From 538a9bc899b487f5cd6716b8754cf23bcd679fa6 Mon Sep 17 00:00:00 2001 From: Olufunke Moronfolu Date: Wed, 22 Oct 2025 08:54:32 +0200 Subject: [PATCH 1/9] feat: cloud structure for private connectivity --- .../mendix-cloud-deploy/connecting-external-resources.md | 9 +++++++++ .../mendix-cloud-deploy/environments-details.md | 2 ++ 2 files changed, 11 insertions(+) create mode 100644 content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md diff --git a/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md b/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md new file mode 100644 index 00000000000..9dddc6612a8 --- /dev/null +++ b/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md @@ -0,0 +1,9 @@ +--- +title: "Connecting to External Resources" +url: /developerportal/deploy/connecting-to-external-resource/ +weight: 80 +description: "How to connect to external resource using private connectivity" +beta: true + +#If moving or renaming this doc file, implement a temporary redirect and let the respective team know they should update the URL in the product. See Mapping to Products for more details. +--- diff --git a/content/en/docs/deployment/mendix-cloud-deploy/environments-details.md b/content/en/docs/deployment/mendix-cloud-deploy/environments-details.md index 60e38fa5306..d7037404665 100644 --- a/content/en/docs/deployment/mendix-cloud-deploy/environments-details.md +++ b/content/en/docs/deployment/mendix-cloud-deploy/environments-details.md @@ -218,6 +218,8 @@ For more information, see [Scheduled Events](/refguide/scheduled-events/). On the **Network** tab, you can manage the elements described below. +### Connections + ### Custom Domains {#custom-domains} * **Domain Name** From 91691936d45d43427c7d933317f949cbae1bcc7d Mon Sep 17 00:00:00 2001 From: nicoletacoman Date: Wed, 22 Oct 2025 09:21:24 +0200 Subject: [PATCH 2/9] Added Control Center structure --- .../security/private-connectivity/_index.md | 17 ++++++++++ .../configure-private-connectivity.md | 33 +++++++++++++++++++ .../security/set-up-sso-byoidp.md | 2 +- 3 files changed, 51 insertions(+), 1 deletion(-) create mode 100644 content/en/docs/control-center/security/private-connectivity/_index.md create mode 100644 content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md diff --git a/content/en/docs/control-center/security/private-connectivity/_index.md b/content/en/docs/control-center/security/private-connectivity/_index.md new file mode 100644 index 00000000000..8e7af24bb75 --- /dev/null +++ b/content/en/docs/control-center/security/private-connectivity/_index.md @@ -0,0 +1,17 @@ +--- +title: "Private Connectivity" +linktitle: "Private Connectivity" +url: /control-center/private-connectivity/ +description: "Describes the Private Connectivity section in the Mendix Control Center." +weight: 30 +--- + +## Introduction + +## Privacy Benefits + +## Frequently Asked Questions + +## Resources + +For information on how to configure and use Mendix Private Connectivity, refer to [Configuring and Using Private Connectivity](/control-center/configure-private-connectivity/). \ No newline at end of file diff --git a/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md b/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md new file mode 100644 index 00000000000..be2c9959793 --- /dev/null +++ b/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md @@ -0,0 +1,33 @@ +--- +title: "Configuring and Using Private Connectivity" +linktitle: "Configuring and Using Private Connectivity" +url: /control-center/configure-private-connectivity/ +description: "Describes the configuration steps of Private Connectivity in the Mendix Control Center." +weight: 1 +--- + +## Networks + + +### Adding a Network + + +### Viewing and Editing Networks + + +## Agents + + +### Adding an Agent + + +### Viewing Agent Details + + +## Resources + + +## Connections + + +## Activities diff --git a/content/en/docs/control-center/security/set-up-sso-byoidp.md b/content/en/docs/control-center/security/set-up-sso-byoidp.md index 20bdbff6b8c..0413dd9609c 100644 --- a/content/en/docs/control-center/security/set-up-sso-byoidp.md +++ b/content/en/docs/control-center/security/set-up-sso-byoidp.md @@ -1,7 +1,7 @@ --- title: "Setting Up an SSO (BYOIDP)" url: /control-center/security/set-up-sso-byoidp/ -weight: 30 +weight: 40 description: "Describes how you can use your company IdP to authenticate to Mendix." aliases: - /developerportal/control-center/set-up-sso-byoidp/ From fb5274532557e46e874cf2190b4258de12a70d31 Mon Sep 17 00:00:00 2001 From: Olufunke Moronfolu Date: Mon, 27 Oct 2025 09:24:43 +0100 Subject: [PATCH 3/9] updating with private connectivity feature details --- .../security/private-connectivity/_index.md | 33 +- .../configure-private-connectivity.md | 312 +++++++++++++++++- .../connecting-external-resources.md | 37 +++ .../environments-details.md | 18 +- 4 files changed, 388 insertions(+), 12 deletions(-) diff --git a/content/en/docs/control-center/security/private-connectivity/_index.md b/content/en/docs/control-center/security/private-connectivity/_index.md index 8e7af24bb75..496a1f4a3d2 100644 --- a/content/en/docs/control-center/security/private-connectivity/_index.md +++ b/content/en/docs/control-center/security/private-connectivity/_index.md @@ -7,10 +7,39 @@ weight: 30 --- ## Introduction +On the **Private Connectivity** page, you view and manage your company's Private Connectivity assets: networks, agents, resources and connections. -## Privacy Benefits +## Use Cases +Many applications running on Mendix Cloud have integrations with external resources, such as database, services and other applications. Some of these resources are public, accessible via the public internet. Other are running on your internal networks, either on-premises or on cloud infrastructure (PaaS/SaaS). You can connect to these resources over the public internet as well, [securing](/developerportal/deploy/securing-outgoing-connections-from-your-application/) them with HTTPS, a reverse proxy and client certificates. You will have to expose your internal resource to public internet in this scenario. Not all of our customers want to or are able to do this. This could be due to security, compliance or legacy reasons. -## Frequently Asked Questions +Mendix Cloud Private Connectivity can help you with connecting your applications on Mendix Cloud to your internal resources (on-premises and in the cloud) securely and privately. That means that the connection will not go over the public internet, but through a private tunnel. +Mendix Cloud Private Connectivity results in a private tunnel between your applications on Mendix Cloud and your own infrastructure. This can be an on-premises datacenter or infrastructure in the cloud, for example on AWS, Azure or GCP. You can also connect multiple networks running on different infrastructure. Through the tunnel, you can connect from your applications on Mendix Cloud to resources running on your own infrastructure. Mendix Cloud Private Connectivity only supports outgoing connections, that is, connections that are initiated from your applications on Mendix Cloud towards resources on your own infrastructure. You won't be able to connect to your applications on Mendix Cloud from an external client over the private tunnel. + +Using Private Connectivity, you can retrieve data from an Microsoft SQL database on Azure into your Mendix application. You could also connect to a Kafka broker running on your own AWS account. Or connect to an SAP system running on your on-premises data center. All securely and privately, without exposing these internal resources to the public internet. + +## Tailscale {#private-connectivity-tailscale} +Mendix partners with [Tailscale](https://tailscale.com) to offer Private Connectivity. Tailscale is a recognized leader in secure networking. Tailscale provides a secure, private mesh network solution built on the high-performance and modern cryptography of the WireGuard® protocol. Mendix will create all the assets required to create a private connection for our customers on the Tailscale platform. Neither Tailscale nor Mendix can access the data that is sent over the Tailscale network. All traffic is [encrypted](https://tailscale.com/kb/1504/encryption) end-to-end, with separate keys and public key infrastructure for each network. + +## Architecture {#private-connectivity-architecture} +Mendix has an enterprise account with Tailscale. Within our Tailscale account, we will create _networks_ for each of our customers. Each network is dedicated to one customer. You can have multiple networks, for example to isolate their production traffic from your non-production traffic. +Next, you must install _agents_ in your own infrastructure. These agents are connectivity tools that initiate an outgoing connection to the network created for you. Agents require authentication keys that are managed on the Mendix platform. Agents can only connect to the network their authentication key is linked to. Agents can be installed directly into the network hosting the resources you want to connect to. Or they can be installed in a separate network from where they have access to the resources. An agent can connect to only one network, but you can install multiple agents that connect to the same network. For example, you can install an agent in your on-premises data center and another agent in your AWS account, so that your applications on Mendix Cloud can connect to resources on both infrastructures. +Once agents are installed, you must expose _resources_ through your agents. These resources are subnets of network. They will be available through the agent (not the public internet). Resources exposed via agents must always first be enabled on the Mendix platform, before they can be connected to from your applications on Mendix Cloud. This gives you full control over what resources are accessible. +When resources are exposed and enabled, you can add _connections_. Connections link a specific application environment to a specific