fix(aegis): restore supported Fedora IoT bootstrap

Configure Aegis with a pi user and Btrfs root filesystem

AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora CoreOS, WSL, and servers.
+Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora IoT, WSL, and servers.
 
 ## Source Of Truth
 - Main orchestration: `ansible/site.yml`
@@ -17,7 +17,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora
 - Workstation: `deadalus` is Windows + Fedora WSL.
 - Ubuntu server: `prometheus`
 - NAS: `atlas` (Rocky Linux 9, reached through SSH)
-- Always-on LAN node: `aegis` (Fedora CoreOS on Raspberry Pi 4, reached through SSH)
+- Always-on LAN node: `aegis` (Fedora IoT on Raspberry Pi 4, reached through SSH)
 - Hosts intentionally belong to multiple groups; trust `ansible/site.yml` over hostname assumptions.
 - Inventory axes are independent: `platform_*`, `role_*`, and `desktop_*`. Legacy `void` and `desktop` remain compatibility parents.
 
@@ -46,7 +46,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora
   - WSL workstation dev: `ansible-playbook ansible/site.yml --limit deadalus --check --diff`
   - Server: `ansible-playbook ansible/site.yml --limit prometheus --check --diff`
   - Atlas NAS: `ansible-playbook ansible/site.yml --limit atlas --check --diff`
-  - Aegis CoreOS: `ansible-playbook ansible/site.yml --limit aegis --check --diff`
+  - Aegis IoT: `ansible-playbook ansible/site.yml --limit aegis --check --diff`
 - Focused checks:
   - Emacs is disabled by default; temporary Emacs check: `ansible-playbook ansible/site.yml --limit <host> --tags emacs --check --diff -e emacs_enabled=true`
   - AI coding agents: `ansible-playbook ansible/site.yml --limit <host> --tags ai_agents --check --diff`
@@ -154,12 +154,18 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - If you add a new operational area, also add the narrowest validation command for it.
 - Call out checks you could not run and any follow-up verification needed.
 
-## Aegis Fedora CoreOS Notes
-- `aegis` is a remote Fedora CoreOS Raspberry Pi 4 node. Bootstrap it once with
+## Aegis Fedora IoT Notes
+- `aegis` is a remote Fedora IoT Raspberry Pi 4 node. Bootstrap it once with
   `ansible/bootstrap/aegis.bu`; the remaining configuration is applied by `profile_aegis` over SSH.
-- Fedora CoreOS is immutable. Do not add it to mutable Fedora package or shared dotfile roles.
-- `profile_aegis` owns rootful Podman Quadlets, persistent container state under `/var/lib`, and the
-  Podman auto-update timer. Keep Apple IDs and other credentials in Vault and use `no_log` for their
-  rendering.
+- Fedora IoT is immutable. Do not add it to mutable Fedora package or shared dotfile roles.
+- `profile_aegis` owns rootful Podman Quadlets, persistent container state under `/var/lib`, the
+  Podman auto-update timer, LAN-restricted firewalld rules, and SSH hardening. Keep
+  `aegis_lan_subnet` and `aegis_adguard_web_port` host-specific; SSH permits only the declared
+  key-authenticated users, never root or password authentication. Keep Apple IDs and other
+  credentials in Vault and use `no_log` for their rendering.
+- `aegis_adguard_web_port` defaults to `80`. The initial AdGuard Home wizard port `3000` is intentionally unmanaged: open and close it manually only while
+  completing initial setup. Disable the local systemd-resolved stub through `profile_aegis` before
+  AdGuard binds port 53; keep
+  `/etc/resolv.conf` linked to `/run/systemd/resolve/resolv.conf` so Aegis retains router-provided DNS.
 - iCloudPD requires post-deployment interactive MFA initialization; its cookie/configuration state is
   persisted in `/var/lib/icloudpd/config`.

