From a110e2ea0f126ac5bed59dad6d30a76b12d29a0a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9?= <andre.peters@debinux.de>
Date: Sat, 21 Oct 2017 10:08:14 +0200
Subject: [PATCH] [ACME] Fix detection of orphaned SANs and add tini

---
 data/Dockerfiles/acme/Dockerfile           |   5 +-
 data/Dockerfiles/acme/docker-entrypoint.sh | 472 +++++++++++----------
 data/Dockerfiles/acme/tini                 | Bin 0 -> 19968 bytes
 3 files changed, 248 insertions(+), 229 deletions(-)
 create mode 100755 data/Dockerfiles/acme/tini

diff --git a/data/Dockerfiles/acme/Dockerfile b/data/Dockerfiles/acme/Dockerfile
index b3fd77fd..1554e6a8 100644
--- a/data/Dockerfiles/acme/Dockerfile
+++ b/data/Dockerfiles/acme/Dockerfile
@@ -9,8 +9,9 @@ RUN apk add --update --no-cache \
 	openssl \
 	bind-tools \
 	jq \
-	mariadb-client
+	mariadb-client \
+  tini
 
 COPY docker-entrypoint.sh /srv/docker-entrypoint.sh
 
-ENTRYPOINT ["/srv/docker-entrypoint.sh"]
+CMD ["/sbin/tini", "-g", "--", "/srv/docker-entrypoint.sh"]
diff --git a/data/Dockerfiles/acme/docker-entrypoint.sh b/data/Dockerfiles/acme/docker-entrypoint.sh
index 25023819..6d3d7273 100755
--- a/data/Dockerfiles/acme/docker-entrypoint.sh
+++ b/data/Dockerfiles/acme/docker-entrypoint.sh
@@ -8,26 +8,40 @@ SSL_EXAMPLE=/var/lib/ssl-example
 mkdir -p ${ACME_BASE}/acme/private
 
 restart_containers(){
-	for container in $*; do
-		echo "Restarting ${container}..."
-		curl -X POST http://dockerapi:8080/containers/${container}/restart
-	done
+  for container in $*; do
+    echo "Restarting ${container}..."
+    curl -X POST http://dockerapi:8080/containers/${container}/restart
+  done
 }
 
 log_f() {
-  echo "$(date) - ${1}"
+  if [[ ${2} == "no_nl" ]]; then
+    echo -n "$(date) - ${1}"
+  elif [[ ${2} == "no_date" ]]; then
+    echo "${1}"
+  else
+    echo "$(date) - ${1}"
+  fi
+}
+
+array_diff() {
+  # https://stackoverflow.com/questions/2312762, Alex Offshore
+  eval local ARR1=\(\"\${$2[@]}\"\)
+  eval local ARR2=\(\"\${$3[@]}\"\)
+  local IFS=$'\n'
+  mapfile -t $1 < <(comm -23 <(echo "${ARR1[*]}" | sort) <(echo "${ARR2[*]}" | sort))
 }
 
 verify_hash_match(){
-	CERT_HASH=$(openssl x509 -noout -modulus -in "${1}" | openssl md5)
-	KEY_HASH=$(openssl rsa -noout -modulus -in "${2}" | openssl md5)
-	if [[ ${CERT_HASH} != ${KEY_HASH} ]]; then
-		log_f "Certificate and key hashes do not match!"
-		return 1
-	else
-		log_f "Verified hashes."
-		return 0
-	fi
+  CERT_HASH=$(openssl x509 -noout -modulus -in "${1}" | openssl md5)
+  KEY_HASH=$(openssl rsa -noout -modulus -in "${2}" | openssl md5)
+  if [[ ${CERT_HASH} != ${KEY_HASH} ]]; then
+    log_f "Certificate and key hashes do not match!"
+    return 1
+  else
+    log_f "Verified hashes."
+    return 0
+  fi
 }
 
 get_ipv4(){
@@ -51,239 +65,243 @@ get_ipv4(){
 [[ ! -f ${ACME_BASE}/dhparams.pem ]] && cp ${SSL_EXAMPLE}/dhparams.pem ${ACME_BASE}/dhparams.pem
 
 if [[ -f ${ACME_BASE}/cert.pem ]] && [[ -f ${ACME_BASE}/key.pem ]]; then
-	ISSUER=$(openssl x509 -in ${ACME_BASE}/cert.pem -noout -issuer)
-	if [[ ${ISSUER} != *"Let's Encrypt"* && ${ISSUER} != *"mailcow"* ]]; then
-		log_f "Found certificate with issuer other than mailcow snake-oil CA and Let's Encrypt, skipping ACME client..."
-		sleep 3650d
-		exec $(readlink -f "$0")
-	else
-		declare -a SAN_ARRAY_NOW
-		SAN_NAMES=$(openssl x509 -noout -text -in ${ACME_BASE}/cert.pem | awk '/X509v3 Subject Alternative Name/ {getline;gsub(/ /, "", $0); print}' | tr -d "DNS:")
-		if [[ ! -z ${SAN_NAMES} ]]; then
-			IFS=',' read -a SAN_ARRAY_NOW <<< ${SAN_NAMES}
-			log_f "Found Let's Encrypt or mailcow snake-oil CA issued certificate with SANs: ${SAN_ARRAY_NOW[*]}"
-		fi
-	fi
+  ISSUER=$(openssl x509 -in ${ACME_BASE}/cert.pem -noout -issuer)
+  if [[ ${ISSUER} != *"Let's Encrypt"* && ${ISSUER} != *"mailcow"* ]]; then
+    log_f "Found certificate with issuer other than mailcow snake-oil CA and Let's Encrypt, skipping ACME client..."
+    sleep 3650d
+    exec $(readlink -f "$0")
+  else
+    declare -a SAN_ARRAY_NOW
+    SAN_NAMES=$(openssl x509 -noout -text -in ${ACME_BASE}/cert.pem | awk '/X509v3 Subject Alternative Name/ {getline;gsub(/ /, "", $0); print}' | tr -d "DNS:")
+    if [[ ! -z ${SAN_NAMES} ]]; then
+      IFS=',' read -a SAN_ARRAY_NOW <<< ${SAN_NAMES}
+      log_f "Found Let's Encrypt or mailcow snake-oil CA issued certificate with SANs: ${SAN_ARRAY_NOW[*]}"
+    fi
+  fi
 else
-	if [[ -f ${ACME_BASE}/acme/fullchain.pem ]] && [[ -f ${ACME_BASE}/acme/private/privkey.pem ]]; then
-		if verify_hash_match ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/acme/private/privkey.pem; then
-			log_f "Restoring previous acme certificate and restarting script..."
-			cp ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem
-			cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/key.pem
-			# Restarting with env var set to trigger a restart,
-			exec env TRIGGER_RESTART=1 $(readlink -f "$0")
-		fi
-	ISSUER="mailcow"
-	else
-		log_f "Restoring mailcow snake-oil certificates and restarting script..."
-		cp ${SSL_EXAMPLE}/cert.pem ${ACME_BASE}/cert.pem
-		cp ${SSL_EXAMPLE}/key.pem ${ACME_BASE}/key.pem
-		exec env TRIGGER_RESTART=1 $(readlink -f "$0")
-	fi
+  if [[ -f ${ACME_BASE}/acme/fullchain.pem ]] && [[ -f ${ACME_BASE}/acme/private/privkey.pem ]]; then
+    if verify_hash_match ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/acme/private/privkey.pem; then
+      log_f "Restoring previous acme certificate and restarting script..."
+      cp ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem
+      cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/key.pem
+      # Restarting with env var set to trigger a restart,
+      exec env TRIGGER_RESTART=1 $(readlink -f "$0")
+    fi
+  ISSUER="mailcow"
+  else
+    log_f "Restoring mailcow snake-oil certificates and restarting script..."
+    cp ${SSL_EXAMPLE}/cert.pem ${ACME_BASE}/cert.pem
+    cp ${SSL_EXAMPLE}/key.pem ${ACME_BASE}/key.pem
+    exec env TRIGGER_RESTART=1 $(readlink -f "$0")
+  fi
 fi
 