resource. Connections must be requested and only if they are approved, an application on Mendix Cloud can connect to the resource on the other side of the connection. This four-eye principle allows for governance over your connections, giving you full control over what application environment can access what resource. Approved connections can be disabled at any time, retracting the access from the application environment to the resource. You can add multiple connections for each application environment, giving them access to resources on your on on-premises data center as well as resources on your AWS account, for example. +Mendix will install a Tailscale agent in the application container of each application environment with one or more approved connections. As the Tailscale agent is running inside the application container, only that application can access your network and approved connections, ensuring other applications don't have access. + +## Frequently Asked Questions {#private-connectivity-faq} + +### Does Mendix or Tailscale have access to my data? +No. All data going over the Tailscale network is [encrypted](https://tailscale.com/kb/1504/encryption) end-to-end, with separate keys and public key infrastructure for each network. Neither Tailscale nor Mendix can access the data that is sent over the Tailscale network. + +### Is Tailscale SOC2-compliant? +Yes, [Tailscale has completed a SOC 2 Type II certification](https://tailscale.com/security). + +### Do I need to sign up for my own Tailscale account? +No, you don't need to sign up for a Tailscale account yourself. All assets required for Mendix Cloud Private Connectivity will be created within Mendix' Tailscale account. This is similar how we create all resources required to run your applications on Mendix Cloud in Mendix' AWS account. + +### Can I connect my existing Tailscale networks? +At this time, it is not possible to connect to an existing Tailnet if you're existing Tailscale customer. ## Resources diff --git a/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md b/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md index be2c9959793..a0e26ed559f 100644 --- a/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md +++ b/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md @@ -5,29 +5,325 @@ url: /control-center/configure-private-connectivity/ description: "Describes the configuration steps of Private Connectivity in the Mendix Control Center." weight: 1 --- +## Introduction +To connect from an application on Mendix Cloud to a resource on your internal network, you will have to go though several steps: +* Add a network - This is done on the Mendix platform +* Add an agent- This is done on the Mendix platform +* Install an agent- This is done on your internal infrastructure +* Run the agent- This is done on your internal infrastructure +* Expose resources - This is done on the Mendix platform +* Enable resources- This is done on the Mendix platform +* Request a connection- This is done on the Mendix platform +* Approve the connection- This is done on the Mendix platform +* Configure DNS (optional)- This is done on the Mendix platform -## Networks +## Networks {#private-connectivity-networks} +Mendix Cloud Connect networks are the bridge between Mendix Cloud and your own infrastructure. You will need at least one network to be able to connect from an application on Mendix Cloud to your own infrastructure. You can create multiple networks, for example to isolate your production traffic from non-production traffic. +On the **Networks** tab of the [Private Connectivity](https://privateconnectivity.mendix.com) page in Control Center, you can see all the networks of your company. The page shows the following information for each network: +* Network - The name of the network. +* External Agents - The number of agents installed in your internal infrastructure, that are connected to the network. +* Environments - The number of application environments on Mendix Cloud that have at least one connection using the network. -### Adding a Network +### Adding a Network {#private-connectivity-networks-add} +To add a new network for your company, follow these steps: +1. Open the [Private Connectivity](https://privateconnectivity.mendix.com) page in Control Center. +2. + * If you don't have a network yet, click **Create a Network** to launch the network wizard. + * If you already have a network, click on **Add Network** on the **Networks** tab. +3. On the **Instructions** step of the wizard, you will find a short summray of the steps required to connect from an application on Mendix Cloud to a resource on your own network. +4. On the **Create Network** step of the wizard, provide a name for your new network. Make sure the name is descriptive and recognizable. Click **Create**. +5. You will need at least one agent for every network. On the **Add Agent** tab of the wizard, provide a name for the new agent for your new network. Make sure the name is descriptive and recognizable. Click **Add**. +Your network and agent are now added. You can continue with [installing the agent](#private-connectivity-agents-install) in your own infrastructure and [configuring the DNS](#private-connectivity-networks-dns) for your network. -### Viewing and Editing Networks +### Viewing and Editing Networks {#private-connectivity-networks-details} +To view and edit an existing network, follow these steps: +1. On the **Networks** tab, find the network that you want to view the details or edit, click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) and select **Details**. +The details of that network will be shown. This includes +* Network Name - The name you gave to the network. You can edit this. Make sure the name is descriptive and recognizable. +* Network ID - The internal ID of your network. You can copy this, for example to provide it in a support ticket if you have issues with the network. +* External Agents - A list of all external agents, running on your own internal infrastructure, that have access to the network. The status of each agent is shown as well. +* DNS Details - A list of dommains for which you have [configured DNS](#private-connectivity-networks-dns). +* Environment Details - A list of applications environments that are using the network to connect to a resource. +* Show Logs - This will show [the flow logs](https://tailscale.com/kb/1219/network-flow-logs) for your network. This can help you troubleshoot issues with connectivity on your NEtwork. -## Agents +Click **Save** to save changes you made. +### Configuring DNS for your Network {#private-connectivity-networks-dns} +If your Mendix application is connecting to external resources, you probably want to do this using host names. DNS (Domain Name System) servers (nameservers) translate a host name, like `www.mendix.com` to an IP address, like `192.168.1.1`. If the DNS record with that translation is on a public nameserver, this is not a problem, as Mendix applications can access those by default. But if you want to connect to a private host name, like `mydatabase.myinternalnetwork.net`, where the DNS record for this host name is stored on a private nameserver, your Mendix application will not be able to resolve the host name to an IP address, making the host inaccessible for the Mendix application. +With Mendix Cloud Private Connectivity, you can configure your network to use restricted nameservers for specific domains. Using a restricted nameserver is also known as split DNS. If you configure an internal nameserver for a domain, for example `myinternalnetwork.net`, any DNS request for host names within that domain, for example `mydatabase.myinternalnetwork.net` will be forwarded to the configured nameserver. There, the host name will be resolved to an IP address. This will allow you to use internal host names to connect to resources on your internal infrastructure, without having to add the DNS records for those internal resources on a public DNS server. -### Adding an Agent +To configure spli DNS for a new domain on your network, follow these steps: +1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network and select **Add DNS**. +2. On the **Edit DNS** dialog, click **Add New Domain**. +3. Provide the following information: +* Domain - Provide the domain for which the nameservers should be used, for example `myinternalnetwork.net`. +* Nameservers - Provide the IP address of the nameserver to use to resolve DNS queries for the provided domain. You can add multiple nameserver IP addresses for high-availability. +Click **Save** to save changes. -### Viewing Agent Details +To remove split DNS for a domain on your network, follow these steps: +1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network and select **Add DNS**. +2. On the **Edit DNS** dialog, find the domain you want to add a nameserver for and click **Delete Domain** and then confirm that you want to delete it. +To add a nameserver for a domain you added to your network before, follow these steps: +1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network and select **Add DNS**. +2. On the **Edit DNS** dialog, find the domain you want to add a nameserver for and click **Add New Nameserver**. +3. Provide the following information: +* Nameservers - Provide the IP address of the nameserver to use to resolve DNS queries for the provided domain. You can add multiple nameserver IP addresses for high-availability. -## Resources +Click **Save** to save changes. +To remove a nameserver for a domain you added to your network before, follow these steps: +1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network and select **Add DNS**. +2. On the **Edit DNS** dialog, find the domain you want to delete a nameserver for, click **Delete Nameserver** for the nameserver you want to delete and then confirm that you want to delete it. -## Connections +### Deleting Networks {#private-connectivity-networks-delete} +To delete a network you have created before, follow these steps: +1. On the **Networks** tab, find