initial database, Azure AD login, Firewall rules for SQL, optional azure monitoring vulnerability assessment and private endpoints. It also allows creating an SQL server database with a SQL script initialization. - -## Module Usage - -```hcl -# Azurerm provider configuration -provider "azurerm" { - features {} -} - -module "mssql-server" { - source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" - - # By default, this module will create a resource group - # proivde a name to use an existing resource group and set the argument - # to `create_resource_group = false` if you want to existing resoruce group. - # If you use existing resrouce group location will be the same as existing RG. - create_resource_group = false - resource_group_name = "rg-shared-westeurope-01" - location = "westeurope" - virtual_network_name = "vnet-shared-hub-westeurope-001" - private_subnet_address_prefix = ["10.1.5.0/29"] - - # SQL Server and Database details - # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 - sqlserver_name = "sqldbserver01" - database_name = "demomssqldb" - sql_database_edition = "Standard" - sqldb_service_objective_name = "S1" - - # SQL server extended auditing policy defaults to `true`. - # To turn off set enable_sql_server_extended_auditing_policy to `false` - # DB extended auditing policy defaults to `false`. - # to tun on set the variable `enable_database_extended_auditing_policy` to `true` - # To enable Azure Defender for database set `enable_threat_detection_policy` to true - enable_threat_detection_policy = true - log_retention_days = 30 - - # schedule scan notifications to the subscription administrators - # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` - enable_vulnerability_assessment = false - email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] - - # enabling the Private Endpoints for Sql servers - enable_private_endpoint = true - - # AD administrator for an Azure SQL server - # Allows you to set a user or group as the AD administrator for an Azure SQL server - ad_admin_login_name = "firstname.lastname@example.com" - - # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" - - # Firewall Rules to allow azure and external clients and specific Ip address/ranges. - enable_firewall_rules = true - firewall_rules = [ - { - name = "access-to-azure" - start_ip_address = "0.0.0.0" - end_ip_address = "0.0.0.0" - }, - { - name = "desktop-ip" - start_ip_address = "49.204.225.134" - end_ip_address = "49.204.225.134" - } - ] - - # Create and initialize a database with custom SQL script - # need sqlcmd utility to run this command - # your desktop public IP must be added to firewall rules to run this command - initialize_sql_script_execution = true - sqldb_init_script_file = "../artifacts/db-init-sample.sql" - - # Tags for Azure Resources - tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" - } -} -``` - -## Terraform Usage - -To run this example you need to execute following Terraform commands - -```bash -terraform init -terraform plan -terraform apply -``` - -Run `terraform destroy` when you don't need these resources. +# Simple Azure SQL single database using private Endpoint + +Terraform module to create a SQL server with initial database, Azure AD login, Firewall rules for SQL, optional azure monitoring vulnerability assessment and private endpoints. It also allows creating an SQL server database with a SQL script initialization. + +## Module Usage + +```hcl +# Azurerm provider configuration +provider "azurerm" { + features {} +} + +module "mssql-server" { + source = "kumarvna/mssql-db/azurerm" + version = "1.3.0" + + # By default, this module will create a resource group + # proivde a name to use an existing resource group and set the argument + # to `create_resource_group = false` if you want to existing resoruce group. + # If you use existing resrouce group location will be the same as existing RG. + create_resource_group = false + resource_group_name = "rg-shared-westeurope-01" + location = "westeurope" + + # SQL Server and Database details + # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 + sqlserver_name = "te-sqldbserver01" + database_name = "demomssqldb" + sql_database_edition = "Standard" + sqldb_service_objective_name = "S1" + + # SQL server extended auditing policy defaults to `true`. + # To turn off set enable_sql_server_extended_auditing_policy to `false` + # DB extended auditing policy defaults to `false`. + # to tun on set the variable `enable_database_extended_auditing_policy` to `true` + # To enable Azure Defender for database set `enable_threat_detection_policy` to true + enable_threat_detection_policy = true + log_retention_days = 30 + + # schedule scan notifications to the subscription administrators + # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` + enable_vulnerability_assessment = false + email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] + + # Creating Private Endpoint requires, VNet name and address prefix to create a subnet + # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name + enable_private_endpoint = true + virtual_network_name = "vnet-shared-hub-westeurope-001" + private_subnet_address_prefix = ["10.1.5.0/29"] + # existing_private_dns_zone = "demo.example.com" + + # AD administrator for an Azure SQL server + # Allows you to set a user or group as the AD administrator for an Azure SQL server + ad_admin_login_name = "firstname.lastname@example.com" + + # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs + # log analytic workspace name required + enable_log_monitoring = true + log_analytics_workspace_name = "loganalytics-we-sharedtest2" + + # Firewall Rules to allow azure and external clients and specific Ip address/ranges. + enable_firewall_rules = true + firewall_rules = [ + { + name = "access-to-azure" + start_ip_address = "0.0.0.0" + end_ip_address = "0.0.0.0" + }, + { + name = "desktop-ip" + start_ip_address = "123.201.36.94" + end_ip_address = "123.201.36.94" + } + ] + + # Tags for Azure Resources + tags = { + Terraform = "true" + Environment = "dev" + Owner = "test-user" + } +} +``` + +## Terraform Usage + +To run this example you need to execute following Terraform commands + +```bash +terraform init +terraform plan +terraform apply +``` + +Run `terraform destroy` when you don't need these resources. diff --git a/examples/Simple_SQL_Single_Database_Using_Private_Endpoint/main.tf b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/main.tf similarity index 75% rename from examples/Simple_SQL_Single_Database_Using_Private_Endpoint/main.tf rename to examples/Simple_SQL_Single_Database_with_Private_Endpoint/main.tf index a80a454..f469513 100644 --- a/examples/Simple_SQL_Single_Database_Using_Private_Endpoint/main.tf +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/main.tf @@ -1,79 +1,76 @@ -# Azurerm provider configuration -provider "azurerm" { - features {} -} - -module "mssql-server" { - source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" - - # By default, this module will create a resource group - # proivde a name to use an existing resource group and set the argument - # to `create_resource_group = false` if you want to existing resoruce group. - # If you use existing resrouce group location will be the same as existing RG. - create_resource_group = false - resource_group_name = "rg-shared-westeurope-01" - location = "westeurope" - virtual_network_name = "vnet-shared-hub-westeurope-001" - private_subnet_address_prefix = ["10.1.5.0/29"] - - # SQL Server and Database details - # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 - sqlserver_name = "sqldbserver01" - database_name = "demomssqldb" - sql_database_edition = "Standard" - sqldb_service_objective_name = "S1" - - # SQL server extended auditing policy defaults to `true`. - # To turn off set enable_sql_server_extended_auditing_policy to `false` - # DB extended auditing policy defaults to `false`. - # to tun on set the variable `enable_database_extended_auditing_policy` to `true` - # To enable Azure Defender for database set `enable_threat_detection_policy` to true - enable_threat_detection_policy = true - log_retention_days = 30 - - # schedule scan notifications to the subscription administrators - # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` - enable_vulnerability_assessment = false - email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] - - # enabling the Private Endpoints for Sql servers - enable_private_endpoint = true - - # AD administrator for an Azure SQL server - # Allows you to set a user or group as the AD administrator for an Azure SQL server - ad_admin_login_name = "firstname.lastname@example.com" - - # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" - - # Firewall Rules to allow azure and external clients and specific Ip address/ranges. - enable_firewall_rules = true - firewall_rules = [ - { - name = "access-to-azure" - start_ip_address = "0.0.0.0" - end_ip_address = "0.0.0.0" - }, - { - name = "desktop-ip" - start_ip_address = "49.204.225.134" - end_ip_address = "49.204.225.134" - } - ] - - # Create and initialize a database with custom SQL script - # need sqlcmd utility to run this command - # your desktop public IP must be added to firewall rules to run this command - #initialize_sql_script_execution = true - #sqldb_init_script_file = "../artifacts/db-init-sample.sql" - - # Tags for Azure Resources - tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" - } -} +# Azurerm provider configuration +provider "azurerm" { + features {} +} + +module "mssql-server" { + source = "kumarvna/mssql-db/azurerm" + version = "1.3.0" + + # By default, this module will create a resource group + # proivde a name to use an existing resource group and set the argument + # to `create_resource_group = false` if you want to existing resoruce group. + # If you use existing resrouce group location will be the same as existing RG. + create_resource_group = false + resource_group_name = "rg-shared-westeurope-01" + location = "westeurope" + + # SQL Server and Database details + # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 + sqlserver_name = "te-sqldbserver01" + database_name = "demomssqldb" + sql_database_edition = "Standard" + sqldb_service_objective_name = "S1" + + # SQL server extended auditing policy defaults to `true`. + # To turn off set enable_sql_server_extended_auditing_policy to `false` + # DB extended auditing policy defaults to `false`. + # to tun on set the variable `enable_database_extended_auditing_policy` to `true` + # To enable Azure Defender for database set `enable_threat_detection_policy` to true + enable_threat_detection_policy = true + log_retention_days = 30 + + # schedule scan notifications to the subscription administrators + # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` + enable_vulnerability_assessment = false + email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] + + # Creating Private Endpoint requires, VNet name and address prefix to create a subnet + # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name + enable_private_endpoint = true + virtual_network_name = "vnet-shared-hub-westeurope-001" + private_subnet_address_prefix = ["10.1.5.0/29"] + # existing_private_dns_zone = "demo.example.com" + + # AD administrator for an Azure SQL server + # Allows you to set a user or group as the AD administrator for an Azure SQL server + ad_admin_login_name = "firstname.lastname@example.com" + + # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs + # log analytic workspace name required + enable_log_monitoring = true + log_analytics_workspace_name = "loganalytics-we-sharedtest2" + + # Firewall Rules to allow azure and external clients and specific Ip address/ranges. + enable_firewall_rules = true + firewall_rules = [ + { + name = "access-to-azure" + start_ip_address = "0.0.0.0" + end_ip_address = "0.0.0.0" + }, + { + name = "desktop-ip" + start_ip_address = "123.201.36.94" + end_ip_address = "123.201.36.94" + } + ] + + # Tags for Azure Resources + tags = { + Terraform = "true" + Environment = "dev" + Owner = "test-user" + } +} diff --git a/examples/Simple_SQL_Single_Database_Using_Private_Endpoint/output.tf b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/output.tf similarity index 97% rename from examples/Simple_SQL_Single_Database_Using_Private_Endpoint/output.tf rename to examples/Simple_SQL_Single_Database_with_Private_Endpoint/output.tf index 5c1a106..1e140e5 100644 --- a/examples/Simple_SQL_Single_Database_Using_Private_Endpoint/output.tf +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/output.tf @@ -1,71 +1,71 @@ -output "resource_group_name" { - description = "The name of the resource group in which resources are created" - value = module.mssql-server.resource_group_name -} - -output "resource_group_location" { - description = "The location of the resource group in which resources are created" - value = module.mssql-server.resource_group_location -} - -output "storage_account_id" { - description = "The ID of the storage account" - value = module.mssql-server.storage_account_id -} - -output "storage_account_name" { - description = "The name of the storage account" - value = module.mssql-server.storage_account_name -} - -output "primary_sql_server_id" { - description = "The primary Microsoft SQL Server ID" - value = module.mssql-server.primary_sql_server_id -} - -output "primary_sql_server_fqdn" { - description = "The fully qualified domain name of the primary Azure SQL Server" - value = module.mssql-server.primary_sql_server_fqdn -} - -output "sql_server_admin_user" { - description = "SQL database administrator login id" - value = module.mssql-server.sql_server_admin_user - sensitive = true -} - -output "sql_server_admin_password" { - description = "SQL database administrator login password" - value = module.mssql-server.sql_server_admin_password - sensitive = true -} - -output "sql_database_id" { - description = "The SQL Database ID" - value = module.mssql-server.sql_database_id -} - -output "sql_database_name" { - description = "The SQL Database Name" - value = module.mssql-server.sql_database_name -} - -output "primary_sql_server_private_endpoint" { - description = "id of the Primary SQL server Private Endpoint" - value = module.mssql-server.primary_sql_server_private_endpoint -} - -output "sql_server_private_dns_zone_domain" { - description = "DNS zone name of SQL server Private endpoints dns name records" - value = module.mssql-server.sql_server_private_dns_zone_domain -} - -output "primary_sql_server_private_endpoint_ip" { - description = "Priamary SQL server private endpoint IPv4 Addresses " - value = module.mssql-server.primary_sql_server_private_endpoint_ip -} - -output "primary_sql_server_private_endpoint_fqdn" { - description = "Priamary SQL server private endpoint IPv4 Addresses " - value = module.mssql-server.primary_sql_server_private_endpoint_fqdn -} +output "resource_group_name" { + description = "The name of the resource group in which resources are created" + value = module.mssql-server.resource_group_name +} + +output "resource_group_location" { + description = "The location of the resource group in which resources are created" + value = module.mssql-server.resource_group_location +} + +output "storage_account_id" { + description = "The ID of the storage account" + value = module.mssql-server.storage_account_id +} + +output "storage_account_name" { + description = "The name of the storage account" + value = module.mssql-server.storage_account_name +} + +output "primary_sql_server_id" { + description = "The primary Microsoft SQL Server ID" + value = module.mssql-server.primary_sql_server_id +} + +output "primary_sql_server_fqdn" { + description = "The fully qualified domain name of the primary Azure SQL Server" + value = module.mssql-server.primary_sql_server_fqdn +} + +output "sql_server_admin_user" { + description = "SQL database administrator login id" + value = module.mssql-server.sql_server_admin_user + sensitive = true +} + +output "sql_server_admin_password" { + description = "SQL database administrator login password" + value = module.mssql-server.sql_server_admin_password + sensitive = true +} + +output "sql_database_id" { + description = "The SQL Database ID" + value = module.mssql-server.sql_database_id +} + +output "sql_database_name" { + description = "The SQL Database Name" + value = module.mssql-server.sql_database_name +} + +output "primary_sql_server_private_endpoint" { + description = "id of the Primary SQL server Private Endpoint" + value = module.mssql-server.primary_sql_server_private_endpoint +} + +output "sql_server_private_dns_zone_domain" { + description = "DNS zone name of SQL server Private endpoints dns name records" + value = module.mssql-server.sql_server_private_dns_zone_domain +} + +output "primary_sql_server_private_endpoint_ip" { + description = "Priamary SQL server private endpoint IPv4 Addresses " + value = module.mssql-server.primary_sql_server_private_endpoint_ip +} + +output "primary_sql_server_private_endpoint_fqdn" { + description = "Priamary SQL server private endpoint IPv4 Addresses " + value = module.mssql-server.primary_sql_server_private_endpoint_fqdn +} diff --git a/examples/Simple_SQL_Single_Database_Using_Private_Endpoint/variables.tf b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/variables.tf similarity index 100% rename from examples/Simple_SQL_Single_Database_Using_Private_Endpoint/variables.tf rename to examples/Simple_SQL_Single_Database_with_Private_Endpoint/variables.tf From d89c2d2f677337ea54f4403f31c518d0e0f8887e Mon Sep 17 00:00:00 2001 From: kumarvna <36370570+kumarvna@users.noreply.github.com> Date: Sun, 31 Oct 2021 14:55:04 +0530 Subject: [PATCH 05/13] adding example to use existing Vnet and Subnet to create private endpoint --- .../README.md | 10 +- .../main.tf | 10 +- .../README.md | 12 +- .../main.tf | 10 +- .../README.md | 107 ++++++++++++++++++ .../main.tf | 87 ++++++++++++++ .../output.tf | 71 ++++++++++++ .../variables.tf | 0 8 files changed, 290 insertions(+), 17 deletions(-) create mode 100644 examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md create mode 100644 examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf create mode 100644 examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/output.tf create mode 100644 examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/variables.tf diff --git a/examples/Simple_SQL_Single_Database_creation/README.md b/examples/Simple_SQL_Single_Database_creation/README.md index d39c33e..227cbf8 100644 --- a/examples/Simple_SQL_Single_Database_creation/README.md +++ b/examples/Simple_SQL_Single_Database_creation/README.md @@ -66,11 +66,13 @@ module "mssql-server" { } ] - # Tags for Azure Resources + # Adding additional TAG's to your Azure resources tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" + ProjectName = "demo-project" + Env = "dev" + Owner = "user@example.com" + BusinessUnit = "CORP" + ServiceClass = "Gold" } } ``` diff --git a/examples/Simple_SQL_Single_Database_creation/main.tf b/examples/Simple_SQL_Single_Database_creation/main.tf index 54f7fb1..1e0aa16 100644 --- a/examples/Simple_SQL_Single_Database_creation/main.tf +++ b/examples/Simple_SQL_Single_Database_creation/main.tf @@ -59,10 +59,12 @@ module "mssql-server" { } ] - # Tags for Azure Resources + # Adding additional TAG's to your Azure resources tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" + ProjectName = "demo-project" + Env = "dev" + Owner = "user@example.com" + BusinessUnit = "CORP" + ServiceClass = "Gold" } } diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint/README.md b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/README.md index dbae24d..2ed0243 100644 --- a/examples/Simple_SQL_Single_Database_with_Private_Endpoint/README.md +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/README.md @@ -1,4 +1,4 @@ -# Simple Azure SQL single database using private Endpoint +# Simple Azure SQL single database with private link Endpoint Terraform module to create a SQL server with initial database, Azure AD login, Firewall rules for SQL, optional azure monitoring vulnerability assessment and private endpoints. It also allows creating an SQL server database with a SQL script initialization. @@ -74,11 +74,13 @@ module "mssql-server" { } ] - # Tags for Azure Resources + # Adding additional TAG's to your Azure resources tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" + ProjectName = "demo-project" + Env = "dev" + Owner = "user@example.com" + BusinessUnit = "CORP" + ServiceClass = "Gold" } } ``` diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint/main.tf b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/main.tf index f469513..9b7c944 100644 --- a/examples/Simple_SQL_Single_Database_with_Private_Endpoint/main.tf +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/main.tf @@ -67,10 +67,12 @@ module "mssql-server" { } ] - # Tags for Azure Resources + # Adding additional TAG's to your Azure resources tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" + ProjectName = "demo-project" + Env = "dev" + Owner = "user@example.com" + BusinessUnit = "CORP" + ServiceClass = "Gold" } } diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md new file mode 100644 index 0000000..b58216e --- /dev/null +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md @@ -0,0 +1,107 @@ +# Simple Azure SQL single database with private Endpoint using existing VNet and Subnets + +Terraform module to create a SQL server with initial database, Azure AD login, Firewall rules for SQL, optional azure monitoring vulnerability assessment and private endpoints. It also allows creating an SQL server database with a SQL script initialization. + +## Module Usage + +```terraform +# Azurerm provider configuration +provider "azurerm" { + features {} +} + +data "azurerm_virtual_network" "example" { + name = "vnet-shared-hub-westeurope-001" + resource_group_name = "rg-shared-westeurope-01" +} + +data "azurerm_subnet" "example" { + name = "snet-private-ep" + virtual_network_name = data.azurerm_virtual_network.example.name + resource_group_name = data.azurerm_virtual_network.example.resource_group_name +} + +module "mssql-server" { + source = "kumarvna/mssql-db/azurerm" + version = "1.2.0" + + # By default, this module will create a resource group + # proivde a name to use an existing resource group and set the argument + # to `create_resource_group = false` if you want to existing resoruce group. + # If you use existing resrouce group location will be the same as existing RG. + create_resource_group = false + resource_group_name = "rg-shared-westeurope-01" + location = "westeurope" + + # SQL Server and Database details + # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 + sqlserver_name = "te-sqldbserver01" + database_name = "demomssqldb" + sql_database_edition = "Standard" + sqldb_service_objective_name = "S1" + + # SQL server extended auditing policy defaults to `true`. + # To turn off set enable_sql_server_extended_auditing_policy to `false` + # DB extended auditing policy defaults to `false`. + # to tun on set the variable `enable_database_extended_auditing_policy` to `true` + # To enable Azure Defender for database set `enable_threat_detection_policy` to true + enable_threat_detection_policy = true + log_retention_days = 30 + + # schedule scan notifications to the subscription administrators + # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` + enable_vulnerability_assessment = false + email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] + + # enabling the Private Endpoints for Sql servers + enable_private_endpoint = true + existing_vnet_id = data.azurerm_virtual_network.example.id + existing_subnet_id = data.azurerm_subnet.example.id + # existing_private_dns_zone = "demo.example.com" + + # AD administrator for an Azure SQL server + # Allows you to set a user or group as the AD administrator for an Azure SQL server + ad_admin_login_name = "firstname.lastname@example.com" + + # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs + # log analytic workspace name required + enable_log_monitoring = true + log_analytics_workspace_name = "loganalytics-we-sharedtest2" + + # Firewall Rules to allow azure and external clients and specific Ip address/ranges. + enable_firewall_rules = true + firewall_rules = [ + { + name = "access-to-azure" + start_ip_address = "0.0.0.0" + end_ip_address = "0.0.0.0" + }, + { + name = "desktop-ip" + start_ip_address = "123.201.36.94" + end_ip_address = "123.201.36.94" + } + ] + + # Adding additional TAG's to your Azure resources + tags = { + ProjectName = "demo-project" + Env = "dev" + Owner = "user@example.com" + BusinessUnit = "CORP" + ServiceClass = "Gold" + } +} +``` + +## Terraform Usage + +To run this example you need to execute following Terraform commands + +```bash +terraform init +terraform plan +terraform apply +``` + +Run `terraform destroy` when you don't need these resources. diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf new file mode 100644 index 0000000..dda0931 --- /dev/null +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf @@ -0,0 +1,87 @@ +# Azurerm provider configuration +provider "azurerm" { + features {} +} + +data "azurerm_virtual_network" "example" { + name = "vnet-shared-hub-westeurope-001" + resource_group_name = "rg-shared-westeurope-01" +} + +data "azurerm_subnet" "example" { + name = "snet-private-ep" + virtual_network_name = data.azurerm_virtual_network.example.name + resource_group_name = data.azurerm_virtual_network.example.resource_group_name +} + +module "mssql-server" { + source = "kumarvna/mssql-db/azurerm" + version = "1.2.0" + + # By default, this module will create a resource group + # proivde a name to use an existing resource group and set the argument + # to `create_resource_group = false` if you want to existing resoruce group. + # If you use existing resrouce group location will be the same as existing RG. + create_resource_group = false + resource_group_name = "rg-shared-westeurope-01" + location = "westeurope" + + # SQL Server and Database details + # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 + sqlserver_name = "te-sqldbserver01" + database_name = "demomssqldb" + sql_database_edition = "Standard" + sqldb_service_objective_name = "S1" + + # SQL server extended auditing policy defaults to `true`. + # To turn off set enable_sql_server_extended_auditing_policy to `false` + # DB extended auditing policy defaults to `false`. + # to tun on set the variable `enable_database_extended_auditing_policy` to `true` + # To enable Azure Defender for database set `enable_threat_detection_policy` to true + enable_threat_detection_policy = true + log_retention_days = 30 + + # schedule scan notifications to the subscription administrators + # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` + enable_vulnerability_assessment = false + email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] + + # enabling the Private Endpoints for Sql servers + enable_private_endpoint = true + existing_vnet_id = data.azurerm_virtual_network.example.id + existing_subnet_id = data.azurerm_subnet.example.id + # existing_private_dns_zone = "demo.example.com" + + # AD administrator for an Azure SQL server + # Allows you to set a user or group as the AD administrator for an Azure SQL server + ad_admin_login_name = "firstname.lastname@example.com" + + # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs + # log analytic workspace name required + enable_log_monitoring = true + log_analytics_workspace_name = "loganalytics-we-sharedtest2" + + # Firewall Rules to allow azure and external clients and specific Ip address/ranges. + enable_firewall_rules = true + firewall_rules = [ + { + name = "access-to-azure" + start_ip_address = "0.0.0.0" + end_ip_address = "0.0.0.0" + }, + { + name = "desktop-ip" + start_ip_address = "123.201.36.94" + end_ip_address = "123.201.36.94" + } + ] + + # Adding additional TAG's to your Azure resources + tags = { + ProjectName = "demo-project" + Env = "dev" + Owner = "user@example.com" + BusinessUnit = "CORP" + ServiceClass = "Gold" + } +} diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/output.tf b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/output.tf new file mode 100644 index 0000000..1e140e5 --- /dev/null +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/output.tf @@ -0,0 +1,71 @@ +output "resource_group_name" { + description = "The name of the resource group in which resources are created" + value = module.mssql-server.resource_group_name +} + +output "resource_group_location" { + description = "The location of the resource group in which resources are created" + value = module.mssql-server.resource_group_location +} + +output "storage_account_id" { + description = "The ID of the storage account" + value = module.mssql-server.storage_account_id +} + +output "storage_account_name" { + description = "The name of the storage account" + value = module.mssql-server.storage_account_name +} + +output "primary_sql_server_id" { + description = "The primary Microsoft SQL Server ID" + value = module.mssql-server.primary_sql_server_id +} + +output "primary_sql_server_fqdn" { + description = "The fully qualified domain name of the primary Azure SQL Server" + value = module.mssql-server.primary_sql_server_fqdn +} + +output "sql_server_admin_user" { + description = "SQL database administrator login id" + value = module.mssql-server.sql_server_admin_user + sensitive = true +} + +output "sql_server_admin_password" { + description = "SQL database administrator login password" + value = module.mssql-server.sql_server_admin_password + sensitive = true +} + +output "sql_database_id" { + description = "The SQL Database ID" + value = module.mssql-server.sql_database_id +} + +output "sql_database_name" { + description = "The SQL Database Name" + value = module.mssql-server.sql_database_name +} + +output "primary_sql_server_private_endpoint" { + description = "id of the Primary SQL server Private Endpoint" + value = module.mssql-server.primary_sql_server_private_endpoint +} + +output "sql_server_private_dns_zone_domain" { + description = "DNS zone name of SQL server Private endpoints dns name records" + value = module.mssql-server.sql_server_private_dns_zone_domain +} + +output "primary_sql_server_private_endpoint_ip" { + description = "Priamary SQL server private endpoint IPv4 Addresses " + value = module.mssql-server.primary_sql_server_private_endpoint_ip +} + +output "primary_sql_server_private_endpoint_fqdn" { + description = "Priamary SQL server private endpoint IPv4 Addresses " + value = module.mssql-server.primary_sql_server_private_endpoint_fqdn +} diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/variables.tf b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/variables.tf new file mode 100644 index 0000000..e69de29 From 83d0870d5a570357b72d27551858d4c4bf6977eb Mon Sep 17 00:00:00 2001 From: kumarvna <36370570+kumarvna@users.noreply.github.com> Date: Sun, 31 Oct 2021 15:02:02 +0530 Subject: [PATCH 06/13] updating example for SQL DB with geo-replication and auto failover groups --- examples/README.md | 8 +- .../README.md | 192 +++++++++--------- .../main.tf | 152 +++++++------- .../output.tf | 132 ++++++------ .../variables.tf | 0 .../README.md | 2 +- .../main.tf | 2 +- 7 files changed, 240 insertions(+), 248 deletions(-) rename examples/{SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups => SQL_DB_with_Geo-replication_and_Auto-Failover_Groups}/README.md (79%) rename examples/{SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups => SQL_DB_with_Geo-replication_and_Auto-Failover_Groups}/main.tf (83%) rename examples/{SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups => SQL_DB_with_Geo-replication_and_Auto-Failover_Groups}/output.tf (96%) rename examples/{SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups => SQL_DB_with_Geo-replication_and_Auto-Failover_Groups}/variables.tf (100%) diff --git a/examples/README.md b/examples/README.md index da0886b..98e2bc7 100644 --- a/examples/README.md +++ b/examples/README.md @@ -4,10 +4,10 @@ Terraform module for Azure to create a MS SQL server with initial database, Azur ## Module Usage for -[Simple SQL Single DB Creation](Simple_SQL_Single_Database_creation/) -[Simple SQL Single DB with Private link Endpoint](Simple_SQL_Single_Database_Using_Private_Endpoint/) -[SQL DB with Geo-Replication and Auto Failover Groups](SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/) -[SQL DB with Geo-Replication, Private Endpoints, and Auto Failover Groups](SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/) +- [Simple SQL Single DB Creation](Simple_SQL_Single_Database_creation/) +- [Simple SQL Single DB with Private link Endpoint](Simple_SQL_Single_Database_Using_Private_Endpoint/) +- [SQL DB with Geo-Replication and Auto Failover Groups](SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/) +- [SQL DB with Geo-Replication, Private Endpoints, and Auto Failover Groups](SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/) ## Terraform Usage diff --git a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/README.md b/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/README.md similarity index 79% rename from examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/README.md rename to examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/README.md index d60543d..6bff514 100644 --- a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/README.md +++ b/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/README.md @@ -1,98 +1,94 @@ -# Azure SQL database creation using geo-replication with auto-failover groups - -Terraform module to create a SQL server with initial database, Azure AD login, Firewall rules for SQL, optional azure monitoring, vulnerability assessment and Geo-replication with auto-failover groups. It also allows creating an SQL server database with a SQL script initialization. - -## Module Usage - -```hcl -# Azurerm provider configuration -provider "azurerm" { - features {} -} - -module "mssql-server" { - source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" - - # By default, this module will create a resource group - # proivde a name to use an existing resource group and set the argument - # to `create_resource_group = false` if you want to existing resoruce group. - # If you use existing resrouce group location will be the same as existing RG. - create_resource_group = false - resource_group_name = "rg-shared-westeurope-01" - location = "westeurope" - - # SQL Server and Database details - # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 - sqlserver_name = "sqldbserver01" - database_name = "demomssqldb" - sql_database_edition = "Standard" - sqldb_service_objective_name = "S1" - - # SQL server extended auditing policy defaults to `true`. - # To turn off set enable_sql_server_extended_auditing_policy to `false` - # DB extended auditing policy defaults to `false`. - # to tun on set the variable `enable_database_extended_auditing_policy` to `true` - # To enable Azure Defender for database set `enable_threat_detection_policy` to true - enable_threat_detection_policy = true - log_retention_days = 30 - - # schedule scan notifications to the subscription administrators - # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` - enable_vulnerability_assessment = false - email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] - - # AD administrator for an Azure SQL server - # Allows you to set a user or group as the AD administrator for an Azure SQL server - ad_admin_login_name = "firstname.lastname@example.com" - - # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" - - # Sql failover group creation. required secondary locaiton input. - enable_failover_group = true - secondary_sql_server_location = "northeurope" - - # Firewall Rules to allow azure and external clients and specific Ip address/ranges. - enable_firewall_rules = true - firewall_rules = [ - { - name = "access-to-azure" - start_ip_address = "0.0.0.0" - end_ip_address = "0.0.0.0" - }, - { - name = "desktop-ip" - start_ip_address = "49.204.225.134" - end_ip_address = "49.204.225.134" - } - ] - - # Create and initialize a database with custom SQL script - # need sqlcmd utility to run this command - # your desktop public IP must be added firewall rules to run this command - initialize_sql_script_execution = true - sqldb_init_script_file = "../artifacts/db-init-sample.sql" - - # Tags for Azure Resources - tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" - } -} -``` - -## Terraform Usage - -To run this example you need to execute following Terraform commands - -```bash -terraform init -terraform plan -terraform apply -``` - -Run `terraform destroy` when you don't need these resources. +# Azure SQL database creation using geo-replication with auto-failover groups + +Terraform module to create a SQL server with initial database, Azure AD login, Firewall rules for SQL, optional azure monitoring, vulnerability assessment and Geo-replication with auto-failover groups. It also allows creating an SQL server database with a SQL script initialization. + +## Module Usage + +```terraform +# Azurerm provider configuration +provider "azurerm" { + features {} +} + +module "mssql-server" { + source = "kumarvna/mssql-db/azurerm" + version = "1.3.0" + + # By default, this module will create a resource group + # proivde a name to use an existing resource group and set the argument + # to `create_resource_group = false` if you want to existing resoruce group. + # If you use existing resrouce group location will be the same as existing RG. + create_resource_group = false + resource_group_name = "rg-shared-westeurope-01" + location = "westeurope" + + # SQL Server and Database details + # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 + sqlserver_name = "sqldbserver01" + database_name = "demomssqldb" + sql_database_edition = "Standard" + sqldb_service_objective_name = "S1" + + # SQL server extended auditing policy defaults to `true`. + # To turn off set enable_sql_server_extended_auditing_policy to `false` + # DB extended auditing policy defaults to `false`. + # to tun on set the variable `enable_database_extended_auditing_policy` to `true` + # To enable Azure Defender for database set `enable_threat_detection_policy` to true + enable_threat_detection_policy = true + log_retention_days = 30 + + # schedule scan notifications to the subscription administrators + # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` + enable_vulnerability_assessment = false + email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] + + # AD administrator for an Azure SQL server + # Allows you to set a user or group as the AD administrator for an Azure SQL server + ad_admin_login_name = "firstname.lastname@example.com" + + # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs + # log analytic workspace name required + enable_log_monitoring = true + log_analytics_workspace_name = "loganalytics-we-sharedtest2" + + # Sql failover group creation. required secondary locaiton input. + enable_failover_group = true + secondary_sql_server_location = "northeurope" + + # Firewall Rules to allow azure and external clients and specific Ip address/ranges. + enable_firewall_rules = true + firewall_rules = [ + { + name = "access-to-azure" + start_ip_address = "0.0.0.0" + end_ip_address = "0.0.0.0" + }, + { + name = "desktop-ip" + start_ip_address = "49.204.225.134" + end_ip_address = "49.204.225.134" + } + ] + + # Adding additional TAG's to your Azure resources + tags = { + ProjectName = "demo-project" + Env = "dev" + Owner = "user@example.com" + BusinessUnit = "CORP" + ServiceClass = "Gold" + } +} +``` + +## Terraform Usage + +To run this example you need to execute following Terraform commands + +```bash +terraform init +terraform plan +terraform apply +``` + +Run `terraform destroy` when you don't need these resources. diff --git a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/main.tf b/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/main.tf similarity index 83% rename from examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/main.tf rename to examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/main.tf index 3bc9da3..b1e9ebc 100644 --- a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/main.tf +++ b/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/main.tf @@ -1,78 +1,74 @@ -# Azurerm provider configuration -provider "azurerm" { - features {} -} - -module "mssql-server" { - source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" - - # By default, this module will create a resource group - # proivde a name to use an existing resource group and set the argument - # to `create_resource_group = false` if you want to existing resoruce group. - # If you use existing resrouce group location will be the same as existing RG. - create_resource_group = false - resource_group_name = "rg-shared-westeurope-01" - location = "westeurope" - - # SQL Server and Database details - # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 - sqlserver_name = "sqldbserver01" - database_name = "demomssqldb" - sql_database_edition = "Standard" - sqldb_service_objective_name = "S1" - - # SQL server extended auditing policy defaults to `true`. - # To turn off set enable_sql_server_extended_auditing_policy to `false` - # DB extended auditing policy defaults to `false`. - # to tun on set the variable `enable_database_extended_auditing_policy` to `true` - # To enable Azure Defender for database set `enable_threat_detection_policy` to true - enable_threat_detection_policy = true - log_retention_days = 30 - - # schedule scan notifications to the subscription administrators - # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` - enable_vulnerability_assessment = false - email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] - - # AD administrator for an Azure SQL server - # Allows you to set a user or group as the AD administrator for an Azure SQL server - ad_admin_login_name = "firstname.lastname@example.com" - - # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" - - # Sql failover group creation. required secondary locaiton input. - enable_failover_group = true - secondary_sql_server_location = "northeurope" - - # Firewall Rules to allow azure and external clients and specific Ip address/ranges. - enable_firewall_rules = true - firewall_rules = [ - { - name = "access-to-azure" - start_ip_address = "0.0.0.0" - end_ip_address = "0.0.0.0" - }, - { - name = "desktop-ip" - start_ip_address = "49.204.225.134" - end_ip_address = "49.204.225.134" - } - ] - - # Create and initialize a database with custom SQL script - # need sqlcmd utility to run this command - # your desktop public IP must be added firewall rules to run this command - initialize_sql_script_execution = true - sqldb_init_script_file = "../artifacts/db-init-sample.sql" - - # Tags for Azure Resources - tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" - } -} +# Azurerm provider configuration +provider "azurerm" { + features {} +} + +module "mssql-server" { + source = "kumarvna/mssql-db/azurerm" + version = "1.3.0" + + # By default, this module will create a resource group + # proivde a name to use an existing resource group and set the argument + # to `create_resource_group = false` if you want to existing resoruce group. + # If you use existing resrouce group location will be the same as existing RG. + create_resource_group = false + resource_group_name = "rg-shared-westeurope-01" + location = "westeurope" + + # SQL Server and Database details + # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 + sqlserver_name = "sqldbserver01" + database_name = "demomssqldb" + sql_database_edition = "Standard" + sqldb_service_objective_name = "S1" + + # SQL server extended auditing policy defaults to `true`. + # To turn off set enable_sql_server_extended_auditing_policy to `false` + # DB extended auditing policy defaults to `false`. + # to tun on set the variable `enable_database_extended_auditing_policy` to `true` + # To enable Azure Defender for database set `enable_threat_detection_policy` to true + enable_threat_detection_policy = true + log_retention_days = 30 + + # schedule scan notifications to the subscription administrators + # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` + enable_vulnerability_assessment = false + email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] + + # AD administrator for an Azure SQL server + # Allows you to set a user or group as the AD administrator for an Azure SQL server + ad_admin_login_name = "firstname.lastname@example.com" + + # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs + # log analytic workspace name required + enable_log_monitoring = true + log_analytics_workspace_name = "loganalytics-we-sharedtest2" + + # Sql failover group creation. required secondary locaiton input. + enable_failover_group = true + secondary_sql_server_location = "northeurope" + + # Firewall Rules to allow azure and external clients and specific Ip address/ranges. + enable_firewall_rules = true + firewall_rules = [ + { + name = "access-to-azure" + start_ip_address = "0.0.0.0" + end_ip_address = "0.0.0.0" + }, + { + name = "desktop-ip" + start_ip_address = "49.204.225.134" + end_ip_address = "49.204.225.134" + } + ] + + # Adding additional TAG's to your Azure resources + tags = { + ProjectName = "demo-project" + Env = "dev" + Owner = "user@example.com" + BusinessUnit = "CORP" + ServiceClass = "Gold" + } +} diff --git a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/output.tf b/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/output.tf similarity index 96% rename from examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/output.tf rename to examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/output.tf index 183934e..8e34ac9 100644 --- a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/output.tf +++ b/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/output.tf @@ -1,66 +1,66 @@ -output "resource_group_name" { - description = "The name of the resource group in which resources are created" - value = module.mssql-server.resource_group_name -} - -output "resource_group_location" { - description = "The location of the resource group in which resources are created" - value = module.mssql-server.resource_group_location -} - -output "storage_account_id" { - description = "The ID of the storage account" - value = module.mssql-server.storage_account_id -} - -output "storage_account_name" { - description = "The name of the storage account" - value = module.mssql-server.storage_account_name -} - -output "primary_sql_server_id" { - description = "The primary Microsoft SQL Server ID" - value = module.mssql-server.primary_sql_server_id -} - -output "primary_sql_server_fqdn" { - description = "The fully qualified domain name of the primary Azure SQL Server" - value = module.mssql-server.primary_sql_server_fqdn -} - -output "secondary_sql_server_id" { - description = "The secondary Microsoft SQL Server ID" - value = module.mssql-server.secondary_sql_server_id -} - -output "secondary_sql_server_fqdn" { - description = "The fully qualified domain name of the secondary Azure SQL Server" - value = module.mssql-server.secondary_sql_server_fqdn -} - -output "sql_server_admin_user" { - description = "SQL database administrator login id" - value = module.mssql-server.sql_server_admin_user - sensitive = true -} - -output "sql_server_admin_password" { - description = "SQL database administrator login password" - value = module.mssql-server.sql_server_admin_password - sensitive = true -} - -output "sql_database_id" { - description = "The SQL Database ID" - value = module.mssql-server.sql_database_id -} - -output "sql_database_name" { - description = "The SQL Database Name" - value = module.mssql-server.sql_database_name -} - -output "sql_failover_group_id" { - description = "A failover group of databases on a collection of Azure SQL servers." - value = module.mssql-server.sql_failover_group_id -} +output "resource_group_name" { + description = "The name of the resource group in which resources are created" + value = module.mssql-server.resource_group_name +} + +output "resource_group_location" { + description = "The location of the resource group in which resources are created" + value = module.mssql-server.resource_group_location +} + +output "storage_account_id" { + description = "The ID of the storage account" + value = module.mssql-server.storage_account_id +} + +output "storage_account_name" { + description = "The name of the storage account" + value = module.mssql-server.storage_account_name +} + +output "primary_sql_server_id" { + description = "The primary Microsoft SQL Server ID" + value = module.mssql-server.primary_sql_server_id +} + +output "primary_sql_server_fqdn" { + description = "The fully qualified domain name of the primary Azure SQL Server" + value = module.mssql-server.primary_sql_server_fqdn +} + +output "secondary_sql_server_id" { + description = "The secondary Microsoft SQL Server ID" + value = module.mssql-server.secondary_sql_server_id +} + +output "secondary_sql_server_fqdn" { + description = "The fully qualified domain name of the secondary Azure SQL Server" + value = module.mssql-server.secondary_sql_server_fqdn +} + +output "sql_server_admin_user" { + description = "SQL database administrator login id" + value = module.mssql-server.sql_server_admin_user + sensitive = true +} + +output "sql_server_admin_password" { + description = "SQL database administrator login password" + value = module.mssql-server.sql_server_admin_password + sensitive = true +} + +output "sql_database_id" { + description = "The SQL Database ID" + value = module.mssql-server.sql_database_id +} + +output "sql_database_name" { + description = "The SQL Database Name" + value = module.mssql-server.sql_database_name +} + +output "sql_failover_group_id" { + description = "A failover group of databases on a collection of Azure SQL servers." + value = module.mssql-server.sql_failover_group_id +} diff --git a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/variables.tf b/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/variables.tf similarity index 100% rename from examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/variables.tf rename to examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/variables.tf diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md index b58216e..24391ad 100644 --- a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md @@ -23,7 +23,7 @@ data "azurerm_subnet" "example" { module "mssql-server" { source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" + version = "1.3.0" # By default, this module will create a resource group # proivde a name to use an existing resource group and set the argument diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf index dda0931..d99e3a3 100644 --- a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf @@ -16,7 +16,7 @@ data "azurerm_subnet" "example" { module "mssql-server" { source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" + version = "1.3.0" # By default, this module will create a resource group # proivde a name to use an existing resource group and set the argument From 8109b428a4b4144a565bb8e8ad9dfadfae8d8ee2 Mon Sep 17 00:00:00 2001 From: kumarvna <36370570+kumarvna@users.noreply.github.com> Date: Sun, 31 Oct 2021 15:12:20 +0530 Subject: [PATCH 07/13] adding example to create SQL DB with geo-replication, auto-failover groups and Private Endpoints --- examples/README.md | 10 +- .../README.md | 203 +++++++++--------- .../main.tf | 163 +++++++------- .../output.tf | 202 ++++++++--------- .../variables.tf | 0 .../README.md | 2 +- 6 files changed, 288 insertions(+), 292 deletions(-) rename examples/{SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints => SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints}/README.md (76%) rename examples/{SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints => SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints}/main.tf (75%) rename examples/{SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints => SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints}/output.tf (97%) rename examples/{SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints => SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints}/variables.tf (100%) diff --git a/examples/README.md b/examples/README.md index 98e2bc7..af9a364 100644 --- a/examples/README.md +++ b/examples/README.md @@ -2,12 +2,14 @@ Terraform module for Azure to create a MS SQL server with initial database, Azure AD login, Firewall rules, Failover Group, Private endpoint, and corresponding private DNS zone. It also supports creating a database with a custom SQL script initialization. -## Module Usage for +## Module Usage for: - [Simple SQL Single DB Creation](Simple_SQL_Single_Database_creation/) -- [Simple SQL Single DB with Private link Endpoint](Simple_SQL_Single_Database_Using_Private_Endpoint/) -- [SQL DB with Geo-Replication and Auto Failover Groups](SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups/) -- [SQL DB with Geo-Replication, Private Endpoints, and Auto Failover Groups](SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/) +- [Simple SQL Single DB with Private link Endpoint](Simple_SQL_Single_Database_with_Private_Endpoint/) +- [Simple SQL Single DB with Private link Endpoint using existing VNet and Subnets](Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/) +- [SQL DB with Geo-Replication and Auto Failover Groups](SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/) +- [SQL DB with Geo-Replication, Private Endpoints, and Auto Failover Groups](SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/) +- [SQL DB with Geo-Replication, Private Endpoints using existing VNet and Subnets, and Auto Failover Groups](SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/) ## Terraform Usage diff --git a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/README.md b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/README.md similarity index 76% rename from examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/README.md rename to examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/README.md index 2dcd403..c2874fe 100644 --- a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/README.md +++ b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/README.md @@ -1,103 +1,100 @@ -# Azure SQL database creation using geo-replication with auto-failover groups and Private Endpoints - -Terraform module to create a SQL server with initial database, Azure AD login, Firewall rules for SQL, optional azure monitoring, vulnerability assessment, Geo-replication with auto-failover groups and private endpoints. It also allows creating an SQL server database with a SQL script initialization. - -## Module Usage - -```hcl -# Azurerm provider configuration -provider "azurerm" { - features {} -} - -module "mssql-server" { - source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" - - # By default, this module will create a resource group - # proivde a name to use an existing resource group and set the argument - # to `create_resource_group = false` if you want to existing resoruce group. - # If you use existing resrouce group location will be the same as existing RG. - create_resource_group = false - resource_group_name = "rg-shared-westeurope-01" - location = "westeurope" - virtual_network_name = "vnet-shared-hub-westeurope-001" - private_subnet_address_prefix = ["10.1.5.0/29"] - - # SQL Server and Database details - # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 - sqlserver_name = "sqldbserver01" - database_name = "demomssqldb" - sql_database_edition = "Standard" - sqldb_service_objective_name = "S1" - - # SQL server extended auditing policy defaults to `true`. - # To turn off set enable_sql_server_extended_auditing_policy to `false` - # DB extended auditing policy defaults to `false`. - # to tun on set the variable `enable_database_extended_auditing_policy` to `true` - # To enable Azure Defender for database set `enable_threat_detection_policy` to true - enable_threat_detection_policy = true - log_retention_days = 30 - - # schedule scan notifications to the subscription administrators - # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` - enable_vulnerability_assessment = false - email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] - - # Sql failover group creation. required secondary locaiton input. - enable_failover_group = true - secondary_sql_server_location = "northeurope" - - # enabling the Private Endpoints for Sql servers - enable_private_endpoint = true - - # AD administrator for an Azure SQL server - # Allows you to set a user or group as the AD administrator for an Azure SQL server - ad_admin_login_name = "firstname.lastname@example.com" - - # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" - - # Firewall Rules to allow azure and external clients and specific Ip address/ranges. - enable_firewall_rules = true - firewall_rules = [ - { - name = "access-to-azure" - start_ip_address = "0.0.0.0" - end_ip_address = "0.0.0.0" - }, - { - name = "desktop-ip" - start_ip_address = "49.204.225.134" - end_ip_address = "49.204.225.134" - } - ] - - # Create and initialize a database with custom SQL script - # need sqlcmd utility to run this command - # your desktop public IP must be added to firewall rules to run this command - initialize_sql_script_execution = true - sqldb_init_script_file = "../artifacts/db-init-sample.sql" - - # Tags for Azure Resources - tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" - } -} -``` - -## Terraform Usage - -To run this example you need to execute following Terraform commands - -```bash -terraform init -terraform plan -terraform apply -``` - -Run `terraform destroy` when you don't need these resources. +# Azure SQL database creation with geo-replication, auto-failover groups and Private Endpoints + +Terraform module to create a SQL server with initial database, Azure AD login, Firewall rules for SQL, optional azure monitoring, vulnerability assessment, Geo-replication with auto-failover groups and private endpoints. It also allows creating an SQL server database with a SQL script initialization. + +## Module Usage + +```terraform +# Azurerm provider configuration +provider "azurerm" { + features {} +} + +module "mssql-server" { + source = "kumarvna/mssql-db/azurerm" + version = "1.3.0" + + # By default, this module will create a resource group + # proivde a name to use an existing resource group and set the argument + # to `create_resource_group = false` if you want to existing resoruce group. + # If you use existing resrouce group location will be the same as existing RG. + create_resource_group = false + resource_group_name = "rg-shared-westeurope-01" + location = "westeurope" + + # SQL Server and Database details + # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 + sqlserver_name = "te-sqldbserver01" + database_name = "demomssqldb" + sql_database_edition = "Standard" + sqldb_service_objective_name = "S1" + + # SQL server extended auditing policy defaults to `true`. + # To turn off set enable_sql_server_extended_auditing_policy to `false` + # DB extended auditing policy defaults to `false`. + # to tun on set the variable `enable_database_extended_auditing_policy` to `true` + # To enable Azure Defender for database set `enable_threat_detection_policy` to true + enable_threat_detection_policy = true + log_retention_days = 30 + + # schedule scan notifications to the subscription administrators + # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` + enable_vulnerability_assessment = false + email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] + + # Sql failover group creation. required secondary locaiton input. + enable_failover_group = true + secondary_sql_server_location = "northeurope" + + # enabling the Private Endpoints for Sql servers + enable_private_endpoint = true + virtual_network_name = "vnet-shared-hub-westeurope-001" + private_subnet_address_prefix = ["10.1.5.0/29"] + # existing_private_dns_zone = "demo.example.com" + + # AD administrator for an Azure SQL server + # Allows you to set a user or group as the AD administrator for an Azure SQL server + ad_admin_login_name = "firstname.lastname@example.com" + + # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs + # log analytic workspace name required + enable_log_monitoring = true + log_analytics_workspace_name = "loganalytics-we-sharedtest2" + + # Firewall Rules to allow azure and external clients and specific Ip address/ranges. + enable_firewall_rules = true + firewall_rules = [ + { + name = "access-to-azure" + start_ip_address = "0.0.0.0" + end_ip_address = "0.0.0.0" + }, + { + name = "desktop-ip" + start_ip_address = "123.201.36.94" + end_ip_address = "123.201.36.94" + } + ] + + # Adding additional TAG's to your Azure resources + tags = { + ProjectName = "demo-project" + Env = "dev" + Owner = "user@example.com" + BusinessUnit = "CORP" + ServiceClass = "Gold" + } +} +``` + +## Terraform Usage + +To run this example you need to execute following Terraform commands + +```bash +terraform init +terraform plan +terraform apply +``` + +Run `terraform destroy` when you don't need these resources. diff --git a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/main.tf b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/main.tf similarity index 75% rename from examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/main.tf rename to examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/main.tf index db426e6..9a80624 100644 --- a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/main.tf +++ b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/main.tf @@ -1,83 +1,80 @@ -# Azurerm provider configuration -provider "azurerm" { - features {} -} - -module "mssql-server" { - source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" - - # By default, this module will create a resource group - # proivde a name to use an existing resource group and set the argument - # to `create_resource_group = false` if you want to existing resoruce group. - # If you use existing resrouce group location will be the same as existing RG. - create_resource_group = false - resource_group_name = "rg-shared-westeurope-01" - location = "westeurope" - virtual_network_name = "vnet-shared-hub-westeurope-001" - private_subnet_address_prefix = ["10.1.5.0/29"] - - # SQL Server and Database details - # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 - sqlserver_name = "sqldbserver01" - database_name = "demomssqldb" - sql_database_edition = "Standard" - sqldb_service_objective_name = "S1" - - # SQL server extended auditing policy defaults to `true`. - # To turn off set enable_sql_server_extended_auditing_policy to `false` - # DB extended auditing policy defaults to `false`. - # to tun on set the variable `enable_database_extended_auditing_policy` to `true` - # To enable Azure Defender for database set `enable_threat_detection_policy` to true - enable_threat_detection_policy = true - log_retention_days = 30 - - # schedule scan notifications to the subscription administrators - # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` - enable_vulnerability_assessment = false - email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] - - # Sql failover group creation. required secondary locaiton input. - enable_failover_group = true - secondary_sql_server_location = "northeurope" - - # enabling the Private Endpoints for Sql servers - enable_private_endpoint = true - - # AD administrator for an Azure SQL server - # Allows you to set a user or group as the AD administrator for an Azure SQL server - ad_admin_login_name = "firstname.lastname@example.com" - - # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" - - # Firewall Rules to allow azure and external clients and specific Ip address/ranges. - enable_firewall_rules = true - firewall_rules = [ - { - name = "access-to-azure" - start_ip_address = "0.0.0.0" - end_ip_address = "0.0.0.0" - }, - { - name = "desktop-ip" - start_ip_address = "49.204.225.134" - end_ip_address = "49.204.225.134" - } - ] - - # Create and initialize a database with custom SQL script - # need sqlcmd utility to run this command - # your desktop public IP must be added to firewall rules to run this command - initialize_sql_script_execution = true - sqldb_init_script_file = "../artifacts/db-init-sample.sql" - - # Tags for Azure Resources - tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" - } -} +# Azurerm provider configuration +provider "azurerm" { + features {} +} + +module "mssql-server" { + source = "kumarvna/mssql-db/azurerm" + version = "1.3.0" + + # By default, this module will create a resource group + # proivde a name to use an existing resource group and set the argument + # to `create_resource_group = false` if you want to existing resoruce group. + # If you use existing resrouce group location will be the same as existing RG. + create_resource_group = false + resource_group_name = "rg-shared-westeurope-01" + location = "westeurope" + + # SQL Server and Database details + # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 + sqlserver_name = "te-sqldbserver01" + database_name = "demomssqldb" + sql_database_edition = "Standard" + sqldb_service_objective_name = "S1" + + # SQL server extended auditing policy defaults to `true`. + # To turn off set enable_sql_server_extended_auditing_policy to `false` + # DB extended auditing policy defaults to `false`. + # to tun on set the variable `enable_database_extended_auditing_policy` to `true` + # To enable Azure Defender for database set `enable_threat_detection_policy` to true + enable_threat_detection_policy = true + log_retention_days = 30 + + # schedule scan notifications to the subscription administrators + # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` + enable_vulnerability_assessment = false + email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] + + # Sql failover group creation. required secondary locaiton input. + enable_failover_group = true + secondary_sql_server_location = "northeurope" + + # enabling the Private Endpoints for Sql servers + enable_private_endpoint = true + virtual_network_name = "vnet-shared-hub-westeurope-001" + private_subnet_address_prefix = ["10.1.5.0/29"] + # existing_private_dns_zone = "demo.example.com" + + # AD administrator for an Azure SQL server + # Allows you to set a user or group as the AD administrator for an Azure SQL server + ad_admin_login_name = "firstname.lastname@example.com" + + # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs + # log analytic workspace name required + enable_log_monitoring = true + log_analytics_workspace_name = "loganalytics-we-sharedtest2" + + # Firewall Rules to allow azure and external clients and specific Ip address/ranges. + enable_firewall_rules = true + firewall_rules = [ + { + name = "access-to-azure" + start_ip_address = "0.0.0.0" + end_ip_address = "0.0.0.0" + }, + { + name = "desktop-ip" + start_ip_address = "123.201.36.94" + end_ip_address = "123.201.36.94" + } + ] + + # Adding additional TAG's to your Azure resources + tags = { + ProjectName = "demo-project" + Env = "dev" + Owner = "user@example.com" + BusinessUnit = "CORP" + ServiceClass = "Gold" + } +} diff --git a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/output.tf b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/output.tf similarity index 97% rename from examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/output.tf rename to examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/output.tf index d0540ce..c938322 100644 --- a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/output.tf +++ b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/output.tf @@ -1,101 +1,101 @@ -output "resource_group_name" { - description = "The name of the resource group in which resources are created" - value = module.mssql-server.resource_group_name -} - -output "resource_group_location" { - description = "The location of the resource group in which resources are created" - value = module.mssql-server.resource_group_location -} - -output "storage_account_id" { - description = "The ID of the storage account" - value = module.mssql-server.storage_account_id -} - -output "storage_account_name" { - description = "The name of the storage account" - value = module.mssql-server.storage_account_name -} - -output "primary_sql_server_id" { - description = "The primary Microsoft SQL Server ID" - value = module.mssql-server.primary_sql_server_id -} - -output "primary_sql_server_fqdn" { - description = "The fully qualified domain name of the primary Azure SQL Server" - value = module.mssql-server.primary_sql_server_fqdn -} - -output "secondary_sql_server_id" { - description = "The secondary Microsoft SQL Server ID" - value = module.mssql-server.secondary_sql_server_id -} - -output "secondary_sql_server_fqdn" { - description = "The fully qualified domain name of the secondary Azure SQL Server" - value = module.mssql-server.secondary_sql_server_fqdn -} - -output "sql_server_admin_user" { - description = "SQL database administrator login id" - value = module.mssql-server.sql_server_admin_user - sensitive = true -} - -output "sql_server_admin_password" { - description = "SQL database administrator login password" - value = module.mssql-server.sql_server_admin_password - sensitive = true -} - -output "sql_database_id" { - description = "The SQL Database ID" - value = module.mssql-server.sql_database_id -} - -output "sql_database_name" { - description = "The SQL Database Name" - value = module.mssql-server.sql_database_name -} - -output "sql_failover_group_id" { - description = "A failover group of databases on a collection of Azure SQL servers." - value = module.mssql-server.sql_failover_group_id -} - -output "primary_sql_server_private_endpoint" { - description = "id of the Primary SQL server Private Endpoint" - value = module.mssql-server.primary_sql_server_private_endpoint -} - -output "secondary_sql_server_private_endpoint" { - description = "id of the Primary SQL server Private Endpoint" - value = module.mssql-server.secondary_sql_server_private_endpoint -} - -output "sql_server_private_dns_zone_domain" { - description = "DNS zone name of SQL server Private endpoints dns name records" - value = module.mssql-server.sql_server_private_dns_zone_domain -} - -output "primary_sql_server_private_endpoint_ip" { - description = "Priamary SQL server private endpoint IPv4 Addresses " - value = module.mssql-server.primary_sql_server_private_endpoint_ip -} - -output "primary_sql_server_private_endpoint_fqdn" { - description = "Priamary SQL server private endpoint IPv4 Addresses " - value = module.mssql-server.primary_sql_server_private_endpoint_fqdn -} - -output "secondary_sql_server_private_endpoint_ip" { - description = "Secondary SQL server private endpoint IPv4 Addresses " - value = module.mssql-server.secondary_sql_server_private_endpoint_ip -} - -output "secondary_sql_server_private_endpoint_fqdn" { - description = "Secondary SQL server private endpoint IPv4 Addresses " - value = module.mssql-server.secondary_sql_server_private_endpoint_fqdn -} +output "resource_group_name" { + description = "The name of the resource group in which resources are created" + value = module.mssql-server.resource_group_name +} + +output "resource_group_location" { + description = "The location of the resource group in which resources are created" + value = module.mssql-server.resource_group_location +} + +output "storage_account_id" { + description = "The ID of the storage account" + value = module.mssql-server.storage_account_id +} + +output "storage_account_name" { + description = "The name of the storage account" + value = module.mssql-server.storage_account_name +} + +output "primary_sql_server_id" { + description = "The primary Microsoft SQL Server ID" + value = module.mssql-server.primary_sql_server_id +} + +output "primary_sql_server_fqdn" { + description = "The fully qualified domain name of the primary Azure SQL Server" + value = module.mssql-server.primary_sql_server_fqdn +} + +output "secondary_sql_server_id" { + description = "The secondary Microsoft SQL Server ID" + value = module.mssql-server.secondary_sql_server_id +} + +output "secondary_sql_server_fqdn" { + description = "The fully qualified domain name of the secondary Azure SQL Server" + value = module.mssql-server.secondary_sql_server_fqdn +} + +output "sql_server_admin_user" { + description = "SQL database administrator login id" + value = module.mssql-server.sql_server_admin_user + sensitive = true +} + +output "sql_server_admin_password" { + description = "SQL database administrator login password" + value = module.mssql-server.sql_server_admin_password + sensitive = true +} + +output "sql_database_id" { + description = "The SQL Database ID" + value = module.mssql-server.sql_database_id +} + +output "sql_database_name" { + description = "The SQL Database Name" + value = module.mssql-server.sql_database_name +} + +output "sql_failover_group_id" { + description = "A failover group of databases on a collection of Azure SQL servers." + value = module.mssql-server.sql_failover_group_id +} + +output "primary_sql_server_private_endpoint" { + description = "id of the Primary SQL server Private Endpoint" + value = module.mssql-server.primary_sql_server_private_endpoint +} + +output "secondary_sql_server_private_endpoint" { + description = "id of the Primary SQL server Private Endpoint" + value = module.mssql-server.secondary_sql_server_private_endpoint +} + +output "sql_server_private_dns_zone_domain" { + description = "DNS zone name of SQL server Private endpoints dns name records" + value = module.mssql-server.sql_server_private_dns_zone_domain +} + +output "primary_sql_server_private_endpoint_ip" { + description = "Priamary SQL server private endpoint IPv4 Addresses " + value = module.mssql-server.primary_sql_server_private_endpoint_ip +} + +output "primary_sql_server_private_endpoint_fqdn" { + description = "Priamary SQL server private endpoint IPv4 Addresses " + value = module.mssql-server.primary_sql_server_private_endpoint_fqdn +} + +output "secondary_sql_server_private_endpoint_ip" { + description = "Secondary SQL server private endpoint IPv4 Addresses " + value = module.mssql-server.secondary_sql_server_private_endpoint_ip +} + +output "secondary_sql_server_private_endpoint_fqdn" { + description = "Secondary SQL server private endpoint IPv4 Addresses " + value = module.mssql-server.secondary_sql_server_private_endpoint_fqdn +} diff --git a/examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/variables.tf b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/variables.tf similarity index 100% rename from examples/SQL_DB_Using_Geo-replication_with_Auto-Failover_Groups_and_Private_Endpoints/variables.tf rename to examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/variables.tf diff --git a/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/README.md b/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/README.md index 6bff514..fa42119 100644 --- a/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/README.md +++ b/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/README.md @@ -1,4 +1,4 @@ -# Azure SQL database creation using geo-replication with auto-failover groups +# Azure SQL database with geo-replication and auto-failover groups Terraform module to create a SQL server with initial database, Azure AD login, Firewall rules for SQL, optional azure monitoring, vulnerability assessment and Geo-replication with auto-failover groups. It also allows creating an SQL server database with a SQL script initialization. From 1bfadc66b88e23b000106f4541489fd77a1fc0cf Mon Sep 17 00:00:00 2001 From: kumarvna <36370570+kumarvna@users.noreply.github.com> Date: Sun, 31 Oct 2021 15:20:25 +0530 Subject: [PATCH 08/13] adding example to create SQL DB with geo-replication, auto-failover groups and Private Endpoints using existing VNet and Subnets --- .../README.md | 6 +- .../main.tf | 4 +- .../README.md | 113 ++++++++++++++++++ .../main.tf | 93 ++++++++++++++ .../output.tf | 101 ++++++++++++++++ .../variables.tf | 0 .../README.md | 4 +- .../main.tf | 4 +- 8 files changed, 320 insertions(+), 5 deletions(-) create mode 100644 examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/README.md create mode 100644 examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/main.tf create mode 100644 examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/output.tf create mode 100644 examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/variables.tf diff --git a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/README.md b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/README.md index c2874fe..06585cc 100644 --- a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/README.md +++ b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/README.md @@ -1,4 +1,4 @@ -# Azure SQL database creation with geo-replication, auto-failover groups and Private Endpoints +# Azure SQL database with geo-replication, auto-failover groups and Private Endpoints Terraform module to create a SQL server with initial database, Azure AD login, Firewall rules for SQL, optional azure monitoring, vulnerability assessment, Geo-replication with auto-failover groups and private endpoints. It also allows creating an SQL server database with a SQL script initialization. @@ -46,7 +46,9 @@ module "mssql-server" { enable_failover_group = true secondary_sql_server_location = "northeurope" - # enabling the Private Endpoints for Sql servers + # Creating Private Endpoint requires, VNet name and address prefix to create a subnet + # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name enable_private_endpoint = true virtual_network_name = "vnet-shared-hub-westeurope-001" private_subnet_address_prefix = ["10.1.5.0/29"] diff --git a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/main.tf b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/main.tf index 9a80624..15cabdc 100644 --- a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/main.tf +++ b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/main.tf @@ -39,7 +39,9 @@ module "mssql-server" { enable_failover_group = true secondary_sql_server_location = "northeurope" - # enabling the Private Endpoints for Sql servers + # Creating Private Endpoint requires, VNet name and address prefix to create a subnet + # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name enable_private_endpoint = true virtual_network_name = "vnet-shared-hub-westeurope-001" private_subnet_address_prefix = ["10.1.5.0/29"] diff --git a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/README.md b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/README.md new file mode 100644 index 0000000..4ff14e9 --- /dev/null +++ b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/README.md @@ -0,0 +1,113 @@ +# Azure SQL database creation with geo-replication, auto-failover groups and Private Endpoints + +Terraform module to create a SQL server with initial database, Azure AD login, Firewall rules for SQL, optional azure monitoring, vulnerability assessment, Geo-replication with auto-failover groups and private endpoints. It also allows creating an SQL server database with a SQL script initialization. + +## Module Usage + +```terraform +# Azurerm provider configuration +provider "azurerm" { + features {} +} + +data "azurerm_virtual_network" "example" { + name = "vnet-shared-hub-westeurope-001" + resource_group_name = "rg-shared-westeurope-01" +} + +data "azurerm_subnet" "example" { + name = "snet-private-ep" + virtual_network_name = data.azurerm_virtual_network.example.name + resource_group_name = data.azurerm_virtual_network.example.resource_group_name +} + +module "mssql-server" { + source = "kumarvna/mssql-db/azurerm" + version = "1.3.0" + + # By default, this module will create a resource group + # proivde a name to use an existing resource group and set the argument + # to `create_resource_group = false` if you want to existing resoruce group. + # If you use existing resrouce group location will be the same as existing RG. + create_resource_group = false + resource_group_name = "rg-shared-westeurope-01" + location = "westeurope" + + # SQL Server and Database details + # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 + sqlserver_name = "te-sqldbserver01" + database_name = "demomssqldb" + sql_database_edition = "Standard" + sqldb_service_objective_name = "S1" + + # SQL server extended auditing policy defaults to `true`. + # To turn off set enable_sql_server_extended_auditing_policy to `false` + # DB extended auditing policy defaults to `false`. + # to tun on set the variable `enable_database_extended_auditing_policy` to `true` + # To enable Azure Defender for database set `enable_threat_detection_policy` to true + enable_threat_detection_policy = true + log_retention_days = 30 + + # schedule scan notifications to the subscription administrators + # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` + enable_vulnerability_assessment = false + email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] + + # Sql failover group creation. required secondary locaiton input. + enable_failover_group = true + secondary_sql_server_location = "northeurope" + + # Creating Private Endpoint requires, VNet name and address prefix to create a subnet + # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name + enable_private_endpoint = true + existing_vnet_id = data.azurerm_virtual_network.example.id + existing_subnet_id = data.azurerm_subnet.example.id + # existing_private_dns_zone = "demo.example.com" + + # AD administrator for an Azure SQL server + # Allows you to set a user or group as the AD administrator for an Azure SQL server + ad_admin_login_name = "firstname.lastname@example.com" + + # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs + # log analytic workspace name required + enable_log_monitoring = true + log_analytics_workspace_name = "loganalytics-we-sharedtest2" + + # Firewall Rules to allow azure and external clients and specific Ip address/ranges. + enable_firewall_rules = true + firewall_rules = [ + { + name = "access-to-azure" + start_ip_address = "0.0.0.0" + end_ip_address = "0.0.0.0" + }, + { + name = "desktop-ip" + start_ip_address = "123.201.36.94" + end_ip_address = "123.201.36.94" + } + ] + + # Adding additional TAG's to your Azure resources + tags = { + ProjectName = "demo-project" + Env = "dev" + Owner = "user@example.com" + BusinessUnit = "CORP" + ServiceClass = "Gold" + } +} +``` + +## Terraform Usage + +To run this example you need to execute following Terraform commands + +```bash +terraform init +terraform plan +terraform apply +``` + +Run `terraform destroy` when you don't need these resources. diff --git a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/main.tf b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/main.tf new file mode 100644 index 0000000..5e202d5 --- /dev/null +++ b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/main.tf @@ -0,0 +1,93 @@ +# Azurerm provider configuration +provider "azurerm" { + features {} +} + +data "azurerm_virtual_network" "example" { + name = "vnet-shared-hub-westeurope-001" + resource_group_name = "rg-shared-westeurope-01" +} + +data "azurerm_subnet" "example" { + name = "snet-private-ep" + virtual_network_name = data.azurerm_virtual_network.example.name + resource_group_name = data.azurerm_virtual_network.example.resource_group_name +} + +module "mssql-server" { + source = "kumarvna/mssql-db/azurerm" + version = "1.3.0" + + # By default, this module will create a resource group + # proivde a name to use an existing resource group and set the argument + # to `create_resource_group = false` if you want to existing resoruce group. + # If you use existing resrouce group location will be the same as existing RG. + create_resource_group = false + resource_group_name = "rg-shared-westeurope-01" + location = "westeurope" + + # SQL Server and Database details + # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 + sqlserver_name = "te-sqldbserver01" + database_name = "demomssqldb" + sql_database_edition = "Standard" + sqldb_service_objective_name = "S1" + + # SQL server extended auditing policy defaults to `true`. + # To turn off set enable_sql_server_extended_auditing_policy to `false` + # DB extended auditing policy defaults to `false`. + # to tun on set the variable `enable_database_extended_auditing_policy` to `true` + # To enable Azure Defender for database set `enable_threat_detection_policy` to true + enable_threat_detection_policy = true + log_retention_days = 30 + + # schedule scan notifications to the subscription administrators + # Manage Vulnerability Assessment set `enable_vulnerability_assessment` to `true` + enable_vulnerability_assessment = false + email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] + + # Sql failover group creation. required secondary locaiton input. + enable_failover_group = true + secondary_sql_server_location = "northeurope" + + # Creating Private Endpoint requires, VNet name and address prefix to create a subnet + # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name + enable_private_endpoint = true + existing_vnet_id = data.azurerm_virtual_network.example.id + existing_subnet_id = data.azurerm_subnet.example.id + # existing_private_dns_zone = "demo.example.com" + + # AD administrator for an Azure SQL server + # Allows you to set a user or group as the AD administrator for an Azure SQL server + ad_admin_login_name = "firstname.lastname@example.com" + + # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs + # log analytic workspace name required + enable_log_monitoring = true + log_analytics_workspace_name = "loganalytics-we-sharedtest2" + + # Firewall Rules to allow azure and external clients and specific Ip address/ranges. + enable_firewall_rules = true + firewall_rules = [ + { + name = "access-to-azure" + start_ip_address = "0.0.0.0" + end_ip_address = "0.0.0.0" + }, + { + name = "desktop-ip" + start_ip_address = "123.201.36.94" + end_ip_address = "123.201.36.94" + } + ] + + # Adding additional TAG's to your Azure resources + tags = { + ProjectName = "demo-project" + Env = "dev" + Owner = "user@example.com" + BusinessUnit = "CORP" + ServiceClass = "Gold" + } +} diff --git a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/output.tf b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/output.tf new file mode 100644 index 0000000..c938322 --- /dev/null +++ b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/output.tf @@ -0,0 +1,101 @@ +output "resource_group_name" { + description = "The name of the resource group in which resources are created" + value = module.mssql-server.resource_group_name +} + +output "resource_group_location" { + description = "The location of the resource group in which resources are created" + value = module.mssql-server.resource_group_location +} + +output "storage_account_id" { + description = "The ID of the storage account" + value = module.mssql-server.storage_account_id +} + +output "storage_account_name" { + description = "The name of the storage account" + value = module.mssql-server.storage_account_name +} + +output "primary_sql_server_id" { + description = "The primary Microsoft SQL Server ID" + value = module.mssql-server.primary_sql_server_id +} + +output "primary_sql_server_fqdn" { + description = "The fully qualified domain name of the primary Azure SQL Server" + value = module.mssql-server.primary_sql_server_fqdn +} + +output "secondary_sql_server_id" { + description = "The secondary Microsoft SQL Server ID" + value = module.mssql-server.secondary_sql_server_id +} + +output "secondary_sql_server_fqdn" { + description = "The fully qualified domain name of the secondary Azure SQL Server" + value = module.mssql-server.secondary_sql_server_fqdn +} + +output "sql_server_admin_user" { + description = "SQL database administrator login id" + value = module.mssql-server.sql_server_admin_user + sensitive = true +} + +output "sql_server_admin_password" { + description = "SQL database administrator login password" + value = module.mssql-server.sql_server_admin_password + sensitive = true +} + +output "sql_database_id" { + description = "The SQL Database ID" + value = module.mssql-server.sql_database_id +} + +output "sql_database_name" { + description = "The SQL Database Name" + value = module.mssql-server.sql_database_name +} + +output "sql_failover_group_id" { + description = "A failover group of databases on a collection of Azure SQL servers." + value = module.mssql-server.sql_failover_group_id +} + +output "primary_sql_server_private_endpoint" { + description = "id of the Primary SQL server Private Endpoint" + value = module.mssql-server.primary_sql_server_private_endpoint +} + +output "secondary_sql_server_private_endpoint" { + description = "id of the Primary SQL server Private Endpoint" + value = module.mssql-server.secondary_sql_server_private_endpoint +} + +output "sql_server_private_dns_zone_domain" { + description = "DNS zone name of SQL server Private endpoints dns name records" + value = module.mssql-server.sql_server_private_dns_zone_domain +} + +output "primary_sql_server_private_endpoint_ip" { + description = "Priamary SQL server private endpoint IPv4 Addresses " + value = module.mssql-server.primary_sql_server_private_endpoint_ip +} + +output "primary_sql_server_private_endpoint_fqdn" { + description = "Priamary SQL server private endpoint IPv4 Addresses " + value = module.mssql-server.primary_sql_server_private_endpoint_fqdn +} + +output "secondary_sql_server_private_endpoint_ip" { + description = "Secondary SQL server private endpoint IPv4 Addresses " + value = module.mssql-server.secondary_sql_server_private_endpoint_ip +} + +output "secondary_sql_server_private_endpoint_fqdn" { + description = "Secondary SQL server private endpoint IPv4 Addresses " + value = module.mssql-server.secondary_sql_server_private_endpoint_fqdn +} diff --git a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/variables.tf b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/variables.tf new file mode 100644 index 0000000..e69de29 diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md index 24391ad..a893246 100644 --- a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md @@ -53,7 +53,9 @@ module "mssql-server" { enable_vulnerability_assessment = false email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] - # enabling the Private Endpoints for Sql servers + # Creating Private Endpoint requires, VNet name and address prefix to create a subnet + # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name enable_private_endpoint = true existing_vnet_id = data.azurerm_virtual_network.example.id existing_subnet_id = data.azurerm_subnet.example.id diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf index d99e3a3..84d92e9 100644 --- a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf @@ -46,7 +46,9 @@ module "mssql-server" { enable_vulnerability_assessment = false email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] - # enabling the Private Endpoints for Sql servers + # Creating Private Endpoint requires, VNet name and address prefix to create a subnet + # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name enable_private_endpoint = true existing_vnet_id = data.azurerm_virtual_network.example.id existing_subnet_id = data.azurerm_subnet.example.id From 3e1fdd01744ab8939eba0204a87c108998ccf32a Mon Sep 17 00:00:00 2001 From: kumarvna <36370570+kumarvna@users.noreply.github.com> Date: Sun, 31 Oct 2021 16:37:29 +0530 Subject: [PATCH 09/13] updating azure dignostics settings and Log analytics id input --- main.tf | 18 ++++++------------ variables.tf | 19 +++++++++++-------- 2 files changed, 17 insertions(+), 20 deletions(-) diff --git a/main.tf b/main.tf index 1b84e19..ded7913 100644 --- a/main.tf +++ b/main.tf @@ -23,12 +23,6 @@ resource "azurerm_resource_group" "rg" { data "azurerm_client_config" "current" {} -data "azurerm_log_analytics_workspace" "logws" { - count = var.log_analytics_workspace_name != null ? 1 : 0 - name = var.log_analytics_workspace_name - resource_group_name = local.resource_group_name -} - #--------------------------------------------------------- # Storage Account to keep Audit logs - Default is "false" #---------------------------------------------------------- @@ -103,7 +97,7 @@ resource "azurerm_mssql_server_extended_auditing_policy" "primary" { storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key storage_account_access_key_is_secondary = false retention_in_days = var.log_retention_days - log_monitoring_enabled = var.enable_log_monitoring == true && var.log_analytics_workspace_name != null ? true : false + log_monitoring_enabled = var.enable_log_monitoring == true && var.log_analytics_workspace_id != null ? true : false } resource "azurerm_sql_server" "secondary" { @@ -131,7 +125,7 @@ resource "azurerm_mssql_server_extended_auditing_policy" "secondary" { storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key storage_account_access_key_is_secondary = false retention_in_days = var.log_retention_days - log_monitoring_enabled = var.enable_log_monitoring == true && var.log_analytics_workspace_name != null ? true : null + log_monitoring_enabled = var.enable_log_monitoring == true && var.log_analytics_workspace_id != null ? true : null } @@ -167,7 +161,7 @@ resource "azurerm_mssql_database_extended_auditing_policy" "primary" { storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key storage_account_access_key_is_secondary = false retention_in_days = var.log_retention_days - log_monitoring_enabled = var.enable_log_monitoring == true && var.log_analytics_workspace_name != null ? true : null + log_monitoring_enabled = var.enable_log_monitoring == true && var.log_analytics_workspace_id != null ? true : null } #----------------------------------------------------------------------------------------------- @@ -415,11 +409,11 @@ resource "azurerm_private_dns_a_record" "arecord2" { # azurerm monitoring diagnostics - Default is "false" #------------------------------------------------------------------ resource "azurerm_monitor_diagnostic_setting" "extaudit" { - count = var.enable_log_monitoring == true && var.log_analytics_workspace_name != null ? 1 : 0 + count = var.enable_log_monitoring == true && var.log_analytics_workspace_id != null ? 1 : 0 name = lower("extaudit-${var.database_name}-diag") target_resource_id = azurerm_sql_database.db.id - log_analytics_workspace_id = data.azurerm_log_analytics_workspace.logws.0.id - storage_account_id = azurerm_storage_account.storeacc.0.id + log_analytics_workspace_id = var.log_analytics_workspace_id + storage_account_id = var.storage_account_id != null ? var.storage_account_id : null dynamic "log" { for_each = var.extaudit_diag_logs diff --git a/variables.tf b/variables.tf index 80851bc..f6958bb 100644 --- a/variables.tf +++ b/variables.tf @@ -14,11 +14,6 @@ variable "storage_account_name" { default = null } -variable "log_analytics_workspace_name" { - description = "The name of log analytics workspace name" - default = null -} - variable "location" { description = "The location/region to keep all your network resources. To get the list of all locations with table format from azure cli, run 'az account list-locations -o table'" default = "" @@ -26,7 +21,7 @@ variable "location" { variable "random_password_length" { description = "The desired length of random password created by this module" - default = 24 + default = 32 } variable "enable_sql_server_extended_auditing_policy" { @@ -181,6 +176,16 @@ variable "sqldb_init_script_file" { default = "" } +variable "log_analytics_workspace_id" { + description = "Specifies the ID of a Log Analytics Workspace where Diagnostics Data to be sent" + default = null +} + +variable "storage_account_id" { + description = "The name of the storage account to store the all monitoring logs" + default = null +} + variable "extaudit_diag_logs" { description = "Database Monitoring Category details for Azure Diagnostic setting" default = ["SQLSecurityAuditEvents", "SQLInsights", "AutomaticTuning", "QueryStoreRuntimeStatistics", "QueryStoreWaitStatistics", "Errors", "DatabaseWaitStatistics", "Timeouts", "Blocks", "Deadlocks"] @@ -191,5 +196,3 @@ variable "tags" { type = map(string) default = {} } - - From ab688aa7aa5565e2d1c811f6f7f3a84a1553b28f Mon Sep 17 00:00:00 2001 From: kumarvna <36370570+kumarvna@users.noreply.github.com> Date: Sun, 31 Oct 2021 16:38:03 +0530 Subject: [PATCH 10/13] updating examples and documentation --- README.md | 146 ++++++++++++------ .../README.md | 14 +- .../main.tf | 14 +- .../README.md | 14 +- .../main.tf | 14 +- .../README.md | 12 +- .../main.tf | 12 +- .../README.md | 14 +- .../main.tf | 14 +- .../README.md | 16 +- .../main.tf | 14 +- .../README.md | 14 +- .../main.tf | 14 +- 13 files changed, 216 insertions(+), 96 deletions(-) diff --git a/README.md b/README.md index 5f13c46..5b2730f 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# Azure SQL Database - Using Failover Groups with Private Endpoints +# Azure SQL Database Terraform Module Terraform module to create an MS SQL server with initial database, Azure AD login, Firewall rules, geo-replication using auto-failover groups, Private endpoints, and corresponding private DNS zone. It also supports creating a database with a custom SQL script initialization. @@ -6,9 +6,6 @@ A single database is the quickest and simplest deployment option for Azure SQL D You can also create a single database in the provisioned or serverless compute tier. A provisioned database is pre-allocated a fixed amount of computing resources, including CPU and memory, and uses one of two purchasing models. This module creates a provisioned database using the vCore-based purchasing model, but you can choose a DTU-based model as well. -> **[NOTE]** -> **This module now supports the meta arguments including `providers`, `depends_on`, `count`, and `for_each`.