README.md

@@ -36,7 +36,7 @@ infra/
 
 ## Managed machines
 
-The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, a Fedora CoreOS LAN
+The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, a Fedora IoT LAN
 node, an Ubuntu server, and a Rocky Linux 9 NAS. Configuration is layered instead of being tied to
 host names:
 
@@ -53,7 +53,7 @@ common user environment
 | `ikaros` | Fedora | Personal workstation | GNOME |
 | `nymph` | Fedora | Desktop laptop | GNOME |
 | `deadalus` | Fedora WSL | Development workstation | — |
-| `aegis` | Fedora CoreOS | Always-on LAN node | — |
+| `aegis` | Fedora IoT | Always-on LAN node | — |
 | `prometheus` | Ubuntu | Server | — |
 | `atlas` | Rocky 9 | NAS | — |
 
@@ -116,18 +116,32 @@ ansible-playbook ansible/site.yml --limit prometheus \
 
 ## Aegis
 
-`aegis` is a Raspberry Pi 4 running Fedora CoreOS. Provision it once with
-`ansible/bootstrap/aegis.bu`, after replacing the SSH public-key placeholder:
+`aegis` is a Raspberry Pi 4 running Fedora IoT. Generate Ignition from
+`ansible/bootstrap/aegis.bu` with the included Podman/Butane helper, then write the SD card with
+`arm-image-installer`:
 
 ```bash
-butane --strict --pretty --output aegis.ign ansible/bootstrap/aegis.bu
+ansible/bootstrap/generate-aegis-ign.sh --write IMAGE DEVICE
 ```
 
-The controller then manages it remotely as `core@aegis`; unlike local desktop profiles, Aegis is
+The controller manages it remotely as `pi@aegis`; unlike local desktop profiles, Aegis is
 intentionally an SSH inventory target. `profile_aegis` manages rootful Podman Quadlets for AdGuard
-Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, and
-`wake-ikaros`. Define `vault_aegis_icloudpd_apple_id` in Vault before applying it. iCloudPD still
-requires interactive MFA initialization after its first deployment.
+Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, LAN-restricted
+firewalld rules, SSH key-only access for `pi`, and `wake-ikaros`. Set the host-local
+`aegis_lan_subnet` and `aegis_adguard_web_port` values before applying it. The playbook permits
+AdGuard Home HTTP on port `80`; the initial wizard port `3000` is intentionally unmanaged and must be
+opened and closed manually during initial setup. The profile disables the local systemd-resolved DNS
+stub and points `/etc/resolv.conf` to its full resolver data, freeing port 53
+for AdGuard while retaining DNS learned from the router. Define
+`vault_aegis_icloudpd_apple_id` in Vault before applying it. iCloudPD still requires interactive MFA
+initialization after its first deployment.
+
+Validate the profile before deployment:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit aegis --check --diff --ask-become-pass
+```
 
 ## NAS
 
@@ -239,7 +253,7 @@ ansible-playbook ansible/site.yml --limit deadalus --tags ai_agents --check --di
 | `profile_workstation_dev_wsl` | WSL development setup. |
 | `profile_server` | Server setup. |
 | `profile_atlas` | Rocky Linux 9 NAS setup. |
-| `profile_aegis` | Fedora CoreOS always-on LAN node. |
+| `profile_aegis` | Fedora IoT always-on LAN node. |
 | `dotfiles_common` | Shared user dotfiles. |
 
 ## What `site.yml` runs
@@ -265,7 +279,7 @@ So, in practice:
 - `deadalus` gets the Fedora development layer followed by the WSL layer.
 - `ubuntu_server` configures `prometheus`.
 - `atlas` receives the Rocky platform layer and the NAS profile through SSH.
-- `aegis` receives only the immutable Fedora CoreOS profile through SSH; it does not receive
+- `aegis` receives only the immutable Fedora IoT profile through SSH; it does not receive
   mutable Fedora package or common dotfile roles.
 - Empty `platform_void` groups do nothing until they get a host.
 - The playbook never restarts the display manager during a run.