the network that you want to delete, click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}), select **Delete** and then confirm that you want to delete it. +Deleting a network will delete all agents connected to that network, revoke the agents' authentication keys, remove all resources exposed through the agents and all connections to those resources. Approved connections will be broken immediately. Deleting a network will not uninstall the connected agents from your own infrastructure! + +See below for instructions on [uninstalling an agent](#private-connectivity-agents-uninstall). + +## Agents {#private-connectivity-agents} +To connect your own infrastructure to your Mendix Cloud Connect network(s), you need Mendix Cloud Connect agents. You will need at least one agent to be able to connect from an application on Mendix Cloud to your own infrastructure. You can connect multiple agents to each network. + +On the **Agents** tab of the [Private Connectivity](https://privateconnectivity.mendix.com) page in Control Center, you can see all the agents of your company. The page shows the following information for each agent: +* Agent - The name of the agent. +* Network -- The network the agent is connected to. +* Resources - The number of resources exposed through the agent. +* Status (last Seen) - Shows the status of the agent + * Connected - The agent is currently connected to the network. + * Date and time - The last time the agent was connected to the network. The agent is not connected at this time. + +### Adding an Agent {#private-connectivity-agents-add} +You can only add agents if you have at least one network. See [Adding a Network]() to add a network. + +To add a new agent to an existing network, follow these steps: +1. Launch the agent wizard by choosing one of the following options: + * Select a network to which you want to add an agent by clicking the ***More Options** ({{< icon name="three-dots-menu-horizontal" >}}) and selecting **Add Agent** on the **Networks** tab. + * Click **Add Agent** on gents** tab and click **Add Agent**. +2. On the **Add Agent** step of the wizard, select the network you want to add the agent to. +3. Provide a name for the agent. Make sure the name is descriptive and recognizable. +4. Select the infrastructure type for your agent. +5. Click **Create**. + +Your agent is now added. You can continue with [installing the agent](#private-connectivity-agents-install) in your own infrastructure. + +### Viewing and Editing Agents {#private-connectivity-agents-details} +To view and edit an existing agent, follow these steps: +1. On the **Agents** tab, find the network that you want to view the details or edit, click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) and select **Details**. + +The details of that agent will be shown. This includes: +* Agent Name - The name you gave to the agent. You can edit this. Make sure the name is descriptive and recognizable. +* Agent ID - The internal ID of your agent. You can copy this, for example to provide it in a support ticket if you have issues with the agent. +* Agent Key - The authentication key of your agent. You can copy this authentication key to configure it when [starting an agent](#private-connectivity-agents-run). This key should be treated as confidential. +* Network -- The network the agent is connected to. +* Status (last Seen) - Shows the status of the agent + * Connected - The agent is currently connected to the network. + * Date and time - The last time the agent was connected to the network. The agent is not connected at this time. +* Resource Details - A list of the resources exposed via the agent. +* DERP Details - Information on the preferred Tailscale [Designated Encrypted Relay for Packets (DERP) server](https://tailscale.com/kb/1232/derp-servers). + +Click **Save** to save changes you made. + +### Deleting an Agent {#private-connectivity-agents-delete} +To delete an existing agent, follow these steps: +1. On the **Agents** tab, find the agent that you want to delete, click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}), select **Delete** and then confirm that you want to delete it. + +Deleting an agent will automatically revoke its authentication key, remove all resources exposed through the agent and all connections to those resources. Approved connections will be broken immediately. +Deleting an agent will not uninstall the agent from your own infrastructure! See below for instructions on [uninstalling an agent](#private-connectivity-agents-uninstall). + +### Installing an Agent in your own infrastructure {#private-connectivity-agents-install} +To establish a connection between your network and your infrastructure, you must install an agent on this infrastructure. Installing an agent is typically done by your internal IT, Infra or Network team. + +#### Installing an Agent on a Windows Server {#private-connectivity-agents-install-windows} +To install an agent on a Windows server, follow these steps: +1. Open the [Tailscale Download page](https://tailscale.com/download/windows). +2. Select **Windows** and click **Download Tailscale for Windows** +This will download the Tailscale installer for Windows. Run the installer to install the agent. Then continue with [starting the agent](#private-connectivity-agents-run). + +#### Installing an Agent on a Linux Server {#private-connectivity-agents-install-linux} +To install an agent on a Linux server, follow these steps: +1. Run the following script on the server you want to install the agent: +```bash Linux +curl -fsSL https://tailscale.com/install.sh | sh +``` +Alternatively, open the [Tailscale Download page for Linux](https://tailscale.com/download/linux) for instructions on manually installing the Tailscale agent on your specific Linux distribution. + +After installing the agent, continue with [starting the agent](#private-connectivity-agents-run). + +### Starting an Agent in your own infrastructure {#private-connectivity-agents-run} +When you have installed your agent, you can start the agent and connect to your network. For this, you will need an authentication key. This authentication key is created when [an agent is added](#private-connectivity-agents-add). You can find the authentication key for your agent on [the agent details page](#private-connectivity-agents-details). + +To start an agent and to connect it to your network, run the following script on the machine where the agent is installed, where you replace `AUTH_KEY` with the authentication key of your agent: +```shell Windows +tailscale up --auth-key= +``` +```bash Linux +tailscale up --auth-key= +``` + +### Uninstalling an Agent in your own infrastructure {#private-connectivity-agents-uninstall} +After [deleting an agent](#private-connectivity-agents-delete), you can uninstall it from your infrastructure. Uninstalling an agent is typically done by your internal IT, Infra or Network team. + +#### Uninstalling an Agent on a Windows server {#private-connectivity-agents-uninstall-windows} +Tailscale for Windows can be uninstalled like any Windows app, by using the Windows Control Panel. Go to **Settings > Apps**, find **Tailscale**, and press the **Uninstall** button. + +If you'd like to _completely_ delete Tailscale, destroying any state or local information, you can also remove the files at the following paths: +``` +C:\ProgramData\Tailscale +C:\Users\%USERNAME%\AppData\Local\Tailscale +C:\Windows\System32\config\systemprofile\AppData\Local\Tailscale +``` + +The path under `System32` was only used in older versions of the Tailscale client and may not be present on your system. + +#### Uninstalling an Agent on a Linux server {#private-connectivity-agents-uninstall-linux} +Uninstall Tailscale by using the uninstall command of the package manager you used to install the binary in the first place: + +For all **Ubuntu and Debian** versions, uninstall using `apt-get`: +```bash Linux +sudo apt-get remove tailscale +``` + +For **CentOS 7 and Amazon Linux 2**, uninstall using `yum`: +```bash Linux +sudo yum remove tailscale +``` + +For **openSUSE Leap 15.1, 15.2, and openSUSE Tumbleweed**, uninstall using `zypper`: +```bash Linux +sudo zypper rm tailscale +``` + +For **CentOS 8, CentOS Stream 9, RHEL 8, and Fedora**, uninstall using `dnf`: +```bash Linux +sudo dnf remove tailscale +``` + +If you'd like to _completely_ delete Tailscale, destroying any state or local information, you can also remove the file at: +``` +/var/lib/tailscale/tailscaled.state +``` + +## Resources {#private-connectivity-resources} +Resources are services, such as databases or applications, on your own infrastructure that are exposed via your agents and accessible via your networks. Applications on Mendix Cloud can be connected to these resources. + +On the **Resources** tab of the [Private Connectivity](https://privateconnectivity.mendix.com) page in Control Center, you can see all the exposed resources of your company. The page shows the following information for each resource: +* Resource - The name of the resource. +* Agent - The name of the agent that exposes the resource. +* Network - The name of the network that the agent exposing the resource is connected to. +* Status - The status of the resource. This is one of the following: + * Enabled - Users can request connections to the resource. + * Disabled - Users can't request connections to the resource. +*Environments - The number of application environments on Mendix Cloud that have an approved connection to the resource. + +### Viewing and Editing Resources {#private-connectivity-resources-details} +1. On the **Resources** tab, find the resource that you want to view the details or edit, click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) and select **Details**. +The details of that resource will be shown. This includes +* Resource Name - The name you gave to the resource. You can edit this. Make sure the name is descriptive and recognizable. +* Resource ID - The internal ID of your resource. You can copy