From 406ab7be7e73c93e35524621c3324430e0123560 Mon Sep 17 00:00:00 2001 From: Stefan Junker Date: Wed, 30 Dec 2020 09:10:30 +0100 Subject: [PATCH] run most containers and back them up at home * switch backup from wasabi-s3 to btrfs via ssh * add srv0 at home * run webserver and syncthing at home --- nix/os/containers/backup.nix | 148 +++++------------- nix/os/containers/syncthing.nix | 6 + .../srv0.home-ch.stefanjunker.de/boot.nix | 8 + .../configuration.nix | 15 ++ .../srv0.home-ch.stefanjunker.de/hw.nix | 31 ++++ .../srv0.home-ch.stefanjunker.de/pkg.nix | 53 +++++++ .../srv0.home-ch.stefanjunker.de/system.nix | 93 +++++++++++ .../srv0.home-ch.stefanjunker.de/versions.nix | 37 +++++ .../versions.tmpl.nix | 37 +++++ .../vmd32387.contaboserver.net/system.nix | 18 +-- nix/variables/passwords.crypt.nix | Bin 885 -> 1031 bytes services/home-ch/router-wan.lan/Justfile | 7 +- 12 files changed, 330 insertions(+), 123 deletions(-) create mode 100644 nix/os/devices/srv0.home-ch.stefanjunker.de/boot.nix create mode 100644 nix/os/devices/srv0.home-ch.stefanjunker.de/configuration.nix create mode 100644 nix/os/devices/srv0.home-ch.stefanjunker.de/hw.nix create mode 100644 nix/os/devices/srv0.home-ch.stefanjunker.de/pkg.nix create mode 100644 nix/os/devices/srv0.home-ch.stefanjunker.de/system.nix create mode 100644 nix/os/devices/srv0.home-ch.stefanjunker.de/versions.nix create mode 100644 nix/os/devices/srv0.home-ch.stefanjunker.de/versions.tmpl.nix diff --git a/nix/os/containers/backup.nix b/nix/os/containers/backup.nix index 6ade22f..3ac35d9 100644 --- a/nix/os/containers/backup.nix +++ b/nix/os/containers/backup.nix @@ -1,70 +1,13 @@ { config , hostAddress , localAddress +, subvolumes +, targetPathSuffix ? "" }: let - unstablepkgs = import { config = config.nixpkgs.config; }; - passwords = import ../../variables/passwords.crypt.nix; - bucket = "bkp"; - subvolumeParentDir = "/var/lib"; - - subvolumeDir = "/var/lib/container-volumes"; - subvolumeSnapshot = "/var/lib/container-volumes.snapshot"; - - bkpSource = subvolumeSnapshot; - bkpDestination = "/container/backup"; - cacheDir = "/var/lib/rclone-cachedir"; - - wasabiRc = pkgs: pkgs.writeText "rc" '' - [wasabi-${bucket}] - type = s3 - provider = Wasabi - env_auth = false - - #bkp user - access_key_id = ${passwords.storage.wasabi.bkp.key} - secret_access_key = ${passwords.storage.wasabi.bkp.secret} - - region = us-east-1 - endpoint = s3.wasabisys.com - location_constraint = - acl = - server_side_encryption = - storage_class = - ''; - - - bkp-mount-rclone-manual = pkgs: { - enable = true; - description = "bkp-mount-rclone-manual service"; - path = with pkgs; [ unstablepkgs.rclone utillinux ]; - serviceConfig = { - Type = "notify"; - }; - script = '' - export PATH="$PATH:/run/wrappers/bin" - exec rclone --config ${wasabiRc pkgs} mount wasabi-${bucket}:${bucket} ${bkpDestination} \ - --stats=50m --stats-log-level=NOTICE \ - --cache-dir=${cacheDir} \ - --vfs-cache-mode=full - - ''; - preStart = '' - mkdir -p ${bkpDestination} - mkdir -p ${cacheDir} - ''; - postStop = '' - sync - umount ${bkpDestination} \ - || umount -l ${bkpDestination} \ - || : - - rmdir ${bkpDestination} - ''; - }; - + subvolumeParentDir = "/var/lib/container-volumes"; in { config = { pkgs, ... }: { @@ -74,18 +17,14 @@ in { environment.systemPackages = with pkgs; [ btrfs-progs - rdup rdedup - iptraf-ng nethogs - rclone + btrbk ]; networking.firewall.enable = true; - systemd.services."bkp-mount-rclone-manual" = bkp-mount-rclone-manual pkgs; - - systemd.services."bkp-sync-rclone" = { + systemd.services."bkp-sync" = { enable = true; - description = "bkp-sync-rclone service"; + description = "bkp-sync service"; serviceConfig = { Type = "oneshot"; @@ -99,14 +38,10 @@ in { "bkp-run.service" ]; - path = with pkgs; [ unstablepkgs.rclone utillinux ]; + path = with pkgs; [ utillinux ]; script = '' set -x - echo Starting rclone sync... - rclone --config ${wasabiRc pkgs} sync \ - ${bkpDestination}/rdedup/ wasabi-${bucket}:${bucket}/rdedup/ \ - --stats=50m --stats-log-level=WARNING - echo Finished rclone sync... + true ''; }; @@ -119,41 +54,35 @@ in { }; partOf = [ - "bkp-sync-rclone.service" + "bkp-sync.service" ]; - path = with pkgs; [ btrfs-progs rdup rdedup coreutils ]; - preStart = '' - echo Creating new btrfs snapshot of ${subvolumeDir} at ${subvolumeSnapshot} - btrfs subvolume snapshot -r ${subvolumeDir} ${subvolumeSnapshot} - ''; - script = '' + path = with pkgs; [ btrfs-progs btrbk coreutils ]; + + script = let + bktrbkConf = pkgs.writeText "cfg" '' + timestamp_format long + ssh_identity ${passwords.storage.homeChBackup.keyPath} + ssh_user ${passwords.storage.homeChBackup.user} + ssh_compression no + backend_remote btrfs-progs-sudo + compat_remote busybox + btrfs_commit_delete each + snapshot_create onchange + snapshot_preserve_min latest + snapshot_preserve 7d 4w + target_preserve_min no + target_preserve 7d 4w 12m *y + + volume ${subvolumeParentDir} + target ${passwords.storage.homeChBackup.target}/container-volumes/${targetPathSuffix} + ${builtins.foldl' (sum: elem: sum + " subvolume " + elem + "\n") "" subvolumes} + ''; + in '' #! ${pkgs.bash}/bin/bash set -Eeuxo pipefail - export RUST_BACKTRACE=1 - export TIMESTAMP=$(date +"%Y%m%d.%H%M%S") - - echo Starting rdup/rdedup backup... - for d in `ls -1 ${bkpSource}`; do - echo Determining backup source size ${bkpSource}/$d... - du -hs ${bkpSource}/$d - rdup -x /dev/null ${bkpSource}/$d | rdedup -v -ttt --dir=${bkpDestination}/rdedup store $d-''${TIMESTAMP} - done - sync - echo Finished rdup/rdedup backup... - - echo Removing all previous backups... - rdedup --dir=${bkpDestination}/rdedup list | grep -v ''${TIMESTAMP} | xargs echo rdedup --dir=${bkpDestination}/rdedup remove - - echo Running rdedup garbage-collector... - time rdedup -v -ttt --dir=${bkpDestination}/rdedup gc - - echo Determining backup destination size ${bkpDestination}/rdedup... - du -hs ${bkpDestination}/rdedup - ''; - postStop = '' - btrfs subvolume delete ${subvolumeSnapshot} + btrbk -c ${bktrbkConf} --progress ''${@:-run} ''; }; @@ -164,9 +93,9 @@ in { timerConfig = { # Obtained using `systemd-analyze calendar "Wed 23:00"` # OnCalendar = "Wed *-*-* 23:00:00"; - OnStartupSec="2d"; - Unit = "bkp-sync-rclone.service"; - OnUnitInactiveSec="2d"; + OnStartupSec="1m"; + Unit = "bkp-sync.service"; + OnUnitInactiveSec="2h"; Persistent="true"; }; }; @@ -176,10 +105,15 @@ in { bindMounts = { "${subvolumeParentDir}" = { - hostPath = "/var/lib/"; + hostPath = subvolumeParentDir; isReadOnly = false; }; + "/etc/secrets/" = { + hostPath = "/var/lib/container-volumes/backup/etc-secrets"; + isReadOnly = true; + }; + "/dev/fuse" = { hostPath = "/dev/fuse"; isReadOnly = false; diff --git a/nix/os/containers/syncthing.nix b/nix/os/containers/syncthing.nix index 9ab498a..c9d8eaf 100644 --- a/nix/os/containers/syncthing.nix +++ b/nix/os/containers/syncthing.nix @@ -1,6 +1,7 @@ { hostAddress , localAddress , syncthingPort ? 22000 +, syncthingLocalAnnouncePort ? 21027 }: { @@ -39,6 +40,11 @@ hostPort = syncthingPort; protocol = "tcp"; } + { + containerPort = 21027; + hostPort = syncthingLocalAnnouncePort; + protocol = "tcp"; + } ]; inherit hostAddress localAddress; diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/boot.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/boot.nix new file mode 100644 index 0000000..cd4c05f --- /dev/null +++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/boot.nix @@ -0,0 +1,8 @@ +{ lib +, ... +}: + +{ + boot.loader.grub.efiSupport = true; + boot.extraModulePackages = [ ]; +} diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/configuration.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/configuration.nix new file mode 100644 index 0000000..b681c06 --- /dev/null +++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/configuration.nix @@ -0,0 +1,15 @@ +{ ... }: + +{ + disabledModules = [ + ]; + imports = [ + ../../profiles/common/configuration.nix + ../../modules/opinionatedDisk.nix + + ./system.nix + ./hw.nix + ./pkg.nix + ./boot.nix + ]; +} diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/hw.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/hw.nix new file mode 100644 index 0000000..4714d6e --- /dev/null +++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/hw.nix @@ -0,0 +1,31 @@ +{ ... }: + +let + stage1Modules = [ + "aesni_intel" + "kvm-intel" + "aes_x86_64" + + "virtio_balloon" + "virtio_scsi" + "virtio_net" + "virtio_pci" + "virtio_ring" + "virtio" + "scsi_mod" + ]; + +in +{ + # TASK: new device + hardware.opinionatedDisk = { + enable = true; + encrypted = false; + diskId = "ata-Crucial_CT750MX300SSD1_16161311C7A6"; + }; + + boot.initrd.availableKernelModules = stage1Modules; + boot.initrd.kernelModules = stage1Modules; + boot.extraModprobeConfig = '' + ''; +} diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/pkg.