 while ! mysqladmin ping --host mysql -u${DBUSER} -p${DBPASS} --silent; do
-	echo "Waiting for database to come up..."
-	sleep 2
+  echo "Waiting for database to come up..."
+  sleep 2
 done
 
 while true; do
-	if [[ "${SKIP_LETS_ENCRYPT}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
-		log_f "SKIP_LETS_ENCRYPT=y, skipping Let's Encrypt..."
-		sleep 365d
-		exec $(readlink -f "$0")
-	fi
-	if [[ "${SKIP_IP_CHECK}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
-		SKIP_IP_CHECK=y
-	fi
-	unset SQL_DOMAIN_ARR
-	unset VALIDATED_CONFIG_DOMAINS
-	unset ADDITIONAL_VALIDATED_SAN
-	declare -a SQL_DOMAIN_ARR
-	declare -a VALIDATED_CONFIG_DOMAINS
-	declare -a ADDITIONAL_VALIDATED_SAN
-	IFS=',' read -r -a ADDITIONAL_SAN_ARR <<< "${ADDITIONAL_SAN}"
-	IPV4=$(get_ipv4)
-	# Container ids may have changed
-	CONTAINERS_RESTART=($(curl --silent http://dockerapi:8080/containers/json | jq -r '.[] | {name: .Config.Labels["com.docker.compose.service"], id: .Id}' | jq -rc 'select( .name | contains("nginx-mailcow") or contains("postfix-mailcow") or contains("dovecot-mailcow")) | .id' | tr "\n" " "))
+  if [[ "${SKIP_LETS_ENCRYPT}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+    log_f "SKIP_LETS_ENCRYPT=y, skipping Let's Encrypt..."
+    sleep 365d
+    exec $(readlink -f "$0")
+  fi
+  if [[ "${SKIP_IP_CHECK}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+    SKIP_IP_CHECK=y
+  fi
+  unset SQL_DOMAIN_ARR
+  unset VALIDATED_CONFIG_DOMAINS
+  unset ADDITIONAL_VALIDATED_SAN
+  declare -a SQL_DOMAIN_ARR
+  declare -a VALIDATED_CONFIG_DOMAINS
+  declare -a ADDITIONAL_VALIDATED_SAN
+  IFS=',' read -r -a ADDITIONAL_SAN_ARR <<< "${ADDITIONAL_SAN}"
+  IPV4=$(get_ipv4)
+  # Container ids may have changed
+  CONTAINERS_RESTART=($(curl --silent http://dockerapi:8080/containers/json | jq -r '.[] | {name: .Config.Labels["com.docker.compose.service"], id: .Id}' | jq -rc 'select( .name | tostring | contains("nginx-mailcow") or contains("postfix-mailcow") or contains("dovecot-mailcow")) | .id' | tr "\n" " "))
 
-	while read domain; do
-		SQL_DOMAIN_ARR+=("${domain}")
-	done < <(mysql -h mysql-mailcow -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain FROM domain WHERE backupmx=0" -Bs)
-	while read alias_domain; do
-		SQL_DOMAIN_ARR+=("${alias_domain}")
-	done < <(mysql -h mysql-mailcow -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT alias_domain FROM alias_domain" -Bs)
+  log_f "Waiting for domain tables... " no_nl
+  while [[ -z ${DOMAIN_TABLE} ]]; do
+    DOMAIN_TABLE=$(mysql -h mysql-mailcow -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SHOW TABLES LIKE 'domain'" -Bs)
+    [[ -z ${DOMAIN_TABLE} ]] && sleep 10
+  done
+  log_f "OK" no_date
 
-	for SQL_DOMAIN in "${SQL_DOMAIN_ARR[@]}"; do
-		A_CONFIG=$(dig A autoconfig.${SQL_DOMAIN} +short | tail -n 1)
-		if [[ ! -z ${A_CONFIG} ]]; then
-			log_f "Found A record for autoconfig.${SQL_DOMAIN}: ${A_CONFIG}"
-			if [[ ${IPV4:-ERR} == ${A_CONFIG} ]] || [[ ${SKIP_IP_CHECK} == "y" ]]; then
-				log_f "Confirmed A record autoconfig.${SQL_DOMAIN}"
-				VALIDATED_CONFIG_DOMAINS+=("autoconfig.${SQL_DOMAIN}")
-			else
-				log_f "Cannot match your IP ${IPV4} against hostname autoconfig.${SQL_DOMAIN} (${A_CONFIG})"
-			fi
-		else
-			log_f "No A record for autoconfig.${SQL_DOMAIN} found"
-		fi
+  while read domains; do
+    SQL_DOMAIN_ARR+=("${domains}")
+  done < <(mysql -h mysql-mailcow -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain FROM domain WHERE backupmx=0 UNION SELECT alias_domain FROM alias_domain" -Bs)
+
+  for SQL_DOMAIN in "${SQL_DOMAIN_ARR[@]}"; do
+    A_CONFIG=$(dig A autoconfig.${SQL_DOMAIN} +short | tail -n 1)
+    if [[ ! -z ${A_CONFIG} ]]; then
+      log_f "Found A record for autoconfig.${SQL_DOMAIN}: ${A_CONFIG}"
+      if [[ ${IPV4:-ERR} == ${A_CONFIG} ]] || [[ ${SKIP_IP_CHECK} == "y" ]]; then
+        log_f "Confirmed A record autoconfig.${SQL_DOMAIN}"
+        VALIDATED_CONFIG_DOMAINS+=("autoconfig.${SQL_DOMAIN}")
+      else
+        log_f "Cannot match your IP ${IPV4} against hostname autoconfig.${SQL_DOMAIN} (${A_CONFIG})"
+      fi
+    else
+      log_f "No A record for autoconfig.${SQL_DOMAIN} found"
+    fi
 
         A_DISCOVER=$(dig A autodiscover.${SQL_DOMAIN} +short | tail -n 1)
-		if [[ ! -z ${A_DISCOVER} ]]; then
-			log_f "Found A record for autodiscover.${SQL_DOMAIN}: ${A_DISCOVER}"
-			if [[ ${IPV4:-ERR} == ${A_DISCOVER} ]] || [[ ${SKIP_IP_CHECK} == "y" ]]; then
-				log_f "Confirmed A record autodiscover.${SQL_DOMAIN}"
-				VALIDATED_CONFIG_DOMAINS+=("autodiscover.${SQL_DOMAIN}")
-			else
-				log_f "Cannot match your IP ${IPV4} against hostname autodiscover.${SQL_DOMAIN} (${A_DISCOVER})"
-			fi
-		else
-			log_f "No A record for autodiscover.${SQL_DOMAIN} found"
-		fi
-	done
+    if [[ ! -z ${A_DISCOVER} ]]; then
+      log_f "Found A record for autodiscover.${SQL_DOMAIN}: ${A_DISCOVER}"
+      if [[ ${IPV4:-ERR} == ${A_DISCOVER} ]] || [[ ${SKIP_IP_CHECK} == "y" ]]; then
+        log_f "Confirmed A record autodiscover.${SQL_DOMAIN}"
+        VALIDATED_CONFIG_DOMAINS+=("autodiscover.${SQL_DOMAIN}")
+      else
+        log_f "Cannot match your IP ${IPV4} against hostname autodiscover.${SQL_DOMAIN} (${A_DISCOVER})"
+      fi
+    else
+      log_f "No A record for autodiscover.${SQL_DOMAIN} found"
+    fi
+  done
 