this, for example to provide it in a support ticket if you have issues with the resource. +* Resource Type - The type of the resource, this is one of the following values: +* Route - The resource is an exposed subnet route. +* Route - The exposed IP range (only if the resource type is _Route_) +* Agent - The name of the agent that exposes the resource. +* Network - The name of the agent that the agent exposing the resource is connected to. +* Status - The status of the resource. This is on of the following: + * Enabled - Users can request connections to the resource. + * Disabled - Users can't request connections to the resource. +* Environment Details - A list of applications environments that have an approved connection to the resource. + +Click **Save** to save changes you made. + +### Exposing Resources {#private-connectivity-resources-expose} +Before you can connect to resources running on your own infrastructure, you have to expose these resources through an agent. This requires you to install an agent on the machine running the resource, or on a machine that has access to the resource. + +Mendix Cloud Private Connectivity currently supports exposing physical [subnet routes](https://tailscale.com/kb/1019/subnets) to your network, via an agent. You can expose a single IP range, for example `192.0.2.0/24` or multiple IP ranges separated by a semicolon, for example `192.0.2.0/24,198.51.100.0/24`. + +#### Exposing Subnet Routes on a Windows server {#private-connectivity-resources-expose-routes-windows} +To expose subnet routes for an agent that is already running, run the following script on the machine where the agent is installed, where you replace `IP_RANGE` with the IP range(s) you want to expose: +```shell Windows +tailscale set --advertise-routes= +``` + +You can also configure the exposed subnet routes when starting the agent. In that case, use the following script, replacing `AUTH_KEY` with the authentication key of your agent and `IP_RANGE` with the IP range(s) you want to expose: +```shell Windows +tailscale up --auth-key= --advertise-routes= +``` + +#### Exposing Subnet Routes on a Linux server {#private-connectivity-resources-expose-routes-linux} +To expose subnet routes for an agent on a Linux server, follow these steps: +1. [Enable IP forwarding](https://tailscale.com/kb/1019/subnets?tab=linux#enable-ip-forwarding) +2. Run the following script on the machine where the agent is installed, where you replace `IP_RANGE` with the IP range(s) you want to expose: +```shell Linux +sudo tailscale set --advertise-routes= +``` + +You can also configure the exposed subnet routes when starting the agent. In that case, use the following script, replacing `AUTH_KEY` with the authentication key of your agent and `IP_RANGE` with the IP range(s) you want to expose: +```shell Linux +sudo tailscale up --auth-key= --advertise-routes= +``` + +### Enabling and disabling Resources {#private-connectivity-resources-enable-disable} +Once resources are [exposed](#private-connectivity-resources-expose), they must be enabled by a Mendix Admin, before users can request connections to the resource. + +To enable a resource, follow these steps: +1. On the **Resources** tab, find the resource you want to enable and click **Enable**. + +To disable a resource, follow these steps: +1. On the **Resources** tab, find the resource you want to enable and click **Disable**. + +## Connections {#private-connectivity-connections} +Mendix Cloud Connect connections allow applications on Mendix Cloud to connect to Mendix Cloud Connect resources over Mendix Cloud Connect networks. A connection has to be requested and approved, before an application on Mendix Cloud can connect to the resource. An application on Mendix Cloud can have multiple connections to multiple resources. + +On the **Connections** tab of the [Private Connectivity](https://privateconnectivity.mendix.com) page in Control Center, you can see all the connections of your company. The page shows the following information for each connection: +* App - The name of the app for the connection +* Environment - The name of the Environment for the connection +* Network -- The network for the connection. +* Resource - The name of the resource for the connection. +* Status - Shows the status of the connection. This is one of the following: + * Pending - The connection was requested, but not yet approved. The app environment can't connect to the resource using this connection. + * Approved - The connection is approved. The app environment can connect to the resource using this connection. + * Rejected - The connection is rejected. The app environment can't connect to the resource using this connection. + +### Viewing Connection Details {#private-connectivity-connections-details} +To view an existing connection, follow these steps: +1. On the **Connections** tab, find the connection that you want to view the details or edit, click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) and select **Details**. + +The details of that connection will be shown. This includes: +* Request Details - The details of the connections request: + * Name - The name of the user that requested this connection. + * Status - The status of the connection request. This is one of the following: + * Pending - The connection was requested, but not yet approved. The app environment can't connect to the resource using this connection. + * Approved - The connection is approved. The app environment can connect to the resource using this connection. + * Rejected - The connection is rejected. The app environment can't connect to the resource using this connection. + * Date - The data and time the connection was requested. +* App - The name of the app for the connection +* Environment - The name of the Environment for the connection +* Network -- The network for the connection. +* Resource - The name of the resource for the connection. +* Resource ID - The internal ID of your resource. You can copy this, for example to provide it in a support ticket if you have issues with the resource. +* Agent - The name of the agent for the connection. +* Agent ID - The internal ID of the agent. You can copy this, for example to provide it in a support ticket if you have issues with the agent. +* Network - The name of the network for the connection. +* Network ID - The internal ID of the network. You can copy this, for example to provide it in a support ticket if you have issues with the Network. + +Click **Save** to save changes you made. + +## Approving and Rejecting Connections {#private-connectivity-connections} +Once a connection is requested, it must be approved before the app enviroment can connect to the resource. + +To approve a connection, follow these steps: +1. On the **Connections** tab, find the connection you want to enable and click **Approve**. + +If this is the first connection that is approved for an app environment, you must [redeploy](/developerportal/deploy/mendix-cloud-deploy/deploying-an-app/) the environment to be able to use the connection! + +To disable a connection, follow these steps: +1. On the **Connections** tab, find the connection you want to enable and click **Reject**. ## Activities +On the Activity tab, you can view a log of activities performed on your Private Connectivity assets. \ No newline at end of file diff --git a/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md b/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md index 9dddc6612a8..ca52a4f0cea 100644 --- a/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md +++ b/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md @@ -7,3 +7,40 @@ beta: true #If moving or renaming this doc file, implement a temporary redirect and let the respective team know they should update the URL in the product. See Mapping to Products for more details. --- + +## Introduction + +[Mendix Cloud Private Connectivity](/control-center/private-connectivity/) can help you with connecting your applications on Mendix Cloud to your internal resources (on-premises and in the cloud) securely and privately. That means that the connection will not go over the public internet, but through a private tunnel. + +## Connections {#connections} + +Mendix Cloud Connect Connections allow applications on Mendix Cloud to connect to Mendix Cloud Connect Resources over Mendix Cloud Connect Networks. A Connection has to be requested and approved, before an application on Mendix Cloud can connect to the Resource. An application on Mendix Cloud can have multiple Connections to multiple Resources. + +The [Connections](/developerportal/deploy/environments-details/#connections) section on your application environment's Details page allows Technical Contacts to view all submitted connection requests and track request status. + +### Requesting a New Connection {#connections-add} + +Once a network has been created, agents have been added and installed, and Resources have been exposed and enabled, you can request a Connection from an application environment to of the approved Resources. + +To request a new Connection for a specific application environment, follow these steps: +1. From [Apps](https://sprintr.home.mendix.com), go to the app's **Environments** page. +2. Click **Details** ({{% icon name="notes-paper-edit" %}}) on the desired environment. +3. Go to the **Network** tab. +4. The **Connections** section allows for managing connections for a single environment. +5. Click **Add** to request a new connection. +6. On the **Add Connection** dialog, select an available network to view the resources exposed on that network. +7. Select the resource you would like to connect to from the application environment. +8. All submitted connection requests appear in the Control Center for the Mendix Admin review. Click **Send Request**. +9. Track and manage your connection requests from the [Connections](/developerportal/deploy/environments-details/#connections) section on your application environment's Details page. + +### Cancelling a Connection Request {#connections-cancel} + +To cancel a pending connection request, follow these steps: +1. On the [Connections](/developerportal/deploy/environments-details/#connections) section on your application environment's Details page, click **Cancel**. + +### Deleting a Connection + +To delete an approved connection, follow these steps: +1. On the [Connections](/developerportal/deploy/environments-details/#connections) section on your application environment's Details page, click **Delete**. + +Deleting a connection, will immediately break the connection between the application environment and the resource. \ No newline at end of file diff --git a/content/en/docs/deployment/mendix-cloud-deploy/environments-details.md b/content/en/docs/deployment/mendix-cloud-deploy/environments-details.md index d7037404665..ee0d2ed6926 100644 --- a/content/en/docs/deployment/mendix-cloud-deploy/environments-details.md +++ b/content/en/docs/deployment/mendix-cloud-deploy/environments-details.md @@ -218,7 +218,21 @@ For more information, see [Scheduled Events](/refguide/scheduled-events/). On the **Network** tab, you can manage the elements described below. -### Connections +### Connections {#connections} +You can connect from your applications on Mendix Cloud to resources on your own infrastructure using Mendix Cloud Private Connectivity. + +The **Connections** overview contains the following information: + +* **Resource** +* **Network** +* **Status (Last seen** + +You can perform the following actions for connections: +* **Add** a new connection +* **Cancel** a connection request +* **Delete** a connection + +For more information, see [Connecting to External Resources](/developerportal/deploy/connecting-to-external-resource/). ### Custom Domains {#custom-domains} @@ -562,4 +576,4 @@ One custom service is available: Mendix Event Broker. This service is required t ### Enabling Custom Services -Custom services are only available if the app's Technical Contact has enabled them. The custom services are enabled or disabled separately for each environment of each app. For more information, see [Services](/developerportal/deploy/environments/#services) in the *Environments* documentation. +Custom services are only available if the app's Technical Contact has enabled them. The custom services are enabled or disabled separately for each environment of each app. For more information, see [Services](/developerportal/deploy/environments/#services) in the *Environments* documentation. \ No newline at end of file From caea84b4cd71881611cc797edfbb01040220119c Mon Sep 17 00:00:00 2001 From: nicoletacoman Date: Mon, 27 Oct 2025 15:46:55 +0100 Subject: [PATCH 4/9] TW review + release note (Control Center) --- .../security/private-connectivity/_index.md | 66 ++- .../configure-private-connectivity.md | 531 +++++++++++------- .../releasenotes/control-center/_index.md | 7 + 3 files changed, 389 insertions(+), 215 deletions(-) diff --git a/content/en/docs/control-center/security/private-connectivity/_index.md b/content/en/docs/control-center/security/private-connectivity/_index.md index 496a1f4a3d2..82ca0f1d69c 100644 --- a/content/en/docs/control-center/security/private-connectivity/_index.md +++ b/content/en/docs/control-center/security/private-connectivity/_index.md @@ -7,39 +7,77 @@ weight: 30 --- ## Introduction -On the **Private Connectivity** page, you view and manage your company's Private Connectivity assets: networks, agents, resources and connections. + +The **Private Connectivity** page allows you to view and manage your company's Private Connectivity assets: networks, agents, resources, and connections. ## Use Cases -Many applications running on Mendix Cloud have integrations with external resources, such as database, services and other applications. Some of these resources are public, accessible via the public internet. Other are running on your internal networks, either on-premises or on cloud infrastructure (PaaS/SaaS). You can connect to these resources over the public internet as well, [securing](/developerportal/deploy/securing-outgoing-connections-from-your-application/) them with HTTPS, a reverse proxy and client certificates. You will have to expose your internal resource to public internet in this scenario. Not all of our customers want to or are able to do this. This could be due to security, compliance or legacy reasons. -Mendix Cloud Private Connectivity can help you with connecting your applications on Mendix Cloud to your internal resources (on-premises and in the cloud) securely and privately. That means that the connection will not go over the public internet, but through a private tunnel. -Mendix Cloud Private Connectivity results in a private tunnel between your applications on Mendix Cloud and your own infrastructure. This can be an on-premises datacenter or infrastructure in the cloud, for example on AWS, Azure or GCP. You can also connect multiple networks running on different infrastructure. Through the tunnel, you can connect from your applications on Mendix Cloud to resources running on your own infrastructure. Mendix Cloud Private Connectivity only supports outgoing connections, that is, connections that are initiated from your applications on Mendix Cloud towards resources on your own infrastructure. You won't be able to connect to your applications on Mendix Cloud from an external client over the private tunnel. +Many apps running on Mendix Cloud have integrations with external resources, such as databases, services, and other applications. Some of these resources are public, accessible via the public internet. Others are running on your internal networks, either on-premises or on cloud infrastructure, as PaaS/SaaS. You can connect to these resources over the public internet as well, [securing](/developerportal/deploy/securing-outgoing-connections-from-your-application/) them with HTTPS, a reverse proxy, and client certificates. This scenario requires you to expose your internal resource to the public internet. However, due to security, compliance, or legacy reasons, not everyone wants to or is able to do this. + +Mendix Cloud Private Connectivity helps you securely and privately connect your Mendix apps to your internal resources. This means that the connection will not go over the public internet, but through a private tunnel between your Mendix apps and your own infrastructure. This can be an on-premises data center or a cloud infrastructure, such as AWS, Azure or GCP. You can also connect multiple networks running on different infrastructures. + +Mendix Cloud Private Connectivity only supports outgoing connections, meaning connections that are initiated from your Mendix apps towards resources on your own infrastructure. You will not be able to connect to your Mendix Cloud apps from an external client over the private tunnel. -Using Private Connectivity, you can retrieve data from an Microsoft SQL database on Azure into your Mendix application. You could also connect to a Kafka broker running on your own AWS account. Or connect to an SAP system running on your on-premises data center. All securely and privately, without exposing these internal resources to the public internet. +Private Connectivity allows you to securely and privately perform actions such as the following, without exposing internal resources to the public internet: + +* Retrieving data from a Microsoft SQL database on Azure into your Mendix app +* Connecting to a Kafka broker running on your own AWS account +* Connect to an SAP system running on your on-premises data center ## Tailscale {#private-connectivity-tailscale} -Mendix partners with [Tailscale](https://tailscale.com) to offer Private Connectivity. Tailscale is a recognized leader in secure networking. Tailscale provides a secure, private mesh network solution built on the high-performance and modern cryptography of the WireGuard® protocol. Mendix will create all the assets required to create a private connection for our customers on the Tailscale platform. Neither Tailscale nor Mendix can access the data that is sent over the Tailscale network. All traffic is [encrypted](https://tailscale.com/kb/1504/encryption) end-to-end, with separate keys and public key infrastructure for each network. + +Mendix partners with [Tailscale](https://tailscale.com) to offer Private Connectivity. Tailscale is a recognized leader in secure networking, providing a secure, private mesh network solution built on the high-performance and modern cryptography of the WireGuard® protocol. Mendix generates all the assets required to create a private connection on the Tailscale platform. Neither Tailscale nor Mendix can access the data that is sent over the Tailscale network. All traffic is [encrypted](https://tailscale.com/kb/1504/encryption) end-to-end, with separate keys and public key infrastructure for each network. ## Architecture {#private-connectivity-architecture} -Mendix has an enterprise account with Tailscale. Within our Tailscale account, we will create _networks_ for each of our customers. Each network is dedicated to one customer. You can have multiple networks, for example to isolate their production traffic from your non-production traffic. -Next, you must install _agents_ in your own infrastructure. These agents are connectivity tools that initiate an outgoing connection to the network created for you. Agents require authentication keys that are managed on the Mendix platform. Agents can only connect to the network their authentication key is linked to. Agents can be installed directly into the network hosting the resources you want to connect to. Or they can be installed in a separate network from where they have access to the resources. An agent can connect to only one network, but you can install multiple agents that connect to the same network. For example, you can install an agent in your on-premises data center and another agent in your AWS account, so that your applications on Mendix Cloud can connect to resources on both infrastructures. -Once agents