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/pkg.nix new file mode 100644 index 0000000..68784f6 --- /dev/null +++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/pkg.nix @@ -0,0 +1,53 @@ +{ config +, pkgs +, lib +, ... +}: + +{ + nixpkgs.config.packageOverrides = pkgs: with pkgs; { + nixPath = (import ../../../default.nix { versionsPath = ./versions.nix; }).nixPath; + }; + home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix { inherit pkgs; }; + + nix.buildMachines = [ + { hostName = "localhost"; + system = "x86_64-linux"; + supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"]; + maxJobs = 4; + } + ]; + + # services.hydra = { + # enable = false; + # hydraURL = "http://localhost:3000"; # externally visible URL + # notificationSender = "hydra@${config.networking.hostName}.stefanjunker.de"; # e-mail of hydra service + # # a standalone hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/machines + # buildMachinesFiles = []; + # # you will probably also want, otherwise *everything* will be built from scratch + # useSubstitutes = true; + # }; + + # services.gitlab-runner = { + # enable = false; + + # extraPackages = with pkgs; [ + # bash + # gitlab-runner + # nix + # gitFull + # git-crypt + # ]; + + # concurrent = 2; + # checkInterval = 0; + # services = { + # nixRunner = { + # executor = "shell"; + # runUntagged = true; + # registrationConfigFile = "/etc/secrets/gitlab-runner/nix-runner.registration"; + # tagList = [ "nix" ]; + # }; + # }; + # }; +} diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/system.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/system.nix new file mode 100644 index 0000000..a74e612 --- /dev/null +++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/system.nix @@ -0,0 +1,93 @@ +{ pkgs +, lib +, config +, ... }: + +let + keys = import ../../../variables/keys.nix; + +in { + # TASK: new device + networking.hostName = "srv0"; # Define your hostname. + # networking.domain = "home-ch.stefanjunker.de"; + + networking.firewall.enable = true; + networking.firewall.allowedTCPPorts = [ + # iperf3 + 5201 + ]; + networking.firewall.logRefusedConnections = false; + + networking.usePredictableInterfaceNames = false; + networking.dhcpcd = { + enable = true; + persistent = true; + }; + + networking.interfaces.eth0 = { + useDHCP = true; + # ipv6.addresses = [ + # { address = "2a02:c207:3003:2387::1"; prefixLength = 64; } + # ]; + }; + + # networking.defaultGateway6 = { + # address = "fe80::1"; + # interface = "eth0"; + # }; + + networking.nat = { + enable = true; + internalInterfaces = [ "ve-+" ]; + externalInterface = "eth0"; + }; + + # Kubernetes + # services.kubernetes.roles = ["master" "node"]; + + # virtualization + virtualisation = { + docker.enable = true; + }; + + nix.gc = { + automatic = true; + }; + + networking.useHostResolvConf = true; + + containers = { + webserver = import ../../containers/webserver.nix { + hostAddress = "192.168.100.12"; + localAddress = "192.168.100.13"; + + httpsPort = 443; + }; + + syncthing = import ../../containers/syncthing.nix { + hostAddress = "192.168.100.14"; + localAddress = "192.168.100.15"; + + syncthingPort = 