-	A_MAILCOW_HOSTNAME=$(dig A ${MAILCOW_HOSTNAME} +short | tail -n 1)
-	if [[ ! -z ${A_MAILCOW_HOSTNAME} ]]; then
-		log_f "Found A record for ${MAILCOW_HOSTNAME}: ${A_MAILCOW_HOSTNAME}"
-		if [[ ${IPV4:-ERR} == ${A_MAILCOW_HOSTNAME} ]] || [[ ${SKIP_IP_CHECK} == "y" ]]; then
-			log_f "Confirmed A record ${MAILCOW_HOSTNAME}"
-			VALIDATED_MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
-		else
-			log_f "Cannot match your IP ${IPV4} against hostname ${MAILCOW_HOSTNAME} (${A_MAILCOW_HOSTNAME}) "
-		fi
-	else
-		log_f "No A record for ${MAILCOW_HOSTNAME} found"
-	fi
+  A_MAILCOW_HOSTNAME=$(dig A ${MAILCOW_HOSTNAME} +short | tail -n 1)
+  if [[ ! -z ${A_MAILCOW_HOSTNAME} ]]; then
+    log_f "Found A record for ${MAILCOW_HOSTNAME}: ${A_MAILCOW_HOSTNAME}"
+    if [[ ${IPV4:-ERR} == ${A_MAILCOW_HOSTNAME} ]] || [[ ${SKIP_IP_CHECK} == "y" ]]; then
+      log_f "Confirmed A record ${MAILCOW_HOSTNAME}"
+      VALIDATED_MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
+    else
+      log_f "Cannot match your IP ${IPV4} against hostname ${MAILCOW_HOSTNAME} (${A_MAILCOW_HOSTNAME}) "
+    fi
+  else
+    log_f "No A record for ${MAILCOW_HOSTNAME} found"
+  fi
 
-	for SAN in "${ADDITIONAL_SAN_ARR[@]}"; do
-		if [[ ${SAN} == ${MAILCOW_HOSTNAME} ]]; then
-			continue
-		fi
-		A_SAN=$(dig A ${SAN} +short | tail -n 1)
-		if [[ ! -z ${A_SAN} ]]; then
-			log_f "Found A record for ${SAN}: ${A_SAN}"
-			if [[ ${IPV4:-ERR} == ${A_SAN} ]] || [[ ${SKIP_IP_CHECK} == "y" ]]; then
-				log_f "Confirmed A record ${SAN}"
-				ADDITIONAL_VALIDATED_SAN+=("${SAN}")
-			else
-				log_f "Cannot match your IP against hostname ${SAN}"
-			fi
-		else
-			log_f "No A record for ${SAN} found"
-		fi
-	done
+  for SAN in "${ADDITIONAL_SAN_ARR[@]}"; do
+    if [[ ${SAN} == ${MAILCOW_HOSTNAME} ]]; then
+      continue
+    fi
+    A_SAN=$(dig A ${SAN} +short | tail -n 1)
+    if [[ ! -z ${A_SAN} ]]; then
+      log_f "Found A record for ${SAN}: ${A_SAN}"
+      if [[ ${IPV4:-ERR} == ${A_SAN} ]] || [[ ${SKIP_IP_CHECK} == "y" ]]; then
+        log_f "Confirmed A record ${SAN}"
+        ADDITIONAL_VALIDATED_SAN+=("${SAN}")
+      else
+        log_f "Cannot match your IP against hostname ${SAN}"
+      fi
+    else
+      log_f "No A record for ${SAN} found"
+    fi
+  done
 
   # Unique elements
-	ALL_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${VALIDATED_CONFIG_DOMAINS[*]} ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
-	if [[ -z ${ALL_VALIDATED[*]} ]]; then
-		log_f "Cannot validate hostnames, skipping Let's Encrypt for 1 hour."
-		log_f "Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently."
-		sleep 1h
-		exec $(readlink -f "$0")
-	fi
+  ALL_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${VALIDATED_CONFIG_DOMAINS[*]} ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
+  if [[ -z ${ALL_VALIDATED[*]} ]]; then
+    log_f "Cannot validate hostnames, skipping Let's Encrypt for 1 hour."
+    log_f "Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently."
+    sleep 1h
+    exec $(readlink -f "$0")
+  fi
 
-	ORPHANED_SAN=($(echo ${SAN_ARRAY_NOW[*]} ${ALL_VALIDATED[*]} | tr ' ' '\n' | sort | uniq -u ))
-	if [[ ! -z ${ORPHANED_SAN[*]} ]] && [[ ${ISSUER} != *"mailcow"* ]]; then
-		DATE=$(date +%Y-%m-%d_%H_%M_%S)
-		log_f "Found orphaned SAN ${ORPHANED_SAN[*]} in certificate, moving old files to ${ACME_BASE}/acme/private/${DATE}.bak/, keeping key file..."
-		mkdir -p ${ACME_BASE}/acme/private/${DATE}.bak/
-		[[ -f ${ACME_BASE}/acme/private/account.key ]] && mv ${ACME_BASE}/acme/private/account.key ${ACME_BASE}/acme/private/${DATE}.bak/
-		[[ -f ${ACME_BASE}/acme/fullchain.pem ]] && mv ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/acme/private/${DATE}.bak/
-		[[ -f ${ACME_BASE}/acme/cert.pem ]] && mv ${ACME_BASE}/acme/cert.pem ${ACME_BASE}/acme/private/${DATE}.bak/
-		cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/acme/private/${DATE}.bak/ # Keep key for TLSA 3 1 1 records
-	fi
+  array_diff ORPHANED_SAN SAN_ARRAY_NOW ALL_VALIDATED
+  if [[ ! -z ${ORPHANED_SAN[*]} ]] && [[ ${ISSUER} != *"mailcow"* ]]; then
+    DATE=$(date +%Y-%m-%d_%H_%M_%S)
+    log_f "Found orphaned SAN ${ORPHANED_SAN[*]} in certificate, moving old files to ${ACME_BASE}/acme/private/${DATE}.bak/, keeping key file..."
+    mkdir -p ${ACME_BASE}/acme/private/${DATE}.bak/
+    [[ -f ${ACME_BASE}/acme/private/account.key ]] && mv ${ACME_BASE}/acme/private/account.key ${ACME_BASE}/acme/private/${DATE}.bak/
+    [[ -f ${ACME_BASE}/acme/fullchain.pem ]] && mv ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/acme/private/${DATE}.bak/
+    [[ -f ${ACME_BASE}/acme/cert.pem ]] && mv ${ACME_BASE}/acme/cert.pem ${ACME_BASE}/acme/private/${DATE}.bak/
+    cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/acme/private/${DATE}.bak/ # Keep key for TLSA 3 1 1 records
+  fi
 
-	ACME_RESPONSE=$(acme-client \
-		-v -e -b -N -n \
-		-f ${ACME_BASE}/acme/private/account.key \
-		-k ${ACME_BASE}/acme/private/privkey.pem \
-		-c ${ACME_BASE}/acme \
-		${ALL_VALIDATED[*]} 2>&1 | tee /dev/fd/5)
+  ACME_RESPONSE=$(acme-client \
+    -v -e -b -N -n \
+    -f ${ACME_BASE}/acme/private/account.key \
+    -k ${ACME_BASE}/acme/private/privkey.pem \
+    -c ${ACME_BASE}/acme \
+    ${ALL_VALIDATED[*]} 2>&1 | tee /dev/fd/5)
 