ansible/bootstrap/aegis.bu

@@ -1,12 +1,12 @@
-# One-time bootstrap for Fedora CoreOS on Aegis (Raspberry Pi 4).
+# One-time bootstrap for Fedora IoT on Aegis (Raspberry Pi 4).
 # Generate only: ./generate-aegis-ign.sh
 # Generate and write an SD card: ./generate-aegis-ign.sh --write IMAGE DEVICE
 # The write mode uses arm-image-installer with the RPi4 target and embeds
 # config.ign; it prompts for Wi-Fi credentials unless supplied through its
 # WIFI_SSID and WIFI_PASS environment variables.
 # For WiFi, the UEFI 'System Table Selection' must be DeviceTree (Esc at boot).
-variant: fcos
-version: 1.6.0
+variant: fiot
+version: 1.0.0
 passwd:
   users:
     - name: pi
@@ -50,14 +50,6 @@ storage:
       contents:
         inline: |
           net.ipv4.ip_forward = 1
-    - path: /etc/hosts
-      mode: 0644
-      overwrite: true
-      contents:
-        inline: |
-          127.0.0.1   localhost
-          ::1         localhost
-          192.168.0.1 aegis
   links:
     - path: /etc/localtime
       target: ../usr/share/zoneinfo/Europe/Rome

ansible/inventory/group_vars/platform_fedora_coreos.yml

@@ -1,2 +0,0 @@
----
-# Fedora CoreOS is immutable: do not attach the mutable Fedora package roles.

ansible/inventory/group_vars/platform_fedora_iot.yml

@@ -0,0 +1,2 @@
+---
+# Fedora IoT is immutable: do not attach the mutable Fedora package roles.

ansible/inventory/group_vars/workstation_dev_wsl.yml

@@ -8,9 +8,10 @@ workstation_dev_wsl_packages:
   - python3-pip
   - tmux
 
-# Java 11 is no longer supplied by the Fedora repositories used by this WSL
-# profile. Keep the JDK patch pinned; update this value deliberately.
+# Java 11 and Maven are managed by Mise on this Fedora WSL profile. Keep their
+# versions pinned; update them deliberately.
 workstation_mise_java_version: temurin-11.0.31+11
+workstation_mise_maven_version: 3.9.16
 
 workstation_is_wsl: true
 workstation_wsl_systemd_enabled: true

ansible/inventory/host_vars/aegis.yml

@@ -4,5 +4,10 @@ ansible_connection: ssh
 ansible_user: pi
 ansible_become: true
 ansible_python_interpreter: /usr/bin/python3
+# Avoid PTY framing around module JSON on this remote Fedora IoT host.
+ansible_ssh_use_tty: false
+
+aegis_lan_subnet: 192.168.178.0/24
+aegis_adguard_web_port: 80
 
 aegis_icloudpd_apple_id: "{{ vault_aegis_icloudpd_apple_id | default('') }}"

ansible/inventory/hosts.yml

@@ -13,7 +13,7 @@ all:
         deadalus:
           ansible_connection: local
 
-    platform_fedora_coreos:
+    platform_fedora_iot:
       hosts:
         aegis:
 
@@ -28,7 +28,7 @@ all:
     fedora:
       children:
         platform_fedora:
-        platform_fedora_coreos:
+        platform_fedora_iot:
 
     rocky:
       children:

ansible/roles/profile_aegis/defaults/main.yml

@@ -7,3 +7,10 @@ aegis_icloudpd_synchronisation_interval: 86400
 aegis_icloudpd_apple_id: ""
 aegis_ikaros_mac_address: aa:bb:cc:dd:ee:ff
 aegis_wol_port: 9
+
+aegis_lan_subnet: CHANGEME_LAN_SUBNET
+aegis_firewalld_zone: public
+aegis_adguard_web_port: 80
+aegis_ssh_allowed_users:
+  - pi
+aegis_ssh_user_home: "/var/home/{{ ansible_user }}"