** - ## Resources supported * [SQL Servers](https://www.terraform.io/docs/providers/azurerm/r/sql_server.html) @@ -27,29 +24,32 @@ You can also create a single database in the provisioned or serverless compute t ## Module Usage -```hcl +```terraform # Azurerm provider configuration provider "azurerm" { features {} } +data "azurerm_log_analytics_workspace" "example" { + name = "loganalytics-we-sharedtest2" + resource_group_name = "rg-shared-westeurope-01" +} + module "mssql-server" { source = "kumarvna/mssql-db/azurerm" - version = "1.2.0" + version = "1.3.0" # By default, this module will create a resource group # proivde a name to use an existing resource group and set the argument # to `create_resource_group = false` if you want to existing resoruce group. # If you use existing resrouce group location will be the same as existing RG. - create_resource_group = false - resource_group_name = "rg-shared-westeurope-01" - location = "westeurope" - virtual_network_name = "vnet-shared-hub-westeurope-001" - private_subnet_address_prefix = ["10.1.5.0/29"] + create_resource_group = false + resource_group_name = "rg-shared-westeurope-01" + location = "westeurope" # SQL Server and Database details # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 - sqlserver_name = "sqldbserver01" + sqlserver_name = "te-sqldbserver01" database_name = "demomssqldb" sql_database_edition = "Standard" sqldb_service_objective_name = "S1" @@ -67,21 +67,15 @@ module "mssql-server" { enable_vulnerability_assessment = false email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] - # Sql failover group creation. required secondary locaiton input. - enable_failover_group = true - secondary_sql_server_location = "northeurope" - - # enabling the Private Endpoints for Sql servers - enable_private_endpoint = true - # AD administrator for an Azure SQL server # Allows you to set a user or group as the AD administrator for an Azure SQL server ad_admin_login_name = "firstname.lastname@example.com" # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" + # Log Analytic workspace resource id required + # (Optional) Specify `storage_account_id` to save monitoring logs to storage. + enable_log_monitoring = true + log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id # Firewall Rules to allow azure and external clients and specific Ip address/ranges. enable_firewall_rules = true @@ -93,22 +87,18 @@ module "mssql-server" { }, { name = "desktop-ip" - start_ip_address = "49.204.225.134" - end_ip_address = "49.204.225.134" + start_ip_address = "49.204.225.49" + end_ip_address = "49.204.225.49" } ] - # Create and initialize a database with custom SQL script - # need sqlcmd utility to run this command - # your desktop public IP must be added to firewall rules to run this command - initialize_sql_script_execution = true - sqldb_init_script_file = "../artifacts/db-init-sample.sql" - - # Tags for Azure Resources + # Adding additional TAG's to your Azure resources tags = { - Terraform = "true" - Environment = "dev" - Owner = "test-user" + ProjectName = "demo-project" + Env = "dev" + Owner = "user@example.com" + BusinessUnit = "CORP" + ServiceClass = "Gold" } } ``` @@ -121,16 +111,10 @@ By default, this module generates a strong password for all virtual machines als ### Resource Group -By default, this module will not create a resource group and the name of an existing resource group to be given in an argument `resource_group_name`. If you want to create a new resource group, set the argument `create_resource_group = true`. +By default, this module will create a resource group. To use the existing resource group, set the arguments `create_resource_group = false` and provide a valid resource group name with`resource_group_name`. *If you are using an existing resource group, then this module uses the same resource group location to create all resources in this module.* -### VNet and Subnets - -This module is not going to create a `VNet` and corresponding services. However, this module expect you to provide VPC and Subnet address space for private end points. - -Deploy Azure VNet terraform module to overcome with this dependency. The [`terraform-azurerm-vnet`](https://github.com/tietoevry-cloud-infra/terraform-azurerm-vnet) module currently available from [GitHub](https://github.com/tietoevry-cloud-infra/terraform-azurerm-vnet), also aligned with this module. - ## Advance usage of module ### `extended_auditing_policy` - Auditing for SQL Database @@ -179,7 +163,49 @@ Azure Private Endpoint is a network interface that connects you privately and se With Private Link, Microsoft offering the ability to associate a logical server to a specific private IP address (also known as private endpoint) within the VNet. This module helps to implement Failover Groups using private endpoint for SQL Database instead of the public endpoint thus ensuring that customers can get security benefits that it offers. -Clients can connect to the Private endpoint from the same VNet, peered VNet in same region, or via VNet-to-VNet connection across regions. Additionally, clients can connect from on-premises using ExpressRoute, private peering, or VPN tunneling. +By default, this feature not enabled on this module. To create private link with private endpoints set the variable `enable_private_endpoint` to `true` and provide `virtual_network_name`, `private_subnet_address_prefix` with a valid values. You can also use the existing private DNS zone to create DNS records. To use this feature, set the `existing_private_dns_zone` with a valid existing private DNS zone name. + +```terraform +module "mssql-server" { + source = "kumarvna/mssql-db/azurerm" + version = "1.3.0" + + # .... omitted + + # Creating Private Endpoint requires, VNet name and address prefix to create a subnet + # By default this will create a `privatelink.database.windows.net` DNS zone. + # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name + enable_private_endpoint = true + virtual_network_name = "vnet-shared-hub-westeurope-001" + private_subnet_address_prefix = ["10.1.5.0/29"] + # existing_private_dns_zone = "demo.example.com" + + # ....omitted + +} +``` + +If you want to use eixsting VNet and Subnet to create a private endpoints, set a variable `enable_private_endpoint` to `true` and provide `existing_vnet_id`, `existing_subnet_id` with a valid resource ids. You can also use the existing private DNS zone to create DNS records. To use this feature, set the `existing_private_dns_zone` with a valid existing private DNS zone name. + +```terraform +module "mssql-server" { + source = "kumarvna/mssql-db/azurerm" + version = "1.3.0" + + # .... omitted + + # Creating Private Endpoint requires, VNet name and address prefix to create a subnet + # By default this will create a `privatelink.database.windows.net` DNS zone. + # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name + enable_private_endpoint = true + existing_vnet_id = data.azurerm_virtual_network.example.id + existing_subnet_id = data.azurerm_subnet.example.id + # existing_private_dns_zone = "demo.example.com" + + # ....omitted + +} +``` ### Create schema and Initialize SQL Database @@ -189,6 +215,24 @@ This module uses the tool slqcmd as a local provisioner to connect and inject th Installation of the Microsoft `sqlcmd` utility on [Ubuntu](https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-setup-tools?view=sql-server-ver15#ubuntu) or on [Windows](https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-ver15) found here. +```terraform +module "mssql-server" { + source = "kumarvna/mssql-db/azurerm" + version = "1.3.0" + + # .... omitted + + # Create and initialize a database with custom SQL script + # need sqlcmd utility to run this command + # your desktop public IP must be added to firewall rules to run this command + initialize_sql_script_execution = true + sqldb_init_script_file = "../artifacts/db-init-sample.sql" + + # ....omitted + +} +``` + ## Recommended naming and tagging conventions Applying tags to your Azure resources, resource groups, and subscriptions to logically organize them into a taxonomy. Each tag consists of a name and a value pair. For example, you can apply the name `Environment` and the value `Production` to all the resources in production. @@ -225,11 +269,14 @@ Name | Description | Type | Default `database_name`|The name of the SQL database|string|`""` `admin_username`|The username of the local administrator used for the SQL Server|string|`"azureadmin"` `admin_password`|The Password which should be used for the local-administrator on this SQL Server|string|`null` +`random_password_length`|The desired length of random password created by this module|number|`32` +`storage_account_name`|The name of the storage account|string|`null` `sql_database_edition`|The edition of the database to be created. Valid values are: `Basic`, `Standard`, `Premium`, `DataWarehouse`, `Business`, `BusinessCritical`, `Free`, `GeneralPurpose`, `Hyperscale`, `Premium`, `PremiumRS`, `Standard`, `Stretch`, `System`, `System2`, or `Web`|string|`"Standard"` `sqldb_service_objective_name`|The service objective name for the database. Valid values depend on edition and location and may include `S0`, `S1`, `S2`, `S3`, `P1`, `P2`, `P4`, `P6`, `P11`|string|`"S1"` `enable_sql_server_extended_auditing_policy`|Manages Extended Audit policy for SQL servers|string|`"true"` `enable_database_extended_auditing_policy`|Manages Extended Audit policy for SQL database|string|`"false"` `enable_threat_detection_policy`|Threat detection policy configuration|string|`"false"` +`enable_log_monitoring`|Enable audit events to Azure Monitor?|string|`false` `log_retention_days`|Specifies the number of days to retain logs for in the storage account|`number`|`30` `email_addresses_for_alerts`|Account administrators email for alerts|`list(any)`|`""` `ad_admin_login_name`|The login name of the principal to set as the server administrator|string|`null` @@ -237,15 +284,16 @@ Name | Description | Type | Default `firewall_rules`| list of firewall rules to add SQL servers| `list(object({}))`| `[]` `enable_failover_group`|Create a failover group of databases on a collection of Azure SQL servers|string| `"false"` `secondary_sql_server_location`|The location of the secondary SQL server (applicable if Failover groups enabled)|string|`"northeurope"` -`enable_private_endpoint`|Azure Private Endpoint is a network interface that connects you privately and securely to a service powered by Azure Private Link|string|`"false"` -`virtual_network_name` | The name of the virtual network|string|`""` -`private_subnet_address_prefix`|A list of subnets address prefixes inside virtual network| list |`[]` `initialize_sql_script_execution`|enable sqlcmd tool to connect and create database schema|string| `"false"` `sqldb_init_script_file`|SQL file to execute via sqlcmd utility to create required database schema |string|`""` -`enable_log_monitoring`|Enable audit events to Azure Monitor?|string|`false` -`storage_account_name`|The name of the storage account name|string|`null` -`log_analytics_workspace_name`|The name of log analytics workspace name|string|`null` -`random_password_length`|The desired length of random password created by this module|number|`24` +`enable_private_endpoint`|Manages a Private Endpoint to Azure Container Registry|string|`false` +`virtual_network_name`|The name of the virtual network for the private endpoint creation. conflicts with `existing_vnet_id`and shouldn't use both.|string|`""` +`private_subnet_address_prefix`|Address prefix of the subnet for private endpoint creation. conflicts with `existing_subnet_id` and shouldn't use both|list(string)|`null` +`existing_vnet_id`|The resoruce id of existing Virtual network for private endpoint creation. Conflicts with `virtual_network_name`and shouldn't use both|string|`null` +`existing_subnet_id`|The resource id of existing subnet for private endpoint creation. Conflicts with `private_subnet_address_prefix` and shouldn't use both|string|`null` +`existing_private_dns_zone`|The name of exisging private DNS zone|string|`null` +`log_analytics_workspace_id`|The id of log analytic workspace to send logs and metrics.|string|`"null"` +`storage_account_id`|The id of storage account to send logs and metrics|string|`"null"` `Tags`|A map of tags to add to all resources|map|`{}` ## Outputs diff --git a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/README.md b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/README.md index 06585cc..30f6a76 100644 --- a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/README.md +++ b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/README.md @@ -10,6 +10,11 @@ provider "azurerm" { features {} } +data "azurerm_log_analytics_workspace" "example" { + name = "loganalytics-we-sharedtest2" + resource_group_name = "rg-shared-westeurope-01" +} + module "mssql-server" { source = "kumarvna/mssql-db/azurerm" version = "1.3.0" @@ -47,7 +52,7 @@ module "mssql-server" { secondary_sql_server_location = "northeurope" # Creating Private Endpoint requires, VNet name and address prefix to create a subnet - # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # By default this will create a `privatelink.database.windows.net` DNS zone. # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name enable_private_endpoint = true virtual_network_name = "vnet-shared-hub-westeurope-001" @@ -59,9 +64,10 @@ module "mssql-server" { ad_admin_login_name = "firstname.lastname@example.com" # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" + # Log Analytic workspace resource id required + # (Optional) Specify `storage_account_id` to save monitoring logs to storage. + enable_log_monitoring = true + log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id # Firewall Rules to allow azure and external clients and specific Ip address/ranges. enable_firewall_rules = true diff --git a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/main.tf b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/main.tf index 15cabdc..03e2722 100644 --- a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/main.tf +++ b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints/main.tf @@ -3,6 +3,11 @@ provider "azurerm" { features {} } +data "azurerm_log_analytics_workspace" "example" { + name = "loganalytics-we-sharedtest2" + resource_group_name = "rg-shared-westeurope-01" +} + module "mssql-server" { source = "kumarvna/mssql-db/azurerm" version = "1.3.0" @@ -40,7 +45,7 @@ module "mssql-server" { secondary_sql_server_location = "northeurope" # Creating Private Endpoint requires, VNet name and address prefix to create a subnet - # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # By default this will create a `privatelink.database.windows.net` DNS zone. # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name enable_private_endpoint = true virtual_network_name = "vnet-shared-hub-westeurope-001" @@ -52,9 +57,10 @@ module "mssql-server" { ad_admin_login_name = "firstname.lastname@example.com" # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" + # Log Analytic workspace resource id required + # (Optional) Specify `storage_account_id` to save monitoring logs to storage. + enable_log_monitoring = true + log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id # Firewall Rules to allow azure and external clients and specific Ip address/ranges. enable_firewall_rules = true diff --git a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/README.md b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/README.md index 4ff14e9..3307438 100644 --- a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/README.md +++ b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/README.md @@ -21,6 +21,11 @@ data "azurerm_subnet" "example" { resource_group_name = data.azurerm_virtual_network.example.resource_group_name } +data "azurerm_log_analytics_workspace" "example" { + name = "loganalytics-we-sharedtest2" + resource_group_name = "rg-shared-westeurope-01" +} + module "mssql-server" { source = "kumarvna/mssql-db/azurerm" version = "1.3.0" @@ -58,7 +63,7 @@ module "mssql-server" { secondary_sql_server_location = "northeurope" # Creating Private Endpoint requires, VNet name and address prefix to create a subnet - # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # By default this will create a `privatelink.database.windows.net` DNS zone. # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name enable_private_endpoint = true existing_vnet_id = data.azurerm_virtual_network.example.id @@ -70,9 +75,10 @@ module "mssql-server" { ad_admin_login_name = "firstname.lastname@example.com" # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" + # Log Analytic workspace resource id required + # (Optional) Specify `storage_account_id` to save monitoring logs to storage. + enable_log_monitoring = true + log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id # Firewall Rules to allow azure and external clients and specific Ip address/ranges. enable_firewall_rules = true diff --git a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/main.tf b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/main.tf index 5e202d5..7e91b15 100644 --- a/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/main.tf +++ b/examples/SQL_DB_with_Geo-replication_Auto-Failover_Groups_and_Private_Endpoints_using_existing_VNet_and_Subnets/main.tf @@ -14,6 +14,11 @@ data "azurerm_subnet" "example" { resource_group_name = data.azurerm_virtual_network.example.resource_group_name } +data "azurerm_log_analytics_workspace" "example" { + name = "loganalytics-we-sharedtest2" + resource_group_name = "rg-shared-westeurope-01" +} + module "mssql-server" { source = "kumarvna/mssql-db/azurerm" version = "1.3.0" @@ -51,7 +56,7 @@ module "mssql-server" { secondary_sql_server_location = "northeurope" # Creating Private Endpoint requires, VNet name and address prefix to create a subnet - # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # By default this will create a `privatelink.database.windows.net` DNS zone. # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name enable_private_endpoint = true existing_vnet_id = data.azurerm_virtual_network.example.id @@ -63,9 +68,10 @@ module "mssql-server" { ad_admin_login_name = "firstname.lastname@example.com" # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" + # Log Analytic workspace resource id required + # (Optional) Specify `storage_account_id` to save monitoring logs to storage. + enable_log_monitoring = true + log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id # Firewall Rules to allow azure and external clients and specific Ip address/ranges. enable_firewall_rules = true diff --git a/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/README.md b/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/README.md index fa42119..8113cd1 100644 --- a/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/README.md +++ b/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/README.md @@ -10,6 +10,11 @@ provider "azurerm" { features {} } +data "azurerm_log_analytics_workspace" "example" { + name = "loganalytics-we-sharedtest2" + resource_group_name = "rg-shared-westeurope-01" +} + module "mssql-server" { source = "kumarvna/mssql-db/azurerm" version = "1.3.0" @@ -47,9 +52,10 @@ module "mssql-server" { ad_admin_login_name = "firstname.lastname@example.com" # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" + # Log Analytic workspace resource id required + # (Optional) Specify `storage_account_id` to save monitoring logs to storage. + enable_log_monitoring = true + log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id # Sql failover group creation. required secondary locaiton input. enable_failover_group = true diff --git a/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/main.tf b/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/main.tf index b1e9ebc..e81aea7 100644 --- a/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/main.tf +++ b/examples/SQL_DB_with_Geo-replication_and_Auto-Failover_Groups/main.tf @@ -3,6 +3,11 @@ provider "azurerm" { features {} } +data "azurerm_log_analytics_workspace" "example" { + name = "loganalytics-we-sharedtest2" + resource_group_name = "rg-shared-westeurope-01" +} + module "mssql-server" { source = "kumarvna/mssql-db/azurerm" version = "1.3.0" @@ -40,9 +45,10 @@ module "mssql-server" { ad_admin_login_name = "firstname.lastname@example.com" # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" + # Log Analytic workspace resource id required + # (Optional) Specify `storage_account_id` to save monitoring logs to storage. + enable_log_monitoring = true + log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id # Sql failover group creation. required secondary locaiton input. enable_failover_group = true diff --git a/examples/Simple_SQL_Single_Database_creation/README.md b/examples/Simple_SQL_Single_Database_creation/README.md index 227cbf8..431f33d 100644 --- a/examples/Simple_SQL_Single_Database_creation/README.md +++ b/examples/Simple_SQL_Single_Database_creation/README.md @@ -10,6 +10,11 @@ provider "azurerm" { features {} } +data "azurerm_log_analytics_workspace" "example" { + name = "loganalytics-we-sharedtest2" + resource_group_name = "rg-shared-westeurope-01" +} + module "mssql-server" { source = "kumarvna/mssql-db/azurerm" version = "1.3.0" @@ -24,7 +29,7 @@ module "mssql-server" { # SQL Server and Database details # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 - sqlserver_name = "sqldbserver01" + sqlserver_name = "te-sqldbserver01" database_name = "demomssqldb" sql_database_edition = "Standard" sqldb_service_objective_name = "S1" @@ -47,9 +52,10 @@ module "mssql-server" { ad_admin_login_name = "firstname.lastname@example.com" # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" + # Log Analytic workspace resource id required + # (Optional) Specify `storage_account_id` to save monitoring logs to storage. + enable_log_monitoring = true + log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id # Firewall Rules to allow azure and external clients and specific Ip address/ranges. enable_firewall_rules = true diff --git a/examples/Simple_SQL_Single_Database_creation/main.tf b/examples/Simple_SQL_Single_Database_creation/main.tf index 1e0aa16..8cbe718 100644 --- a/examples/Simple_SQL_Single_Database_creation/main.tf +++ b/examples/Simple_SQL_Single_Database_creation/main.tf @@ -3,6 +3,11 @@ provider "azurerm" { features {} } +data "azurerm_log_analytics_workspace" "example" { + name = "loganalytics-we-sharedtest2" + resource_group_name = "rg-shared-westeurope-01" +} + module "mssql-server" { source = "kumarvna/mssql-db/azurerm" version = "1.3.0" @@ -17,7 +22,7 @@ module "mssql-server" { # SQL Server and Database details # The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11 - sqlserver_name = "sqldbserver01" + sqlserver_name = "te-sqldbserver01" database_name = "demomssqldb" sql_database_edition = "Standard" sqldb_service_objective_name = "S1" @@ -40,9 +45,10 @@ module "mssql-server" { ad_admin_login_name = "firstname.lastname@example.com" # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" + # Log Analytic workspace resource id required + # (Optional) Specify `storage_account_id` to save monitoring logs to storage. + enable_log_monitoring = true + log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id # Firewall Rules to allow azure and external clients and specific Ip address/ranges. enable_firewall_rules = true diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint/README.md b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/README.md index 2ed0243..6ff2cf4 100644 --- a/examples/Simple_SQL_Single_Database_with_Private_Endpoint/README.md +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/README.md @@ -10,6 +10,11 @@ provider "azurerm" { features {} } +data "azurerm_log_analytics_workspace" "example" { + name = "loganalytics-we-sharedtest2" + resource_group_name = "rg-shared-westeurope-01" +} + module "mssql-server" { source = "kumarvna/mssql-db/azurerm" version = "1.3.0" @@ -43,7 +48,7 @@ module "mssql-server" { email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] # Creating Private Endpoint requires, VNet name and address prefix to create a subnet - # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # By default this will create a `privatelink.database.windows.net` DNS zone. # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name enable_private_endpoint = true virtual_network_name = "vnet-shared-hub-westeurope-001" @@ -55,9 +60,10 @@ module "mssql-server" { ad_admin_login_name = "firstname.lastname@example.com" # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" + # Log Analytic workspace resource id required + # (Optional) Specify `storage_account_id` to save monitoring logs to storage. + enable_log_monitoring = true + log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id # Firewall Rules to allow azure and external clients and specific Ip address/ranges. enable_firewall_rules = true @@ -69,7 +75,7 @@ module "mssql-server" { }, { name = "desktop-ip" - start_ip_address = "123.201.36.94" + start_ip_address = "123.201.36.94" end_ip_address = "123.201.36.94" } ] diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint/main.tf b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/main.tf index 9b7c944..6ea0f66 100644 --- a/examples/Simple_SQL_Single_Database_with_Private_Endpoint/main.tf +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint/main.tf @@ -3,6 +3,11 @@ provider "azurerm" { features {} } +data "azurerm_log_analytics_workspace" "example" { + name = "loganalytics-we-sharedtest2" + resource_group_name = "rg-shared-westeurope-01" +} + module "mssql-server" { source = "kumarvna/mssql-db/azurerm" version = "1.3.0" @@ -36,7 +41,7 @@ module "mssql-server" { email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] # Creating Private Endpoint requires, VNet name and address prefix to create a subnet - # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # By default this will create a `privatelink.database.windows.net` DNS zone. # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name enable_private_endpoint = true virtual_network_name = "vnet-shared-hub-westeurope-001" @@ -48,9 +53,10 @@ module "mssql-server" { ad_admin_login_name = "firstname.lastname@example.com" # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" + # Log Analytic workspace resource id required + # (Optional) Specify `storage_account_id` to save monitoring logs to storage. + enable_log_monitoring = true + log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id # Firewall Rules to allow azure and external clients and specific Ip address/ranges. enable_firewall_rules = true diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md index a893246..5a515e5 100644 --- a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/README.md @@ -21,6 +21,11 @@ data "azurerm_subnet" "example" { resource_group_name = data.azurerm_virtual_network.example.resource_group_name } +data "azurerm_log_analytics_workspace" "example" { + name = "loganalytics-we-sharedtest2" + resource_group_name = "rg-shared-westeurope-01" +} + module "mssql-server" { source = "kumarvna/mssql-db/azurerm" version = "1.3.0" @@ -54,7 +59,7 @@ module "mssql-server" { email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] # Creating Private Endpoint requires, VNet name and address prefix to create a subnet - # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # By default this will create a `privatelink.database.windows.net` DNS zone. # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name enable_private_endpoint = true existing_vnet_id = data.azurerm_virtual_network.example.id @@ -66,9 +71,10 @@ module "mssql-server" { ad_admin_login_name = "firstname.lastname@example.com" # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" + # Log Analytic workspace resource id required + # (Optional) Specify `storage_account_id` to save monitoring logs to storage. + enable_log_monitoring = true + log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id # Firewall Rules to allow azure and external clients and specific Ip address/ranges. enable_firewall_rules = true diff --git a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf index 84d92e9..d15e757 100644 --- a/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf +++ b/examples/Simple_SQL_Single_Database_with_Private_Endpoint_using_existing_VNet_and_Subnets/main.tf @@ -14,6 +14,11 @@ data "azurerm_subnet" "example" { resource_group_name = data.azurerm_virtual_network.example.resource_group_name } +data "azurerm_log_analytics_workspace" "example" { + name = "loganalytics-we-sharedtest2" + resource_group_name = "rg-shared-westeurope-01" +} + module "mssql-server" { source = "kumarvna/mssql-db/azurerm" version = "1.3.0" @@ -47,7 +52,7 @@ module "mssql-server" { email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"] # Creating Private Endpoint requires, VNet name and address prefix to create a subnet - # By default this will create a `privatelink.vaultcore.azure.net` DNS zone. + # By default this will create a `privatelink.database.windows.net` DNS zone. # To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name enable_private_endpoint = true existing_vnet_id = data.azurerm_virtual_network.example.id @@ -59,9 +64,10 @@ module "mssql-server" { ad_admin_login_name = "firstname.lastname@example.com" # (Optional) To enable Azure Monitoring for Azure SQL database including audit logs - # log analytic workspace name required - enable_log_monitoring = true - log_analytics_workspace_name = "loganalytics-we-sharedtest2" + # Log Analytic workspace resource id required + # (Optional) Specify `storage_account_id` to save monitoring logs to storage. + enable_log_monitoring = true + log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id # Firewall Rules to allow azure and external clients and specific Ip address/ranges. enable_firewall_rules = true From 18fce96ef820b370b1ac46b1fc15925b30d5be5f Mon Sep 17 00:00:00 2001 From: kumarvna <36370570+kumarvna@users.noreply.github.com> Date: Sun, 31 Oct 2021 16:38:35 +0530 Subject: [PATCH 11/13] updating graph --- graph.png | Bin 1124722 -> 917496 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/graph.png b/graph.png index e9bdf23c74ca1837ee42829fdd593dab43a5fa96..067d9c49e559de1662288b6c3553b73ac42a31e7 100644 GIT binary patch literal 917496 zcma%k30zZm_B~yl)>hkU!74&qQCtvQP-IJ{ZipyUt0-$!6ht;zWKD?Hu~w;2Q9xwL zxFA);6eEN!iLD|cOR5x*H3&jPmH?52knMk70@%(>`}L1%`^p3HkQJ&E(lPUX*jMu+ueCwY- zJ&oUb`17NSmc`r8|K|^RQ)le@xZ~&ZkA4j|*_*!5A?d))+cWl+E&s*Y=!d1|U#!?> zb0v%2Oe>L_RvRjc=@H%o{!gl2Z4%q;49bYG7RfSK()clBI~qz)^n_V`h*SJOKHUF( zI&Rwk@i)Y;9j_I>`2YB`_Wl2#Pv;%=_>I4MJ~RE!p*6}_GRM=bKis;xxw%Iwx67Y? z@?KQYj>QLPG@9qF9gAH&JgS?TTwjhvzZ@Cc*8lps+|!fw=Dz;%&qs&%_KrkbhQ0Wj zJDkLPo#Y?sH8ozo0#E-Yb|t{{$YaU@OdQC&&+``52$;Xq5R)_NAT5r_8IfE>X~t6_$pIXR#slGJ0u>Cw5d6~COu`!@vjz~ zvmaB&;xn4#iLb@2fjF(q*s&h!NDig?*}aqE`!k$~%eD-8zRA1N?B>mz&&$kWgEbcw z)1O~7P~01$9BB}KHz#mYPMy{CU7t)|$I;MB%QBSvW==lv=Yzt9VI{3LqwU9KEkaVt zNrUKx)5(g%Tt%0ePfUz;SBRxx@I%3mdc4uHB1w~+ISdBYUpIkGHykLZ<~5KKrh;?|@n5Qg%xsQ$5C{_z%85 zkM!hU!>lq)t^V=)p+6n9w`i7LJw{Rc#fmNHE2oo2_i#tc%)BEaEE?QHw+5CDJ#eQh zM~a?(H%GG$35v7i#O>Gby!erSgGudL67~G7-SBVgrguF%X_%Rvo1067LXoUHEfi<; zJlQRttsHqh}OswL~!7<3zXOspULIetv#S zNafO~t|gSzU5I{Ja*!-}!$|_(v>*RW{69{qC`vI@9xCEUyW3(!)jni-;g7h?8X~$lhsj_buBR>j%+xEm#)Wov7x9l-g>yH zfxB8TmMbWJ@zHA_GF?o-rbpOE|M|k>Ki}H)k+b+oFvJ+nVZ{H&>UEq z5z&?^Qq+jH6uEnbeQ&lY!De{VK#?$$`h1>Y1rgz;ud>XlDRMvh(xAwDb3)qh9@}to z%H-<|e!J^}V|ML^DX&jv@^_kp^p*z?HpWVP=&OlH?Nz8m>R8R*2T?och&ci|=lYJt zannSXhg12~1tPjyE&(AB(m<@*^|$EcdGOMfl$0acAAtUqD6^f z1Zfrf6B~G{k*Ll&f(t37&*#TY>%ZL46BZ(EjS$jAF%*NCzPwUNKC_xUW~W|gM(c6V z`_qd#{{4#`zJnK_%godV+GI5m3+!WG+0o7Ey+O)c{WXX8{Bkzv?VcR7nv?$2PZF0$86UBv6E`i494jCw&7&<^PzG>zMEjIUhyY~`EB*6H@5pes z1<%q@(LP1oDp0m+Rx^jmjefj0_`8i)wzZAiis;G^QGIR|bzh_o9yhGApw(I|wKAE! zoTI}0j>~UN{`emUiDuMiQ=?>+luW1C;d8PiiY!SXR4W*vBXzsXtV}Xb9Lm2KQQA3| zz^M=v4*~~d5$XZK|MyEAjcYwgRy-sAVbRMQIm6aGv9;`$XzbR8llNT?SFdV#PAsOX zMj*4+gookSCBsJ&iRALVHz&_E(sS_^;P&O?laKuQ;AmXk6w=@^#RyN;AWmkN&R2I( z6mceIW@c7KHOG*{lxm8ql5R;KGE5Ta+k1<8GD5E>eBSA-6p11Mw6#`RQMsU z^fg*dK297QeJ7Hr0^eDbenFOak&_v!9tKHRp5~aH>XwM-ncW%B7!e*QX~j>c8T2;^-xD7Uh^ zQ%FB%Wo2zR8Cruvu2AsRip%%bWQperiF|3HimPSM3{}s>;eU8;VaeY;cg6k{6)|n% zOvQ@?)j@(`oVb4&+@mEzKr2#8nrr*R#YC=L5}?D9W^-lc`6R+Cr%9|wgO zs2wvH55IA;O~R!ZdhY&!NmurU66FNXU#Wrao~=QT@CU1c)W-}*kG+yB5y=E70QxAN z>am9G=6-`!HP^?KzdI>^FBOGZRfk#8zIq_@F9liQvuVxjF0!gz9a)p`&g82PuKoH# zW&$PZ^=VH2N^@YJNFSZ9-aAkt;u8E&*cEwV?HBeTeZz0F#vHTHZM?FasV3?wSt?Yy zPctN?AD=RPfxQ8BP@CVsog|$n;L+!I(fV@o&gK&{g+;>&>LGFsk;&8^2Z~it`Ribg zP1>f%4j%Vu5$%f;Z&BotCFR3Uy%G*Y zL_}N)etk(chBN=Rw%;x5Aj;^mx2A+Nctm8Rbbk8&38RX<${98dW5OoUjsU&w>B2`y z`;_J&p6$J7%a$xzBJ3}G{Q`WuvJJ26>FdWeM|#JHBGbc5GF)?$vooU)J${z{TL8N? z*$9;PVQ@fDbZuHqp`d7(dP=-MlR8{+^VTiz0|yTL`TR}H{xXIxG`6%<9W-xZQ*Rfn zT*|1N*0c&>Oov zqYhlG_6{uWxwd0*62udT#piy0ewK&Z|B1&UHkE{uPcQk3H4wzLhEccEQw3f;@Tp*1AKh5TEj7r~2?~T`bG`>kmBL+#HJBN#`nm zUPdrqLP;t*%v2qgWamp?Z%XX*$lT+cV#IC@cZ=;wiS7A`7O!uaNKuqgs^$nr9~f1f zL_t!V;0@|MIcSbp)#DDHPz(W7#1b~oHYlpnjY!6G4+>W7wh)z#JajV=*S&8b>nLS4M{{M zeoM&B^OarTxz+0LW}n%(Icqxt? znC~i9jEzO(}Dyns+M?<+~=Qq?|L-uDX39N)~oEinsB~*?oBz zj9?XP#U&>qRI{CPs^zPomft@?OE}_R8k11om|s+s8eT$k$F&*zr)2>j7Q=G@b&nY) zXtmJ1rqQQst$Sws+W3BVE9&TBLJ(5gDxp zoc`G}XU^Ejo}c?{+DUxE#rW*ZMjWJWSpaVV$Bj)*U`gQ*I)_5J-0{89Zp@9kL)aU9 z#V0HdTp+Pe1qI2tBw&~~EA_1@)2gJF;mwEgZ{NNh^1JP8P2Rr#{o1(xUDB{3xti~;@#&n@ivvbZWK6&u&Tbg}1VMhIeB0WNhsHr(3DdK*VVqEy6 zm-Q|Hou~L>1BjPF1zjyt+m1vl(+xwH&DxLsXzuq$ENM1oe`x4Rm`P3~*?t%xt5>fc zu3E{z+R%Go*(~C#`RoI0^sfm-J^;)sj~9YmVgIp7KC5cBUq6q`Kw1DWWVSIhnr%)_ zPSNv3hwaP;p;Q54O`NA;iETly2HZ01E=*>@QE~P%&V|?`uO;^6Cg9-iR9DTqJ3?uI z^_(+;8Fc)Y&+S)eP&&~Fuvpt;uEl5j#K#BES65dX+4BT^EMMZ)*1(ArIcr2jS300?@4qpwa?ma**^;Zh}-4Hoe!8SQmf>lkgcq!sBS=b;`51|kj2nN zqArRuhn_@m(4wwnH{H24p#?|)oHxqNFMEE(0kq_^!xwM>_JRU~$Bh}(6}V==17fl# zyo9Kt-QC{UBcy~)M%9xi+Y{ANSt>0YAC61f;9;PS!16-S5deVT%G$mNU*RO-1jRB| z-J$AU@6cy?N4i2}Kha)qMd+2k+X~j|KP|e}akNjwivO_j%EY2;s;XlmYWn_VvyAM& zySMj2XE0H@37=?UpTIJ3jYfodQ(y1=$9)QJ31*xDi$&@hEz;CSheVW`Yum3I*#miy zLCML8*AEhVjvC9O3F&8==wt$Nner9i%1 zXFq|tTyC>XejvpodHeM+Pv*VO1ac->?4#O(S0D|YazfymTK1MNocX?8lG(owyl;B{ zLd{7wr$0a=qDuyfmk_c7oA*w@Y94>!!}2y`iC@fch4D)LX#i+=Gf#TLR?I$wPpI14 z91iV?m+8`_S-@ytUtdp)49Arjjw}}I9E_;iv75JYbF;QzzuM@Jt0eZTx3?FUZdV6a z6Z_ct5)cR2;2w!#kS9~4ecv}1JWc+p*hU&0WH(Rj3`jVfJ)?@lYpURO4h#eWRuZu} z#1{GZ7$f8DaiX^Y??%Ah#6#nkN`kRF_ zwHzkX=(=-`i;IhWBBBj-!`R+67u%_+MYi_0HE5P-biJY1#np9l-tH|xu0%itHgth~ zeM19mx_GOB;o%SfY2y9^2j)E_SY$-G3Z??(5J9_z_onYu+Xm+hK+ zt?p39ifUD+wB93D)`h3F;_vDxk`ooEwBu9eLzKP&j?QZps;DFeg(%$Gx&W5Yf20UIA)nQ2f`$&wxN@m zcK5{9Wf_jyant^{tZAnfoR$Ne zH9|oJTOgF+#t~b_@pSr+{Yo^-bzWi*_cGlzH~ja!#H*f6A79@^8vDPqu#*U7cT;js z=$kbOz=b=_{WGpLa(sCO1cm`H%Fnof=}J#K=NxJBE#N2Z@=RTO>F1+4d65*^qg^4w zjEHWcO7WE~{4Rq2>&^Ydrve_0dL==AGb1}rQQO}#d>BD%h*%20<1%0pdj+J#cHuya zmpH&@c!@1v8qL8%MG2Hmk`i9cO(ruN5#(-am;?}6k>U7_iLOxkxV5zv_=S>Q!`N$l zj-b$h)kXXOku6QcQTo?aXKtO`xAw5VwO;j3YQeCxK%SpbS&Wma*gt%;=8|hJbW+z( zii(#tchsrBubO=ZeF&c;26x2*06D6=Z&su7urmp)2?3TchouSh>e@aoi;XgK_t;y= zv#EujnCYYZ5hYxysNyTOcuI>Kx(GRM%2Nz)I9bNJ!{KCTjL359wzIuV9*H+NmG>iI z=EhBn6Q1Ho`@BTYm>_jM0KbBP~Q1XrZARY6C-2@T^lseQ1giQ-Xu=N{jFb{PD93^ zqS+^+>R}(W(T;$}0ZsnF$$NNynp_J(Rr0=ov@;x_rYAFEM=L9j%gsa*c6D_DdyMRJ zohtz(puNDAb4DZ4wjhcV1q75G>pcNH&@c#mguk=1^LRLe*@L5K%1+d;R!3RL5&)3( zmB$A&$*uU;PXgJ}arBv+;w`BT*L}-zk8b>5F5xl8eP*yUuArC`1kZqlCAgJ|vRc4ou;8Oxx zO;c+9R|^H7N^)}Q4lPRBTwa${*@a7qYV9j|-QyA3{hc9L`Wp%dULK`jKZpajP=OPO z=CpBX8d!P8rM*k^%__JwBn=U`y`k5%uns*-$fb$R0bRZH^#y6_(yw{!fC5S)IFwPv zpD>81dk95s8`1tYD11m!x>lh0#5BH9lcq(JD^L17>Hf;Ro>ZUAib$Kbh!zdEJo3c6 zgl*tPhXz9xVhES~QUpvF6FRw?u+iKjT8~7@n+2IfN2P3E@Z(FtpD@%4p_ph8RoIco z9xG&IwNSj0EM6)5E@;!?wI0u}q5z+L3rv(6pkFYJTFNItXDDmju;Vn4fy?h{r+*<6_>?6pX%#BU&gDDih z_IMB%j8m; z32zRCn^vCdoa3AC3i2w2^hjEAtMJRReM2^s_e{ems^Jvz4D!$n*+V;0BGj*GP)u|4 zFb&NQFkjEGgMCBIJY}=&I%Dj*V%SU_;wibE(q$amVI0yNz=jcC*k0Y;yg&;KAS%3%Jey#j9=4?dff-;Clk*JH4Hlvc>MyjLOZoCq_Bc{l`W^8PX+Yiu6 z+I*nRb8%9QguG;8gE^2)r z*{@x0Zf+?3YYqv3d8oMOB$hL@1RBK=CDI<}L+EBg_$*GM$swf)5!jIZ^+Hg&f#z(j zA{UT!(u=ggTf6zn;}<`v{zFV47r@i?canBm!C<*j_wvnKZ|lXaJ2|b3p%&9K3ACpX zeQiY@Z)}&w_1#6Gja*(=a_~%fr{am3a(kOvB^B}%DeAt(n%g7=Ey3k;;iJb* zn{H|atw!huC~ggxxsVNm&y#84q#YfAfNBkt{!|QEL@TFgYkp4M=3Hk7jwb`OGflZ|IXr@@F=aR1$?g8Wd9}o!@ukJqtJ6e~0=v`WKqARX$dKg?KqDE3R%h7t@c z5ZS0L3J4Z#i)`Nu`zKnqs=<@eAVy*Neman$3AXuN+p`?}6|DQOI^5FP% zwL^+$^!1`+!V_Saf=UfBAuCR*f6QjYS}|isa>Qc|JQ6dyE(bBMJGX7aGciL=MF;U# z%aI0;&pvopHXu?BloHPP63?O28&1BPK0k)x}BC?FMfomsA@RdE#kJMQA(YN_4W=p<1bQNCVu|YcN?D= zy+V>q;@RvT1+wNFVF*smv5dXZmf?sN8l&#tRo; z-k5`F(es;CdNG2neYOlG_!0+>(T>XAJ}If=X=rRgzqYjVWwR$qnUCGx=o^%olRy7) zA#C{l9&e8|`ZKC$LFhn#X3y=6jdNi5%l##m;eL;OkH$4jfT+J?GqeACcIG1l*2Fs0 zI%$R`+ACfo~6oe{_i1nFl@sGXC(VN>L zc7zi_tW^SC(J9NP$n*8B!WI(K5(9;u@kEl!>VuT^u-P`8e9zrT5@TxpSlm?c(&_nn z{^1x#9oD8ND+P>|Q7ab2c$RZdT1ra!S2-FrExlSU5OE&mH9Tu9h_RSVJD+QRqbv&7 zz{|>phoh0_ReGBYG_HtN_hp(Tw*<0TB_(NKV_F5cU*nb6=s9QhTQA{1NFTADLGXWV zR&_UP5O57;eUWp{0r;kba823_3JD80GicYYUEf^a(H*ypue%?UNa6w_B}qDmuW7T+ zX-ReW0~Z+vYM@#y1FJNJJPAG#WX1CQ`yAqBKnWe zG^!Vd$}2@9^={(RyGp;b5Ku#J6~DZ(;bhb=MAr2SRQ(#_MGRLEqcwyyszfy_eYunQ zh%)9tUt~s?RqD-MaF?}OBh#VOpY(?l+8q|_5!UZLVeyOkV^AQXrKp!DBm{d_={P0)E@h z3_@2GxjO=2c@~hqVyPXTDQR<8p`HUhA*iMV#p#-{(R6wU2 zM8CKMY4Uu7S@bs5ea7ev&4^I#R*SB&UM3&4|METCAYy9e#g&BaP=?%{=;bN8gH+xI zv7^rr-aJHg9Ugr1|XY^acb^v{{zU8GSw5{#$8E|7Z zu!Fwx$sibs*Ma>ina^G;kAstb`@2 z@*$m@Vn|&^Ol1*6Yk(AYVkm8580*2DpehH?;lxr*Y}KGQb@^UwJ+X*MOzM0>mJqA1 zK&c8O7SU$-;XLROOv=cxuH8ffn{X>b#MKtUUhV*#uhn-q?BxlCwX|EP%0z?(HD-7T zzRKtkkBEngih)l64g?u&OZdbYjy|!rJ~F5k01G5LbTQ5w2lxu!0X2#3z}DaZJMxV| ziE~aC6fi&qIj0q<@RK2du^o0EosDv$WdXc^+lNepID)b_Ts67iec8)eMJen4xb73j zcUwTssmGdU1V~L6Q;VCuqyP(e*x7R%@}_>o=#hj;12pc3aPa-N?#foBos>Gn2z!)I zCb@M+H8VR+Qd6K79o-zG4 z9<-4<%~WFD&Rtz-*73EKwe-iQgpB^vh~acq`}B|(zg>!o#vqwc+DA-JTC^NqNAy!# z4&VEb*wbNRbPe)$>Z!R$h2ASt;jh+wgKB=Gl=2c&nPFDq;ZvEtZn@5cad^Ga-yj7c zysZm@N=#iqh;GNTrB4vn5iWuM!f+AYli)2xK(uep~rQBm667eWL6 z#YD={mCIAN5N5o_8YXN{C{xfk?DbHj4JC}-&|59%>;5aFzdqk^iP*{P`9;3a|lTfJ6_iDGqK~CU!_o-uI~U~@}E3;LSDV3oBJU?s%rhYR?gtt znw}29v4u{_*ex51i7sE9v^%{~n$HomddonDjOdHyv?(?_RXh4YOMM@84M!D*OvJVx z^KTm8o@)Sea0*f4gmG6T=xGH6pckjL>9uAs;Sr*>ql~3;Z#g>mqOL zxb%-dOd^#E_CBB3LT*56&kf`M*$Epp&2`u^w*AQyGvBoN`{>ow6;Id;7Aq4ALW=ZZ ztcsRh)*0+{aWv2?maZ{oZ zuH7}(55SwGbY7hFlXFf`e4}6|YBd7OI^kDJZL!~TimPX!L!yzVgK<99R*~P^6|~4u zUw{4TG+OrK34|E+T2b5Jy?f#+{`h^+)YG9}=GyGg92gkbfmye$g3hJ(B*E=~ooV+O zIzLCT#3yzxr<3v)H}!|N2n5W&2#H$FzORt2&2^4LkK}1nQ?&3bo^sSLrbonXP_>m5 z7Ji?do$W)5tq_EZgF`|-0o2Z!bwX5G?57M`#JdA}d`ltClqUNrDX!s86Q?uEIzWup z)KdPJ=icsCVEVYr!G0O)3I>Ivg>wGH zHT>~Ax87v={zRkTn3y@}av;6oo6h>+-Q}}Bc=E5acmxCOfSOk{==`l)q9Y>o@ECY= zOKamCt&>6LJbBt8hU*HH83Tl_E!o+ukT4l_NT{La_ zbUY#btt+^myOg>Vm4|g)c*$I38GkIMQovMQQ-OQ@qE97it*JY$BiIL!Lst2|J zbN6{j(ZZCg6Q6{==%aPoFjIB$iZeGSsnu z#i^ml(jOy(NoP9&BNh8U;dlmpaki6c$aG1$8XOd4hL-}-dfMC^hZO?X_FeJ7fAt)= zM8r_1yQ$skw5>B%qj9`3-*u~8M<-Ul^1TWl;mV+`TS%!}oF#JCeZw;Gg|0OuQarXG z!hrD2N38%pN^48|L?5~}@Aq&zU44_c_R>eFU(bTNjvqh%Y9wogfXi;NK(~@O(>~Yg zNSk;#Yi$fX^0+_TYmNQ`JY5{a%`|0RO67)2Uw^+j>k|a&u#6hb17c@2_+v@Hn;r_q z#OiIoz8-&r)x(*i!y271;olR94U4kJ?0;!%|F%dQ$8)o4j8`g}hWqkc1DRX?ZE2QP zz0owqEiz-irQ+gn--s3k1qkV*yl)#VD{ovNXS;lAmeEjEW7qbHSZD_2P^Q`P83R#syaAf2xVu@xEd)dz1XJcTOQ+L{%CF}0}49a|HaB%P@^GL%I zgbX-zQgeKK{61jQTXr?<=eg2P1tIid2NC&JaknIY;ykmrjh|KC(YIfZMNXV1 z*1#(vA>ncF$i8K>?jwIZnFQ)=-E83yZo#-?YM)rh;hcGPnDAl%PpCXEq;kY?nj|

Q{Rr=8h;eI^I5qUh{lfu~ z$ZOfG^&m@+56*;|Pc%A(11LHi;H>ZnhEO1=!Ks()PXn*ICO=}8@k+_@6qWI-Cc!0d z_YYK(A+`{c49~?fpw6~j=UOFNa6r$8T_M{{Q~tEm*je!Vh}p|^j+$98Ziai980Tk{ z)z$5^!AI}Pv}%&WZh7(rPPQl0Zo#?6yP6vsmWh@&#AEybvx#@w0@r-vf-aezl~fC$IhK+&R}0F!H#1ldCVqdYq= z7*4}z*=dA1)&xk5NdlBBl;3#_KCGZKSS+CRe=ZLKA7ub(-^z5(;dFlghK|CrEzvxR z)P1hp)7|}kZEY=!Bs_Qb*5(i7+c&*G6<2Wgh98v05{!{H^*ZO=+Q|vudgJlI^&C&i zL2FCPQ^=bS=UOUSBW*kj4dg!OnYV6rXaF!n8L^V?Azj*aq}g5kj&>=y5vkCXt*=tF zKmO@!`+=N9D(AdTUsiNUYdmsSk1WbJq6BSyclDB8C^P$4h|FDebkwuVGW=@ygOiAeAAD{1vC3Xsiq0Ru|ycY^s4uw!FTj`a^@&q0vlo)IJaPjJBLwpn6q{|Uks zeM@j6Y{_zigewiboY7RAEEXPQf`D>&(-hC3%vK(MGIak~7YSC8w0Ya&q%W~em%cvC zH`Fe|sQ3QAB$n+lP{#XEka1Q<_D@210;h8a&uqN%BE00WNV;pl8f%$H9X(yv+azu%;uXLjCK9WRpU!(=ORtXckYxn`bB!%3yHjdyCKw{6tBRgS+J2*|n!o#QKUUId!g$v9YlRl|4n?4LWnQWvoHj&CW7zceCGlNgF!Bduqmm3deHo`CzD+Aps-~i zbJ@++CG})_t2)baE;B%WvB;qJQBb3^X^N6Pe)F^7`>I!2B`5yJxzoP|u|;;BHL@p= zUL!CrH}q~`HaPTRRTGWudr{&EbTdQ>_J=pb*0i;GB3^&0J47(>pLQ%J@crwB>rn>4 z-nDCq-xIlXeTO!e2!aZt4$G!3_&iudK<_7B+*KN&5T5fiEf3jV^=Fo>(;j1)0Tcn>=>R#6N1PW> zNxVz*zT*`%(oV}_bcv;@?;YtF8Vc?g9$+<|kn2`TmvO_=V)V7kGkD~$%RV&*m6!GQ z2IhQo*PV>~TvqyT2Y24S%&zy#Z?ca62r{U0*s{q%7*rWdqs_(5A4}vOqy#s;oEq7m zXs}K@9}v~4y*^w_VR7+kB)WNbvrku-TqvWGaORz_UYX-Mp1_7U1vlajiD)_pyg2ww z4%R`G9<3Zel|pfXy#Zl?n>p-}1;lSeQXpVfv!*VMM4QEWPL^pXz{xUAY#b^NC>S_X zE9PIHAY9||BTfPGhY%6t=uRxo&!7Eukx=R5^#RtiQ5qACTn_e1<&S&9Kop_;5}L0m z*G$X;;7su+5VYWjcW4=4dr*8hCvXBH|FpCaWpZEMEc^nAi3UuV+@$DhNLDubFcJE5 zb&m21P=qrag=H7EELb8f!SbCvdD4gG&1wYU0A5`|4Ykxl3t5xC)MGNgLT$19b)==M zKr9yTc3g!EMjB-|_|G}>plJ-|4;l-W(`v_7M&4VhBYl^)#x^$r51IY0%Z5!MC$h&wiMM)uAHBhj1_1%d1m$x2)t$bmVy zD!~!77Y|*DG5uap2Rw{Cy5pJa4Ej_C%(IT4rgK;7MY`VMwvY62XIa?>8(Ul3-cXWn z$Bp%;&B}iH<*WUy#&PJ-30j2=>h4~^3C9!-FvQf|DKp6Jh^-|w+?B`Q!;JNu=edil z6{jE0T{@_%EviHX1q?u`WAE6_1fK^2V839bX_??W`@|Epb4K>keyQA#yyRTPdTbZk zL^bnnz~Vr;MNlD%v|1jj6j6kW>rshCXoCS1_7Tp49l>DWsED@yWj$$U9)zwzNx%qH zvQOTP{w!KUg*VGL@t4xFjJnKmPzO7F{h4d>>7bK=9_^{=mk1MlX=NHiGC<>vm4SW|RH z2#?apUbjgb8Yjl~EZZ&rOv?slBNssrUCngk_)Xqm1y4dyOUuu`p)<;@HvYgpWz%5~ z0uDwD!GqavC}w#}pCyYbI6ElpfI3lTRHMJ7QCXPs(k#Gw z&6;IF+TClPlZ-n%Yq!!TECtO8Xum|p$@ZJ%d~&C>p441WL;WOq=P8%AC*c#?eX))X z`MV>+h#<=;xRHuT-z23eqnV>C7RJJrUy)ih&Te%4F~fSBE*=CzSVUgE%SHp- ztYwBfmprKlBgRNdMN8DK$ZV z(a8RGh+Co&3Z!1sclVw>;sX1xXj1tUyd%uvyC4ZrEB)9>8qbX;+=kuEt1`YDvov`| zw}-pCiIF%xYSG7Sey~73uQ1lUNGWdE)7OBOH{e6B5}meZ9G0IN{b}eP)-Y9x5`jLS zMcDbflxp}5zqZ^#x&nydvbf?#BO;5}=x+o9gEJ$G!HtmKQ02ZfnY7`yHbV)VU!0_+ zJ6Cp_z|A7C7XXAi^&Ul|JtLsxItzSJxQP$0?O)b__U2XK-L*Y7aTWV-hct)8Xag>Z z#!p;~4m6N?>PSPAPcvd0orws8Pj!wOR`w|ZTP@oi&}XV&kR8)w6VzJZLOAhlZEX_) zFqmLYH@sYTXalR!-HodamJ?FkcK1_5FR}w;!dJVx#>{w%Pr5>)*4e#BWx@z0%AkhU zjEgkn9_rzUkv(ATsyqTZmc}BI&RS&pF7U|M(#l!UUUuS<0q=8KQ_0BmPKjOnX7a?+mI?!I4A+i2w^i>F9X=+-RIqfQS$e5=3cm@GzE3@uFMQ zV=CxWUL3O`vYgY(%q`K=N@T^nzjW1)Za}?2Uwthu);`h3j}i|@7gw#Jvn3qPT+J09 z(#Abx6&%y-<$jEyv<{H{?5Ggg8`(;CIKm`2_^1X6VM2qEY8FN zP%~sPi^di2FtQ(hfk`RPIfv-iY`pR@t{64bH8Uuup%+g3>ag=VW@&1VLMlV%@Dg`* z!ip-9gx+rK`&9{+RZZDWwzXa5^RZ@eH~r;xw#TewT-|4xd~Wy6W}hV4{+T(S?6`Sa zM#HKSg)GDFEuEtcHEK^Q3f}bN2Y`zYjeEYZFMrLNHQ)QMF43BYFn%Qvw&O@#hSEKb zT<|jr@z1c82lHJCltV9TIb)h>N@W=?9=)hC1OaB(2oeYj;Gp?z0?BZtc=<0=Dgy== zzM(3V#WYt+i+NXLLqiEq-H&Vx6Q#sVl{MnxhC&Ph8lkUkGPLv0r`8BAjf;M5SZTiQ z`QnTF#p^%L*;l{^y54l{@J$}wyYrLpyLRXEwPEPLXFWV_f0pG4>Ez()_9P(`&|L-j#IV`H)oDGw)MhPR$r7ct&NyT~dmFQ%wxO$lL02_$ zzGyG8Fi7yyQbhpO@n1eCFcc;+Bpjm-cVB@jZc5zWWmA*tnyafpCc>FN5e-gzD8KkN z$uGw_hX^rbu4zh4`8I9NuBc5J7}supxKbTOnYKw1bUKhNH$jpe@Kzz~6%pH+j@hh_&QTcmXCj1$Zxg2=g;6>F2&9LDupFh^4A!@d{-FG5Qi9k%uMoOYEPbX zY2MqTei+6eG&u?q&JQvG#29r7w2~0(a7rYwQ2JRkxR3ZH3aB3$cdBk6ZY+W^tdS+> z3#uil`4HzQr9BdW9BwI^Yp1>8z0K*b2-s0kCG@#twzwN=p(mz>&-bbu-qh&78g0EM zR3$&D<+xo&sP2!0$mDdgS$Y|Gg$;>B>J3%3h_XU|*-7*!8vVoHBHFCP2b~M&0Z~r$ zoa+t|IqmN0c`ZOF6b8e%KpqFv=?rcVy2J$5Vxsgk8lJE6QLUKBUqTO}!+zZEAA`zN zhGE_z?){MFVq(-Dq&`>iga2x|zhl`AOI>FETo~D~Wvmml@5pmAIrWz7+5Zmg(MwCs zUZ~N<&_Qw7T{Ng3UaMj*eML6Z_J>&n678`uU~U8^bSP67sjK&|JhFth`svgDU5Z|%u|`U?rHaBJ%B zg^PyP1zQr@Ej(|+U+%I>xZlGqYx^mTPe$l}p*hdhOIK#_*8MmCrLF|CFFuNBo;tO~ ztbACqb83rFEIYB`B^Fzog=QN8GoXj5TfE=80{biE_LYXjFRJavX_L~_czN`q|!kc6)FoTL0(??tOgChTs6xC1ZGp2;@#n`{OqT?SP-=SUzyS69s@~ z>>W;y=+9tmoWuh0y(|!w!#;V$M?;=)uC=W~v{eZk2LgmZT0D%B-in!gNMKtAAB}EJ zCJe6nOT$Evqm}7#gw+8^%p6J4XmeUHdK#EAXuXS@RR-%rf5nYd{({K?i@wrjDV4M# z%YA?BzhSjwcc8iv&dN9kXh7MFB$z+(tXk(=K2~YQ16Z^X*PXCBbqk?lHByVbT2#S*lJ1(rWu=HQDECN0}CH(l5aHl zFO6aD0dOP8P`&ZJ^ijfT0w_}Sp>y(hJl-+H`)Dvm{DDXms^gj%ZPgtMuCv^W3RYWm zS-e)82JJCN(A>wzkW4ImHG;dKF2x21e++n;D&04I+BEnVX7};d8Z*giMJS+mbfkeo zI7cwsR!4^EP?vNI-^@*$bLR$)8_?=L^u0QB&YeT1zoir)s>%oxBSG`dhj-aaS9*;6 zzCin;fA~uEL8t)kP3{k0ewhP)yE}h}Q`UBu-7{%B!R?azH9YPO@VHtB`%up~!iPrh zs!Z9T?~z8hoZhpWitY*-yQ?v%j~gzS<>WcY5}nLyk|}nzVgRQHHiAv>VP_ z=@GHv(?48}_K>^W$;l}gY)RXB)7@7TP^2Pyraak(iWIa9xP`XoD*X2#>0)hi5*tg; z-}QdYPA%=L9rDuecK7v}5Ix!`qw(h--HxI~xb7OM@&gLLAvtyn@xCA=+Sp7~JDL+r zd@WH$W0pEP_{CDbCmnCH0~52Y{p=fqoK(h?{6Np&Z%AYX4c!h)`Nv&XS-i|&9jbXB zgQHt3|EgU@&cuYkf|A{yo2VYBLJyz?S=?^Dw;1#9U!dqycM{SbjPc!geVz95+lzy% zZtPCl(w#5n?L4*D6O9qQeAj@LJ()3pcUsx%bq=#c-4z@vtbw3K9DRpREVad9HQ$%Gq<@rSL;9c(7p zhTSxsL7E$hpSEQ|kd-t|Ku>C@k%bhsG|`~vywF$I4ptB^)<)1x?e&sk6&I3yn0VhS z^~d&!SLJBEm%|=}kQg0&whk~67Ta~RAMcnL%$$3acQcm9`^Y{KIO%o}w?u1P3>bb! z_KC@qi+nT^CasK%^*#j8CUB8KcUo``j8~J{+>L)lzD7f##9w!&fZiDoF!Iqfd>i%^ zAQ9L3^GB5dIWNI6=U}4asHj%EGA8H`GzGATe~QAKq=dJNKMx}K_RngqRm+`-2E-iWB?zW3Zh$prM*;CrSol;S|)EWh~(64mB+7&a*3T9<82} zQ0^z}&-J6U6$Hjo)|*uIx>@i=Su%RJjM(?Pm48+G2W{QhyF(F=I33*a>LLf5zWC3* z-mUwpSjaudKfNZ<;(ajc))67zAbnEQ;`g4VhMXtTDHo|;q=^Bu3Brv8g`%VakPzOp z0IQgzT`N;7dFqrJ%2R`$<-Q$uH$nns8_~3oqi>dpPr}eMCZ-#k`@@N!@F3y5+!yG@;Vmo98ddx%T)!Ucgi+@$ zymhE{qmK0Y%lYKuom1O&;klf6v?OUWOgS{998my$c zNemSUwhW9o*fJ0BW)%c`MzdBsONl<8I&aD}>Mmkt1Ku_P?RC4~ zvGOaH@YI+4o>^WoYYdXud~?4;yrELQ!Gx4!9whOfDYzvQUg)kSGt5`U#4p-6B)irn zyynecPOFF=pR)~M34iKlq~f+RI6E06r)50E_h|22Wr3EdFh)9I{~}&`@t})GiZ59QYk;L z`O;Z6hi`UTe@OaH0^VAW=u#jA7i3blL`hgPhoof*LY}D4r!QAK2lz@5ELr(Agy;!B zpH8wo>Y}m*afd7;+Kq7U(HriC7u3jq_h*+%;Q?lu|5s87T|zd!dIkSWCPttnt1>SH zx#=NU__~7=d~uH$x|DD>2z@o$EKunZoPp0EmuEXMI)dnOH!8fX46*KzK&*#1z-|~7 z(pADy;=NNx``LmHwjkD_5)x+)jKcPW-K*4LvGF}_-B)f6+jalDJEZ89?0Zq8dW@o8 zqQYH^OYx4yO5PCOjX=GH@zyitQt}-0n0hbCmaj2z!FcC0&CG8aDQ1Pbs-lm^3V=)@ z*jPceN`6rwS>???y?*_e|HCQ;Yn@nLO-{f{3D0{r2i5shRgoLagX-w_#C+>&w^)fU z8cl?OX*M9%r9TiQ@8o|*JHu9da5F~bTgTea%WdfM32Yn=b^7>YnD(?=dsLb*t?#!` zQ-61m)6O*V@8U01vVulTP#9v6YHG8$x|dK5+!j1C}&z(n!tF!l^v10%Y=TV$xbWW;Qux(W;q^Gly%?)GcHf zHd41AH^X~{W>rk%8V&t2G?Z7CrD4ukt=O*t&Z=IXYKexaA^h<6?dsD+N!xM-J?n~A zv5cyyB`d#~jbhgPYj00a&vyy$Vlp51woT;+S3P2lQRURCCTpVcEtN=~6m_GN!QK2- zA(ln;umZ%)6KkJk*mYDYi8nv(Al_Xb=Hn9NmgWuBJJkw?dWIVB2ywfIDX9in_OSj5 z*}&gSI7ZmJ;yc4pcI+j)pd%u;_rGwoc(@-g=2zg?aA@##^KPdx4q8%zI9 zQJ_xXSWk~1=8A1pJ?o}?Vm14>$GLC)81TU-?-_L7x3kIfvaVROa(nmgg`IOdE-p^H z>zwZOg`4C1_4a+6R~#r>oVrDKpEYZS^{QoQzxT~9TWN2zPWFAkCqL+U&wI~n-fwkh zW?vde{;_!eNFKc~(`RfT`J+2Wr8zIJ55#5)#5MwfNH%h1pkA!Bopy3vV%33-s%?tf zSq>>Te){R5yLaC19UdMTKW|A)rN8ao^FxcVeRs@`M481ek!Jj=s)HdRD?|q#$eVZT z#+5yn%4a0MbNnmly_NjMhC6reyxrXYp6u90(njjEORa%U4_BIB8*N!UPqaApGwkHy zeAfMadAlzi|F0aFc;Il?Ki)l#nF#!^2|`L*anOA}u&t5hlVnq6@9TRVBZ}#c+4|E? zT4tsBR88sL=kLD-s-^+h^v$~-jur<)72;E;PTgt7?Yz5o?o3KH^|*2R^!q!VoiD!S zYK1pNi8^o~Yw_a6JDi=b;SFkTRvz_BT|OExe79cD)cv>Le?M>PUij~Se!j<4ELZxb ze0JPx&hgd-OO`HOHN`Q(aDD5u!&g7J8E9kbRAtRMgMKb%Op-`97uCd1k|q5KM$%RTSA zXV2YIS(Lr~soAq<|Ni93<>X{t%M3?M!iq<3?9ADp?>g0eo{rAf3pZwN3TfMR0H z-tT+P|NDMF@6X5QM4i3&^E~%`uXU|!U2Cn2Dk|4>R12*8F1%rE9JIwFOw7)1 zTzot}kR-4nZ*x3s(j?HQS!zp)UYvVS2zP!X#aQmd}5 zodQZPASlSBuO`->Hz_gk0zM?fWFcB<}nS&(}$n zm6f&r`AvLuJjbfXdSTA~sh5|rwe>}8A2s0}ijA^(Ut?qAi>j(GyC^{>B~P|>UqpXe zL5t~;u9b@6cW~*qeY2)`8sQZO zxw*NIucHh0K*wB5ufwZiDs9;x^M~=&PQUB2EbFt5)4r^$>stA(*FaBChClz;pQzM# zNzp0D{rsIrVtTCLob%YX9INh1w{~>v>K@NJR7*Pw0e=ZYI^*B(bIM5?^`fy6t5&bB zG?7EdR@d10>VI}lW=2MEZF#^UkgIF8SfNh~?sD8YqeWUCNwFy!9vvxIW!I8xBXPU^ zRJl`L3kgdC;qiRX;)rgB8C67_&1)v=3=KoNHfY%3ng;q1$ikK&GB%s+=ZrQ z%jrh9tzV^D6*QbGBvqZk(~u()qrDZHF?PrY%#{(_{`^PCjpDX7*lk zRavnXYN(B_Uq7Xjs>bep2LHvkdDfMls)*W8pB@p5jT%e8;Xp3 zW?Q$!CzrXqC42YoeIomkn|hAjPKyhav$Hd|A9b)k zM95J1$dP@0_XqNKu(EbpOLST0z(n{SPSMJ_AQG1HHWRK=?O;?jR}sxZ`s1_5T_M`T>XWWZ@4yU3b)@e7L`c=FxG(7y` zu8p6krm}I~yGExg8v59srFGxuTf3HWCgkU9;pK@WQax@rT}d{w7k`R1ECW~c^Hk1vFm*cx*_|w3+F}8|fb!0%pfMV}URH$Jw6H`(GYWpslnWapB zV^ROYqV>g2iDTvKMo({V6Br0sknXk)Vx#uzS_HMV_0>w|lSyi6YU?8(>- z&dvpRjF)tEQ&IGbot2P~Adk(Nn3#C*DsQYD=L-^vZyw$FpX%6mZNpbc&)DLq>w>p5 z+R-x!7hWHZik68!|9-$J?%eVfL4kpxQPIBf`xFANYwN%$y?F70^6jr2^Iu!#uRTJK zJrY>j@#XOrE@5$TZh82(3#zJqaFp1b*jk(8aIBjKC;n&vsMjKth_L>1F0LO-&r$a8 z-@oHb$K>RT zFwfJ?!D<&SSaOFl(w)Bw@x=}f4z*ny&+pp!j5dTH4);vYFL=6|eEj$kd5SG$!z}8X zg@VV`QYpVr4vg(o6*$6M0sjpYkdELm;7sGc?B1nLk#i8jP=+SClCNO-mll5a(k2KQ z`DWMh^=k|s)gN`6)jYt0ZeU~#6Wx25y~E=Ct?r7D2lqDaWH{4Y7%~?gwv8^EY32QQ z4~nLTU1vL@Km#1wxF&c2_BOOfrDN6MvTAS)2AP`7!a7B?)Tp^mE(dgM?zGLr-)&iS zJFCfb235))rQ(9+FQ};agocJ@SazLF(abzc^ts0xR+Mf#ba`tw zoL!sd=Jl(N2n)v?F{!UGaZaiu01okcrK*BxU46apmKAjBw{k`v`dXzsOGm+m9XWb5 z>~+MHWU{q*({O4TGfZ>#i28pq&1$*uT!%kh8M$jQoO(u97E4%Zqj2_YhG|oJ#`3~_ zj0^Q}HQ3vK)NfUL35y9o6jIw)yL9Xp7F=*Vu=hg@&?u$u^XFYCy9_v_20kkxI{F0o zZOEvNO-(Q2$RuAjS!S|=PK^-{8OM4914H?st;wxh=TDwI2?)4@h2`_FU$0?|G+fGj z_Yp5TdGfx!P%yllmGRA+pJv&d$9h%fd(RxJL0puIV}_AdWG&dXNQZuI=V1@sbHPz2 zcfXxK;Gb3jS5xydH6!DqLLiR{y3y9Zqxo^^?}YvEC=qlAzWVzY$DO4bKJmkAhpf#uOI*T-r5Ve5F$1on(64;|28c5wf&JcL`@!N%s_ zFi`i~83{{Bgbp_kTxaq)eL3lpkK8GRAilbtcfLi>4i)K!iCP3wx^mYa`Gc;lW;-jZ zA6`a)6`+;~DaXr%OY7~uSx&38>Z#h7Y?4L21iKI#x&x~Y)2akNi8JL3Q>L%~5~m+P zlJG3gcVNMHMeYM$U;BT~8KZmMcurAq$qU~#g?+3PJ5R+&FReOqkC&6xuQ5~svZUhU z2oG#yV*{@u6a)o85_*f@JyMc+)z2L=?5PS3l@bF4quh{ITyq?QCjsHmt& zthurA1za5L5-jC9V3OnM2?^Zelamyzxt*OlUf=!v2bcwXR8(AC9H;!gefu;sjRSBW zHA>KsI1HCCk7v2gW;qOIHe9@T@p|j={eHf_n_Ixk6FBdWdv~!_fa0H#O;4Y8!!=$4 zgv2(@@GeuGn`>`xUul81dw=^t5fDu5Afc70 z4y@iv57>P5!HsRqz!X_Z;kw7AO6%k_zf`b3cir*4n zvE*2Pd)4sj4p_eO@3-(C1U{AYcGbRe0n8XlzKN3v}Aw#(%R%Ct=nvpjjl&uX*7#gx^LfaUC(d5Q`oDO_&cntwBNVWKNw7IMi~w!K{)5ed zeeJZCfL(fy_YRL*<}#T_>#M(FaU_)qYR4_y79sTQau3$#{Pqv41b8>ZHH`B81Amo4I6w z{~I0mRD(YS3FThvVleCjiF{llOj{g1_ziwgvTQsm>3WKpKER-%-m>HPC zK%>}~XS|7>2F*|E_@Hf`^khzTA2C;MpV!vEEestUNeM9kf{lrKPD5co_zkPW>B?Kt}`f zKW^)9zg+eCI}t%&-O&S!4nXt31|ALg8~X>Cx<>lWZ%20f_U(JdYdX15$I)5l=YS-k zP3NagJEa^hB8`iM^Nlf}1SX`UC=S%8sG680X(afb5OxD6!lCY(4;a>&Jzc0D1AAG>qhK3+p3Fny% zd+ng&@8@xyAECSIv;c<1MIg+3;Nal!l}b%gjaM?l21cIOHwO6f=I=dvsks!_xGkFr zkz1OW>q0)^^lIak<0T`doi&O1BRJYIfRaR5Xfp_>mQStyodaH_=nF zD4Hk3u4A8PTq|BhJcStyE{d@ks3#sMyq+7wcDh?n#c<~?7;x4f8>CZ%;h0<3uezkA zl^hbXU7q7xCyZg)&}7o9S8^P9^%%z9eF(=Q7-Uh`5x4NSuk0BB{{dJo!jsvvv9O#M zV+-WGq^352NKO?`b;;kGid-S~_VH`$85sI;+WPzYR4gn~9UL9&a0>r^?2yVPj-6(K zL+0fa%~--8g76`Z-`ylPY~0@`!YBd{87a;}tdTY1$fw@k3chf=(KxlEZ_09Q1~P01 zH4&|B6LY{5r%*O~l<2wrA05=}0y(?)`&aV(t)ZW7M~n>NpSASJ7x zfEyp5vSwQM)yQC^=kZp2_&Bj5Z=&W+%hTcBA|u&%id&w-pxZAPvKoh9LBg1Q%T~c0 zO>gx1tnS7C4lUuK<759=o?C+>4h1+ZwHTloB)GJ519>!Fu$pI|!06QiV)W_*cr2!D z#Gf(Dk57F?`g&=vpc8l!Tn@2UfNThQfMf0*M{hC5!fV1nV#DJG2s+J;0rb^XB?L3X z>4J{~66vQQ{XbrHbm+jwHJ{A0Oa_}Xo3n4fL=)1>E#N=#Wc;uXtQ&Eu%$5J;v;?&_ zHWIKd37`ex2L(I<(C8AAMAgFFfxy?1#owR7HNm<62CtP3IE&r+fWt&&UB{pv4q%80 zYspdQtUZICuhD*7%87`VCtDp;iLn~J@RFBd`FWTWqE8mwEVEHxf0D}cF_?53AA@!n+u)u zu!5N|iBcGUyKdv)H_7?2T8F9c?f_&qO_R>zo}Qk)b!xhG=%M#Q7Zd0R&=$yhC5{-t zGDGA`fJRLaRJk$yvl$S{=r<(pCKd|2AVSjq!j>&td}9E#fihoZW?lmOW^8065D#mn zyRAWfIUQ*|$kw9SmZ33XxUK`5C89a0g%S23I(O&d=giw3vcyTr#mrlq7Mq4`65lAs z0^JRG1S4sN)$H=+p@y%YiXW=p$ z79`nofHwIh;4{ZlTWa2&p+8OebIiJ}szQcx4EXHL-O3g7nyu1DpoWA`jK}bVGiSWn z>%P1^GmZr2W!wrFjITu0b@XTUNzCVqlAihEU4G-uHi_%7t>XF*{(q6+|Lpd=hr+9S ze$y@Tv%RC!K>s%x9+}+|VSqf(yW`$R7eGq|Q zMJ!sAE5k$;e3in*qS0+np1)ws7rjPLU^V-c7sr&xgIuSBW^g}c8?OA%;~{={PKWf2 zi21iyPgzCdcv#ul>tPiPl?c}co>8}#@CE1s#7S^TXzX|&)?rnOcHU)^`s6P_K(9b+ zyh={~VX3y7?