-	case "$?" in
-		0) # new certs
-			# cp the new certificates and keys
-			cp ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem
-			cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/key.pem
+  case "$?" in
+    0) # new certs
+      # cp the new certificates and keys
+      cp ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem
+      cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/key.pem
 
-			# restart docker containers
-			if ! verify_hash_match ${ACME_BASE}/cert.pem ${ACME_BASE}/key.pem; then
-				log_f "Certificate was successfully requested, but key and certificate have non-matching hashes, restoring mailcow snake-oil and restarting containers..."
-				cp ${SSL_EXAMPLE}/cert.pem ${ACME_BASE}/cert.pem
-				cp ${SSL_EXAMPLE}/key.pem ${ACME_BASE}/key.pem
-			fi
-			restart_containers ${CONTAINERS_RESTART[*]}
-			;;
-		1) # failure
-			if [[ $ACME_RESPONSE =~ "No registration exists" ]]; then
-				log_f "Registration keys are invalid, deleting old keys and restarting..."
-				rm ${ACME_BASE}/acme/private/account.key
-				rm ${ACME_BASE}/acme/private/privkey.pem
-				exec $(readlink -f "$0")
-			fi
-			if [[ -f ${ACME_BASE}/acme/private/${DATE}.bak/fullchain.pem ]] && [[ -f ${ACME_BASE}/acme/private/${DATE}.bak/privkey.pem ]]; then
-				log_f "Error requesting certificate, restoring previous certificate from backup and restarting containers...."
-				cp ${ACME_BASE}/acme/private/${DATE}.bak/fullchain.pem ${ACME_BASE}/cert.pem
-				cp ${ACME_BASE}/acme/private/${DATE}.bak/privkey.pem ${ACME_BASE}/key.pem
-				TRIGGER_RESTART=1
-			elif [[ -f ${ACME_BASE}/acme/fullchain.pem ]] && [[ -f ${ACME_BASE}/acme/private/privkey.pem ]]; then
-				log_f "Error requesting certificate, restoring from previous acme request and restarting containers..."
-				cp ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem
-				cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/key.pem
-				TRIGGER_RESTART=1
-			fi
-			if ! verify_hash_match ${ACME_BASE}/cert.pem ${ACME_BASE}/key.pem; then
-				log_f "Error verifying certificates, restoring mailcow snake-oil and restarting containers..."
-				cp ${SSL_EXAMPLE}/cert.pem ${ACME_BASE}/cert.pem
-				cp ${SSL_EXAMPLE}/key.pem ${ACME_BASE}/key.pem
-				TRIGGER_RESTART=1
-			fi
-			[[ ${TRIGGER_RESTART} == 1 ]] && restart_containers ${CONTAINERS_RESTART[*]}
-			log_f "Retrying in 30 minutes..."
-			sleep 30m
-			exec $(readlink -f "$0")
-			;;
-		2) # no change
-			if ! diff ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem; then
-				log_f "Certificate was not changed, but active certificate does not match the verified certificate, fixing and restarting containers..."
-				cp ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem
-				cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/key.pem
-				TRIGGER_RESTART=1
-			fi
-			if ! verify_hash_match ${ACME_BASE}/cert.pem ${ACME_BASE}/key.pem; then
-				log_f "Certificate was not changed, but hashes do not match, restoring from previous acme request and restarting containers..."
-				cp ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem
-				cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/key.pem
-				TRIGGER_RESTART=1
-			fi
-			[[ ${TRIGGER_RESTART} == 1 ]] && restart_containers ${CONTAINERS_RESTART[*]}
-			;;
-		*) # unspecified
-			if [[ -f ${ACME_BASE}/acme/private/${DATE}.bak/fullchain.pem ]] && [[ -f ${ACME_BASE}/acme/private/${DATE}.bak/privkey.pem ]]; then
-				log_f "Error requesting certificate, restoring previous certificate from backup and restarting containers...."
-				cp ${ACME_BASE}/acme/private/${DATE}.bak/fullchain.pem ${ACME_BASE}/cert.pem
-				cp ${ACME_BASE}/acme/private/${DATE}.bak/privkey.pem ${ACME_BASE}/key.pem
-				TRIGGER_RESTART=1
+      # restart docker containers
+      if ! verify_hash_match ${ACME_BASE}/cert.pem ${ACME_BASE}/key.pem; then
+        log_f "Certificate was successfully requested, but key and certificate have non-matching hashes, restoring mailcow snake-oil and restarting containers..."
+        cp ${SSL_EXAMPLE}/cert.pem ${ACME_BASE}/cert.pem
+        cp ${SSL_EXAMPLE}/key.pem ${ACME_BASE}/key.pem
+      fi
+      restart_containers ${CONTAINERS_RESTART[*]}
+      ;;
+    1) # failure
+      if [[ $ACME_RESPONSE =~ "No registration exists" ]]; then
+        log_f "Registration keys are invalid, deleting old keys and restarting..."
+        rm ${ACME_BASE}/acme/private/account.key
+        rm ${ACME_BASE}/acme/private/privkey.pem
+        exec $(readlink -f "$0")
+      fi
+      if [[ -f ${ACME_BASE}/acme/private/${DATE}.bak/fullchain.pem ]] && [[ -f ${ACME_BASE}/acme/private/${DATE}.bak/privkey.pem ]]; then
+        log_f "Error requesting certificate, restoring previous certificate from backup and restarting containers...."
+        cp ${ACME_BASE}/acme/private/${DATE}.bak/fullchain.pem ${ACME_BASE}/cert.pem
+        cp ${ACME_BASE}/acme/private/${DATE}.bak/privkey.pem ${ACME_BASE}/key.pem
+        TRIGGER_RESTART=1
+      elif [[ -f ${ACME_BASE}/acme/fullchain.pem ]] && [[ -f ${ACME_BASE}/acme/private/privkey.pem ]]; then
+        log_f "Error requesting certificate, restoring from previous acme request and restarting containers..."
+        cp ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem
+        cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/key.pem
+        TRIGGER_RESTART=1
+      fi
+      if ! verify_hash_match ${ACME_BASE}/cert.pem ${ACME_BASE}/key.pem; then
+        log_f "Error verifying certificates, restoring mailcow snake-oil and restarting containers..."
+        cp ${SSL_EXAMPLE}/cert.pem ${ACME_BASE}/cert.pem
+        cp ${SSL_EXAMPLE}/key.pem ${ACME_BASE}/key.pem
+        TRIGGER_RESTART=1
+      fi
+      [[ ${TRIGGER_RESTART} == 1 ]] && restart_containers ${CONTAINERS_RESTART[*]}
+      log_f "Retrying in 30 minutes..."
+      sleep 30m
+      exec $(readlink -f "$0")
+      ;;
+    2) # no change
+      if ! diff ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem; then
+        log_f "Certificate was not changed, but active certificate does not match the verified certificate, fixing and restarting containers..."
+        cp ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem
+        cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/key.pem
+        TRIGGER_RESTART=1
+      fi
+      if ! verify_hash_match ${ACME_BASE}/cert.pem ${ACME_BASE}/key.pem; then
+        log_f "Certificate was not changed, but hashes do not match, restoring from previous acme request and restarting containers..."
+        cp ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem
+        cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/key.pem
+        TRIGGER_RESTART=1
+      fi
+      [[ ${TRIGGER_RESTART} == 1 ]] && restart_containers ${CONTAINERS_RESTART[*]}
+      ;;
+    *) # unspecified
+      if [[ -f ${ACME_BASE}/acme/private/${DATE}.bak/fullchain.pem ]] && [[ -f ${ACME_BASE}/acme/private/${DATE}.bak/privkey.pem ]]; then
+        log_f "Error requesting certificate, restoring previous certificate from backup and restarting containers...."
+        cp ${ACME_BASE}/acme/private/${DATE}.bak/fullchain.pem ${ACME_BASE}/cert.pem
+        cp ${ACME_BASE}/acme/private/${DATE}.bak/privkey.pem ${ACME_BASE}/key.pem
+        TRIGGER_RESTART=1
             elif [[ -f ${ACME_BASE}/acme/fullchain.pem ]] && [[ -f ${ACME_BASE}/acme/private/privkey.pem ]]; then
-				log_f "Error requesting certificate, restoring from previous acme request and restarting containers..."
-				cp ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem
-				cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/key.pem
-				TRIGGER_RESTART=1
-			fi
-			if ! verify_hash_match ${ACME_BASE}/cert.pem ${ACME_BASE}/key.pem; then
-				log_f "Error verifying certificates, restoring mailcow snake-oil..."
-				cp ${SSL_EXAMPLE}/cert.pem ${ACME_BASE}/cert.pem
-				cp ${SSL_EXAMPLE}/key.pem ${ACME_BASE}/key.pem
-				TRIGGER_RESTART=1
-			fi
-			[[ ${TRIGGER_RESTART} == 1 ]] && restart_containers ${CONTAINERS_RESTART[*]}
-			log_f "Retrying in 30 minutes..."
-			sleep 30m
-			exec $(readlink -f "$0")
-			;;
-	esac
+        log_f "Error requesting certificate, restoring from previous acme request and restarting containers..."
+        cp ${ACME_BASE}/acme/fullchain.pem ${ACME_BASE}/cert.pem
+        cp ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/key.pem
+        TRIGGER_RESTART=1
+      fi
+      if ! verify_hash_match ${ACME_BASE}/cert.pem ${ACME_BASE}/key.pem; then
+        log_f "Error verifying certificates, restoring mailcow snake-oil..."
+        cp ${SSL_EXAMPLE}/cert.pem ${ACME_BASE}/cert.pem
+        cp ${SSL_EXAMPLE}/key.pem ${ACME_BASE}/key.pem
+        TRIGGER_RESTART=1
+      fi
+      [[ ${TRIGGER_RESTART} == 1 ]] && restart_containers ${CONTAINERS_RESTART[*]}
+      log_f "Retrying in 30 minutes..."
+      sleep 30m
+      exec $(readlink -f "$0")
+      ;;
+  esac
 