ansible/roles/profile_aegis/handlers/main.yml

@@ -1,4 +1,14 @@
 ---
+- name: Restart Aegis systemd-resolved
+  ansible.builtin.systemd:
+    name: systemd-resolved.service
+    state: restarted
+
+- name: Reload Aegis SSH
+  ansible.builtin.systemd:
+    name: sshd.service
+    state: reloaded
+
 - name: Restart Aegis Quadlet services
   ansible.builtin.systemd:
     name: "{{ item }}"

ansible/roles/profile_aegis/tasks/main.yml

@@ -7,6 +7,17 @@
     fail_msg: Define vault_aegis_icloudpd_apple_id before applying the Aegis profile.
   no_log: true
 
+- name: Require completed Aegis network placeholders
+  tags: [aegis, firewall, services]
+  ansible.builtin.assert:
+    that:
+      - aegis_lan_subnet != 'CHANGEME_LAN_SUBNET'
+      - aegis_firewalld_zone | length > 0
+      - aegis_adguard_web_port | int > 0
+      - aegis_adguard_web_port | int < 65536
+      - aegis_ssh_allowed_users | length > 0
+    fail_msg: Define the Aegis LAN subnet, firewalld zone, AdGuard web port, and SSH users.
+
 - name: Set Aegis hostname
   tags: [aegis, services]
   ansible.builtin.hostname:
@@ -53,6 +64,185 @@
   no_log: "{{ item.dest == 'icloudpd.container' }}"
   notify: Restart Aegis Quadlet services
 