$$OU{I>h`++}`1cL2A5`~VPq4G`&VXEe00$2{GH@qq>kv2tHe-wThT zbX-8IAdFgaoRIS+24-ZWGW$_{u4Jl@WYu)VAsRoknvtF7rq;UHtSq&t=?X(Wg`ahL zM#Wc`_T*G@RZ+T(tINtkmwrJ%>v&jFr7#gQU(VBeHq8@0 zYz&P>dl9*P6{?nexwt@EByt}%n0^ePI^!=PA#oA-xUCoL?1=v3Z8KMP{o_gf?UxG( z#g^hQbI_cl_9Ia1UE2C&;yPAeS10iKz%BYY^xdwXELwD)$Gl=9 z+-J9ITV~djewr8?7kx6X)AQZ-bw^?p)zpG;6*WJLo~0Rh44f4W%H5XhT2ZI>NOa?x zoA7!wcpnngJg+ibjaYOtY*s(+N$Yd)sFC}xd**C*^)^@NZPt+`D=TY0>`^jFO zo;;0rmVE+;eeyz#`^D5d7KR*ua{6ag=wlA|mrxp!P1<(fcIHVb_d|{QBdq0!t z?;Ss0Ej?=*U5w6^9hz&@tXh~nFwag2uuhKUgD{mgjiadL_4Ah?txzoLb;0$4|R-zUHGUjN2`yu80dgxuU*nTzyvujSZ|xo9nRxXv-o zkHsImguWc;(4Mq7eQYs)0rM4Q(9O_|fpPmYSIfQ(5H$HeAzeSu8KUjgQ4~DWs8^w= zAqPF3uD|#R5AEn?v)$F3`bNGny)ik$Wg=alawQ(22E5kCadX&r>Uq^qAM&KFqn(6;u_(R%HQkw-ps}24XC=ZBHa9ne+P~BrM@JGzd^iL1l6=LY;1c*s0v5vg zvYIt#$RmjU{C!(EtkiD{vvtji4E<7u!KOE*TI_39Shu}hroqF6Z>iZIZvYOtsb!Z) zZ{DbCYis*n4-7F0U(LXF{>&M7&V-~S1-$oB+aI6bzP-yCGV2}1T(nTDe2mwl+VDi{!HviP@XLF`P)YJ#A5o5KNt!e5!sll~% zQmRpcABy;E#??CFc31$_m#3qvx=>dfYfk$o8@^B0$uSi}W!8e@v7OReT_vB6l#PxI zhRM46TxWj?vlx?79j6$U0kf1}wMp$IPEPMEZLyFDp?R;6dy{nM6EQu&8)5hB&(Z(1 zeci7Rlw!x`!V_csyR$q7vUrc7;EISrcObJ{nJUd}D+FePccJRd6oySz1fddKt z9Jt#CD`!F_oAv+r@fFFubp?wHv%u2?pVqb+^hgacBD6Oy%)Ewpt0Bx`$J-JsNANpK z=6JV`4=E-*%8B$28=g(tNlahqxD&%CAc%-(hR@8Yqh&UqwmI(S0L{Kd$MuIk2gSrO z$C3}r6N5z(;@H1nx4%b|Gt2J_NtQM4=)$@PcfSRXJH zfy9}LOJvEcoX$9dD_q)9lsZw%2nuODJbC&6FYhI=b&;+M_5?#toB?;mXDj`D% z2q4lIS>G%@7JgJOoFh)A^{=)Q-~^M9r-oLm2*Z?9`v^!!L|_B3GPRwZF@L^$j@D7F zF0*DZhkY2h<5M{N)Z!*q%-F)BfdDZ`W*|Q#Bf9dgFihR}8P~BhOUb3Eg|T=d6t|}E zW^I*7KHc@*o#Qgj4GbGWDg=Oogachfh)g&R84(3+TeD&_*)Qqa7G=q6 zflo{H&`rh4%Zd`n3o%L!o_-zb>9blL6o4vg?-Y*i+$rs(&M5ioE|K4`Uj_2nox?>P zv?*S4$HQUC-l zkf}6URGJhK9HD#+WIyWjDao@=)cn*`WkkDQe+R;__T~O3pxfEmJ~`Q+lv+MCNjPK& zFiTk*4~*Z;wdM7-`(z6m2`4j#$8o$)jfgTlZGtH|yBgBUCnC>r zsTocXLxcw~u+4`y6vRoudG7n8 zJDlJ4ZfQtFvaT1s<1MV`rfx%fU<|4o4~EbBpIw6Qu1trZfk<7kJMFURI< zk0qd?8Iex~c1E>cvW4@&m1bPBQj~NGz39x zQ0PJHOvJo>#CZ7(kc{&SlSK{37DtZ_EJe(p_Id+gCx4FC9wzzY%%>7({+lh;YzBE1 zQTdvmEqPn?AU=t=9coP>*c*&-zbq4ZVvfwezhSr9kC0@|%!A*@!AMz>Pm{tuKv%Y4 zZ!AGc3{F5M0-mc(FYS|FT1=;=Tn&tQiei`uH#R3M*vvadm#cgVcjlNS7`aqA!j!`d zP4Z0bB|MvEa}ncy~{=kYDNh%Eh6{w`SY`1 zy_Px937IfRVxa0Fv}JqSyewPGcCb0tFv|Hd%D-}@=e{#CON9UVMxDpkU+@-5fCe5i zF|j<{wfFOG;>qpUzFh@rq8P?i)%nmbX1XrANMWe0)xjX6#hgHcLw?oym5NC5MpDbIP%tm3Sqd9$68cE4Uw58AgnQLg)vew6uf*+2)@k8S*A zueaodXA;&nHVN23@HM3RWR1P@5MB|v!vjGB!3O<3grg*`9a$Bt^KGafNXp7;NLBy? z_~VP8vUEu1F)jtZutVKWGhek@nbXuOBwhZBIYr(S5)ui7k$$!7X`ofXDlb35pQAErT{s1n-R~0X!vKjk-()cjyTY8jnJ zZP6U1s27A+vh?C~brKK>@{4W^eNSwTbkD`)tyqEV6uJW71Y5gk^X?NoG1!_(tSor`oUFP6{p_AndmoSyEyuYIny zLTl!D;izS%YGK;;fvO`9okr5Ssdoeea<+=wO|$u(vp+Fvlr`<2(`a>?JTBOUXj9aT z&nzm%qSNn~tWy1Zw4G_jAtb{lYH3lD2~BihK@}cgh0$4GIaXrk{*x~OxApKPpYG5yXA(N5XnW$1^~A7lCZvDgM$|9 z$upR^+)EhLv3G6n0AK}IGbkDI&D&qSdi;{a-j-b9^{6ZQYVNgjXnG9}35g@I56pUBA7UMd)1D=RC2yzta zJ(=i}Iqlj{#gFxM>zX=yvOSxhoeXP8;E=GEBXptT}~}Z zYtS_L4NiKC>*74Jpyk^sU7w0`E}BL1a{SO6xzWA3TB})@N*;MSNaT~?qbl_U8(0K0 zn`Fi!&JATM1l$)5njSU74$|ngIxTI`?H4A}P{bcHBU?DF-+7%k8K#)n>|fLLOK~sS zy|-|m*B=kd|3g3cx2M2k`R*!_)5I{v4%9O}hcc+b=IoN-Ll7!d@rWuZb)mO4Muvv-sz`tIY<8Dv>=jSb(~f$imx3tYhZ8iCSv|7vUY3c5VE` zc6B@~&oAvH=kvG);dD zH_>gHa77G5Fe*Se2YGqxkWi|)m)Il7G88Mud|fE0(Nm%jtY+>YncAHn;U=N0GXUva zCg=%g%xWqyolSoA>RF3Co$$wPH3&z5l&uqeo~HyxiO> z$T8cO6%Az0`Z2WT&QIRbBGI&&-90y83{td}9z$^*-i`%NIrvtnFnC3G)m7ItZypczC1&I@eALy|I<@@*7w``K=V{TY2)O`u8I zD>?X3f`KK7^3i6d%^;%yk`<5{0PRFifw7bBv2?Qqg$(j*e`-4Mpvh)b$RbiP(kH)O zp!xgMa0mT;>$pRzpU9!r_CL>xwT_D4ct}JDNEXb1t!0LadH}1WdJo z0t*kX5Mh3xr|aU=F5e5%h96wXsHLwM7(GcE+BHprO2BW#UJ6tG47$^mMkd*L@?X5z z!>gTZtut_0O|8e~8&n1eYApkinSIt0=`8l%sRMGI@}@~>&7jf`w7N3=6=R_Y!B&|j z+{!EHXnGb1efot9zL}m-vEr-B4EKhfUt%U9TBW7mZ*_kAhn4FtHO@?g?I&mikPV+P4#%5-9P((71?U126{=)HR&KYH?asP!* z<%Ls7{u#)TxfAogr;Ybio;EjZf1m}mhbqcM5g*t5KJGC7RaKc#6&*zXj}D_kcRj{vsMbG=Q*g@)sb;7q5pOiGA8r!*Q$Yafu$i zbLK`^Mxj=%)*EkPwF3vWuBNG9FlXn$Nwo2tROB0;eXW^-tyG@lHOyXaI4j#CSWqfh zvix|)fB42Ac&W_MipC%^p=PpKn2z1|m4Gw~*mq#I2uv%;z>sS|VUiDRXiHv- zri*5^@vkW9I8K|cx|4BdNJrkID8+XtSV&)MNCrbj`R?rW>zfOM?L8il2j zH2ot{IKC`Y`W1f=h=B;obuT(@SBjM6mgg3w6Zp|uF#BTicIH&2g^T`#MG;N6?Iy{* zPrA5kCSN~IeY3O`U|5o9E-iVIYwkM5xHcTk`~3Z?Az zd6c8&i*gT*`l<0Rgd2 zT!j|}AR2}^Ek^q?Dp-)I&!GJ69K5ZIMi2ztF!O;++UGD094fd8LN((s_6q6$v33vs zeq@h)Io*q+fAh>C-UAJ(YLMvfPFzN(7C=OMfXi76zZe(KS4&NX|I8n)l5w}L%-(G2 zVyS(f!-DU2D`tZF#t@9{Qc`|#e$udILJ!oM8c7U{&KTsxTEqq@HAquOX%&&$MR=!1 z&9Z1v6m1b6a;W5DTc4bon*KOC#rnyR8l+NXcTR2p zj;H&-b!yLevlhhX$)hlr$bw~A$hFEkd4dt)7EKj3XNs!GzUG`edcjHCS5aBnP_oA$ zarVQ9Q#w7%oOV$aKM5ryC!gzMeW=b8ShE0yKa}?H2P}oIt6soJ^h#ur6E!}-QmosMMb*MOB;0v zc7r)Pgme-({&S7pky4JF^2(CKr(`@CkIlWt_NlNZHi}x|$Tnbv8%k!Ge+Axuh59cE z;0*nSXx222zfi0c3_p=(Zm+2CF7r%ZoUmAogNrLouGYTO67agUi&P9o{xV4`0i@kL zYI9RU!@_L-qAa?}6F*zR#)IX{8>=_SI$=noC%b*8kLTd^-v0gzfS66*?bOm&Cr1iB zmnm{M^zLo}za&1ZL6Qz26~&vJd>KBh>FdRDj1*>`D_`ohQ)qRNVwTiPrD?WNC+|z7 z$?Fob`Mwp>0c;jvTEyQb3uGsMVMn50gqE5!(+$90X+@+K$KNhzg!I&C= zH?}xAw;FmX7iPIge&=8F;tP3ZBX{aC%WX8L@`i%?W!McA6=YC-VvtXS`wH;)kD0I1 z*3sd^Ts)CN{3S5WMd*{)x)*cPf;v|32=f0Wl@BG;?w@vWfd~2clxC#}8Ki@QCR9({ zL`G}dS~tSFZnikERnXND_Dk{ROZ1WyvJI=eK@Q?1a(v;FP`#n{4|Wv>q4s0c;AEv~ z(V)TXyfD?m{oe6i9e2K#yuf}(gl`l?m^ZdmUteE;eN%8V)#^F*%9GST>x>oq{4UJU zw$`LrylH}ZDWqWra7w<9W}Byt)4@FeF?+1D?hRx9znMf5Ct~YM=-5<#UF(jDu5K!N zIXxgykG8|S&!>hfnYL->XP9dfZZTzR4*Z)NvC7@-@ z1NGXj(>$k0C!xFl*f?qwb-k&1k6P8~IFqucT07;r&EU{894F1CFn`k+l1J=5%=U~5 zF$;2<%QA0qP_Y;58zI$#4_tg! zi|v)>?DQ_SF5@>#tf5@O{OxGVU+Lp+PF3+f3meYf4{nilIsM*0U^mJ%^UD|Fl`!?&fM)r zM6QbWCF7wuv;ov_i|0H)3+ay7;bL>e8Rp=SLcBpM4U}OD^Sidz%m;d5uwTwDv)%zHtu)RG+|yZt3pI<#zfj7|q~tFBXU&!S3e1-IWgcSolzbU5NR6 ztw-7I76;4$!&bR4th&FQb`&5{B#d`3$Kb||{T<>(0OSL-k+QO~2lgmF$oCm@TgSY) z{V_D`E=Y;kOADAEHYbE|z?7&)IjaRv5`F%Fnbb>wf&Kdh`PQwvZ`5<r36#$eWU zQbDT4kJIXNVdtodbeHD|#XF!;i7}4=7MOJ}F7%LcZR)*at6kH-^%`vdLT(RG}lJBRb3_0~2 zZO*cY62IApk*cQVhZ+Q~_vjsfT1FE z;EnG)me)trjtNcpB`9}|vdfj;Y#<~X%VTe7Rv!o(%GnjAZ{SZEi#!)-kr(H2RGYP{ zKkVb(_cg1R2mXXK2G``!9b%YaKicgt!Fs>H%I592BzZ)>5R9oJ2|=qtb@P@Py^%ZR zou%h!`%-25X3|UaXnzo-q0~X~e-r`{9q6ox!FqA;}RsiLK$6TqVBBNFX z(P+I1TZQe2jo59wFJx9&r&Lb>;eP`D1)JyEQIW7pPiN3e*bOzSqf(xxf0XRIKeU=~ z|3!ybocC^i99(3zZ&CW%8k9H|seK4S%LDq^eBa6*Nh7&Ch54Ga`)Wr)(T;?9-qu1D zN5y2~Z7+dx)}AL*qxXmN;)fT6TZ?fG2M-+*susn;0!F~E^gWDWmHUBQ;rsy){nZC; z9n0EB5ebj8kzG_Na%Ebk~2K)d*{^>mP zxJB-mS>02)i#~{uV&)=!jpnV3YI{a!7h)ly_Mey>M+(m0>U=J3wNOgb&pYp|i-KZj zTX<`S?)24*&X`NWsf^@Q-FO4ONbnj_d-9&v*f~?#BYNWBhUWM+NQHi@AxfPjk(h!w za-Tdjy@WImfh(k*KoD_|NA(17tfFg3CxnT_P+fvIS9WUOLc}u7RBBG)e&v6g?2FFr z9gxf1*V`AeSXZK}kkzri zQ!iCO5+yHRw_Q{g(RHO=vYE)0_Z!aDj%QiVK9+q+KQD158L$DzgkChVVynemrE;wR zc@v^50RbNyM`C~P39Aeo?*81=%{y@s5c*N+Bx}d2Z^NR~ig!kDb;y4IDDiQFee8!Y z7cexVtCBuCR@oI?FWWrtI#I>>(Q6=gb}@9Ia_C6e4Mw(8<;zcNkgq?vU@FdW_1*11 zSm~e9$>s~Bmp$M~FWbN7$LV&{r*y5Hul+7DiLmWTYLrdpBrlgs_7rKF-_J&Jxy#tkDHl%^XCMzRac9UCd>fquPnR}aha ztSdg>*oo2GuVYoVKJIC=k38UbO2z+mNAdTKkk;)!$iLSjN#^|s<64cK=>qPh*&;nB z>_q|%_KnaNAAV37=M<~O$2AfNzVOrDivs4&-N=oU;B2L#`hYfDKr1E+xxN#^fjb6S z9M>mmmi@RUP}cKNa))r3;#`;R!oCHxwsHAkMr8i!-pU!isJLHkZd%h&IB^7x!p@9H zW!sPLN5Xc2o;FjT_1RQpc(v=V)l*?b)2uKeY~{n3qNrC7zeNGIUWAxe8krn;!10XA z1KYd})uU~*(yQ(-bD}Xz=YGHSNGH`D^QT{Njm_2D(WotdQFsS2YbQ`hbno@rt{F`8aEjeERQza#QuzJ{TZ7!Lj1Ri!j?&F1x$&4oIt-Z4A3k_ON(e$am5)kIp5*+lypLzaiv{?~ViFrl(1vb1)P z)c@)ZvuIDrYJGonD1Wb>3!hH@qxeXNwIB(%N-qq1cO=9|zQ=$9l_-(o!xg7Cl?v!M z^zCyR4WoT1TAVE^CYw1y5c?shaBQE`PphbtDVLA-tA?xZpDqf$U1jE5z4%=GhlwlX z4{f=85E2RbE`0HJ8T(wN&%gNnaK*LZ!%Z=_Q@c*gRS&8xaGCI<>DYIazPu;0J^(9I z*bt=_^Ys?r2|G9pf!9x;Y2{Gjo`P4e<8@&<+qJ&<@c+}d)ra+~mSZn{H9-Hp-BWVw z-A|(N%~vxpDl*4?*A#C=2T_|aOcC3dG1C-sm5td$v&+*ObO?c4*7P zXgg_6zOaWptzkAgCpN|uCS`>0I?;Z{O?dd-tcJzr`j$cI4aFOW^tPU+-`)28)`7r~ zxDY!v$!di)a<#T&8$MC4A3e;ne)CY_oX&(p!Okqd)3!#DWat zP2Qs@d2DZ-cG6iB!L)WI9hGJpdtp{t0@E#}7%?K-FV5(G z($v)SId$;;s3e}AT_o2-9LG;V^1rTBIj%3>xSZb8?@_)3``d}5p_kZ$PsyF%Dfh&1 zId$@6!+3=g)A4@6OJ5x~KQ|1zA@quEkM6O@l+xSl6>B%1_EDGZ8!7xcpGfH%tR=_J z#`1-ox;V=d6w)sCkTmevk&~v7D{}Du7iS-e$%xSN^pNmlKY|8n8$#nA-y;PTGVTyo zRA^*8*dgJy_h-mJ?hBr)q5Cm>Vq`ks?%1;D=MOwr=Xo!zs2=EcHg?YlLv!hgHF9bP z11bb3UE1y03nvSPzK7A~_Ukwf9tjt>T19MYZ^$w!c7T!W{YriNb6%FoON(}YX@l@y zgwTBEBZZ)EQ49NqmNYAg^pu;VWjTYL;Lw5YOXA*jnJXP4Oo4RFOB&;G`XcP(6N$Y)MCyYp|pD5g(I@(-K4Wh zJj$2#w69X5PDzg+UjKbo+KG0CtrShM(B}Gu^v)Ic)Rnq!AH1V#FS+K=2mF_G+@Cvm zYE_41IJCv+QOO4uRi&0UPAvC1cAk$p=xpo*j<9}=IM(=@)tT-T`W(+Vfm|c3h)#b# z)|B)I)e5o`hGn0mc|v$xFQ=(LFwl6MVVj3}F~R*?(3Ty&vFI2526FXiM>8wwsDs=i zvxhqDTfL-bl0`Uo&9koBHK&-)ueczRFmEWv_Qc}Inm>j&tUR%cbcV#G>fAV*f2u{j zki2WnVKxR;XU6MW(w$iPMN>${w5fRkqj5g%hBM8(thL=c#OTBHGy-p$yd0{%&6dX7 z1lY1G&@VOR{DC#pt5gwT#gjQ&t6tBy_%g;`NZ@Qfi@(4e8>cX9r%dPLWbd&Bifw$0 z`8tkuuLp(V2hY_$=&|2(EY>-}<(KSBA3O6zns(-1xY7L3PsUeTmGNp!c#cW1e`K6m zJF@Huhl&}wUrliRNl7&f5!~OJ0<9og*Y_o1_tc-ZSb%I8P7GCkA#U*`2%usa8B zav18dHn3^gmR)O^n3!&j_h0&!eS7&^TWTi)v&V?KHZ$|2+?MJQXAbmS**j4F2RaQan~JhAobl?Ll}3-legXN5sx1#siPCSbe`!{;=FeTX z`2_F3yL#%DUtI0aO%coK9m}5`Z;N?hw8L6kd2j_x$b+lFJaVW9Pc_o)ceZPUM3{b4 zR>thL(ET{**`*q2>Aq>1QUK4U^V=?I{dAd#eNrGLH+!Mv2ZO%u+b?U|%J#UYw;63* zfsUJWyFNU=7bDkx_3*|Q9wRfy1sNMt4bXja_X8e&DxoP3%B!zGMZCPz#*uP31R`efr zA*-A|UfOhH^E0=jkHx&)b|r?(Rx2?5^k3<|q4@4K78y>-Cwm0WYsf~b(X`8xVD~!5 z$6CwYe>#IU>aCS)e@vtFKbvM9F(&1c^5n&uc^6&NA^S+Xo=<_# zUOR3*y#{DUF+*n>Y+%iQ3elghO@|ALKB`*ss*lZkW_#IZq3AnjdDY5C z`$tue8tuKO@8I3n;!jgJc>l&@&mk_a4m8Ht?WGUo)XF@)o#o-OTH%t}<1&@P$_;W2 zowL$-o_d{}nAAYWL`-83Y9f7Ia ztN^Yd`namWG%_t&-X)0E+cIqG+n8=lL?NHcN@S#dMGQHu7PV;ofY$PbzufrSJap&w z5Mp2{>z%R6mS_C@oXjhVDFis3Bf2uuwL!pqkVugYIdEVq$5ipLxsy&P$|>bSY1_Q? z>Fza9zZCqKh9{c9|C-~xt` za$+O!YNX4I5m7!UX4PHs8?XAPq&5skElx+-^~DA)Sv-)ie-7kkTlZ}yQlR<2-mjZN zRgD|!Y1zgT*th%5=~fn0nSEoKa}OwXvMm}tT6CX=#r{YLVfU9a4dstAxXjc>wR5^dJKV}Go^Ma#V@~lw0f7oIgMv(Rg;}g@>TBF1(Y;ic~`A${JH+8 zOPU$$v=jSVvUcLdgL_hMv7KoQ7xVg_%lH29DVB#a=Y1XsDb}9adRk_e&rgqV<}XJ+ zJNQTWeB#np+qgnzMR4HYrB|O1uissmG>{vtHps)f_qMFWvGni#M^r*h7m)$Aa~UbD z6D;REArl}t#@1;tG9N$3n-YHFMY!OJjmI0tPe}wA-DQm2L@%{v#Ohh}c&FpJJvBx$ zpU!Ci1ZBI|U>zkL@!Oet-XIEn+Rdx8;#=3QJf*Utdh`R#x@7g1i5S`tO5pbWjK0Q# z3M%v+hO`|m-|;hk2o4Q>k6u^jQ!a1$GX{ehI`eBjJU*hx+9#G!+XsXCj%=2p$$M=P z0Ws}3oR;togeY-F`%SNAQ8Dh=-9Y304VVh@q@?n<)eelWl9h(&nwU3Vj=l5fREE(G zv0TeEP4gIght#@B^~fNa^CkbO*B`#@EWJ07+b+pQV1HU#at`ae`uXP7UCKbx`5`~i z%6*dvb41Ys!{VJvutZ1a9eD*Lar{j)I4ICE|B;qwU>KV&ISde-kw z(@0-7rVSD@IPNi^nCUWYF0*2TI`=Td_^)5z9dccqoq~MZ+s$ny%fowMk{O~W<882Nh{}1*yzRg-mY`{bEuHQz_?PhC4gseTE;Q`>C9m% zsSQ-J8|}f|!Hb4_IG+9}-d(hITKkoY%(&04HJ{D1?l>1-Onot;Egi+Y(BdS`Uv6hv zka!_s%_7N+`r_Le13B#mm4u6QbalqtLgS(lQ>62#kYWV)7N1*dOr%%P1>x}o!?dxO)O4obTq5gI8RfJbu*=l*|6(g$UE{8@GH)nXu-<=EgKcgPF zQoCVOY1++!J)I(Za-0u6+4Ft$i|_`ojz^Bs12d0~$xWnc2D-Tv@jDe~xQ<7DvB%c9 z85;P@8K31NqSRExw|92H`%fO$ux^FDdHnh;tI*>7Q?Aj%@pAs_HBPtbP8II<>vD|A zm)&2vdT)=op#RXP>n+UXNnSg0cDl=XC_Eoo9epfKJsM-5 z9&MSoh4&5{SK2Yn2I0yFig7)PTNvo_229g8 zJ-pFH{~!E@)kd&IsKR7K8PtBF+=B2QQ)mz4#wu#Q%S#_>fbS5Lzay%&9zx#v%XRJg zVoBdQR2Og% zMSLKV3@Cx0TmBnu5MA-wOPF;fUw3St9Vc7`C!>dA^MH-yn#CNcD_NlgF>*5sXRuxx}~Z+Te#+HyOX-Q3yZ!*!2(Ui_=Cs zNl?Ya#QB}~If&Z)ePUdG`=x_y^D`W)4p)4Uk$H6g9Ub94$SONtw=}Iq7U2H9jm~Hr zCbQA&6r)itb#U#blj7P;2CJTJ6zANncJ=6xU+v_{x6fAmlKbXwD%>=6;K}CqP8nWt zMvwEgYlXqpfO1&zPEKMs|MF)W?}UG)-8cBIu5lN>GkxzB<@US&9L?kixtD`l4cqp( zX_W4M6~3>>it`1%X^%bZZ_V|uBU=WQt33K5VoW~UXg{*poJ-pKF=;NDMA9=e;~j2oBtJFId;*kwHug^^X-4>+16v>5jqeb9zrTD) zsffmGlwQdhtxhKs9=Pkfv8L?%N@3S$F#*Lx`z93r$XxAa6#C-axh{K+*R{99AIQZM zfbG(p>bA874f!)0UXAwue~i5cIMx6EKCY68?2zo8WF>oKugoMAA_^HHdt^uISQ(L( zO~^Vnm2r$BdmNIz$sULN9>@Fh{rtY)@8^I0uK#tNxA!q}j&okm$GGqNaXSi|r;=%UwP2V)3S5E%1>z()XzV^`Ps zW82()DB<2cy5M9zhwDa3L68mO4UWib!2S{<599~;H{Y<+J+jJXyf z1v+ko!-30SZ@`i9=VUL6%*TKGx5{JzLUE_qot3-I;A|z>unmwU!+E)r`O8+x$ zaUjNdzWTxqqI_IR*I~2l*HRt`5)XMVbe5)B({jgN=9eU zetw@h>qjoRvJtwGzx=9O%TEqW`@FmJBY3WB?7Us&_<>w)#vqe~I!no=zl>+nXY=vi z_^Y&&mDSRayAHT>((YQ`I#;ZNWVbvWYT6X*9(dli%ZL9j5bxXyXTc%ooh?vQ4h~%G`+9|WObroPDeav5+T)TmI3<+Em zL5Axe+LtaYJ(_wXg)7T6cS}Peat}OAzY1ye*z=&Nt8ELH#nrN+tFj@Dj#db1G+{eY z)BGQW12*PH70DoYeONo@imf1Od5c-KIx&|2S>-bDjIIh}EB}Y}o|mEEC;PYpcvzg} zB;aWLyv8+bA+T=IGqXO)jAqU($E0|AUgks$LTFI3H;B^C*zV;yZcHgYta^S%OZtEf zbo_oWb95HicV+Lve-eg7SzX}<8d_W1(`3oGn#6>Pa3)W)J?wI`q?loI9lGKfP z<0=}d97GKr7Fe5vT3IIw_mbV`ji+D{cFQ^1mmPj0O2-i-BGpa7lEx;4XB$sqA*)5seh#U~n)fjM^;XaA z1Nzx0z{ZYAg{0aWvl6q#Smv^=6G@lewd`2EH=}t@_jJb7#TbgvDU(QT?s3*8{$?L` zodG6%xcZ@DoeDIZElneL-q&+*^!n(-&>B2`nLo5`<#|sk{)B$!Q!nE~!vA z!~}1+s>KBFz=xK720aTh3lC3z8f4iAg)hOHIf0@G#c>og z!WbX3XO{ljz#>)Bp#!siKfWVm24%9C`u@ z`LK0`WBYyw_2m1FJzhTwCjQpXF}fuF;HVkrg&S;6gAy>oK{yFOCi8|KtF*qw&;!qU z-fVE~M@SPqLNmZGp4swv*J%m3hi+bwc?mws5zax-ABYA2Eo3U&u8R`G?gdhFUz!!V zCY&!|q4TFN^)F>{!yz{ov8w~OJBYs!VzDsw^Mg%GNtjZv@;(rh-cBdUI;_VYsJYyc z;bBsbD{oLHpCb<((jzXAj%fS%&7@?!#W6NAQ{y+!Zq}LPwnhcB}=i4Ytk$A{d=+<(UAysS4zLn5ja7{=b2X6lNk@b-D@;3`lPDQqiIB>X@rjb zkkgh~aUQU)QEH1ehwCv^NrLu9Mkd1cqnfME7utO*HQu029A&JhkuEFQ$B)O#y_hR0 za7dBi+7nkt9P(Oi^BfJ9BtAAQZ&qgbGA@ZQH3sTXvX2h*(-bk`yS_=PWz4mUVyaad zlHFCYm(Oy}_OQ92vl=p{DQ8i5^P0s$|BTniY^~l~Z35<-2OaZ`rmOl+4=St^SsJ6! zB{w?NGVh}6KG+*l!C$-hZb*kAv3p)I5xS2erupFV2;Dr~As0pQmgKCFbRh{swyg*M z!R{rzde4Oa2TNfX7#MtkF)zp2j>|`2< zIE4z8(3x|RRq~{#sJ1%NG27z4c^v|{aMV-vEjG3@Ogknq{J5+4sh&I1DTmf|!ZpXd zq=31ni0HRd`F?T#_PfBK*|NcyzS3VMfl5@}Oe$?!RMaIr>iC*ufOp~BWfG8E5}b<) zO}mr$rIH7sm>K38nO5cLvsrtdt)*<{nNEwWfnTHgqw&AWAn?@SRaJ6Jbyd8p8qc12qKDgL#wN9N%FeW}JJB*(wSS5~!Sb6%B;8=ZR zCuz~LTwi(6^SEhIz+@cP60^U$7%$WiqZ}1{pU{LPbj@!84nE~=>8~>6LKeboi>8|W z$b_%W9osCek^oBS68m}+>Zuf2(ok#erpTYq;S|z@gnm@X^hn{HgA)eD;}+YRYCvl3 zWvxCT4WgPN&Y%UAH+IF{Px*i_1I|Z9{d)MD2MB;Xro>j?#ksyI7cyjft8$(C?E`%^ zb=Ih-@5==*mr2aj%yo3U{=Ac{soZ~|5{bl?j_Z3R)zx8Kud(-Sg%za&Rw~yqa-T$A zv%o9A-w<)iWPRi!pSb38fBVN-QdcsSK{t-$`|cx8+NOfCt-m4dbSisXjPWD;ZtpN3 zhH%He&ZS=R}USTDCoS;NC&*dq&VEkxZb33-g~eV2L1X4 zX#g;SIQn@SFcu5n9Lvok*cGJG(9Hk63s=?;CNh76x!C0Loe?rB%O)*WfR9X?P_(i=3MXi)8lta}Ia_RAg zK{91Wh+Yy!SoN`EC~^HiYe7wcQJF7V7C*)CSUYpys;9)EPXd`p*VDcEtVFqU>yxsr zwc~qyVj9^!-q+Q8YP`!vuD0(5BBLtr@7+{g_3!WEoFI8!``J#ykp$o@J9L<+a&Ag4{gTtesfxTVebUaR3Q}i2c}?s}6PkFj;vHM%%?A z5mLJ}ARQCw-MjQp(O3`NQI*RwmHn@}FtEku$e!?8mm&+7l#z+RmZG4X{n8Rn?FgbT z$%B~~ARMHpu4DTgnh-JCa`))JYX5xlp9+qDe??3|g@@;oVU>~MWpeEiRReB~+mFYb zbz6un^wM!J-?NbA&`6M1qOySRDac+9&|Z8YF4wO#%XMC6S1nOniaC5RGm4`|c1%4~ zTEjg^g`x(S0WA3G;;5N2&z|B)6Y`nox}#>`*V~@}RI)`gcrdCaNX2)`_6Y@qQl^Z^c zvZP=3e4qqHIR^b<2Dt!$s<5auh->P(DCIXTJ^M5lt1Ex}b6E%kdzoO{%jMdyj&#t$ ziXzO=!jOXHDHW$`Y|$ZhXrRj8WkF9@w2U8s0}vL{F6t$oEKZ-0nPD91v7pAy5=kQY zgzRe_m&|B5il$BE0@&DKtR8ylV6HfCnFZ-x%(47+c{1w&Gq#UP0S0lFVU}#oPk@>i zi5AV87M0U005Z(QScf_zM&!xn&^D0CmfL17Cw;=>s#Gi%IhsY2c7{BuZax8~3@BH?PgC8!*H? zPd?H(hd!Vs_!{j;KcarP2HK}xKIj?zYXMy_FX6IX@9(FC#_e;2EGfW$ANv-urSw~+ zb32~&SFc_*Ffq{#%@Rih!eGeazlg{y*st~&bZpRJz29*J4vZ=v z9R66FL_78M^<9tRjE58p^#T8(@J%m2NRI0{(v;>5F+(7}KJvpJ#m1vqz6}`dIITUP zgcuweI%A7j%5|=Xvm*DVJ4LE{pPgF7L8Vt&(f6zP0X@3?bdI30a8k3*}tBfO$Co%vudL#x6%;S zjZ5wiPmyuzzY;DV;^u0KLg}?p{U-ScuyOj+5@Q-RS%adW0>PMyK5)!;)vya;tofbc8bYl!`xvG#;)Wg9t4s zHDQz&y0~<0(gw4Uy`=8>bnC=W9msU=F3jxHi0P{#jMIhHstfh(Q={zoF)gjrCU#K~ zHlv!3i5J>skq;PVT>J5eydRWpt^zcPuy=r)>M)>pfbISUt1_$%(SE!p81~VY{DLbQqVg*ggBKBm>8tPc(Na+J(u8>I!wxhE z&-x#an6w=1?801N5hR6WD40~zVWkGeoTj&GOaB)Mpv96GUHnlb81-gOQ11fl0_!x;btFi357_FE-J54h!x*j_w?-zOBT zji`H=60hiqgWtn{SZ-nDZts;sf%)3;y}rgh?kKx@Z&L@ICD-e$8iRXW4iaF=rz8p8z+!j(KHtU*-C`wqZ!n zXTQ~_8Z6p6lz@&wuQsQe79LclBB?&)0+>E)hsERyF*`H#7g+?Ea}INFIMy_MJKr~slafr zgs)?UM@Pxm#lwEGDWk4RvfduUwA175rUR9i&V!-~qHPvyBLRrXB{iV!n=G8qWq zXyoS{Hcx1@%&=O6y3gvInjie8ML+YXho;4!w&`FZqVuXikK0_LVhs#$@y_wwxM5~( zP0-odY3@DUdP(3IMr$~iW-E*?LF`LNN@{`$gBGE;GSG-Saw>kuhu~SLPY5?q9tw?Q`_ zQvL(7BW&YFIt>TGRw03Q|BJ);`X2D(EuYclFe|Q*tl8>f+z;LKgM2{ghBb^5-9@+l zur_AA640N7oo3T6nU4r;rOQV^v5p(;u6t2gH2;tKLfkIuzV1C)B?B`}h!(cdXtg)YCdI zN_;W+ENEKF7qc}co*kGBomYBXl+Yf~Aojjo6yez0Ykq##Ax?XmbkA9W8@+;Zy%1(; z2vu)bc{vT?4rb(stCKC{$f=}E1A@dHFNzT6JAITJM1VDfn0;}i>seDp_lfBw<=CNt z$)vl9f3~NU7WYiec##$7yLF%1ajIQYFc5@!P*MR<^*}lXIv0(c6h(Y)f!(8Yso7Ac z_JIfoTCHWkKdN3@EK7Amk-$%M4zT0Xx~XUGs$$gVEvR#SdMXYZQWLuJAFNS%Ds5uQ zl1l&Drz0PEq#!i*9zccVlbHRsnP-9zfG>c0yt4P{ZBjvB7KLX!Z@7KO4ozh@1emP@ zj-UIl@|PNYY1T$l^pVp(3x^A$)+ZNoH~Pz0%|JGG%k_#%rGRybxwU|jwea;D3`Rpc z{mAul_oufsuimz~YB5@o*>ac*KF8xWVTgD;)6h9`30p%L8h!;Z>oY*FKzW#ZcwB*@Yy;Ta-rGwKg+lWo zOiqistM{?*aP{5k za>Rmv=Fh-8bSOD4Um5sv&=r++o)nek?^kFp$Hqmq8#13MNv;8~a4+O>@^%#ETocttSjdB{Ez?QU(cX4;ixS zD{Y=GS|^tmOvsJ8WtgBc>pO{@X)?p&En?4=c5qtHatu(d&AJ;}CY1}u+o%%^%>BA9 zwOm)$>&C6caNc^Cw2k+iMOF@h`O3SLC*5vp-Q4#rvYy5cmG+i(7z6%bS@dc9!j&Bf z{l?((Lp*|hvTZw9mZ_H(I$z}AA2B<;7H)8vG5twj@nC9wmK?4rQT*pr& zKt~*$Mixfi^Vu{&9s~LTf=MO_(q4Jiv^=LZjJcfNUrqsrN9DE|4F%RNA?53em*1;i zKl$m_x9SQPlz1|n>i~BSIEM}Ez-+z{r`OpP(zyGs406rkF}6^3t?#kI|0?HMT)O#I zXu)%#7Q!u@D&Pr*g-fr!c)8F3?~G%i#Za3`k8t@3Pwm$gMw=8K3~9flX;E$74qY`} z+9=1)cyuS8&GFlgYi2a&K(tKWVX~e8;%1l^@feifKGaMx%VIHqt_zKDJ*p*wcz-H0 zg~zFWNDM_iFxA>QMauvb%aw0|o4dKh5?92Mi<6<>QsA~!$4;B_B6?*H14S^5C5e14 zFBcNjNG9)*Fh>g`=p{m+<^KS!;6EvVVj8O9X*dET#_xlxMgFOvArHWv(>y={ZOR>y zq#xfc4I51Rgmif00eb*-0YJgpyzwo!t>I7q-q{H{(|j5R5Z)id?%2h!K=a$L$_&;fEA$Yc9a z*1lulk&2KKba8#M9@)6YgxVD0FPgZrpH{f^xz*542QrsuF4DHK57Z95T=xEPUMUy4 zw?Gk7GrpFBW+%d`7{hk8AJzT>iU_Im7h-V+;HMa!=RRr2%#EDe7O*`bgj z$)k+Dy)&XEj(s#w=z2S@+l-1XOSYjcTfFJnPGyG#Udkm`osx=y;ryhu+6-?Z|C=Dw zs3{RH>0n#t5n-E`**icOhZ1Z+z>hJvvKrmJ|7)OQm* zMg39Pm7CxL6Su>p8lI)sM{JXvA-Su0lJ>vosXG@z!GqO504vt~{P@rX5O(O?9@e~2 zCBgz#5T$ie1>x#yhEW~ItvQXc8W%!vt(IQm=kdO!mWGw9E)4oGEY7mZ}yaZMFM~851M7Oj&@3uBZ=CKC>9Xso^Aq*-m*qQ?m z_ol6OetzC@cf}BUX=3pb6k71K5m;e0k|e0_|Nl||{ySxDwUx&3x7mxoOWw9a9PWR~ zeSX9iHF#xJbFuEnuSy-o#rH4P2BQAj&y$#^?n%7-DQs4mY`DI6WJVX*$T=qq{VW1s zA81;o41rQ!0*XALq#tCC=iyoiW)@HG3XS|}#>n@Y1-=^PQr4mRR_U>Vt+goKNBC!- zyoN1Y8cd;gozlb!3Jq0*D+g4Ni-sTnSTB~+^ocGSp1otZ7-E(NBwVt6B8OU5@9<)r zC5VI&nKx@6lXuEbf9hKVQ4mqk=Qnj9Y=6KM6krfYzd@OcAdfv4c0MYNC=3cEa}_oy|srIYhP-|ow;3aGO>K4t(l+5jHJyMUIkGE$dwcD zn6mRsxU|;Kml_LcU~oTkCN0(QLRf?cB{~NvMLCq>&BaiNzc5xV)Q4^mu14UT;Lt!| z0f?5Mwme4EGBJTI9FLI>;u{uRgQcDeX;vN{hMD8l&KFi)AADM`;RTF9;X(koD^m9f z`GV7DRmxvd`GalySKyDL_w~W8#(S?E<3I`WM*_wF-Je{M4ElfAbmYIY;{raPk9>TL ziLiA76c0;F+`=Lv%14H5Ocx(1r~qoMS8(r+mKNdHQLMBKeyYlG8n4K>mP7oY!tN@J zz+Y_-oLvM3PxkA2?A3Nbt8qfBKc{!e0L1AZQ%nj5AOs%tPwM2}&vPLh;S;qt(w7QU zDNxTG5O7tK0Cac0@O#5;yNacRQN01c#8^@k7%s>%;f~GI@dB9c?nlKRErrCAFCv+i+p9FHETdwTAwl>cIcMTbDJh4 ztQ=I(Pleg#z5^`o@4^Gz~dg$0Y#9uJ(o*mgLccm6%V7u{lRH3hT zW;oKZuhjf0%@f@bb?@&@NMn%1&U=XR$)gHdGssH{$*Q-PP;ds)I4aj z*TD#nEP>p5^l#pH;#4qB=sq@^S63GS**7Ul3;}xH12_d7P3Bh(!^N0qdVmnUuUU84NzX|=a8xO)`|Q?^3A?FD++mf>hMqrfPtQY(t0`F-KfhH+%Z(nNxP;2i5&5crMp?90p;$GZt)uVDid(W zkXZ|ST`Cz!m@D5q;1)MeLIV#Td@)?$eTER5cehz=2NMg0Ef`UC}1m7Wcu)* zPgQ>)FGDVt=waYMvG&PSE(!femG((QW6RY9;rV#Z1QgwYl7cwfw>8F5N7PO|vJGYn|`Gi1MJ7-nUFnKsX*^k_s z{zJBlN*BQwRMAzG9 zxLT=Yy4b2&5Rm1#G^<&-ysqgJ{vH@UYF1)_M;kyvV{`YrkGq{TL}{mpwxP(PVR7l7=I&IZAG^J zb=}Law3qFiMpSN`br2 z-8_qn%DokHPSsIP(@hXHsn@w@wVY_{V+^hJd~?c`GW=mMRi&1C^SFZN`i5k0uUZy4 z0OP8x*m(~q-xS2$Ia9x6GNB185Nt#9GoJA_BotxD}b`PPWqekwrQ^v>WLx zZGK;*4+K=X&tXA`1*1G(#jQ9?f+$Wnu(_lDE70qt|LXh3aAV>8q-Fy|^@g^ZmWsLFn%^U#|JgDUX zJgD;8nmN6F%D~G`;od3S+LInJHG+l;PbsTV;)}K*GE2%j%2{Lggpk^rYR_& zMO~KkSWJQ5{|aJhAZVH_rQkRjLk$Mg!y$0w1oZ7TKr%<+I|UWn&8J=PAPi8cge}5) z(aEEOtvpB0?`zhT=&*E9V}K&JH}S_48>6xj%B_6uiaYQJz|0sCRJXHEVgm2f*mZ`Y z`k?53VoTaYhu3fKYA{{C-_GMYUHNIi#>*r=xD|jkz8Q%35v&-_%KEIVD4$GM5u;b5 z>$&w>2(h%sx#%@KfLdwrcsj{fAH-P#Qv$re=$zl`ZZW7SypqQ7sBzB(F!>cNLsj>& z(C!0r>eE(-4N82a{1c5sh*@;*hL&~7gmuZgY1^Dpky~-xHyG4!xOJcqAMt^Q8NMg} zcW{u(Zxwk2tr-o`Z%jkz1NcoW#H@(N&5j>vuX<9pZ4k`dMcO@R=4um`Mm%1q;a!nx zF@Vg1Mv{f3t2onL0Ldc$S$JMk^h8Zx9`OU-#X@yw$OTj}!${ykTk4_BXDLqeE`{R9 zm`^+1AWamZ!$sNbqCFb|jzlsT8;ZB>G>vad35O>XON&i(h|4l(plGC~ZCjF*2p|w2Lp9wfn(6_v?Oh-F-&&Narv(Dv4-0agBN*?p`=fk z&8kq2ek41JU0c(9)ukGBuH?BzJ^K}nT?oYA!@OP7|=YA6w*zYB?PfJr98sbzI2$IUfz)hh zG~D^A><^@U_tsAlc?3OhYi}x2Ag|qLmLa|3`{hTOOcUKRB7Dh$vAvB?_r*3due>y zzViAC#U-}UA^S=w`bo`L(!YKx-Kb|GlQkX+{(;0cvS0a$pv=U5j}!V-amwh$S}j&Z zfV4Afga#M@QCA(LnT5#Wl^&m*`FBtDxEh(zYRH?N%I*Bk&qeQqe&gfiodVDOu*KNe z%Vyzs`kKMX0>=FVp>m6axbMAQh3^l<%PMco} z=7Y8LU=I8>V2G&c4sNOOLjYQOdwbiCz)S;BZ8%oqy7yTG?viudJI)26FhDd|uzh=5 zXl{NU+mjjOK+4BI}*WR$?Zjf1nK;{2P0}Ubuf515L$A`Qi z*UZr44qJr$nrLzg{g5w?^+<1}-EMHCjbUsUv4so?w9LkMkLQeAj$Iq4DO_ANGp5<@ zZ^!q4x38<&8O_8O>K8zOi&azHcWf_KmwsSW30D+95i~?4ye;C9TB6q*VxT*3WUhUG zi{WW%ya)VCm>B{m zXB?)EA5LShLDc+R9kaCK$>REcciJN*G%77Y;Ps7j$mwKo$*{JN@L#1_9B;`5n_&$>v!D`||(20hyb80t^!{px7P+_Gi4g zZ{l$tURCJpu}goRFZQwnj6=})cexP(l@9&RB6PNrLbmqyFfwonYc>OU3sTy@x@cJX z(p(A-j8Ut0=vLSWZh#%GZQl0X-obVrlHxE=1o_L%*_i^~w#Ova0@tB!#-1#&H$*_L z!{Yhi%`ECTh5O{m6Y|b|8L0WNjm-td8^6{~woVDv{{h3pH~+c0s_LU&NVt&KOe|}5 zNV|GT8V2ogsZu!oAa|>uaN)FM#5hWlKYBzncdl1_d}6gU(8x^$GvZ+OLau^+^T;Hg zzQ1N~G-8a5=jQu25A>@iO1pH{wtOR;wI>ek6J|=g*cf3vJkg9eaQvd>Soe_*!?VVb zVyDjIuJyf!>#-Ms%Y?C7Qo=OvUbSp0=55}V&(iPI*8V7Imq9+aQLR~7G2_d>9wDuTlcuVXXgg-5!Btmm zbhj05DFc~ZwJpBSV ze_6V!bs}(hL&4I`1GpxXBg{L$FlOvTzIhh7Tlz~Aoy$VM*J-k(yI1>GTuaWG?NbJ* zut&qDX%N$F&CxJqI3-?7Hmv?Y`Lfa#>U)wf;tAu|P5hw3hN<~sV#9@NptZw07i1PX z`Ml~GGh?aG3lbE4=bjJDDVuW=IVV68ggWIBurU81H@$7!nDxfg{WxHOfMtvTxbQou z$nT_zInVi%MR@7~W1Ks*Y>oxN!C8_;LldMacXon7HDgqWT*exBk7<4bL=m71+P>LW1ZwVVgdSBadK;!V3-z%V8|;R83l|#{SXdni@USX( zQbirj%{P0wUV}O4Yv^2f`1qzF&tM-OOCpt)vdqmQJT5hTfw65zD9#}AK@|@JGXMo? zj&);)tN8fB!As;8NF(=VAZ3Vx%h*Cye73cy?~y3r_N~bWf<(@_Q2O?etzbp02cFK( zcZtfqq5gyVk@ajj%$Q_bn?HUmpJ^Bu3}i62n8U_=>~JBhf}_DEH=w@$QNhHM-nFFp z9VpIlFxy{atY1?H=jujZ1jo>ETV<^NP^XcSuZ2C~BLnwJv}z1ppq9Yy;W{bj6z{{xN3^Pm2@0z>aGG z)gQ?sFlpWvA6&RX{5IKMbDm)uRTj&RFk>)oBkpwMe5bTC08UQu7DRy*N@0xhbF#9w zVbT$w-rTMvNyB>6o=?e}R)}e4G%WZ5QY}GA+1JePx25u-Dz&{eDHU;;reymQ*dS1g z<0#a1Wj><8^CK~jfD8K}UrRvGt$C+vg@-VWW`4DUFp$X)L|Os2KQV@+50l^onQ`?3 z>*TkZz^l;*y`rKw#kfpI@jb?|sv#>wDx6SZ+s;x_l;hNB?hh0{5gdZkv6e|p!yk_} zJLTFN@)oi#H(iYWis*Ey&sujB_^*iGd>!*~nUC@!Yu~$}f<8(awY^y#`+}&>oS?&Q zf`hXb{WPYV6m7XDWHCN$Gn;m!()|Xix1^&xzI}1^vd-vflbo-A7lBgrt@P`0SJ`>_ zklTTLv(aV=!`0Y*dlQWlJwfHCK$rTk^?dZYROC^JU(d|7Q9y>0m)_rIT0N~Cd#yS-!IOJXywI)ai7caKol zSKg>qmC1GCJa!)wpliCr;WVG@loN0BDxviG1p+@DRSb_?Tb?T=w_C$C#=C1X&SQ_W zUHEGlbLk&;&^zQOo8>2)b|gFHW1?15N6m6ZWpj9VGhOGdx&6B4CY*|7q*`c@>FuDm zP9Ds52_bQed&@*L+S;QD%aZH$`Z@H_fkl z{eJGm8UE2pUjES$=)RDIZ(Q35-}p}7cAftTT0R@)y4#)ysudDJwhpeN(#wf3i6nhZ!t2J<@yRI@QJWUk4i zm-5y#3S~c4d2AH1cETq4>cVAD5hyi*QiVq2pP>}E1NA2qnWPpgFTn2}55`R7ZfBq7 zDxh2)-zP^Z7C^xSOp~P{fMNjoTayQ;i)+)NU~Uf-lY2hQuX|zm!>Quw9Mm5if8MSqU-0p& z57O=iJai(6eoW5xhwUZb$IPDG8*im%zKc@4t-7VEs<-~k#qF5n8|Gl3xFG3=23ywN z8QOb01z82P1ur`>^?N?^U1qTGsE~w+=+UD`UzjZv`AUrO1D;dCIR$l-oOrSlM~u#L z9Z#|*02Je9cVVX&KJHoWNtT^w)%CEHidzOMLlL&MtVm*)dzciwL|oV~G!Hic`#eS3k7LCP~|b=A(+!C@LUcMgw?=-3T` zH{s{n+5(e9y72D#yQ`NgjJL%>oH4Z_8r_~L|0UkUep*zPH05R6VDyhCQSBD*hMx&1 zwT#!g^$ZQYGA~(JQ10ve;i??AZ~+gGUsCc77`QppT)hge+&F-$@QaFuPEMM^itk78 zM~^gY*CY&mEr0mnfpfVIN{5>8?4NCq?-qh>7J?lqs_6Q-^_7(uAFhL=E<%8P#Kyz0 zauarZz3(J7G1&INt7JdnW7szEDXPD^Ei*8G_2A_`KW5DP1+FZq=EY6=NnfRzmkQ1m zLPP4#U-cSYB}8J{b3G=S4ikRX-Ad)lasojlG4y|U0biMb1nHiKu}z!5@g_ouH0k8i zv+<9N3oa?&#+Ti@c+dBe#|i80o?n;fdOUWdbY9k7;J2^NOpd$@ZG?Y%jmBQjr0?hc z;%v{T$}|1;+FoCM^s6176(?lp9p!(U@12sqh)6}BQa)Bvyo1Ez2x>wyL?gCS@2Nf`kM1@iO&X@IJ8Abd^-tTk+8tghaE@TsY+d3i^? zmF7_RpzBJAzkWg1ZiUeesOm3I%RlBgpnou#&=0k2@Hu zL997LOIH`MBm+qU7*Ux6@C8Ob0OVkbPt!cm)P4ns*d^4`&KeJ7*)i z=Lbq-UfwY^Wi&6LfeR2ml7|JozA!aA`J5(9;cU7#KHN6k>7rC{;ZBr_!uAn7{zE2H zaJo!_8JWTsN;@|LM~*LyIy)<@ZHNszFU=_e_^v#A0Jy&%A_X6;(@j zE(S1xGZlWo)sXs$+{^#<=luKc`q!Pw>f2fY8dU^`)v?tC*)_4%?74FU4{Kwq!+dIE z7gbBnJpHzAZ)tCC=o!5hBd0~KzR+GmkdhYnGscuc(u1ex+7)ZgbTN@LMpD+ilN_J3 zILq0^*~r{7^|!_jhR7&E(~l@ExthqM;MXs(Z!j2QK0joZYPU0hP%L&%LB} z*@`{r)}24d<<|cmj99E#`8+RE@Qh*CN5TCbDIz5BqGoEgkNx9=jH&Y1cNur<$67bL zCHff$DVi(=uf!e&L>vCR3EMAVzX|r8Iq2uhd7RgMd%kKUOI+5+bV>ehV}dPN|KLWm zGF&>Ak_`8cA2d!xz`_FGXEjtiZl=u>M^(R%71Suf4Gc8g8w)+GJ4EoSp}N%LzRbRK z7eEmJBX2Eu0QAm1@;W8g_*Jx_PBaniGGNqwLiaurtA+GDJKJ3Uds^(TQ7f2V#fO2^I(}qhy<`S zX};!pG42zLM$L%bwXmPKW)6^h8DxCN;(jI<7Z(+Y|DA5P=#6SKHjNKj%L%;05%@xU zJnqQ**|UPj)tdY?5SeMf?ifw}p*A)Gfl#Zzj{ogFfJ0Nz${=c@20ca&4{Ovus^XqK zb88Ns1osFBz#>>#94vZzgFu+OyVHPQFAXj2xBY$5kXNq+Ail!Ng`lR%r-#*E!Fv?@ zZr|czQ{2gX!XE5^Sy*4czlv+Bn+j{sdIuV3*nr0$9v^Rk6@`Ch+9_7n*2GQpcK0_P z!#!{jb-Ck8i;w&6&tpjjWtOPhg706v(-A8KBXjnZs~3Y!5M| z(`mYSqOFA%oCBz`@s3*dYn-*LFCD#ROlIL%Pd(+vH%{{)PNZ&sQf4FFY{&Q`>SqH) z04QZ2^5*PDIaq?>>Q;IE?JbTH10v~Ek`4EVKPq~q6JNbWP1_)X=ZvQ}suG(9_Sne@ z-0Oecz1d2JE4zUELn@{_U=1U;H6+ydW4?aJ!`{cFw(pjg|It~iU#7*Wk4tFkOo|it zF5w0K@vQ%Inx7%V!uB)x*pUi=@2t!zKP1OQs=YU2O^`O-5O_%KmWWzIuID16s<>oH zbEUHn6H$~=-K+!7dZ=@ah=`AWMF#x!V6}6uR2tA|)SfH4eA>r~E;M^yU_##UG26mu(dsSi-YSBlm`&MA;-j7=5?z}>%^*^2W84b-U6?jZZL;D!9Bk$R;AZ0XGHAV&XO?y8A&!j~^tMj2>-A z4|pc)*+zw6paa=3#nMQ|=49LCxL&KNW}jB(s=E}S=wl`SU3Xz)LVr}z(hg4qFegxnJ0wl}dSoxwyQM?#Yu^6q~jeyK{18Ph!C5y~|6hW0|67qR%JhsjngK z{ofR%d6k4g@(YOGurepmZ%+o2NZ$slL_i$?THdHA_PGSY5qDTPgnn`Hyew%@*_p*= z$PBZ~S^{UiRWUn0S-S1_NZ!i}Pg)3uX>$d^&435I-13huQiKJKQb(Z3!W2j^29t&< z(E0LPIILw3T!*^t-OswJqz3(TZS9SFBewe1&n)40qBR`v1N#iO_jjIXrHUs$%{YYh zE!C|Cx?-jr&eoQ4Id}i)Hod z^S0H;!k+w}9x$Q`83*$C6j)lk#={?&7RTTV5R5yIHD4cZxKQc!GOlW;e(X?Z8K)75@AO5Dlglh)M#(gJLM92%-i z8QR-8G-7mc-dMB8Y}b6Kd|IQChL--NR9zweN|E}?9Lu-y-9?w{#WFkMrSSD93#$Pp zoLk68d?gl>BeLBNP%(E)jSP;R#pJCwQG8x(9~q0T*^#SMkm+|wZ@{B3;6$cN6Yktx z5WB+>V;2@2^z^1{9|f28CXw3AQ$wo!0d7FUpr3+|pm;49&?TVd5LuthtR=wH9eDj!rk z&%=E#0&`qh(LNaS$3o4pqSWraX3oZ+N%_paMdV?0^leW`1}HoGmv@lO;jmYVhLI7~ z)`kxT`~2eKud%g$M8sn&D|~F?Vqj?f`SWMq?le57e3_rt)ipIs354n#G5Mxxe0kmc zf`U%@GJ86*Q}st#@lm10=#oQ8##iARt<#Q{wJiP}P)jIyTQd?Io&ECrcN%T#MoF?X z2`Bzjg3_z=PGVqL4(Iolh}=mYyo3<;VQbxrADqEeRx-m<&ZmO!5$jKB@Zin**uw?u z!Uf>@{r&q_SjWJaOZfere7oYI@E785fzJX2ku_G0IaX~FMlF;I2IN?xz5tnpC7ocB z6BsA&MRilB?