-	log_f "ACME certificate validation done. Sleeping for another day."
-	sleep 1d
+  log_f "ACME certificate validation done. Sleeping for another day."
+  sleep 1d
 
 done
diff --git a/data/Dockerfiles/acme/tini b/data/Dockerfiles/acme/tini
new file mode 100755
index 0000000000000000000000000000000000000000..6556c966f4221a108f2e6d57fd0b16c4e8ac465c
GIT binary patch
literal 19968
zcmeHve|S{Yng2~lAS7WD6l{uEjv63n5)vddqS2Wo6J|6dF`1y2VltVTB%_m=ICCe6
zWi@tybvneRYHhpQZPV7r+SX@Ft!-g!OB5Ar?YF4aFVt>DQF{mcfkKh3)!EN`eoQU{
z+1+RNdA`s04-d?o`~H5<d){;Ix#!%;?e^A|+?*Uum0ax#jYDT!IZAwM+GLC3&@`)7
zug%8ydD=p4CeZo#C_byaQuRrxTGa(o%?#9e_|)eLM18K6U#NPaK*NG4%0sHj-c+&5
zOHprMB|uec8si9(BVS9e;2`Q=exd3w%o6ygWv%4MJ(8=Caurfe)%&Dls#fizw$aBW
z+vm!)0wUN-mDbF^r)uJ*((#7wrR&xe97Jv97plHjpfy!1xoaRte*Sk$sbuVw_NI%=
zQQ1CKOHf-L@b|4+xjf*l3iyN3TdHoUUsbhgWpyM}y@I!!^b_xzwr*}o#gPFbpXcF2
zIY9LF3zzJ?X8pX;<IM;1H#pB5{@00H56lJae0+$PVp=+0%GTy=pII@ZjF6*Rg~ke4
z-fUJ|Fzc-5Tt>X*_$<X|89tTx)Zjzq5_~8v>Ip!(OjM_QUk>P-JLjkNf3*GDr6pT0
zJp97D7RL*9V>jLYPn%af@xfWU#@@3${OENruKHe8?7+>}Eqwas_|p$veP}Xy=<dx=
zzVPMm-#EMJC0G9JwU<uZdc4v8;#<$&`LhF;zMoiFJnyw{y?TH1_m)(wEcxT_4t?vA
zzL(#gv-)dA73XbV_-<K`>V{K%A>ar2oOK#j#N<r)1qk+;@ZM?kTnc`62K~REhM!`0
zCjGBYga67j_z$MRUp)=}x@qvUr)lr6rfFC6G<vG0!FNuBzj7LU(KPr2)8NmV#{aKP
z!~ctE@O2ni47BVL1>#Ko_1HA{?@WV#dK&!ZY4Cm1`18&*{4~Fx$<MFz_*k?Z=Uc&n
zF)ZiNJk)1t7EB-l&%j4zoy3opSvkB};+JtfCEC491)dY}^)m2twNGnSTQ5glohK-H
zoZq5N%(ZgF=cS(cfaYoov<L0I9530mw>f{2Hc?{bc=bhc<mc!@f$x@jz98{OKO^u-
z*)F<2mO_6*>Q{P}Oa2<E$1Vxa0zVfL6S7^(pJP(b{wzK7WPFZZDC{n$$roh@=l`^(
z$v6ls<{8PaEwFM_nIvqMcs5_)zYTdR)V@;0Gu!_$;3*DF>X`v~Dm(C@cuq<`)qQi3
z<R6#qlI)sO+C6xlmBh6|X*YzL`f;VLm*Z6&4k^1*kB?I|?dKA&$@R@e68|vp40^KT
z@Fmd6&xtHQmrH*p&#`h1KY=_ixG#F>Hn>WQ=;4TeAm|Qgp<&%0^lJT~@J$*}!{Lx;
z$Q|L={r*58;?uPOpFZsOYBvESK|K`EJnlds<k5!19vwLUfNyA6-$cAUJ-%=_80rDl
zt@}ek5{3!j`-j8+px)o(8H94(8;a^$|8P|IXu1c2!vo=Ajn}XQ8DDUOxS)*Gdwtvy
z-z`4R$gtMGG3?iUgm-(mjg4+U_YfG}KjiZgOrAnI6ozSPcTYrjhxMKzw?C-$xg)-y
zd&tLIMuz*tKA+<AM4~<Y{-9qQc84Rr9&)6|=~~+ZUwi}pi0%u!);0w~L7&Ur7l4${
z>(<?xqV+_gePN$_*caAXolW+(E_+YF7t}nVV84GL8us<TM}$2hwY$Ru5slpKaR<FU
z=!A{#uvhZHAyO?I2QV-c3d&aWz@>Ivd;P(lXvF7Lw#;on6A*SE`nIR1FA|Yz!oG+e
zGPyy%_S_m8>ht^H6ZH_H<?#h0i0`m_V^Hh4YNV%AHoPg|jzqvG8i=0sd2W(I(TIBh
z!Jt5?P@EDbe<T!e>psZ%172-StFy7GXGQfT)hjdCE2`^|q`C6n)YbGD8h?sPQwCk<
znEss#nJGDE;G{JnNzhy&ivDT;Y+4C^35Ez4T|jWIb{`o=IeBF-uV>;Lvwo(i@t6<H
z<r%D&nV$(yYe7}iJVSVjfhuLzUVcf-el>&%!AyAR3g@dZ;VB-f)R^#U4kB8;2~TZM
z#cIN59yvgCnDA;&B$*Bq9s$af>rD8<3|7;6O?X<Hs4{567b_&{VH19i34e<TUt+?K
zn((SGiF~ICPiuHp#!Yzh{r>AF{Mm{b^@Ise&kCwMXu{JyS(P0o{5cAVdZ!8hDHDFu
zgvYF(DNmd53o=+u+h@X`Yr^k0;b|?S%0UzUJcUGUnDC2C_@gE~GvOVvw+bAI{IxYq
zb8MZ|^9@?KIATu}>=8`qx<-)Fi<|LXvdD@nf(MD1I+#XTyqaK2?bJRFuOOIGIyK4R
ziwK@U@D2`NKrp3nYJ$TH2&Q3^8t3p?1XC)fMmbzaFr{#6n8UdQQ|hLAIsCWffGK5D
z9UOk2U`o}LmBWV#rW8%paQHQXDK%4!!+#{0QZiM_;pYjq5Ug?d8G<P_Q%64rV)5ey
zQ%a@|ayUuwT!Qy;_+f%61yhq8{vpAXdZ`^8{w~3ka;XUp{}aKKYN>G!-%T*3SZb8R