+- name: Create Aegis systemd-resolved configuration directory
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.file:
+    path: /etc/systemd/resolved.conf.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Disable Aegis systemd-resolved DNS stub listener
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.template:
+    src: 10-adguard-dns.conf.j2
+    dest: /etc/systemd/resolved.conf.d/10-adguard-dns.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart Aegis systemd-resolved
+    - Restart Aegis Quadlet services
+
+- name: Point Aegis resolver at the full systemd-resolved configuration
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.file:
+    src: ../run/systemd/resolve/resolv.conf
+    dest: /etc/resolv.conf
+    state: link
+    force: true
+  notify: Restart Aegis systemd-resolved
+
+- name: Enable Aegis firewalld
+  tags: [aegis, firewall, services]
+  ansible.builtin.systemd:
+    name: firewalld.service
+    enabled: true
+    state: started
+
+- name: Render Aegis AdGuard web firewalld service
+  tags: [aegis, firewall]
+  ansible.builtin.template:
+    src: aegis-adguard-web.xml.j2
+    dest: /etc/firewalld/services/aegis-adguard-web.xml
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Reload firewalld custom services
+  tags: [aegis, firewall]
+  ansible.builtin.command:
+    argv:
+      - firewall-cmd
+      - --reload
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Remove unrestricted Aegis services from firewalld zone
+  tags: [aegis, firewall]
+  ansible.posix.firewalld:
+    service: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: disabled
+    zone: "{{ aegis_firewalld_zone }}"
+  loop:
+    - ssh
+    - dns
+    - http
+    - aegis-adguard-web
+  loop_control:
+    label: "{{ item }}"
+
+- name: Remove retired Aegis TLS access rule
+  tags: [aegis, firewall]
+  ansible.posix.firewalld:
+    rich_rule: 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" port port="853" protocol="tcp" accept'
+    permanent: true
+    immediate: true
+    state: disabled
+    zone: "{{ aegis_firewalld_zone }}"
+
+- name: Allow Aegis services from the LAN only
+  tags: [aegis, firewall]
+  ansible.posix.firewalld:
+    rich_rule: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+    zone: "{{ aegis_firewalld_zone }}"
+  loop:
+    - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="ssh" accept'
+    - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="dns" accept'
+    - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="aegis-adguard-web" accept'
+  loop_control:
+    label: "{{ item }}"
+
+- name: Check the standard Aegis SSH authorized keys file
+  tags: [aegis, ssh, services]
+  ansible.builtin.stat:
+    path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys"
+  register: aegis_authorized_keys
+
+- name: Find Aegis SSH authorized key fragments
+  tags: [aegis, ssh, services]
+  ansible.builtin.find:
+    paths: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d"
+    file_type: file
+    recurse: false
+  register: aegis_authorized_key_fragments
+
+- name: Require an Aegis SSH authorized key before hardening
+  tags: [aegis, ssh, services]
+  ansible.builtin.assert:
+    that:
+      - >-
+        (aegis_authorized_keys.stat.exists and aegis_authorized_keys.stat.size | int > 0)
+        or aegis_authorized_key_fragments.matched | int > 0
+    fail_msg: Add a public key for the Ansible SSH user before disabling password authentication.
+
+- name: Ensure Aegis SSH configuration drop-in directory exists
+  tags: [aegis, ssh, services]
+  ansible.builtin.file:
+    path: /etc/ssh/sshd_config.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Ensure Aegis SSH drop-ins are loaded before other settings
+  tags: [aegis, ssh, services]
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^\s*Include\s+/etc/ssh/sshd_config\.d/\*\.conf\s*$'
+    line: Include /etc/ssh/sshd_config.d/*.conf
+    insertbefore: BOF
+    state: present
+    validate: "sshd -t -f %s"
+
+- name: Render Aegis SSH hardening drop-in
+  tags: [aegis, ssh, services]
+  ansible.builtin.template:
+    src: 00-aegis-hardening.conf.j2
+    dest: /etc/ssh/sshd_config.d/00-aegis-hardening.conf
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Reload Aegis SSH
+
+- name: Validate Aegis SSH configuration
+  tags: [aegis, ssh, services]
+  ansible.builtin.command:
+    argv:
+      - sshd
+      - -t
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Read effective Aegis SSH daemon configuration
+  tags: [aegis, ssh, services]
+  ansible.builtin.command:
+    argv:
+      - sshd
+      - -T
+      - -C
+      - "user={{ ansible_user }},host={{ aegis_hostname }},addr=127.0.0.1"
+  register: aegis_sshd_effective_configuration
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Verify effective Aegis SSH hardening
+  tags: [aegis, ssh, services]
+  ansible.builtin.assert:
+    that:
+      - "'permitrootlogin no' in aegis_sshd_effective_configuration.stdout_lines"
+      - "'pubkeyauthentication yes' in aegis_sshd_effective_configuration.stdout_lines"
+      - "'passwordauthentication no' in aegis_sshd_effective_configuration.stdout_lines"
+      - "'kbdinteractiveauthentication no' in aegis_sshd_effective_configuration.stdout_lines"
+      - "'allowusers ' + (aegis_ssh_allowed_users | join(' ')) in aegis_sshd_effective_configuration.stdout_lines"
+  when: not ansible_check_mode
+
 - name: Install Wake-on-LAN helper for Ikaros
   tags: [aegis, wol]
   ansible.builtin.template:

ansible/roles/profile_aegis/templates/00-aegis-hardening.conf.j2

@@ -0,0 +1,6 @@
+# Managed by Ansible. Do not edit manually.
+PermitRootLogin no
+PubkeyAuthentication yes
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+AllowUsers {{ aegis_ssh_allowed_users | join(' ') }}

ansible/roles/profile_aegis/templates/10-adguard-dns.conf.j2

@@ -0,0 +1,3 @@
+# Managed by Ansible. Do not edit manually.
+[Resolve]
+DNSStubListener=no

ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<service>
+  <short>Aegis AdGuard Home web interface</short>
+  <description>AdGuard Home administrative web interface on Aegis.</description>
+  <port protocol="tcp" port="{{ aegis_adguard_web_port }}"/>
+</service>

ansible/roles/profile_workstation_dev_wsl/tasks/main.yml

@@ -66,14 +66,27 @@
   changed_when: false
   failed_when: false
 
-- name: Install the pinned Java version with Mise
-  tags: [packages, mise, java, wsl]
+- name: Check whether the pinned Maven version is installed with Mise
+  tags: [packages, mise, maven, wsl]
+  ansible.builtin.command:
+    cmd: "mise where maven@{{ workstation_mise_maven_version }}"
+  become_user: "{{ username }}"
+  environment:
+    HOME: "{{ user_home }}"
+  register: workstation_mise_maven_where
+  changed_when: false
+  failed_when: false
+
+- name: Install the pinned Mise tools
+  tags: [packages, mise, java, maven, wsl]
   ansible.builtin.command:
     cmd: mise install
   become_user: "{{ username }}"
   environment:
     HOME: "{{ user_home }}"
-  when: workstation_mise_java_where.rc != 0
+  when: >-
+    workstation_mise_java_where.rc != 0 or
+    workstation_mise_maven_where.rc != 0
 
 - name: Ensure WSL boot configuration file exists
   tags: [packages, services]

ansible/site.yml

@@ -35,7 +35,7 @@
     - role: dotfiles_common
       when:
         - "'platform_rocky' not in group_names"
-        - "'platform_fedora_coreos' not in group_names"
+        - "'platform_fedora_iot' not in group_names"
 
 - name: Configure Void platform
   hosts: platform_void
@@ -71,7 +71,7 @@
     - packages_rocky
     - services_systemd
 
-- name: Configure Aegis Fedora CoreOS profile
+- name: Configure Aegis Fedora IoT profile
   hosts: role_aegis
   become: true
 

dotfiles/workstation_dev_wsl/.config/mise/config.toml

@@ -1,2 +1,3 @@
 [tools]
 java = "temurin-11.0.31+11"
+maven = "3.9.16"