*ch})-GUt_YGk8wTVU&9B9Dq&BG!obC4upZAUguiwA5V@R=rhrD@1UJ1^=62z>-d4BP?q`upgX2I=|J5jyNHm z7$UUaxiQdE-#-Z@HVhU+Z>e9vOnDKgEwFlVmt+9pS3`rei_CU)drp}5hpGu?dim5a zY1Tafwi8^Dmz(v!x3>G&GucPNtyH%#ct?J)5{R}^)`t}qiNN#vs9lZ{VI4Ueb&_*7X zdr0p-$_oaGL2}H1mc!e8n+XR_a0Ci0T%m2vIU1#Xi{~xP2$UV%0qk|t5iB$TC4)`~ zK0=y=xn8(IhJ`7i19RP^VVerNzlr44Xn=AWrIJabMWRr2pE zc)n`=E2r|F^4BuT1}TIOOE%_6{^VQ(z#(>)7%`=Z`9a221%4U@!S{OIDGib<4P_}z z*>~v&I}gpeC)N*Tqw!q6E$?7&NW0jX0L~|A3YWaX2I0^`vjZEmu^-Q#K{?CusYPmh zBki%GgpQeg80Mo@IAYYS0)~?KY#OT{_&6pUHrrKCJnbyhOtWMn1z_Z^st8ve)mt=I z*lU0Y!ejwHEY!cNu9hOJii8zJ4+Pul(;V3cbf71P0~e)|dvKn%F{+K+2T%M}tH011 zHp!|!R=A@|+9eI#N>WnN@bK^#7*)dpa$pz%i~*LD0y0uULSo51wfj{`iNGCAO>-wF za>yHY%S}y9(PML0qT4MZHFE%T((CoA+yNaiau;z}(QZKwtM0L}7i~W)FE4K=EQc-U zRD_ch#gp}2EOXdX8)35@gi&s5a|q^Hx;n?M9|1DU$jJDAWUHdBn>k@1NrfJ62V-b# z?DG86f{iG1VAzGelQ#F2(uno|FnM%DQ*CVu#Wy45A8QrE`^mlnV2YX$I8JC zf@$}B6V~Jc1`T&=U{O$0NX(BX89hu3|Qh#mu zyM$2aR}TAx1KRb$oq3a=PqVUqt-aWs_&pC9VHSN`z4U%h^omZh_cBB^$8^u|C5P9~ zKGsApxh=)q9ar6vX}PImoR8*Rbg$7YZZN|cJ*vzl&OD4*60@%aZ|@dD9lDsIz{jc`2>O>dXArwZii$dzC4`Dh3#IYM1@3@Sws?PFb|El%*wf>A?qS_) zt-GG$P&(3LE(L%P0w#!L&B=~pGw@{ggRvMP zN2#v~mn6A-*qd^9&g~`7-EuOo;?|Iv_Br>wlD)iJn}uJNYE8%pD*gyAwWXvcDNF}b zqo(Fem#H-lm$D-g>Rnm?gRmK%MA;o25@G}KO4Em1D+Vmsa@;oNOsJL!QZ}}mZAS+u zdGMe^H3=OTU%2Ggbtfga%()c^du~l*3RIL0EECb+-{@YZ<;EN#7CQ0j7PDon5T|J4 zLTQFx3wxchUwhr@3*GO)lWVkozOk%#+Fes(AQzP5uC~jrPipF59z@NgYF?|iF&d; z!^bt@cm8sr;ab}RH(y*}-V)ek#}K-MUqeobdA$h#$(Agq6AGRICi#(0tcC3!HkAF` zCXF^m)b}H5Bc@2>3MXb8B4@TZyQcWWk9!bD*x(LHHn+iyRQq}Fget&g$nR6?Ui8MDpT>b3Z+LVLQY&4G`%(ne)V^YAyyf%pZaCZtHn zEb0Pi-rh){^D5^y-Z=Ba&r+h=sH`T!Qzc>CHg;?;blH;>4b%@z-euLS8zvofI2 zvurJ#8iKOziCUU%TG9J9*eCZdN>4#)cky3b$_0AVqWw6 z_h||erp3hKr_0QD@80Fuw(V0@74teeIszC(>$Q=Q5em5VJ9g~g;Ntp>mPznC8*O_| z%;~tx;CE-*S(d{@qx3~1FdUmG1TYJ-=p(+yv#UhNcUz>!yRk1_t!pAfb?L5UYfW8U zuw2W?jPd2muZAYZyTMQrGk&(eXnI-Ch73{Xk*79jhATDsM33t=(Q)zxL=X24x`ZC`SyUO`h!i=#peFk=Vv@(@%b z3-gg{+Yi8F9Pl`I3eF8Qv2IHKs00i%A~0>M_^URH=ft7US0#~zaVtgd4XD=IoKm`z z+Kf9o)ZdCBF;Mg6$ zY_;jLd@yf2btyBHQ?SIGDeC0Wz zWDQUOSmn+Bi8)>U_AzHn!!RyGDl{h#H&UxC8WW<-QUXejr8FSbTnI zvQmwb5#<*vwA5m+xYXFc76cdHqkv)YZZU^KxW-r2Xl8sx(8lE~N*6i5ZEnefjfCwC zwIeq#Zgo?NlFK@m@M&ZQDZSf={?*X7uH~5K4qZn1nW{&J_+CYx2=z>}-~?4>E;4JS z5p+9sBdlNqD-e}F^fL$+^WicVK9Tb zm$INZBC^^FTc*`$eSUZS0Sd@j+}(nAzWQ4o*p3r)t;@5o{PcRKpZZyl0S7!1T&=z4 z<*~oNBZ|I~Mh!L3T=7@>p7&*%gLAJ;@)^{54_Yp<<|l?2`{fP_wwz(%T7PHs_1~>o z%RpDV9sK3KlJvvu&P{Who<5=?qtz4;_ms~AbBfN*B--82FIc5~)^k;nI;8khBjtDo zKnjdNS!iA<2`))62~;Hs-+w#rPkxf~bzh@*4&R!>b?o+Sts6-90%g{a*zELWNc){w zoEw-fUB64dl4B9{nI+r(EW2$_s{~dJvluyUaij@%_cSbAw|W)YLsp+7fB_JyS4KSd zvW5_OvUXh*RP@Qfmb%=>W;lZ}G)3gWDoEVHO%QR%!sQ&65u!OGXN8THO{}g6sY=(R zZqj%XQQ7Nn-fCDiaomB1ee{)gnd{L0jcSeCodwpEr=euUQpMlz<^v-0^pf61?un=C z-#;1Pb!XUjne#(SjOoMS{o8%xsSMg2$Ec-1|H zT*E99=`8h2=h$U?dsc$u{o=*P&!1^AgxY)X;JvXio0BI`UcPqiFpDVf4uu@I6;{QK z6XJ!LnYBHg%p2F86_^9ee{ElXLk}h3x*@Z7FI#!q-|6Xh(VM=hxj|r`#>Q*FesMC4z*CPsXcScDv`TdH;PWX7CM1o|rm!orHWyp%P4 zFBtL@Mx#SFmHX0j_r%7=9(g|Yr26`S(K6vEk=rvEnENZuug9l^ItxQ`!es;44U9Og z1E1@io=e_lF}x$U6-{K>m*qYapop4 zz5(DxpG%ku7Yvm7`k~a&aeed5nHf4hvN0%_o{OcPI4ZO-z_Xq87+8LNi6hv2S5st} zh3~cWuHL7LM@X(pDZeNVizC!!39#u26A!#aV5Dx-jiwlwV){<(HzCOQ=o-NsZ9ic& z&w|;cs|S>vHq>QzV#+r&+tIM9_{YP38aLg>|6 zV3ROLmIls`%~MjMoLw&_)PkczxxO&zXk%<#%-_QWK0|Bk z$n^zqmAQu6k!2rwN~y>&inM2veXwW9@d>BPottT<+4)U=ve3cV$;a+kU&)zkbg-7Q z`P=mGl#ro&k*6-D+-1~%Hxq`C_=6>Pgkw(U=}<`pokfaWw$&FyYfcMPmPoiVTu1*< z60m!9Jcmy?{rZ8{}}t2DO!%G5F4)nAwr3tsq?R(rGdr?{=BMR^*RQd3h(9(%U3RO3+R zn9QO_VKJQ~k3WEZ{;fW;i!4hk`Fj3I)A>|(i*=!#C@XFn-tAGle%x+vmygDBb(gE= z63skgpY)r#?RwJ#30hSOtM=Sj3<4*LFh75xC-FWj*@4CTd1$9W;Pru5w4LdQ3Sw&{^9c8 z_tSKU5~}=}t&}MNF2;nzcYkSP7!B-GR7vjTN#IjiwRHBH?u;7DjE^IK1y=5-P%T<` ztUXEU7v(k!sIyPkr$oyq+49q>Iu+G&TR6mC zCS6-Ke{k}1^!!1;)85gXxy5l|`{RaBB?zyvmVdB8n)%Y`s_X1F$aP*0>IO@Zw;kyW zNUpYa-)l#X6NP~mXM}f$-_?lVDVOHdLd=7gH`9MV7^WGNxZX>RHAPpHTVo@mvuM%b zrA>NPnR+O4*v)5L%P39UDQ@!pgiI`xgkr@8?nH%m_)oGj={ z|Cpp)bk~b!=Hm{M(ldR}Qq8~X_gvN(vCGMi4Z9GmUs#!>-8&tb+ZIVHMUP;n#Yx@E}I-|m++OWj*tRB4dK4L>| z;8#}>);pjLV@^Nkh7ZMEYW=~ykn$kse%OT)kAA@~`5_l(JnES2d`*Me%J*#6Bfas7 z_%=Dm#2u-tqn(x=HFW#-ZM6+f;amG&{^+*-v*1VcrHWLTgP;@fFIEOWxuQM&n^VkO zQvFXYsTiATTsl<7H=XXEd_JWflR~toZ%^O85h`l4mda%xH7UF6*_k+9+ohAP&ra?< z+sy7$@|;ik(UdR?{gjxF;x@(yn|+Vgn!c(mP7zwY1gJv_BybI}AAvqK^8*9%F-$K{ z?&N+{a?5t?<;!hYa55!$U1-oBX(1_TkAmAQGmuv2*-?HZpTE&JMnrHUl@Sv_CSE1` zj7E%j2;dY`IbvXktaadkH!|hMO`EPDiT>#t&9`jYLaXB3g0>F3($wT4zF<2SWRt*Q z2|X@ehd^#kP1PIeu3P#K?l>T!FBA{0csz!8FbRQ}Klp%RmU5 zVfTO)alk(b#R4G`04{`OEgT#iGW}%5eJ~Y+8^nF5mRocn)MAssC-`EM-T1UZsWa4N zUXKNmCnvHnG|i{GiA9Pwkc@#M5Yg7`&`UUJj}eRJW=2{|SJorDwk|~e;w?Rf1$Edz z@E8*0H>Y>OqN0txaCR+^lH2;W{#h%?7YMr)sMA0_MTTn=J>2x@0TXXWOTOzrZJ`g5 ztFe7%Ee)}XhVVTkOlb+IK)HJC{;VzB<~(XS64@v$b40rY2lSXh-ivnC0;uh!Q_ox|m|> zD|JmLTu2bEVVNp!XtXbg$<=|s3vQxbtoKv|pJ%qU%-{w8(#}2#<%|bkhSroV#^1(@ z=rHFOvn`HyX=|PspNkfnE9*ZouXO#mM|Fmvr@7u~&i>%pIL@vehn31R1Y56^U* zEwoaVmZz<#ThFH$D)#IDgJj}YrXOA5l`?z$ZwvNsMkBhlQol$+ZFWlay_1uIq4RSt zt51_?TnsK~7OrFZGGf1Jsla}WS)BFI=;7+pwM<3A_A1f_&S$h=4UReMUOlYJ^sRoa z+$3#iV|-yOMoD~)e{1d=lJ_?YFZtI|fEd}uDM zpaKT{nMZ6`rKx?q<$8+{%OgJK_3yn^K3zT~bn4+@0lzLwg*i^4jA%+#_(`#?YM^RK zy)LfvaTTiU$`+~~41V>heyO^bg|__`4xvDVmORVdiLSONkNLQmP0?@K6t>O6;^}u} zWaLpn7THhQlZ(;Rqn72^Ef93z4u*<;-a`Z-@@^W9F2ob5_iu^}G*AAEYp+-;nz_K=C$rG{71E!&!#C>E? zm@p87w*To!jt=iryMIAu<~`&IzCZL6s2iLyNkrF=M3*w~hG?;V{D^!hrSbcQinG+H z?E0m*l{(o&BdpX;DQesFKn4{Ipbo2D>m_L1JhCBujH=vCeGC{8ZZxXVuX?|T~sUTNB`PTrdN*s z9T6f@L^9!U8GrQJ(cf*&j9ntZ9?>-gXSg@N)BFLoijAE<|fMKS_PP`2ms6WF6 zm!eY+S5wCJ>((EM(V1OZ_A{nwNfB=S3Eqlxz9EgayJi?#E{uu804w_0Fz{AZ^~Sh_ z*WK`xFb>wTh-uNP&VExr6;sFklPoTee<5P`dvyy&Ze?O9ZK`h>^+9@;Y z#V(TL;|#+-c{DfQ=o&yK=J6+GKKm66!UI|r~{Fi$UXZ zf8ja>-)G8x&tX*jo_$o;|6z}lB9H$-C0>xtM^(aQ9T3ewY&5V$g!~W!9l6? znBEWK*hVI%PR`cZb$CHP(qV>HoOkly)b?+mMvB_mL{$iyj|gex%VHs63-y9 zJ_eIJj#E@v0Ytz?~k=sUa_}@1(S~~VY_9#U$iS9zhYb5`-GK| zQ9Kj;n&9nonVcoMBUSvjcCYPu^uG>bMf#SfIvk7kZUkI*_9)p9^V*{wa@flmos4+z z$A5c|p0wtfM<1Rwu+vj)j)?^EsmS`ZNZ4-a>9}J!DGPpaCxUnvHemn0GJ;AVe+o6!`U^-}qA!!LAO;5RMaj zHwJy}*gGn@nO(Byb*$SHR{zpk#hgd)$IVWS(|?rR8e>LtYV~)w#k%7U&-Q77F!3mR z-^-0Cs~PSU-To%0QnUp2$fLumNxW|c6AyKK$rr36um{DkirhMBga{P%C0A`KXWmhn z=>yJO<<_`!l*+_X<9{^9?;69TXV>vx*F8Zo&o>F|mLOtlMipLhSy6tBU9&Y3(jeio#1LKIV_J zv)MadN^AEmf#DDpC$*3PIl(in*jg;+-9Vs)7`2Gq;{DV+aRn^;EnBt#th=G_=j#jc z)q0RduGZs;@1feg3^hGr5Cb(m*!aI&KvY47D3;(u@_crTkBhOmbL{;!y?KrX$`nD! z2i8b*Ie!T6d;fGf1a-yU{+A@L`}VjM71!w@-xglX>xxjf7fbKw*m%|4{QFOdR}Okw znwqjbRrlB*{QopK=l;(IC&+gqV?4>qeFOSB>S85zP=q?{ROmx2*@M(uCR(1%3$6bw zrEuA7ajBK6NbJa5Sz(!wQs7ceno3B!M+w#@K| zh@l&cY5yxvO%IWYJ`<5=Mc?D$VOXoY7z#ltulwX?!h#ALE<5Xz^k+wlnUK8+T^O-e zh*-}}Ovi9PYwm7@5a_lj?&Py(fV1Ln#@JelG71#U z-Y^vB*cdO%s^{eD@Y@r%R%etQH`BJywm<5ea(M)U=d9MDhEjjtk$&Md+4Uxt6xX3% z%F@!(Hzv5ev?qRAva>hhHXN~y`U0sC$aAQUaXTINX7R=J<4;WYRR0h!zcC4OG49yv z!w)ce2y8aD07O@iaVR;aZ<8Xr+R#B8YWRRSVTf^`3) z_vB8%-I(f~Rd5gwfi71aK6+UBP>|SET3g{?z}cn#gCZ0k2rkc^Pp@t|L5_wQ6>j*~ zIQ_wmYtTWwy8)d@(a6kh<+-INXJ_Y!hm&_GHTf?2skvPAJeT$2j4ty|pIZL>GGU{&E(|5!*|K2pq+J&TOxuJhcX#9Ldi z#&4i`KRqdv?9L%F9a5S)#d7ycXUFV|N7ShP--|Ab3co8`?s#gqVidfmI$N(dpzl<0L67d#joxN<64&6`a~;aizFlD)iu{j!RJQ zSb0o@3A>;8Pi87wB{^ss6a@E?|B;kd?mPcA`qAi>BE1dJo%QB@cXVB@c3>VGzy?E4 z{D1n{)3qvB*=Xrc+viFfyuU*yyyp6e>rT&)2Rb;P+FKP#6G+FhMr(}bKV^i>_A;DZPec|Y%mYnU5TUy>tP;ALhEJ^M4-P2K8MFDuK2e$_rpw7d5GN|jp z=g&@#j$BuNL!N?cChwVgLHG5?j0~|8duGy7YB>CbA9qR3FI^4YiIak5>8&@LE@?dX z#mI=@YKTcB+u zU^9_Jl((npfehe0rmtdWSc_H(XKkh-9GJznl6wZ49*_x#DBR*&(nvdBC0`8$Ogw6CsC-GvH- z3saiTV;|fx2`R;#D*h%36Z3WJ*8OI&s{H=_{m{>!KO+O)Y;X;%>`g5wKtkF?%$i_D zfkD$vchEG1jWh%hAW9tSYw>Twk<79evwWFP=O8Og*MyQZwyv zyag6^2<;|))AgnqDD6zhU?c<5BMiy9x&(>2n5^t00+B-sgg*cfxmcGE)i*PVnHSy! zfWpM2B>o7kgpu8Ul*jEc+c&PmV9Sr-X08m=XrVcd&)>F^{bpYt&k*HO2HY0qHck&0 zV8VSEI2plA#Fz+HXoRl~h!sE`u>a^D`_4xfpb^b9s~`O#KLRG)%H{)?sd(e$;SBg| z-@ku0fpb99Rn+ji#vkN(v(RFoF zjje@6#pW|xz`eV0mb9nJ_U6rRn-PtQJ^`hGC&vJ!l-%Swx0cjM^u*I+k~Bn`K@>iZ zMjY4ZzL$qlA+7K``m%p?=HgOsvJMMz)NeH_^bix8A3B<1*Jw%E7qw@7(FCoKa^10FaGTdxWjpzzyd`dm%J{n z%+eJFJ|N2547x0W+km)UtmD_A?XI7eEHSo1af)OHuoj68U;iYwn_*vhNhvAttoVp} zs=*5!96&J_&uJTPAx-7Or)b_@!ia212Ca#)B0TVQeb(UKp@`(UU%rN4oboenST1Pg zMJ-TzQ;*-N+O6;-%xrk9 z!9r=8pOfF8YI$ILJg-V;``t@nleF?B!Mxu29qV@e@GrHRpt3azVz`&E|G=^I2)x8_!y(|g%k3`N>8FT8?^e7BrJ9O{6_%!>R?oc}Iy-F7#bW_h-ue zI9cY}lcfQ9LhTMdY?cL@CA8i`x`;2&8`Pnv>i7$NX~kbP{M&Dkr7%ZAw*vGQR|zk$?=7ydObFgZSXLvcjvoz^r z6|)CtC7bGAldm}IR}RTG)y0tS;fVSLE-|z^%Ew+16WwgVQk%RY{}7E&*#Vn_w`Fo0x%j|cI^Lz7jdqK5lo#5h-VK!! z3USBrS2#W?qGA~9?&cZ0?1vUjZ0ngvV36u>|vs#2$;6r8-k^dJNU3Zo{&<(TMnr{|KZ zrq>yWs#9IY!y$jqG&&h2fjZV(=J`svS?Ous4`F)E!ip>x^vWwB?pUiX%HzffNWA_r z#Y7AB#}soNVJ-$+CM0hYt1)Kx#`+?lL)%4US9A0Cj(_1jVKzp5s_E%04S_W@1bq^T45{(Yu&M_{+b>^0D)77$ zr6IFnaB#2x7lueHD;*F5yoZO|FkD@%QC`}zjP{KS z^{VF>yXS2y&jm6guV=gcv-0lI{@5sj!1xD!ob8tIe1yi4M%#EF_OSdTP6I;NQFL#E zfyLiw!wF|p;uThs83+a4D?Pn)lnjwa{7A{dxl;8 z>VIx^2u{6FaDbpbG18TOc=-gXwz;?Cf}?0`gyvd&oE7}g9OCT94amzP!>rtlr1ivZ z)Nq*Z-Zc2K8-an%-t%qoteg#`M27y***+N2M@{6eVR&@e_QT+jYK^vnyblqSjKOY> zr3*Z*sqDEUiR6HV*W8mA3@B8EMY|H`sFvpK?^)LvLl&&J*}=eR!IO7 zg4h}a(PRsOxg!`F;h1DX5%|lI&dryV)-B5%Y9RajEihDgRvwtZj z2hW+-WS#}L&{tS3`srg~@X>5i$ZAK7&T@-RVFNy4ox1LGMgcW)mza4-~0<^#RTj(d>-d zO>c$w+H)F@l&EwF&is~04f&H?Afh3>q+8r)3_dIj=Ml^uK-%XE#@Q}m9|=J)L{lZS zq_l$ZnLr%E+q&2zjh(P#QPjC80#4AH4_--LMC;_OcC|shoBkht*gp*$UZ}`!llIm` zVfuH6+}m#aZHpwoV6U=0Qp9idjz>6H-e$Mbj6c5Yy5Q+4&hV;GnJMd6EA@TV-QXN+ zF6|2&WdivoXur@rzi^xEKx2B^xOnf=V}iewB9CqJViDz=T&Nnk$bR7IAuYVe_C!@x zRqvKqzAFOgSOuag6D;y2Fyu>XOzc#gT&5i(X{Ku7)V%wuzKb0F zB2^0v&liJZW=tlR>8n~ws}|HgrYxKQQcK@HyW|0BV1cy8AuakJ5L^_hpmAQ!iR6zf z8-*f|KOMe;palodG_g!Zg(W5Zq^%&`449o04T>ybYku|lfS}mgLqe*(Q4t05%lYHp zAAd1*xy#K*&d!{yZ+Ab^GP32iG4cKd`_EoTsF}BkjGgIaR88s7i>ULTQ0QL+L3#jJ zW<$r7lpNm8?$XCz1$~Kd&E!SZ)jL7(T36cd-O&TMf(9rA;l1`$N9eVEMB)Vr9wo4l zxx#@1f>R%?-#k4gpPy}=w`@zE=_(8Kqb6wG8M1sm95Lt4KjVuMn4cWTp&tv@@@%kNOvjv|kzyJr9g(6ZzMlCAh zn@AkL_TkQH1N(HN)A{PhdvSWR{1Q%G#Gs216du1EmDS&bvGWTomj$1N7i_72k`od_ z=Mj^p2iF1TA^i~azhA#}$@2{jF9c)c1keKVC^*0J@IeMZUjyIEGf5M3b%-6vTK`Q! zc-Scl6lXX6fHt=uF#&c+v=78X4Sx+M!Qx|4553#oy?ec^Wj2B|4jlhWxIeG*x#gWG zXuzg;5gJ-Vq(ot1APFE7D!q;MT@jJ_BK?3Zk@>-sTA*hHIoT{(Fz`5RHVMKa9(eP( z338x>F3aim>;Ev$v2e&6ySa%bC&ph1#FhUt0#dWHA8ue54`;~xbsRR`#9~as^A-zHrKEw`OY+IpU z;QK$uT)!?LwzK}1=Rj1f0|_aP8FTMyZv2~Jh!lbe7AOOk0gnqc#&Np}8{G%3s)updq1b}IQcQGP_6$ddVTrQ|Kt<6=o$E82b)GOSpLQMe=(sr9 zdU1w((8M!#-30K$+*Z#=xzEFy)9PrJvd>^fRVKfR8cg|kiu%y36o2)%n?Tv-p0~4C zD0wpGZqHL9H9Er|Hmu^Hk6sOIcsNx}IA#dCV=S-+6brb2>_0Af0~jO#JqW=OG}6QX z`JLrG9qzZXg<8W&t3E<@;|Hd%7Gjqu-e%#}zN`k+f&&~(R|mSbAQbeQ18|F2u$diD!l zx1FDV^=-TDIe$yx0+W~82QNCh)z-8L6JAOmxBV(zvwoE+Gk@F0`2@HIUE8g`mML*+ z&J6|mP2RN=tE_1^;&+QEpVAdRvRkif8s}4Mi*p7nXXEb4(^r0X0^;z)iU zocr82_aJul`_1S=wvoYUl)ho^GdhBdfC7t%|I}E(l*`)Dw2OL)4`XJGosD1>Lk#gz{d?@5QtQ9fQTfT^ zvzaqBAacume*Z;#*LNBl?CR+Z0mObote`GyiW>7lltpP#=Rx)XN*4S)w5@5$+VU+p=ovs@t{WYo^^ z#X$A){QXVoKkxy54aN;Y$E-X(3)KYWz=$~fdY9x$SQQCAdUkDZQ98Ivd?Drhm_v!% z<#6qLc~W1NKGsg3uM|27+=@Fs8!{zF0gq@tZE5=W#EUINuKPMQ3e67_!BD_p-@z}9U!z{S-i+D zJ?rsm=sdXT<8K8FNVv6c&^T~OMgcs%&&X^piq4~llHf4afvML(1Ng>eWygtL3ysr1 z$?l)|lcZ$(Xe=seXPsM^#~^Qc!5X9uyUou~CSTuTLB{&|Q-@f^g&7exOr>FVzE;6w zkpnNJE0u&aOW5@}qiG_pkbfFFpo7GaiPico@>dB(vRkiw>nDGY$sLP7d6zaX505M} z0?QP3*DvBHc=~AAut92kd>_c`qfj!xhMs4J+UPpbkexiSNNv~p;qsu^J?Q<{tYhlI zuivdYT$ILDazcR9?~JfPwcz!iuldq4tk>*Rsa|)4^ZBk*Zk_9BtJn1f(C)#$REyH% z7A0c>-~6t=voQ~NEu`~C1Y0bXx;8%O8ev*$iP<0G^mW_gu&=#qxSH&SrJQT*lSGgD+2Z5S(Nz>Fa_u? z8-Ob6=;?({XA^9D)B(4fElZ#6P_L@1yAOZ;=*&z9gU;W1+&6agTL{?6_k-iIYvddZ zj?QQJe76wF3S8gVc+9%vWFSwKv#ssEl1kO5hl*XQ*D$99fBW{0Iz0Bz zVOh(;UXPb|Gp!DLy0r+a!;-h~a?Q6g+fx2eN6z#ZmWOxajE69_XFrH?2mSTOfn8RV z`;}ZZ8=%j=B;HMmu2c)Y^}VB$-|mHpQ5*^A^YfA89v&WgdD(ih`e8Ytz8Sx>!iN6J zEoeWQ7#0;}6n!Ot(auvMtf2iS*}?Zfn(NndOh?@Mu7wRpnNH8t9MtI8-^TF)xC{L z%gA`saL4JsXKueg_w$achCQ^XMnKv1k5n zv_QKhdX0$R)&EKuTLYWuSi?I@6X`L3V_+LIzVFSf`c+)OR5oy%3GS}^`_DI}p2kgd zyR2ch`ZC73*}LJ%u-6T7t1np<^BWo7;};uuCH_@Tiutgu_d{b_!^@|dt{vw@^pnUp zd)?DdJ-wClTZuE(BHyC1_VbbIJ?F{7WD9{sbv(2AfrQ3tdopPt+xPm2#hclNqrB>y z_o;r>GTlFaL)tER>gjRM6GkCr(;q%42;B@13-duhug0~FKRC`f;4#Fx2w>n3HSP}; z%vA8ESX5rrLD@3a2Il%qBF(V-Io(3CYJJ?+er*Zup@Z`G znZAw^AC2eS$2_ej9dMMB>y!Qp6E3?%f+^F$0Ji8x-|+yAiEv1FbGtNE|M>CaQ~LU5 z7iVC@d(( znUFkFq2R%Pq*e=66aEIX2wc_>o;zw;M8xSF3-fo$BT9=5PL{LRvrZzH5%^~y})5ZL!RLe z6IxB~GtJpBcDF`-7n7JM)}4)(G+fbjYjbn6^H>SH4X`y_lby+V!>VRxyMO=wZ9S4d z1Br=ccctx#7!oP*w*k?Vg@>P{|Is(*d@dvP`%p4o^tYUU1i=Jlg~xvf z$3{_k;e{_(QxB$m>bHOW{{4FKkPT8{n~oeg0?PHkMZ3Ia5mC`Q#qD0j?T2)9HaA(4 zT(UM66L$w4t1K5IO?_`bqq!8#sX}_M=W>T;oLHA) z!o#`X?9`Sk5nJA^XJffU3Yn*;;bNr23(&k7P#L~|i(gQ2eu5k63a_`^J5N27v3rv0 z^=lQTVPnos+>sBnI1=LYUc(5`qEe<+SaBGup!SB80Rc@b7n4BCfeu$FYqx$m6?I`#Qwdzgah3 z8zJaGC)~V>A-kP#?Hf740l#}485?PkToBU+oSSVVxBH6r9$gBRUfsOvl#|@A2s#|{ zDAu771j&H6SHSzJ{@SI8;-d^jWzM%7Rxi2V58?}7_7LKHV_4U! z_SJQR!3CWbvxo0toL0b65#+>pI+oHKkZa)C%C~fIX|ZR92@^|{k3X;LJ{p80DNdi~ zwgaru(Y=Y}sl|EmsUjW){wTvvrd@ z{N&OA?D}HH0}gv#`qm>?YDuzs@zgxm)ryU)@+KKNm3Vi5``06liC_iCT#)AXe)DMKN2=Cmf>-j!A+xZA{AENKs7TDzsJa`&ric$h2eSkI^8r$K~0Q&}X0cXR~ za2;*hv`O@!l+^3gRGlD@0k*w(%&fZX36l|Vqk<>sZV6XCXj_h7{Kjz=MTqF`-8zPb z$zLXM)uCI05)wn1=y^vWA)yA6mC4hbc-Mfp4x?EwhN^N(R^73pavE<#*b7{&VJGTOa zs`jwf#hrNI&#EdfD|d>%bK7mYtcA3%J6Ra+5tb2?)6=gpA-&Y_!WvSS)9SQuuT z>c`@=k)SC4-U4Rvq}p?v4)x6uAzhZ%@91@ zM?z$!7QTKhfS*nI3*f4} z)iM6kZcUUjxOLmceSj&^#vO0XEgx*Z|H-M7{IKC{y8qPC#PVOg&qt*qJ9+3{U?$@$16@-oDEOT- z{n~Y>V@x@nV%$^mRq9dLiu}4ch(H`xbGj+(f5z|b`2{cs|^yk)uiZd+%4Om zXr}iqU98~6_!A%PcLgc4ypOeGXI&ppznOI(P>RfLF?sjU>fP+w$Nukw4Q6WI$JNs?0I%6yP`$Qk&aTk`r?RGg2QP#lXAW7MwFkUdS*Fc z4y}m1PxF5Oy*2chGf`L=On2^iX^IZ#=dWMhHL=>A(GPfvnw?rJ#p0S!9quF(PXGQ%YG*!9Cz_+98RnF zE9L@OQ^3OX#+noQ=OWMNZxX9a9E>5Q9J!?W!?idWum*&39U zkP+mtnc>Fy^8If}w<~TpzI9I``R?jEijSWEP_cIC{S&i($Mfd#mJ(CbZyL@UFl+os zBDbHc%;))hZb0fZZwyOVygz4I!*fg5l1PfJBqy@o0%b(qa%;L*LeO68cir|X!IQ0(8iLM>CQIB*{PLUTJQ1F! zlsDftbKkY_g7nr^diN?`K@RWQ)0JT}tpiza&oXbcgTtoitEYm6ttsREv}JGeEjZSN zYnf_bbHeUA7)Y*WI3Cby7Bg@r-7ANO>u~E%N>bL_ycrhe2G) za|uLlJGx(5I`)qA2^!OUg?;-1sz>lV*Kgj`pl>r55A-d8>nbQn!8fqapkfz>!C#h_ z7E(Q_9tTjMqu;_n;#6F2u1i=UJ+izQx&xcJaT82JcI64LJSGZH_dYI8XVoJV09Z&s zs92!FoYG3n&gNK{9y$?*$WEG|yd!Em(7p&04@maG<;r#(3f1^i-s&!3&3a5)8ViyJ zo=nBSfO}wI;MAEjcjxC_e$~~z&dLg&c>6Ug;N(t83@?bdjw)JFQIRm~Mh6ud8d~-H z_haKyzv!f-O)wa0{yX(e^U41!xU;t{2rJLg6D7`NKtm=bCV!%P-|+Ak2pUs2ohQu^ zLqI~&KL+0%VyUZh$0OmtJ*mq>1!8IU(D)FcJvNq(P>c)>m0(o(wugxbsBhn{MT3Ba zO&of9dR5icgwBc3$Pf#c0F11R+r`9Q#l_JR>zLxs#Qsz6zjJHBWt*FqH->RU2b4D@ zRPZ)e(fD!6-oZkP4!8=G;L1(v8F}h^$uP#I~+nx}Zn8sWxbi+1=djuyM z*u>?%4`B-X`D*HOH$LWLWq|!qn4?BHxTI7zIHJ{fmozfS3^y?3z&62~R`zHFMezmp=g) z1S;&s=|cayeb@H&wjMv#_nLY9^>}veBg@+vb6th8W`bX-M<>1Cw6JNeG3Y&%!Sp6y zgsMMR`AxF_z!`^%({r09TTj*Bt8&<3Uua~o`>cnZL7^&jFf%KKuG#6lhv|}ZHK}|g zBZyp<^gtnY+~}F9?qIS);W>wgle}+Ro*BOtm#kNIiAdwwbSQ4kcZVmxI8U=btb2KO ziN7?I!X*F5VzF}DSSfGo@Cku`azonjF0qt@W~lD|Tl!0JBzXBW_DFYdC3Nq% zk*lCh@bXRQuDAPM!DA&}(~m6ka9i`y)p0-Sb9d~bF^Nr@uI0{1nr16KL$jN!uH^RF zs)$b&3wpA7K7k2;>trc$cQ}ha+>*ejqOrF5nc-gf_{TK~m$MrG8WXa4%=Y=yIp$c` zPfbe9!g?y<<2CN;wq^n1GV?AWFT?E=89N(k54S#{8SJ4l0TK#e%y$>FxN@U>U`TiK zj_S4dKOY^Syzx!kz*Uy&vYR6zzq{tXCOoQ&PzdTKN&Xvko@r zymim3%c1ALCLMU3xBObQ$M#s5N#Vj)t8LlX%#mI67_c6C1ayxfIQQ`38#f~oIcebNu9VD*A;%pO5>~|p z62u`Q);JRWV7Ei2+RDK!0;A9NaefHRcTG*rT`D1Ozqgf#6@v>4r#2uML2NgG6#4Gz zMPZYi%!rwQ(X%d(&8q8*(wIeED(|%OPK7 zWo@0Bnj#X1ySpONjnikR9fwUJ)CXR#4%`Tl)n>Q}5l&JjLW@hujl;si;<^RE@6J*z ztsyPgTJ1u^o|~In)z}CVok!Etj`sHUgTLEEi7A_p=Tg0A3D~lGNKW?lZKlc#+gjWv zD)tnlC3O@3C;k8eLw&I`@a9KWIo(>#0F4y(@o!|5PtTQuH;ApIy z3D*2*d$IQFNzdk#m6Zj~v;eL4;^@^oH!DP?&*54+zs)wpI4C47?|WUAXXIm946Al5 z#@k`IlRKw2nx@s#EE6$yg_<>YvtvQv=cOavhnu@#2KVi>>=}FUc`Ro9*50N}JF_jU z`sT00$Ie!wEfA7if9K~@v^1UTcRM-Y_s`7t_Onyiv(t$~{fqHd#1TvlMz*3W2Moe{ zt|vbD-g{bHd6)T4`8cn$P_^|qoTR>%gA7GoCHxHT!F#a?m8jH%0EAs zo$BVe4!PqHQ{9&+zlx1|Jh==w??gpY<{SSSRYngZ)up^uzAmLRi_codB(Q;_tRme= z%X~W(em^Fdz@&ha6I!LRI&2vsX^l3*B8A4+4;j2@4eULn(W;edoRj%rQS)$fa{mpJ z-;)#1mXf0aSVfFOGc@bFd?yQ%=}Sc3Rh^l2`&J#eRL~IQzF+iTEx;{X5v!z~w$_y; z=fZVFlX&--1KUhI$3=E~HLkkn*6)Aho=;1PI+>Nf+NC1n;o)!E5%r%+)B zB>6ORT)QKknMD^zd`8N7QpgQeIH6H^Uy9k566s4^W`zrrg9WEamtO)JVg%m#ouac} zef}T?X&B2`MN*qXPXAM^_36vhT0V1G{`W@zg4Cv!i65JB3x!e@9+{(E=fgP&7e-b=Rd%TO3 z=cw+9bG$NXv0>X>BE7q|ZY7UtoLQC?Y+Qia z_lF28J7aW`nRRgRQr0|6j4&U~7dv6LiM#XNolCr?4snsuLkH`5j9IHHznN8)mAU9_ zr%)D>tZ4TwP>~>s6i(`f4{)-Pz!pAQZ3f- z13}r5FPpZda@=}k#;70KK-FAzR`f!ZDf6jvs<@JgS*=-pg~)#EGbSz~4_Fp_k zqz(U$+-?Jg^cPH8MwM!XxGRJpPtR(aG4mK$SI5Y!V`%tkRM=9$h3<1yjRq61PR6hq z$D5?s#>U1sR$jH{zHt;;ZcOH%hJAbUGiQeg!YtvN^UiqhRD%)Ys?A|63OQ?`v*{Y`V^;&i)mzn|5^3}e@74!9}2mwq!U@yhVPVshTA~KGI!4mjt#1x zyH7-*)VsK>u(Yx17-&o<<=WX<6jKZtnCt44cb%}_fP(@ACRfSLI_dv=n4p;`xRy1V z>f^Y9;!lmDoSNAZSqX+nPC9@-8n$Xp@9}hTs{B!Lo=~}weR(>!aPEXdpJL>Xp^7~x z+yK`R@gXstnIA=q42kZnN44Q{v<>PI1rNiMD}KyoAaY4e#M-#$+73u z^p}Ssu541?iLcUu&ixsST-wE-KTd~zWE}XzqtLU$J6HnizxYp^R>#DC8?tE(@@~k( z;`bYwMFQxG7dU>y(IFmu5Qd0&VI#8_b+xr|*=t;Bb)jhAvwg!JT52ejRJ%9?-`Ivy z?i65KF;FS~>~L9yg9fgE^*v*jeS>9}4Hq{)wCp+8=iQolZ>KGdI|hexsBGJkd2+-7IV)Nu3!I4GXWpPi9H z0hlOI)DAhz9=L=}xP6k%cxrJVtK3j&1T&yz|?Zd38tWD+>!{wWEf@`y{OQ5+V-gNN#Y<{Go`uHgWbEh}G|nG7oYGW2*x2`=x96#?U3d;t z|8Eih!Q#t4XBSu}?k8ulP29W2QJNYRyBo&=o0V71!CT2D6Z<<0`Klk)tW}VLFJ39+ zEEAiRPmSd0&$6+%b;mJ@`-WpZMls<%J6M*sFIzDncOYcfS1FcaDbd-BdBcvwO+zy5 zsAbl>a0s)^HI)3R&|ah?C&7*OkM4s7?EiM`q35g8PWQ0=w=*F6ncVMfB@E5a&+byc z!ze46bIOJJ?Zq%EifGC;b>UYmySJ_VL%qBBqO?f2;Yz{29-1>b-#v!JUae`TliDlH z^@2I?;-=59PJD`<+tvJ4%SQI~>@NJW+%@T?6-J$vKWx}UrLvkB-OXg`_qDE@`?lF{ z!1A+f{}Vp*t_G8SpW0pDju~e^iK4_aGBZ7t>aN^hmus4|kj_D06f$8}Vd=biWH-RB zM`|W(-;QXVo;}~|`t;Cd+jE?>84**wIe$VQS)7fOc2?OltQuWV?-O9dzGs~B=j}~w zlM)}Fja#^%4R_-6KbLcdR=Kmbt}IuO=bO82GRL3mS}JO4(yVf6{i^++I&Nx&X>GU2Q6Fbw=mB)pft79D{vuPg60jHPC}Q1 zEQJe|f)JO$*b}?@n@j|b0D(_T+yK6e@b_n45P>Itt&+T1Xyt=dYiIyQa2wd7F~@&s z)-;z5$pdj8z}0|`7ELVACqPe@St4PWi?y0d1|(25dZ0~7*b zYP+k#Pw{TO_r3SyuMZEuLf%0NDfUlmrP$>1PX)sy_97u+eRy~{JiOP;&84KI9*#CO z4(<}XK@mCg`RX4mwyL~k4;r^%EPNPU^$pJylR2{HfT%DXrgB@0-RU|1e599agYWJq zsiR0Ea)kpsDl2Q-KY$F8&%qio3J|e&Yi?5X6Yn z1RpGOK=3)jLId08xyG)kx!RjiP5v~?b&U#u3qE-GVFh3p{EH(T@OpY9>Kjh`+Jdx7 zAnTpCiUzF{D3U?@ZiS~M<^uN^cO^`*#3KkRPv^F6+Z3ymE?uI;-WV)E#~B!e!Yjia zIu<4>{q6aj_S3nu$}{JuYOTKDGsUNlJawV``}fBzy8wsPx6Tl@$A^s zNi-x7g>Z6`Q3lKa*}iaK`(+(P4t^QOL^UpMZt3HNW``k=E3c?fEKdtxY(5ci-ZZ3E zu+3+^@^Vhny}wz5%YVo zS7fe6wTap6WyI^g@5z}A8$Hf9oWCHNpD)(Tit^L11G)+q=m(2x;fJvicI%+-l>lnS zZ2NmNp?L^ZKRt8@&0oY-NYhvr|2%{W+MV>;Qr^27{~P47`ZsT^BEx?}$Mx5j32Yx$ z?>Cz~Nk@4rU-fvCzQ6YH&Bm_Ibkeh5{_N7N!h=d@xF;`-+496yzLZQ;&LNq(^Jlwg z-ZT#6)+vM)rt2JLGD-?gWWje(A2Q^yHbG+#HIgKSYbv_TPxnO7DTOo<)-T4 zrq~mCftr;)sItf2;8r5FrNM_vw}|G?sSH1U>{6z;tu$;l((_S%AJY3#TSWtfu2}N(X#g(df3$%^J_W%67z*ed2}JkeB3z1KHgJR28)n*%J;NfKT~Keoe;#qKXrnW^Xm6y+#xL- zIe1s>?9^9t1+%+&V3!v}0X2*8831?K*X!cJ(Q~xX0R$o`cOckM7`ZvTe0)|>K#Fux zTib_J#$fkh>$R*Op91nAL4YWSM4o}|z4#{Bp?sh`q^Q5Qxu9EkSlqyX1HA-+t-)$R zF!=mA>z0P1UpLy?itdpXjHuj*=wl7dE_ngV1Ry(5u3fa&9>|YiL1)|X7{fehLd8t2 ztT}&k6O-SM*&Da~e~VW9LPK+#L-LIOC*?|);=pP&J@BL)u0DAWV4TL#nB3C1-1Mho z1PrAZqPfwoggNy$VM81SQsDkk7YnKkTZw>`E?`Y1MzPVz#| zl|stPci-57-Ieb z|G4rmQhhf(x7n<7J$q(0dSb|=%(7lYN1tZWmY07mS-6We_hAOg+k7EA7I3^-bT!O1 zG^ob(?;9EE18x&=`M!HBCK`t$<-MXUk=+=yu=Q9=iw2R|3fHe+Kd07e zmeq7@uA3uN4A=*1IyR>M{27*}g?7}Vg13?F2yUv6_vl|DR+B1pAgTe=$2ge9Bu_pH)R>v ztT7U*^I&cWw$?j(`uk~zuaz>5e1mddr8ZY?$!hX~u%+`Vrwq9N^1m_^ZXuo%8?!k_ zn_g;gPRS3gzH#b>!Vvw9j+P2x%H%>DDzish`h*0P`_m-r^Zn*H3x#iVXl;YI5!!Zh38tnSpT9UUki+gJTUjsH~N zp5s>qauTAF*sJfWwMs;su>Az^$I4@%!#cNCWOPH$Wj>;u?7WrqMU(?)m_1=s0^~&8 zN%aN0Bc-OcgW2Ja_{qrzy|+k&hgRopbI4hgNE2@O76|E%xpw4x%n@4-`>yB+^UETIzKSL;I=7rN+Ek|fleRS6p5B2WZuPak*?cv3s zvu)vUy7)ju!?ETF_l;XLu5(cBu~r&jr{Eaalc}_AiPoOidh1)(WwzGp^YDdl`_mhb z1?YVYHn=ylaCYyoyg>VQkG3J+Z>x`#o>o=Le6q^4w`a;ZgJO+wQo^fOZMi4XINeY0 z!A1ydnZru?#B+PhOfsCTt(Dg@_XP$9KEvRLz_@)}fh8RPM7U)VteRL`f~EiPCfuP? z9=>XQt1S_*!%#T8MWazOETkS5(xUSCG^@$KEYTQst=ItrFdVMqxL<8mbnw z^h$v2-dgs4^AMVZ2h_;hx1>WH!#}!-i0FTHyaF{?K zM#CcV2pB5S6i$zHAmOsfF+0~ED$L|$K1*wB?EZ|(&u7B_>~GPO5QzqnWq`nZm5`AB zvzuh^Eh1gzRkTml^^aPmG=jc=kb%_g| z#QH%5y7C$h>t8r^1aG!eij26+5j_Xb4;yq?w+A!o|GZz%-*$hS*1IP2LN6#d-ehF_ zf*|C>s!b;eQf&S`i#=5QB=bXTIvXAvk9kvwu3B;BZ*XSM-@LiB+N?I@8&yg|g5ruA zAaLoW`UQ8Do`#1@o@Ca(S#ZAVY>W&FxQ2ik-p?!{g!Mq0u-X{;LBx%HdJm2#C^h1D zL7xZLsK`z)5_pqFNtY?nB>{aBhzE43Xio9)DG5*z*l?;7br>SNbwfip1g%ZP3?)jt z*cQ5wTmctoP$W)J1IJw6N)a|NhFtsiOX3EHhFe}q>3&+;p}>%kgtXrV!mJu7pO;ot z1M32n7nBqp87YN8zZKuCPB4Si1I-NT60jJ0fAsbcS06d}jdd{#%0TFaUN;RwZnsY` zXS@uR9C{Q0x_DgX+lJ#FU*Yw+TKLF!{H(?a;2S_Wwr_YjEz;w}*JZHBPxYoq?Dy>V z-ICRwa*rwvKfoo5C-7I8TM%DZhQ*{%D=LT>Cyngb@uIH&YoY1Xo~Lw>7!jci)jjSR z5UOBP4GJM*+T&O1QSfT~;ES(4PpvD=vJyn1fjKmrJ*+gmhYvpdl5dI`<`w{7AD=dk zL_fwb+3u~2x~@OfdvXpo_9c}m)Kw@S1-0`%WtQ0$LimQODmr*6?WSCb)S#$yL~eG2Q3(x zzU-s*9JnxuXa^#_?Tws@n)_nEyZ@!0l;lbeW4~g}Vb*Flo$c}7zO&HoymYvn9o1%YgNIw z?VEk6LJtK4)xy8$r3fxkw^LB=HkNvCLR)fxq7)kdZjOJwN44tM!1g-~xvO_`a0%ZD z-2J}Gu~OiI$@6FHqde*La~!QW&x{qg`ZkMa7BwUV+ldX-2DjIQb2n1yXb&qaC2G{# zhT_Dj^sBN?%G@97sNAITsWpv*anAbioa$i0lm(t$Vx`@jM*neT(K9Tu6@j6>a?PI) zzS*C957#=nAb;x6a}bh(E$9BK=%~H$*m9Zv%h**LJV;$30894>LV9)ou1Cj-tz!G+ zUO)Do!L8ZhePZa{U{-7LC|c;VPa?rzum>TW4S51ewFzj<={EBE1}j3BvuQ>Xi`p3HA!7UC1kg zZqm}q>UnxPJ=9|8r;*j#ka@Eu{9RVzg6VSN@aNCxe>gh*xyRDxv)JRqTT(Yg=ORWy zs6j6r6F;r$HHk{(#{BdMQHgkxxFFD$ApicO>A1gsTOf;>tSk*IivKD*kP*aBv?4V% z(N!dzXq&dfX8ycCE43U(BoVXyyr6)2lgRXL(gB4DS$QlTv3EsrnHZAS?i-x;^YaT7 zi$CPVX=;-&=>Y2Uo}ylwV=lP*Ku%e^kqUx{l1DE5P5kqG};Ma zW-M#J$xt`uV;q2m7iQ{z(1IB7t0Wu=%R7L9V%kwV81WSPXJ8qDK|#*}iUb7(ad$$2 zj!)wb-HY%G_XrBts@$7G3cK_U=QN3dWV3tUI}bOeBqlx@dxA+i--(0_o*O%VHR)g= z=0*Y_96P4s#X^#(me+b3oUl5PV4Sp~e&TbUmidoM%E~W;-^89S{U~CPW4b@oU`WsK zd#k=^fN!M^+jv)+nqh*?mE=_d7THbX8&9{&IoWHnDZkN_Oi&v7YP7REsyW^`r~Im$ zNMh|({d>u#`^LVU)>9f%geD&+00q~H-F9(N+407C<&Hu2rV~4&X5#y^{WH{LY;GOh zUw(eF`cj98=A15DT~J`)K<{xs5aQfuYi`f>#*VZ?mqV6*z{})8JYCZyUJZSNLUjmk z>Ew>atC7XSFmbhmyq&H_ieaECv7z9Orj?kaf~3x?j>z2pekE;H<14ZJeqpElB72u0 zmrWB^#-`PlngS&Q0wt7CUTn%y^wTQg43OUPX0@2dizf}MDY&a-C@>TUb{H*>7)ni+ z-Sjtatn_VXU;XpO-IdS6qVMzuKQ zpAFjhK|bIODm!4L??VYE+MiBsIbmq!*kxQl$b{PHSu>`fBGb$_k={TF723d^hK+G^ zF^d9IY#%QwSNX;1?YZ&7EFecQ?0k$!pim8DGbKuKGR4o8`YhrUi+?HYQt8~qaE2hX z?hQhzD!QwRz1>Y2=JpCG4n$H5x@iU$csI!8%dt78nn(&$sIEKeHh5^gNYBE$^egw& zY6!gaK!@V(*H+qG9)X&lQ@imN?9gTWs9dUG;+D*TqCfCi4^S++m< z=q;P}=&9?{M=!ApoEh)~%jWH-Nf*jCdD?qR(+g+j)q2!d_H#YuqxGzvB_x*%Rg&wR z3VlzOdi9n4uF+DPwrB0oeMcwH7cO?g)^;Xy?YI5>{IS$?p#jwNp#d{YD&pcUF$Zqi z+S;CLjF0$XGTye@Kg6!yL3_eV*(wbuI{MV>*LyvNb+xYYSvajBG74c#;<#{tTsZP; z+@p>wS(hG-;C+=9dY1npp5zrGq z(8xQX;agXiA;iL5C+vE@JikCMdRa^B6Iu9k=FFv?%*?Xf{o+ZuCN82Ad+>k?x&+8M zWIGX1Korin<*P#X*gpk+5+>@*O!`*{=3sk)YXhX?&FMcnXiH(_+XC7NIj+q^70rkL zhpO6k;tU1qEAjG^^!AwMZgS6j*d+RBW@d(=^?rUi$|MPNS;1d0y+;JwPufYKuDqIB zc5{fN^+A-9>6E2e{*z;$4=?A(fCa^fd(`~Pfeplw_+Jvdp`3m`$UUIdYtQbE_&~T4 zWUH>C5c%V>sf}o1iT-Y&A=Px=P@fa)SZg0g+H!Zez>vy4c1f7oXXnykeghNVg_Uq{ z>E*k`$G&_Sn37hd?h^lvY$Wbni|hnpp*Yb7Tp{@$f}tKxEldd9z60J{I^sWEP#vIFl2uL_|G9t8fV ztmMw+6=H*YVsIpZh^vAA-pc+jeB=MXiP4JVfxsyNsDS`~;FHkGPgBzR)!2L#*8V-U zPNBNu=QgI9B{%Jd1%XSKaaoUMXsD}8z-!#Eq0gK^m6jg6D{HUubK|b$+J~Q`3*-8C ztLt>8zR&hNQWz*2t%{%X!x$X;3fN|2@q4M7jYoob} zwoN?q?4l@~6;Q)($laXI78tauQoTvQuF#|^m3d7>?U!)N&z;!WW7hPjIx2l1t9~p! zHKp(Qz0fgUY89Vd+x~@T4tG{(H0Q#`n~Pgw+h9DJJ!Z(+cHVE1BxQO#e(R>~*6h7{ zwpA?bcBOYw`!tViK3|AT_^Da)Crna(Q}MfbG}WLzk8e_LR#12BqlkwleJIzY?5CgO zsV5Nd-}XsR^QD_3y#~jmoXO(`Nyo7BpW35`Sp~kF%-q{u;}hg)@W`7qv8x_|U(PGn5daA8LEuDOME}@=!QmURZKs z3J)*u&+*}9AJi7ehagW=YSUc%o`)Ef(PvWJ!6<}+8AI6;bV*aw3sGMm4AV`=j_r9j zk(z)=5;F3GoH9BtC`jFAr!nx(Wfidz0{MUwKEX$HQLtb%DCNe6P?NO;;e)5;&*#I{ZP*Mz zh5@v>@GB!?E%|P(^8co}2EI)GUWi$j!4g~_lf$h(Ygim;36^+s^tZJ4Mp_vFtP!{N3k$GCLF#6B6`jIVDQ>yD(on7W$hkx$yL6zGRc3PxFpv z#jD;DbZ?Nw<1SqA`q6bmFcT|I(lT&p#5|#+ri7w9cGmna8d0tczjqriy{6KpafL@xc)#5md2Cv%gJ$>qux$#-2Bta?w_kfz> z2QR|t^eIW^+__7+5Z#>4kYOLT&Q)s0rdA+LU?JYyhP(PQ5iTaeVN}`yuC5PlZM$*X zk2L7{`~q%$1XpQca|k(Z^e+(Ndpw5!`HL5;oR_AY@pYp4Bgc?FW0_jj-YA-X4k4oI zIJEXsFmU=t&ZZ87_qQ@j_4USXWtcK%Y@(1=;BXyKwdCBq`{;ojt?s^nd8;+Mg-eqf zcbv9~*tUj}f_oxY@G*tF_Zj8-C>FgIb2i#FbZrm5`|pT-&5hon`^( zc!c|4fJjh~USaF-8s8r*6|NJ4(=wuE13mniru(Iw^Q$3S)Ynt(cdR_apPq5dI6uMf z$~xo0fHDP^4{Z88Uza$ISF@)6Ft@W48f>_Kyv)B6hleR~r~YNg0YSb1Y|1ecsUBqG@74kiXPpqIRftyI7<6!G%+DWh zxhyJuAjfh=2xQ1gqL%4}A+=M|A;kH}GH+PGvg#~p7Bn70-ncf5N4gH>G|pCmmkL(H#SBs2Tn8{1oF} zn#g6XT!3zWWv2FUMgOE$))+DPvvg0=rBR^~7Ia=b2?mi=e~a!aENuio)&A$#2iWdU z!LRPkA`12kBxY{x+W*^rFRp!jJw)GsV)z}`IxluRM_5Oa5WTnk$+<+V^3!Q%ngus*t-EVCJ5m288AOqt>@&#j2md~4+4`}FbYAK zo@P{C1&$CpRJ_W9mOZq1OF-um#kDr%cyNYG!1O5_DdJVaZ2w4)n%#JODqgt)K74pb zxtuSwoe`Cs<+9V39EI$roYN12qoZJ6abZ8T_q(7q|J@2q1|lb~Y=7|do=#P4sOJY; zh-K3zU<2B6Sr{UJtR%{#yo`vQc!cTDqDKQXm*9xpozAQ9jHBFR+XiAjw$Rot!*T#e zV-qd1FB4lMZwbAGH4RbQV^w_J1;iiC{8hPdF{pp74qQl@ec9Em zRRX#b&Kf*GBIm)l4=fzL-rsV+bj*=u;j!0Kektlkp~N==wb=VZ=bJO#g$rM40%DR= zxw{V=8xO7iwvdwE%NaU0x*_R-QtPn*ha6L=lB9aK;yq^~ybUp5kzGj$@y+nuL3c*JcDzVY4AyOlh1SbrrShRxLqDJzflU89Kirh3+=O~LKG;hk4oKgFf+ zjXxjDZxX8=rnuC+zo+V;UHJYnz!X=MGXdd2sFNJ$yZK>e%M@+K_$>HPDyRUm#f0z6x?o}>#?5f#1 z{AcH0TsxA}F0ALRw=K$K@hbw@P_CHMS(Tj4UNJq-NrE;?%)1ucsbETb}JCy@mOBvk6tHV*lxeEP<+ zP_Yu7mfuQcIBiI<6c!}5=b(coW)|H^eC3>jN=w{20L}Z9l$E2RqE-^jnTO{Tu3$7P zmjgIDBJ>CDJqVexchA#!}G3!vj%(I zF*OHWvs+P7QQ)&IU_PKQ>F~$=sP7nwrp$)&K|#9CFI*aT1QfkC=c|IvvO=9S>Z0u`O(=wRS)7WHrIiDNP`5!SrZmnTd5S0e+AS0omUT!Anq+LLz=caF+sS~bvSr`{mQC=SC#L22}Da} zexd7KZ>gT_#ur7|gdzw`q~*!%)zetIux%rwE%rW%ArAs7k*7zatX>!=4{il0gm