zUm}=ND>cmFFA_}4rBpA6ZzY&gEY-o`Fu{~sDJzF>B$!evRm0)FYNqv%1LnnX$6I%z
zvm9fs<?|e4uJW?I&E-4}sOM3y8lOX~kr~AaARKo*LEL+4Cyg$I80c9$iRs9jj<H9|
zt&}=r_m&?-y=w{3j`#<TxL#i27}Lwyu^&0&|5u`2<uw4uwv<m2*VyKAt0UfA&WvB9
zU$#z0e`MIX_ULzwZ=&ZM3BA0GoGT_)W>EHQoh;cJM0Yq6o6F0LZ6Br6VB&PEQIFmt
zx*K$mfz``PjXv}dVXp=@wi%7oe-~@mj$q8#I2&y%O)Ub!2tbn~(eTC!ro|siK3rkd
zeoYNTgYQQ49Emx<1tm%0=J?%zSZ39X0Zyvh0n%>DJfj6#j{K0uOYPgv_;WWn;;%Vk
zuOIDjIrmP|%G0s;F~+OC^c-L;1^e;-l10s!PrhdF)w&&3<ER|5lNLw(jgfPALMI=d
zb2scJLi!+>w-8d>u!pSlS1b6}MDKRo@eWt;*vB)Vz!5*{c+9xck@J+}xsUbv8Er*M
zTgf8m5%xzL=Aso^bZ$2U4T|uFr}96pWm?WLZfQ5Wf*iY2i{>A>2XYx@?~y=y--gt!
zkeTwQ%aQnO?emWKhr4M?Fn;%8I!&GMRRE4eq@ecs-IV&q8yp`!AGlKBDE*D+B=2_s
ztcUSY)SB^IV9`NdxP%V6A5l~t^xogmf7?M$)Ej@rb&_3VMG8I!?p5GcY|nt?NYq^j
zl<2H)K!j)U`aS*Q#!W(h-s$?kLi#I({;!h$qv(6+Kk_Za!MH@oJ&V~X%dhK6?)cxh
zUmHlyA^b{t5UH-(6SZmM9H0@FJKv!e?t-S;bo?n}5*J%1<9qaw@iT}!;(HQW?Bu6Q
zw#-6G#!k-E`;1=^KGCr5bgPHR(aVgtP$mD3a*YR~3XC!kk5XP6zXTo8m=C;&Mgkh+
z`!n&beL2=Ja52+zM-Ceu!q{&xp`eM+m_k3owaoc3D9IYA6=P!p?KG|y2JQt(7`O;p
zj{J+tSL4Hf=Pe+5R@}~qr149T(VvTPo&1GpMrtMErsT=Ly%)j1l5H(O8xIL}i%<9Q
zdG7t3BJ!~!<Kr;-_<c^QJBrCb__z&PQYSE~$8Fs<moxrRcb7AM+!23~ZkNV`V5i=y
zK?L<+tYHo8=fwAnv>VmJ`uCv-jhSznJzU&G!x$*eL~%I}kS)GHxgYj1xzq^{f*B9;
zpeeoqB)S)`-(dT^O^kH#{syxJX5RTk5qYb~m_J(M?;3aVY>K|(Ok7^x8h`WA+o_|!
z2ZcuPB&E@llt#IFY3$@2o&-B@14Bvkej`NWL_>ja-#oUy3hBf@XvV*wCjY_pS{0fS
zpG@YOS{Vcx*|ZlV5y%E;jPFl<mgWRLzZpfs#{FQ)>hD_e@YxS|f7fwE4Yz>{iJN@i
zlxu~;h9_g=07Q5k_zjp_nVNsPyBzUjj`&Bs<K6|QZD+y7d^990l;e*0D+ueuJT~td
z&wwdeBY1c>3GzLX{3DQoA+H9(BnOkBbMk>C-Ka(O*FwFqR-(%@=p7I;R!KBHK?v^s
zgkB`kv<WECS|!j061_Tuwi5b1?#Y2<Z3aC`=s!yIc^R~mJlVt1e-_>HzzJ%^fg~*>
zgrNcA`L<}=u2BHVolwSUh|PV1z(E_2^{y`y&q?rryphPrMn_!eU%w&M3=4E;O3bfb
zN`3h6!VGPPrRu@1#&0a0Yg^}xpRjd1<1gA=xQYC(EB;|?VoAxCSK(apA(&~6pNPL=
zJP(brlj)Kzb7}T7u8f`h>_(O@f3kNux^pjhk;98{Q>k-a%pmd?BM0NxG(K!M;2xsI
z^1rbJqxHxG@_rJ_Uk3J^Blk%-G5<Euai2egK|STOu?5!m+PRf%ouh<>-Jd{$?8Y%Z
zr(w0i{?BN(NL|S1FnFH0tzcIn6#V*IXz8&BO191h1;fh&HmPM7Wo+_6&{coTgf}AP
zX$?zpj=yqoLp`}%09~=YISx<SICvbIwoW?Zc1^$3;hA3s`mz_CV=G^(eSYi9C3ii=
zmo3FFIpW3p9I?l9E`8zlqYlr@j=g#NsY$hysmH-#Tu*8e4eu{IZN%RGSCAKgj2SwH
zYj8aaE*cvZRa4$x$4PZR0ZF9aQiurm-7tV&nHsM&PIpuO8FwG!-s`hs`P(3wvzs!`
z*etR0lZE8s2}gXdQ2}-F{Kw0goG$l_Pw7kKUj^YVEGp;JzHGj)O^VK?foaTw0)C^t
z*=U9SSp7M;*OqLVB-(m1m}od&aa!x|poU*2Zlhaq4X*zKE^7S_Q|mv+Np(L3Nwj_$
zGzw2JU&k6|!|xd-+ipNd8t=T%)eHz@=GEssu4T?zP?A$4`$-B(ihEeMB4glbXyFet
zv@ZE)p>m~AX`0jJ{htfZnNNDV&|VRh>)^lf6`}WU7{9{tVbZ%3J!Xn8`imYJiXo~Q
z%fS#knWLA}io3XWa`$4w{s36IUnTMvUC8LpvoVbB_!K6LvOVKii5KVS#}fH7Km%9G
zIQ$-uK@4UQ$wO$N%KB2_s~?mk?Yj$KSuK2hgSWD-E#vDGq=hV~b>lrkZLv^mUcBsr
ztl<I~S^O)mr{PVS17Q82sUPnaCVmT&2#1?Q@~^&tX{kzdp18l+*3nFM0y7y_4PAJ;
z+D9R{53IE8{Y<W=?aeDM01iRR%R}uL`+RvGfPx}{ES`nBb<A5{4rJ*}ft;6*`d3n{
zjGpU3Tu3Wt)QnckM~a30#Kn%-p1k-wv<?`TRvm~{>!pXHhn$IXTI27Cm3Y%p;nJfJ
zCLd~QCwHAq*YQ`5Iq+=ug#rh3(-H^kBk(#C>-hZ6m+Pyf@LeE-P)ZX&U$dVl2wNT_
zF$MsGV%Or+hE5AS!yNl<P)zrrYnP!X&*h}LEg*?7|LtAy-th#*F?;51hLJ~!oM>>J