secrets/vault.yml

@@ -1,40 +1,40 @@
 $ANSIBLE_VAULT;1.1;AES256
-31333936393638613266313236303037323963333839336537656538623730326661346335346361
-3635303665316130666139363462616230353763396439650a346463613033626365306666323638
-37343734316534653437643834383139613562353538303838383137636361663530313432343030
-3132333139346363630a343338336235613062336639633431643737383638363131316536363630
-31643031626666616537303538393134326335666165636362313861306362623939396337653365
-65386165343130613332363361313261353930396536396134323038623764326630653431633430
-33386463313266373531343365333734336433656635663130613334333666376336316232323836
-36373961373661323361363739623665616162323630396166616232613234623338613664303332
-30623361363663396633333865343461616334636439376631646236313538663363336432623765
-36323435626265333063326232663334376234303735313761306130623739323663333563363461
-61383066333639323034616535333535373666346337613035656635313466666362313130633035
-63383465663464363238643666653462656635626137613531343961336166373732323863613162
-62386263376231653836336331653064316430656661336137316432363464376435373136383630
-32633134383861616266643534303934396531343065376338653663356339343236356362393164
-39616464623232646536376630646239626131373938323337323261663536323135623736333534
-32393766663131376662666462666135616262353366336230336134383565656238313663626435
-62636333326331346661646135313766363935393563333939323336363163306132333534626361
-66623261376639646563306464623836306163396565326266366663386239306138333837376230
-34616230623336653633303864353434666335323936343366653733396463653838646534393265
-34393138656538373732616165646237353833313365383035346532613461613766653765366336
-37613963386333666662323731656237343862383837633734363333613537623836666339383731
-34313966383739383937343332613931656236336365643135373235343331346163333332313139
-30333035663361393266303464376464623864653631306430353830383935643930313132623936
-33303135386434366365396339636631633139663030323237646165376263666430626634333936
-34333638333638613339343437396566323435323361323061666338356130333032613736633735
-61643033383131306430653039633161343039303438373761386132626135613839313465353934
-38636533353465633231326665336130616462303730333733306533326466346665333239306662
-32336133346236316433353766356336653039303563623763396665653237383335316562376534
-61386464626264363436656362303233633833623835623630656635353962333264393466663865
-39626530323539656566326631316461303931323330356534316236616636613433363233303531
-30326463636162653935663361653363313633323635613666616437386537653532656461653131
-34376663393364356432656331383830633832363030643831303135393039343838303636616336
-64666132353364373235646637353934656264313330646530393637663063326134363166613037
-63373037333939363935316266363633316236373434363430323535393530383066396238653166
-34653666666435633832623139353330396235616134633339643932316432363263646263613863
-38343337353137653239623162656465363562643031353939653634323734663765356335316466
-31653636626538303161626334643235643236666130613437643930306263336564373465303564
-38353832313732376336643635613536336130393365336239303862393838323632303831656664
-333665383162333661393336643863376438
+65623833316230316230376465656261383230643661393032396462643232383334383236653134
+3964353234623165633736303035623132643565393461660a323930623462323635613361373836
+37613164656538353734333932326136303532346161663238613466616236636432346534626331
+3434663266366637650a336235363033333562626135333962626265666332386261643666306638
+64343262353661346435326662633833656533643464653665356233316466333432303536356539
+32623430303663616261386636613534326231613366636536303761646335396132623231336361
+61656337313766353533643266396230626439353033373630666336616230316362616135323462
+30306633373234386639633932393437323931613739383135353835393630623937636639343338
+35636530643330376538393262383738333735656230363633383463386366343065633961663562
+37653264326565376166666262643136616333656233386564333030663532353836306131316530
+62633738306434303236623239646638613230323434393761656265393064373235333435393264
+36363936336330636433643133346164643733356239616530653831626165316238643834356236
+36333262313764653137633930663131306132306434376433306230306564366633363738313634
+35316230623134623932396132316530366662643366643439643334366233646334633764346266
+35373764633138343235323931346134613265356238616138323134326338633335336339313862
+61653939366263386431636334333661306538643166353661336561396365366434353830643465
+31626136626336633363653531363064643534396336623331363130313966653966373636663232
+65653132363139653239383636333861323435613362666637366162323062376139633033373563
+66656134313931313965303134613836383534636438363936353836326639346565653031363839
+63623738366261363734376536646532396231616233303061363364383238616434333366613933
+63616539613336393863633361303466353738313666393164343638373530376666663666666235
+33666234353736633335343639623664326566333162333539636235346663663737366432366665
+66373831303666666533343234373466333132343135326261663532663062313939623963383437
+34653732653830313638343631313437623931623531323566306232373165636662316633333438
+66666537623966623932323463323330316337613637383339613637653637333832623965636434
+34653330336663323263353636353139323337646166623862343565646637616136646232373633
+33356134373464646664303865353763323531383661323930353038646333386366353665396431
+64303739643735376235626134663566343165646433393966373961393738323036353437346436
+66656166306561353637623462303039393465363261343164393062643130383736623261383232
+38623036626464613138363635646233323737653137633830316138663835656633336663626338
+33386232633862616432396662343738343462623263303337393533313264396637356134373739
+61323266623665353631316461633462646536386266343934356235363065653162363566623661
+35643332303333306362303538333034316461326363653632313765396664643533373862333533
+37306536356465393933366238663031653630386239383839316365323761316236326330306637
+36373434643864343064646437323736393330326361663231373933613864303339653661616139
+36356134636136333830663031656132656237383331663362313238653133366538323462376632
+63373766383939656265313934636462626633376162623931333363393837303336363036303439
+32643730383735383535633439326564376261343937343934366366373039653761383934316162
+383035326562353431616536646238323164