22000; + }; + + backup = import ../../containers/backup.nix { + inherit config; + hostAddress = "192.168.100.16"; + localAddress = "192.168.100.17"; + subvolumes = [ + "webserver" + "backup" + "syncthing" + ]; + }; + }; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "20.03"; # Did you read the comment? +} diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.nix new file mode 100644 index 0000000..519781a --- /dev/null +++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.nix @@ -0,0 +1,37 @@ +let + nixpkgs = { + url = "https://github.com/NixOS/nixpkgs/"; + ref = "nixos-20.09"; + rev = "51aaa3fa1b69559456f9bd4968bd5b179a784f67"; + }; +in + +{ + inherit nixpkgs; + "channels-nixos-stable" = nixpkgs; + "channels-nixos-20.03" = { + url = "https://github.com/NixOS/nixpkgs/"; + ref = "nixos-20.03"; + rev = "ff6fda61600cc60404bab5cb6b18b8636785b7bc"; + }; + "channels-nixos-19.09" = { + url = "https://github.com/NixOS/nixpkgs/"; + ref = "nixos-19.09"; + rev = "75f4ba05c63be3f147bcc2f7bd4ba1f029cedcb1"; + }; + "channels-nixos-unstable" = { + url = "https://github.com/NixOS/nixpkgs/"; + ref = "nixos-unstable"; + rev = "24c9b05ac53e422f1af81a156f1fd58499eb27fb"; + }; + "nixpkgs-master" = { + url = "https://github.com/NixOS/nixpkgs/"; + ref = "master"; + rev = "9b3e35d991ea6a43f256069dcb2e006006730d05"; + }; + "home-manager-module" = { + url = "https://github.com/nix-community/home-manager"; + ref = "release-20.09"; + rev = "7339784e07217ed0232e08d1ea33b610c94657d8"; + }; +} diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.tmpl.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.tmpl.nix new file mode 100644 index 0000000..a19cc09 --- /dev/null +++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.tmpl.nix @@ -0,0 +1,37 @@ +let + nixpkgs = { + url = "https://github.com/NixOS/nixpkgs/"; + ref = "nixos-20.09"; + rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-20.09 | awk '{ print $1 }' | tr -d '\n' -%>"; + }; +in + +{ + inherit nixpkgs; + "channels-nixos-stable" = nixpkgs; + "channels-nixos-20.03" = { + url = "https://github.com/NixOS/nixpkgs/"; + ref = "nixos-20.03"; + rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-20.03 | awk '{ print $1 }' | tr -d '\n' -%>"; + }; + "channels-nixos-19.09" = { + url = "https://github.com/NixOS/nixpkgs/"; + ref = "nixos-19.09"; + rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-19.09 | awk '{ print $1 }' | tr -d '\n' -%>"; + }; + "channels-nixos-unstable" = { + url = "https://github.com/NixOS/nixpkgs/"; + ref = "nixos-unstable"; + rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-unstable | awk '{ print $1 }' | tr -d '\n' -%>"; + }; + "nixpkgs-master" = { + url = "https://github.com/NixOS/nixpkgs/"; + ref = "master"; + rev = "<% git ls-remote https://github.com/NixOS/nixpkgs.git master | head -n1 | awk '{ print $1 }' | tr -d '\n' -%>"; + }; + "home-manager-module" = { + url = "https://github.com/nix-community/home-manager"; + ref = "release-20.09"; + rev = "<% git ls-remote