zZsb*%H#UQeetiSi$;Hr*UIq6OaI36Jaxd%7&KQhCgj<qU#p;XSKH%Tg!rto`wMY=t
zcrtDl&3%R_siXzQl!<GFi5;MbHZ36~XKK^9apWD|o-L>Ap9?L<Lm;C)^KqR#fw6)1
zq%P+7fGr3R;_)LPkF?14?>X-IoQps)1^o*6nc9XyE%K);$!xtEmQ1lHMji1tjR4f~
zyKVx?6D!MOAJ5fqiZ!?v(USWgA3*;n=D&`i8-L}4SGGQ1()^+E3?wj+yNnzXt;Yi>
zrqU<LwNl~Q4~YHL(5-@Ncv!g-RkF95x9Ug_U&+N9QlH_b4nYI0hTj^cXA`Vv-$tCo
z6H%W2X6$5<{;Kg~!X+9UryF<?reWaEsFJ0^02paLQhoGO?p$3lP@<2%NXlSNB%PW^
z68WElKN!nfLNsAF2#YUa63CjYJY3(LUxJcc4By3MRS(-ny)gA1kc6pEK@0A-i%8><
zw|E=8LZf+}nkzJ3MH)*p8i&z;#+%%Yy5$*-Pm&fmUpq<BYDVzy5qgVH*SibCcv3LV
z7i~FwKBKHk-T}obIQI$tzXwTp?1MIBLn@86&MEhAKJgvz;tTFlej7;A6tWvlOB=t3
z6q1P&;t?Qm7hv@KHtRgP1ODSCFe2?rac{%}jognw|1aeI|5H#eJraEgTQ$Y;$78SE
zUb2<m8HqLg2K1bfYmA4F@W5RRAK|_E*=s+{mi)Z6d=9$2806$m^nz;IqdYEk$C+x{
zm!OA?l>Gb&TRg8^JiBD}SB#56j@1_;^`ahf{wkQq?YoKEw_LdJAaub6^X<EvTbXkg
zD5k!<kNWN+;Xowgz-(wq9peilkY7H`o23h#=J_TEf@=Md&y_T^fs6WX+|<B7a;NGp
z$>{$9Y0QqZ5fOIY!obe*{Tp1toaaF?`Tl+KJt%bl0wj?aYqNBZ8|MnW_X@q{e714n
zhFghpAi2|&ZcByQ-i+E4DTL%><l6XHW6tF{w?$$N&o7{EzrlDEB=qY_q2Ju?ufj5I
z|Hb}tyI~hzSinW`F--AEa#Gzf3~SMbI5Z}(*@zsA9UisC=ar`}fobC!Vd*d!p~BP?
zVkH&kdglBV<YYOrTMT%HrxRn1FtH<JVhOdUl-gsv7AuB$nzk8Q#}@zj9EQ!iu_~&u
z<8T7cM6Ju-z(6i=JoeEHquoGTx4x}o)TrmD*7#vO9yLQldfuOK>(6mukQ_$$%1r~?
z4YnThdidBL8f4H14qW0)Dpy<IVsqJA8P1UXtYWc$*#@Rgaaq6HAMklsv&9i@eY3r>
zd(A0anNwdgADu#*VLI@IycxCL+1Ap|PEiGhip7y-g<4Z+Xb9)146l9p7#(bff|1pQ
zg&Jd3fz_;QFtiaQez?hq&3B7muP)T=!4ZEr6ddvebvEJ-`{`Jhi@BU_&YrIB#!kDf
z!``WJaGkxgvAxUbx?ZcQ8u8%}9Y@@YBZb;vWMm+qt#@_Wn(U`Ir_N4&UgnN4e*DR%
z&WP7vYwN_oJ0*Pn0eSGAY4*~^k)>0|;3l-6qt%(ci2(i<9)6~W7*3pV<jcC8Yg}l<
zG=%nUt<&f6`A6U=IGY@;%~}VJd;P%yCeEx^Gww%QNVWo+`9ZrGK_|n|gY$2%<l5-h
z2N_-;AZfU3N6evewWJOrCe#f$!qy;1XVYX*hKV1QGkP82)TV)#$`rqB8XH8n27KWx
z?kv9c?rHc=Psw12>G~#C5xR-uNOAW0yvu}j?BA&u7c%z1ABlPfnb$XhJey9giw@Q^
z0peOC5guHoq9uYQ4e{)d$;N7`Ygbj*vMM%!<gM}b_j@n-tmNyaGk6+rY<)Y93)<Vd
zHn5J)_BEZhwXCX&t+#cq0cJC<r7{c+Dt3&rsP1EKYT-cGJ;b6xyzRjBK_8lfR~bh9
zl;<qe50(*k!0%=Ba)F2kJm-TCsxZuyW;xoF)27h|d*B<C4Emry!UlbTVK(H8ko)F=
z3BJf`rUnoVAMT+CoKr)HRfK&vNBwxOfwj`xp6rSShSv&~VPHdkWHnpk3;M!%^?(i0
zAb>}Gp$KM&sE(IUs-b<@=hj(tm^%0p3`F<=QC=XAMD4;W6mkSah>4=Y^K)q=6M=zn
zC_1dfV0ZEV+;1L7lJD~A+?Mdzk2DPUMtlKQ;q~>qqX8Wq?ZupjGBwiqTRFU~KD2fd
z!+a{o61`|52e8)B+0$ir^)xx0t<6*O8$(Y-gYFSb8#DtlbU5#wVZ65iJww&ZhWKp?
zMOl<j3g&2E$>TNUhk6C%3{xJzA8>Y)-<USke36+OnOoPx{yrq866p^5ZW;D@Fj+AE
zW)HHEIwteVk7{2Ny<>v8DS~kby&DI8L5c*uS~E49!G+WGotaaq)$H^-5!B(f#%DfK
zMiIvBmWeI3Y%Sg~l3^Ef8^ioNgucN{!Us5BMbe`*;{8i$GC7@JaEa+piU@#a;LQAU
zx*T~E4c-(CZ45HRG=iJce^Q1QSUL6fPwM|s97@j>@iYF5`0e;F=+ni2Vj8(|iFeVW
z3!^p|(pfkf3{pNK={uawtd`HC{zz~sNb>D13>!X$X01W03qQwS|5B3~Cen>~(~oQI
z^Fg`_FT!DM1aZuMWV4b*LQK3fMp-sYb~lE|)JCk|sta8q*6+WCPhPm8U@jS|#GK*d
zh^mNOm@%X(-uL53ykmFT3XGk)`Xbw^A>4^GwxyD^A`}@89*b)9ZqB(gE*nQZ7a#rK
z(&;~;cD<5L|8j<=J#sLeehBa*ucp)Vj_n^_OQ$PQ>#wKNt*BSNnNEKb^&@{tr|I3+
zKcIdc_3K!Px8{P5CAt^&y?FH4j{1H)P(6a$i!F&t=)WJ^QeM=5z&`AsP&Z>wyF5?)
z&H!e$oLf7!oLfqB&Mlr*FrG83lwR=Q@9V&?i-<uM^{&yW{NlF-#6SM0bb25B(k!Jd