are installed, you must expose _resources_ through your agents. These resources are subnets of network. They will be available through the agent (not the public internet). Resources exposed via agents must always first be enabled on the Mendix platform, before they can be connected to from your applications on Mendix Cloud. This gives you full control over what resources are accessible. -When resources are exposed and enabled, you can add _connections_. Connections link a specific application environment to a specific resource. Connections must be requested and only if they are approved, an application on Mendix Cloud can connect to the resource on the other side of the connection. This four-eye principle allows for governance over your connections, giving you full control over what application environment can access what resource. Approved connections can be disabled at any time, retracting the access from the application environment to the resource. You can add multiple connections for each application environment, giving them access to resources on your on on-premises data center as well as resources on your AWS account, for example. -Mendix will install a Tailscale agent in the application container of each application environment with one or more approved connections. As the Tailscale agent is running inside the application container, only that application can access your network and approved connections, ensuring other applications don't have access. + +The following sections provide an overview of the components which make up the Private Connectivity architecture. + +### Networks + +Mendix has an enterprise account with Tailscale. Within the Mendix-owned Tailscale account, Mendix creates a dedicated network for you. You can have multiple networks if you want to, for example, isolate production traffic from non-production traffic. + +### Agents + +Next, you need to install agents on your own infrastructure. These agents are connectivity tools that initiate an outgoing connection to the network Mendix created for you. + +Agents require authentication keys that are managed on the Mendix platform, and can only connect to the network to which their authentication key is linked. +Agents can be installed directly on the network which hosts the resources to which you want to connect. Alternatively, they can be installed on a separate network from where they have access to the resources. + +An agent can connect to only one network, but you can install multiple agents that connect to the same network. For example, you can install an agent in your on-premises data center and another agent in your AWS account, so that your Mendix apps can connect to resources on both infrastructures. + +### Resources + +Once agents are installed, you need to use them to expose resources. These resources are subnets of a network. They are available through the agent, and not through the public internet. + +Resources exposed via agents must always be enabled on the Mendix platform before they can be connected to from your Mendix apps. This gives you full control over what resources are accessible. + +### Connections + +Once resources are exposed and enabled, you can add connections. Connections link a specific app environment to a specific resource. + +Connections must be requested. Only if they are approved can a Mendix app connect to the resource on the other side of the connection. This four-eye principle allows for governance over your connections, giving you full control over what app environment can access what resource. Approved connections can be disabled at any time, retracting access from the app environment to the resource. + +You can add multiple connections for each app environment, giving them access to resources on your on on-premises data center, as well as to resources on your AWS account. + +Mendix installs a Tailscale agent in the app container of each app environment with one or more approved connections. As the Tailscale agent is running inside the app container, only that specific app can access your network and approved connections. ## Frequently Asked Questions {#private-connectivity-faq} ### Does Mendix or Tailscale have access to my data? + No. All data going over the Tailscale network is [encrypted](https://tailscale.com/kb/1504/encryption) end-to-end, with separate keys and public key infrastructure for each network. Neither Tailscale nor Mendix can access the data that is sent over the Tailscale network. ### Is Tailscale SOC2-compliant? -Yes, [Tailscale has completed a SOC 2 Type II certification](https://tailscale.com/security). + +Yes, Tailscale has completed an [SOC 2 Type II certification](https://tailscale.com/security). ### Do I need to sign up for my own Tailscale account? -No, you don't need to sign up for a Tailscale account yourself. All assets required for Mendix Cloud Private Connectivity will be created within Mendix' Tailscale account. This is similar how we create all resources required to run your applications on Mendix Cloud in Mendix' AWS account. + +No, you do not need to sign up for a Tailscale account yourself. All assets required for Mendix Cloud Private Connectivity are created within the Mendix Tailscale account. This is similar how we create all resources required to run your apps on Mendix Cloud in the Mendix AWS account. ### Can I connect my existing Tailscale networks? -At this time, it is not possible to connect to an existing Tailnet if you're existing Tailscale customer. + +At this time, it is not possible to connect to an existing Tailnet if you are an existing Tailscale customer. ## Resources diff --git a/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md b/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md index a0e26ed559f..808dc0e339c 100644 --- a/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md +++ b/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md @@ -6,324 +6,453 @@ description: "Describes the configuration steps of Private Connectivity in the M weight: 1 --- ## Introduction -To connect from an application on Mendix Cloud to a resource on your internal network, you will have to go though several steps: -* Add a network - This is done on the Mendix platform -* Add an agent- This is done on the Mendix platform -* Install an agent- This is done on your internal infrastructure -* Run the agent- This is done on your internal infrastructure -* Expose resources - This is done on the Mendix platform -* Enable resources- This is done on the Mendix platform -* Request a connection- This is done on the Mendix platform -* Approve the connection- This is done on the Mendix platform -* Configure DNS (optional)- This is done on the Mendix platform + +To connect from a Mendix app to a resource on your internal network, you need to follow these steps: + +1. Add a network. This is done on the Mendix platform. +2. Add an agent. This is done on the Mendix platform. +3. Install an agent. This is done on your internal infrastructure. +4. Run the agent. This is done on your internal infrastructure. +5. Expose resources. This is done on the Mendix platform. +6. Enable resources. This is done on the Mendix platform. +7. Request a connection. This is done on the Mendix platform. +8. Approve the connection. This is done on the Mendix platform. +9. Configure DNS (optional). This is done on the Mendix platform. + +The following sections provide details on each of the steps. ## Networks {#private-connectivity-networks} -Mendix Cloud Connect networks are the bridge between Mendix Cloud and your own infrastructure. You will need at least one network to be able to connect from an application on Mendix Cloud to your own infrastructure. You can create multiple networks, for example to isolate your production traffic from non-production traffic. -On the **Networks** tab of the [Private Connectivity](https://privateconnectivity.mendix.com) page in Control Center, you can see all the networks of your company. The page shows the following information for each network: -* Network - The name of the network. -* External Agents - The number of agents installed in your internal infrastructure, that are connected to the network. -* Environments - The number of application environments on Mendix Cloud that have at least one connection using the network. +Mendix Private Connectivity networks are the bridge between Mendix Cloud and your own infrastructure. You need at least one network to be able to connect from a Mendix app to your own infrastructure. You can, however, create multiple networks, for example, to isolate your production traffic from non-production traffic. + +On the **Networks** tab of the **Private Connectivity** page, you can see all the networks associated to your company. The page shows the following information for each network: + +* **Network** — The name of the network. +* **External Agents** — The number of agents that are installed on your internal infrastructure, and that are connected to the network. +* **Environments** — The number of app environments on Mendix Cloud that have at least one connection using the network. +* **Actions** — A list of actions that you can take on the network: + + * **Details** + * **Add DNS** + * **Add Agent** + * **Edit** + * **Delete** ### Adding a Network {#private-connectivity-networks-add} + To add a new network for your company, follow these steps: -1. Open the [Private Connectivity](https://privateconnectivity.mendix.com) page in Control Center. -2. - * If you don't have a network yet, click **Create a Network** to launch the network wizard. - * If you already have a network, click on **Add Network** on the **Networks** tab. -3. On the **Instructions** step of the wizard, you will find a short summray of the steps required to connect from an application on Mendix Cloud to a resource on your own network. -4. On the **Create Network** step of the wizard, provide a name for your new network. Make sure the name is descriptive and recognizable. Click **Create**. -5. You will need at least one