https://github.com/nix-community/home-manager.git release-20.09 | awk '{ print $1 }' | tr -d '\n' -%>"; + }; +} diff --git a/nix/os/devices/vmd32387.contaboserver.net/system.nix b/nix/os/devices/vmd32387.contaboserver.net/system.nix index 2944e09..c25022a 100644 --- a/nix/os/devices/vmd32387.contaboserver.net/system.nix +++ b/nix/os/devices/vmd32387.contaboserver.net/system.nix @@ -114,24 +114,14 @@ in { sievePort = 4190; }; - webserver = import ../../containers/webserver.nix { - hostAddress = "192.168.100.12"; - localAddress = "192.168.100.13"; - - httpsPort = 443; - }; - - syncthing = import ../../containers/syncthing.nix { - hostAddress = "192.168.100.14"; - localAddress = "192.168.100.15"; - - syncthingPort = 22000; - }; - backup = import ../../containers/backup.nix { inherit config; hostAddress = "192.168.100.16"; localAddress = "192.168.100.17"; + subvolumes = [ + "mailserver" + "backup" + ]; }; }; diff --git a/nix/variables/passwords.crypt.nix b/nix/variables/passwords.crypt.nix index 92f89d2bfc12e71b27ee2c02617dc3292635bb3d..98713c6e5605716f7be63bfe6928ad1e839d8d04 100644 GIT binary patch literal 1031 zcmZQ@_Y83kiVO&0xcY4K4yh7j%a%1^i!yJxu}|?cbbIAsv+?_C)rMPNPE7r?42I_Z1EQO}93LKouJmpuHuv3&mH%=kS~t9m3lmNr+_1q(ik z$_c6Q=hj-55Vm~QwZCkF^RK(L&-M`(?DAFP?3W3-Ryeyafra$ z&4I>$b2H_pu{ksU$|?9~-jdEHe<7L6O!C$p-n$mx7b(;nvv2;X>hnQ-3HRMwS6geH z>>|qBcJT#N-(7XdRyFPV!j&xsRXZi@a=TAeW}h&1&ey42*1T)=rti7MOGA4;I=ndk z$834c%L(#PE3SX7%xU^8eE#(GE4R!~v3|L+`i%5nCWk6ZDX%jgGd%(wGz6Ouy{bA} z892fG_6dXaS6dGqW=S>qV!8g;#PEF+d0H$tKKfayaD!>jw{U~L&-P!rbVC)yInOe<@y(t|9rp?5zev-J|LU(Nh@rFa^wG zaep{}>(ZM|jQ20IKdu%{Nv`~0{!6K5_u_|AWof79acI3{J+8a%ILB|3MK8l#R0N&l zJ#{+8l#cGXHh=5&E9+*Q-FoP7vSYDZdZ(_0hJx&$Y2Hs$FV-u1wcS2-h^=+Ssx8X@ zqgl?*H+ySTAmWg}t?S|&L0`tyLZ@w(Q+m}ViyfWUJn6sv)(a6{(Q~+rpDT*`av5Lg zO1N;{IL>r3`<~eS-pAz1Eq&!@E@F7fl%i94OgO|)igme|=IuuHdv7Hi-7-6uM-)$8 z_H)jXH)5Z<=83hPn4NWb%S_hPdhw*P-Di_J-H%jfsCoQqKK9TeNkqe>EQn?2kGt0v z2q%i!cgeF{IyLRqGp0r56Q?yUy0hSn*vhAC_h(lvTJpihaq-i?r#5C?QGdz9ayxcg zbk&3E)4q)QRq}Zsk1Cc`nM|tZ+N3w(`^;CGttC3k1#{17R!)2ILGFmt0>4+5k(%$$ z$a20}vF_n4$&>$Y=O*UtD17yKqS3*Oqv?mfti1fY)A+`6k9KbVr;6v;R#`QxB?seslEPJiDfYm6wjDPrdur?pL$e9M!8VdZlX%b39*E{yUrXuo?he CSOVq% literal 885 zcmZQ@_Y83kiVO&0xSx<;y21QlRPvFGuCwA>SWkV5xo~gVxz9Y`Z$_o7N<|zwd*RP< zSKm3BT!Eq&m*h`#-}(Dw-3ehOjoPi;uWxNUDfq|GY}$;j^1z7N;2TlAzr?s7d)Hs^ zF?01!WBV{UGa@H{wjuxNrPC9V91Im*UVM);mb}0AvqW^qXJI|=wPn0|42$l}b+wHu zvp9F~-HO$<0{nr8lJ`WIE$!&J!~LXk z&RPFC{4hI&_tiOGu^yRprAacs4Na1Jd_wX}cp@7*H@*0L!~eGF8rQ}uhM((~7SC;5 zlKNF${g#us_<6U;uXl|qWgiqCj{X%@TkE){Y2rrLG$+mjUHS(?MU@tPt!{hsv)0y0 zHpJbfcE%kquj)xxABpoA%H3PpcQVR%73-B_^LI~~e)48c=8OPCmxZUksl74tnba)0 zr_5pX%#7xVY4fZ*kL%ejSQxUUp56eG+k@C& zTC0xF{GPqzV@+ZFW>s~=Us7cT84aB7Tr2!}=knzi+<)}0Y?J-UZR-SbHa!hKmJ!A^ zL2qGJ%s=+tO2TSNp`h^|q@{%FLRzllP$4 zE0@AM7CEtZuD=(_jb~otE;Tdh^5c5@&pY2&PAwI)|JNSHvG|Ufpz{5zXH0i(%hVQY zbC=o~{cp|=IirXNpDvh8ZPVN>_iV+zQmOw1F_WVfMHfFXG5J%q=R-Q*bIG*CP)>`> z@jExInij<$CTS!ZZ5!p;XXvSavOCuB&q_tJ^-72NlpAarG`=`=w!PcmBs4wAae>6v z|JyE1Dt^oJ`&mxqnK=#hH&iC^+lJQ)v0qx-c6Z&{SJU;LTv#FR_EvYt?