zma?l#iZ&LEYF93}?4nD`FCZ24WYLVzgV4)}&t@r&<>sy_v=lgsayOuADgu_<4xpYu
zJor1bg70gb5BOGmw&TMNrPKV~(nd?^SZ<@GZ2OF63)_}wvsA?Lud>wSh6^nfHVd;^
z%D~ZRDX<r{1Jh!{w2;9{e5gOh5pVu(H0*85g;Z?DRTehGont9;T1sse+QXzmaVUoW
z2j57i%Q!}S(HgQGcmsI;F0b8EdRMO9QZ_cjZeiQWuWk9wmYUei+-rnq@L71)T$Jm~
zLOF^)pM|mW=m`7UVP_n9U?<bfmeO3SrGVmlKk!cj&)=zDL-B=P3hx(D@z#odpghu$
zKm1)`MD13P8;f##Rg6ikj?Zyw5BT`I*zol(it}mhSz{T^o#DtSwA8flh-cc>Qk3ff
z7A;3VWU%%k3P3h*qimkG5_SW~-x}mGf480Y|J9c9oLuApbp*n7Bd%I_%YKZjCTg4u
za`!`y_Ne$f-0*ih_2V|mi&$QZrDmki!kR2)P>6I`Q#4~ed^RI;kswpBNJpNJe}~@j
zm(ywf&ifk6czzI(vI&nVrx#*e9mU3`57!#(ewpHQ7xnvCUZbUAd%nX`vu&osQXiYO
z)?y7?>TNtKji#vZyrOYhhVcq>pOjA`@JR$diNGfj_#^_KMBx8}2<$uC%DvbjYvmFx
zrKqU7Sb&+|z0nKWRMhY6)I0U+_to@*GZnSIRPWZ8UD3<&d@XLG|MlZ^hzMWLwNjP&
z&3DIa0n@=dmC+eiUd!zy?YnYOq1IVy?Mlbu=7J@NDArzHtF_34yrA_j6*}#wLhp_7
zGRMj*g`X%EuxeK?r)v0pyeP^(j*EDEh9y6aqd2VMiDeas-!HOC$^SQ%`W<_=wU<hS
zA8*R~gsf+l3j8^;ULxyNvTl*}I$8J2dPLUSWPP8kACUFWW&M<_Uy}8kvOXc}nRBIm
zSuc_GDp|M4dY!EMWj!M6ZL-d8?{u*0A4Mlv{Z^E4F6>mUb-J)GD$YDA04yskYzhr;
z3i}5Jbyne7##YqS)-l&$2)pd8Jsi5#6JnR^9JGcwSlu7KqOh>T7asECGyuDTe8)EI
z>)XVzS4{f?m5hErN87`mLF_a7D(PX}9o)pQb&M@27V6WnBgS_pm<PrS!O6E4BcXmB
zyK-XF7iSG2j~|<tUgiyXqI4X?e?f@71f0jP3fgzQpi4?zu#6kQ{$8NaPaBmu-cZVD
z^9<X&*e<|N0R8+If|b}R^aP@O`%jSr{vp4#K;k?ikwSQmt%^$SXC=0bz5f19sC~Ry
z!_mHgKQdU!y!aiU*qg*&2qAfZD{0eZIp5a^1Pako{HBhgV)l;nP<#*@*q0&V8_OFJ
z^;38e>B9bKI0%zs^Tmtfg%G!RBep?F3#sl8;kTF@DZKcVp%=$1;?&CplDjW7g5By&
zhhwLR&LwC&UhM5o^{OOA2C+}cu<s)R2D|=XA)!=ruxk_T!v<zh_qzjZI27jgvYT05
zSm<)tSyy|D3nyH5=Io-Ah;`0pdo#Ph)&=;2N_MT&<!JAAF>rL++FaMO_7-MqyPjR`
zY-_G$_Uk%2?Ok20y|d7{wxiW)2hQ2n)Y{$bY+J(`A=lQ9+;$?Vq14sR$e>i^v_r0i
zt+jVHIiT6r=xoK2U1ed5)73^gTiQFBjdj>MUCyTNR$C|Q=<e)j@3O;uGt{=>jIk3|
z>}&09u4-5Xj@j1%U|kMdYb%*5v~|P#PV$d6wRc?K>0IM*F-LoAvmMArJ3O;Bw%Ua$
zG^(l9=3HCJnr&-sYskA!)($P5g~TSjW7j(Dgd%%3{BNQo9BM{WdmEiAx+>AiPFF_s
zT4$HNlG!?)T@;X(&i1vHg%nOmKs%H`uFWpAP^fu;GCcwo3RpK9t$bn4c3UfSp?lg+
z>Avd1HBC*cSw(kWG^j^eUG>W9nyOV%4%Oa<^QfAYIB^kpnow5Ntg5+G)2btb^mAc%
zpH_|EmHO~I+iGN)uNn=m(%l0R8VE+K`=Z#fufi{Xs|muP;GkCR-4u*$8WOc078H4&
zbPCV|TG$tGlYqP$4(MbOzkjX9W%WP^7rO5jeDfdnR)<6UH@nro!Jd8`clmk-y-=bc
zA=={(huxcmgu1@b12&j(5BWXtA*7RfVCV<H)%cCAR_(zFG$t-JBmeJeS|`w)uI~T!
zxmG|^f0stBOE?l=+4qC9fups6l6U1=0ny)i;g!ZjmHE!gT#1YGQJLlSTq`H&Ql9p^
z%q3fXC5U+0IHc^W_0rcR!jQuGvR3O9rSl40Pz;p3T2GD21=2n#Nb4<XyOLMynik-Q
zRmrRMS%+Kzsr49Gc*%}m8?dw%Qu1p3^S)fbZI*J%f5oTj^`O(*O2KM<H7pmXHBvs?
ze~H#^#0AAv$*c9;gp}`<jLLp?`zZ}czESdNa($@D1@VMbO!5@7Z28-OqnN1mtol0=
z6D2^RsCBY{ge`SV^(K7G@{@9%HYw%#UbRVpUQDB+>Mgi7%a6<T(Kv15qbPp`bUHi+
zf>~bu-HZt-|9;lOTiI3m?#Yr@&ky%56&z|Et@yL^{~J<1(|=2?oOMFV|4=;`NCiyR
zs`?Ht$bTiT{?3y6`%CvKMp<Xu|8bW5!4+1{d2odgcqsFrA>izI?gH9^k785LOX}}2
zW%FmlPePWuTFI;DsWKYaDB1kk@N?jy_A7b%`5+bc-;{p|yp+32UOi8!zn7)*Pvy6=
zukzqd$eQh|-}|2w$KBKVuk^f<C9hd~fkCnIZ|$V0GT%y0)dnbL`<ks+@Y+O`$m(z=
z(3$Uda7DUQ`_<niNZ18SeTGw9uq^l(V6tD6g;(-4zncs3QZd)cwxEdb-O~Qw%}A4+
GLjMPAa2l)t

literal 0
HcmV?d00001