agent for every network. On the **Add Agent** tab of the wizard, provide a name for the new agent for your new network. Make sure the name is descriptive and recognizable. Click **Add**. -Your network and agent are now added. You can continue with [installing the agent](#private-connectivity-agents-install) in your own infrastructure and [configuring the DNS](#private-connectivity-networks-dns) for your network. +1. On the **Private Connectivity** page, click one of these buttons, depending on your scenario: + + * If you do not yet have any networks, click **Create a Network** to launch the network wizard. + * If you already have a network, click **Add Network** on the **Networks** tab. + +2. Read through the **Instructions** tab of the wizard, which contains a short summary of the steps required to connect from a Mendix app to a resource on your network, then click **Next**. +3. On the **Create Network** tab, provide a descriptive and recognizable name for your new network, then click **Create**. +4. On the **Add Agent** tab, provide a descriptive and recognizable name for the new agent, then click **Add**. + Refer to [Adding an Agent](#private-connectivity-agents-add) for details. + +Your network and agent are now added. You can continue with [installing the agent](#private-connectivity-agents-install) on your infrastructure and [configuring the DNS](#private-connectivity-networks-dns) for your network. ### Viewing and Editing Networks {#private-connectivity-networks-details} + To view and edit an existing network, follow these steps: -1. On the **Networks** tab, find the network that you want to view the details or edit, click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) and select **Details**. -The details of that network will be shown. This includes -* Network Name - The name you gave to the network. You can edit this. Make sure the name is descriptive and recognizable. -* Network ID - The internal ID of your network. You can copy this, for example to provide it in a support ticket if you have issues with the network. -* External Agents - A list of all external agents, running on your own internal infrastructure, that have access to the network. The status of each agent is shown as well. -* DNS Details - A list of dommains for which you have [configured DNS](#private-connectivity-networks-dns). -* Environment Details - A list of applications environments that are using the network to connect to a resource. -* Show Logs - This will show [the flow logs](https://tailscale.com/kb/1219/network-flow-logs) for your network. This can help you troubleshoot issues with connectivity on your NEtwork. +1. On the **Networks** tab, find the network for which you want to view details, or that you want to edit. +2. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}). +3. Select **Details**. The details of that network are displayed: -Click **Save** to save changes you made. + * **Network** — The name you gave to the network. This field is editable. + * **Network ID** — The internal ID of your network. You can copy this, for example, if you want to provide it in a support ticket for any issues with the network. + * **External Agents** — A list of all external agents that run on your own internal infrastructure, and that have access to the network. + This field also displays the status of each agent. + * **DNS Details** — A list of domains for which you have [configured DNS](#private-connectivity-networks-dns). + * **Environment Details** — A list of app environments that are using the network to connect to a resource, as well as the environment's status. + * **Show Logs** — This allows you to see [the flow logs](https://tailscale.com/kb/1219/network-flow-logs) for your network. They can help you troubleshoot issues with connectivity on your network. + +4. Click **Save** to save any changes you have made. ### Configuring DNS for your Network {#private-connectivity-networks-dns} -If your Mendix application is connecting to external resources, you probably want to do this using host names. DNS (Domain Name System) servers (nameservers) translate a host name, like `www.mendix.com` to an IP address, like `192.168.1.1`. If the DNS record with that translation is on a public nameserver, this is not a problem, as Mendix applications can access those by default. But if you want to connect to a private host name, like `mydatabase.myinternalnetwork.net`, where the DNS record for this host name is stored on a private nameserver, your Mendix application will not be able to resolve the host name to an IP address, making the host inaccessible for the Mendix application. -With Mendix Cloud Private Connectivity, you can configure your network to use restricted nameservers for specific domains. Using a restricted nameserver is also known as split DNS. If you configure an internal nameserver for a domain, for example `myinternalnetwork.net`, any DNS request for host names within that domain, for example `mydatabase.myinternalnetwork.net` will be forwarded to the configured nameserver. There, the host name will be resolved to an IP address. This will allow you to use internal host names to connect to resources on your internal infrastructure, without having to add the DNS records for those internal resources on a public DNS server. -To configure spli DNS for a new domain on your network, follow these steps: -1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network and select **Add DNS**. -2. On the **Edit DNS** dialog, click **Add New Domain**. +If your Mendix app connects to external resources, you probably want to do this using host names. DNS (Domain Name System) servers, also known as nameservers, translate a host name, like `www.mendix.com` to an IP address, like `192.168.1.1`. If the DNS record with that translation is on a public nameserver, Mendix apps can access those by default with no issues. However, if you want to connect to a private host name, like `mydatabase.myinternalnetwork.net`, where the DNS record for this host name is stored on a private nameserver, your Mendix app will not be able to resolve the host name to an IP address, thus making the host inaccessible for the Mendix application. + +With Mendix Cloud Private Connectivity, you can configure your network to use restricted nameservers for specific domains. Using a restricted nameserver is also known as split DNS. If you configure an internal nameserver for a domain, for example `myinternalnetwork.net`, any DNS request for host names within that domain, for example `mydatabase.myinternalnetwork.net`, will be forwarded to the configured nameserver. There, the host name will be resolved to an IP address. This will allow you to use internal host names to connect to resources on your internal infrastructure, without having to add the DNS records for those internal resources on a public DNS server. + +To configure split DNS for a new domain on your network, follow these steps: + +1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network, then select **Add DNS**. +2. In the **Edit DNS** dialog box, click **Add New Domain**. 3. Provide the following information: -* Domain - Provide the domain for which the nameservers should be used, for example `myinternalnetwork.net`. -* Nameservers - Provide the IP address of the nameserver to use to resolve DNS queries for the provided domain. You can add multiple nameserver IP addresses for high-availability. -Click **Save** to save changes. + * **Domain** — Provide the domain for which the nameservers should be used, such as `myinternalnetwork.net`. + * **Nameservers** — Provide the IP address of the nameserver to use to resolve DNS queries for the provided domain. You can add multiple nameserver IP addresses for high availability. + +4. Click **Save** to save changes. To remove split DNS for a domain on your network, follow these steps: -1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network and select **Add DNS**. -2. On the **Edit DNS** dialog, find the domain you want to add a nameserver for and click **Delete Domain** and then confirm that you want to delete it. -To add a nameserver for a domain you added to your network before, follow these steps: -1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network and select **Add DNS**. -2. On the **Edit DNS** dialog, find the domain you want to add a nameserver for and click **Add New Nameserver**. +1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network, then select **Add DNS**. +2. In the **Edit DNS** dialog box, find the domain for which you want to remove the DNS, then click **Delete Domain**. +3. Confirm that you want to delete the domain. + +To add a nameserver for a domain that you have already added to your network, follow these steps: + +1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network, then select **Add DNS**. +2. In the **Edit DNS** dialog box, find the domain you want to add a nameserver for, then click **Add New Nameserver**. 3. Provide the following information: -* Nameservers - Provide the IP address of the nameserver to use to resolve DNS queries for the provided domain. You can add multiple nameserver IP addresses for high-availability. -Click **Save** to save changes. + * **Nameservers** - Provide the IP address of the nameserver to use to resolve DNS queries for the provided domain. You can add multiple nameserver IP addresses for high availability. -To remove a nameserver for a domain you added to your network before, follow these steps: -1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network and select **Add DNS**. -2. On the **Edit DNS** dialog, find the domain you want to delete a nameserver for, click **Delete Nameserver** for the nameserver you want to delete and then confirm that you want to delete it. +4. Click **Save** to save changes. + +To remove a nameserver for a domain that you have already added to your network, follow these steps: + +1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network, then select **Add DNS**. +2. In the **Edit DNS** dialog box, find the domain that you want to delete a nameserver for. +3. Click **Delete Nameserver** for the nameserver you want to delete. +4. Confirm that you want to delete the nameserver. ### Deleting Networks {#private-connectivity-networks-delete} -To delete a network you have created before, follow these steps: -1. On the **Networks** tab, find the network that you want to delete, click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}), select **Delete** and then confirm that you want to delete it. -Deleting a network will delete all agents connected to that network, revoke the agents' authentication keys, remove all resources exposed through the agents and all connections to those resources. Approved connections will be broken immediately. Deleting a network will not uninstall the connected agents from your own infrastructure! +To delete a network, follow these steps: + +1. On the **Networks** tab, find the network that you want to delete. +2. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}), then select **Delete**. +3. Confirm that you want to delete the network. -See below for instructions on [uninstalling an agent](#private-connectivity-agents-uninstall). +When you delete a network, the following actions also occur: + +* All agents connected to that network are deleted. +* The agents' authentication keys are revoked. +* All resources exposed through the agents and all connections to those resources are removed. +* Approved connections are broken immediately. + +{{% alert color="warning" %}} +When you delete a network, agents that are connected to your infrastructure are not uninstalled. +Refer to the instructions for [uninstalling an agent](#private-connectivity-agents-uninstall). +{{% /alert %}} ## Agents {#private-connectivity-agents} -To connect your own infrastructure to your Mendix Cloud Connect network(s), you need Mendix Cloud Connect agents. You will need at least one agent to be able to connect from an application on Mendix Cloud to your own infrastructure. You can connect multiple agents to each network. -On the **Agents** tab of the [Private Connectivity](https://privateconnectivity.mendix.com) page in Control Center, you can see all the agents of your company. The page shows the following information for each agent: -* Agent - The name of the agent. -* Network -- The network the agent is connected to. -* Resources - The number of resources exposed through the agent. -* Status (last Seen) - Shows the status of the agent - * Connected - The agent is currently connected to the network. - * Date and time - The last time the agent was connected to the network. The agent is not connected at this time. +To connect your infrastructure to your Mendix Private Connectivity networks, you need agents. +At least one agent is necessary to be able to connect from a Mendix app to your infrastructure, but you can connect multiple agents to each network. + +On the **Agents** tab of the **Private Connectivity** page, you can see all the agents associated to your company. The page displays the following information for each agent: + +* **Agent** — The name of the agent. +* **Network** — The network to which the agent is connected. +* **Resources** — The number of resources exposed through the agent. +* **Status (Last seen)** — The status of the agent, or the last time it was connected to the network: + + * **Connected** — The agent is currently connected to the network. + * Date and time — The last time the agent was connected to the network. The agent is not connected at this time. ### Adding an Agent {#private-connectivity-agents-add} -You can only add agents if you have at least one network. See [Adding a Network]() to add a network. -To add a new agent to an existing network, follow these steps: +You can only add agents if you have at least one network. Refer to [Adding a Network](#private-connectivity-networks-add) to create a network if you have not done so already. + +To add a new agent to a network, follow these steps: + 1. Launch the agent wizard by choosing one of the following options: - * Select a network to which you want to add an agent by clicking the ***More Options** ({{< icon name="three-dots-menu-horizontal" >}}) and selecting **Add Agent** on the **Networks** tab. - * Click **Add Agent** on gents** tab and click **Add Agent**. -2. On the **Add Agent** step of the wizard, select the network you want to add the agent to. -3. Provide a name for the agent. Make sure the name is descriptive and recognizable. + + * On the **Networks** tab, select a network to which you want to add an agent, then click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}), and select **Add Agent**. + * On the **Agents** tab, click **Add Agent**. +2. On the **Add Agent** tab, select the network to which you want to add the agent. +3. Provide a descriptive and recognizable name for the agent. 4. Select the infrastructure type for your agent. 5. Click **Create**. Your agent is now added. You can continue with [installing the agent](#private-connectivity-agents-install) in your own infrastructure. ### Viewing and Editing Agents {#private-connectivity-agents-details} + To view and edit an existing agent, follow these steps: -1. On the **Agents** tab, find the network that you want to view the details or edit, click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) and select **Details**. -The details of that agent will be shown. This includes: -* Agent Name - The name you gave to the agent. You can edit this. Make sure the name is descriptive and recognizable. -* Agent ID - The internal ID of your agent. You can copy this, for example to provide it in a support ticket if you have issues with the agent. -* Agent Key - The authentication key of your agent. You can copy this authentication key to configure it when [starting an agent](#private-connectivity-agents-run). This key should be treated as confidential. -* Network -- The network the agent is connected to. -* Status (last Seen) - Shows the status of the agent - * Connected - The agent is currently connected to the network. - * Date and time - The last time the agent was connected to the network. The agent is not connected at this time. -* Resource Details - A list of the resources exposed via the agent. -* DERP Details - Information on the preferred Tailscale [Designated Encrypted Relay for Packets (DERP) server](https://tailscale.com/kb/1232/derp-servers). +1. On the **Agents** tab, find the agent for which you want to view details, or that you want to edit. +2. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}), then select **Details**. The details of that agent are displayed: + + * **Agent Name** — The name you gave to the agent. This field is editable. + * **Agent ID** — The internal ID of your agent. You can copy this, for example, if you want to provide it in a support ticket for any issues with the agent. + * **Agent Key** — The authentication key of your agent. You can copy this authentication key for use when [starting an agent](#private-connectivity-agents-run). + This key should be treated as confidential. + * **Network** — The network to which the agent is connected. + * **Status (Last seen)** — The status of the agent, or the last time it was connected to the network: + + * **Connected** — The agent is currently connected to the network. + * Date and time — The last time the agent was connected to the network. The agent is not connected at this time. -Click **Save** to save changes you made. + * **Resource Details** — A list of the resources exposed via the agent. + * **DERP Details** — Information on the preferred Tailscale [Designated Encrypted Relay for Packets (DERP) server](https://tailscale.com/kb/1232/derp-servers). + +3. Click **Save** to save any changes you have made. ### Deleting an Agent {#private-connectivity-agents-delete} + To delete an existing agent, follow these steps: -1. On the **Agents** tab, find the agent that you want to delete, click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}), select **Delete** and then confirm that you want to delete it. -Deleting an agent will automatically revoke its authentication key, remove all resources exposed through the agent and all connections to those resources. Approved connections will be broken immediately. -Deleting an agent will not uninstall the agent from your own infrastructure! See below for instructions on [uninstalling an agent](#private-connectivity-agents-uninstall). +1. On the **Agents** tab, find the agent that you want to delete. +2. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}), then select **Delete**. +3. Confirm that you want to delete the agent. + +When you delete an agent, the following actions occur automatically: -### Installing an Agent in your own infrastructure {#private-connectivity-agents-install} -To establish a connection between your network and your infrastructure, you must install an agent on this infrastructure. Installing an agent is typically done by your internal IT, Infra or Network team. +* The agent's authentication key is revoked. +* All resources exposed through the agent and all connections to those resources are removed. +* Approved connections are broken immediately. + +{{% alert color="warning" %}} +Deleting an agent does not uninstall the agent from your own infrastructure. +Refer to the instructions for [uninstalling an agent](#private-connectivity-agents-uninstall). +{{% /alert %}} + +### Installing an Agent on your Infrastructure {#private-connectivity-agents-install} + +To establish a connection between your network and your infrastructure, you must install an agent on this infrastructure. Installing an agent is typically done by your internal IT department, Infra department, or Network team. #### Installing an Agent on a Windows Server {#private-connectivity-agents-install-windows} + To install an agent on a Windows server, follow these steps: -1. Open the [Tailscale Download page](https://tailscale.com/download/windows). -2. Select **Windows** and click **Download Tailscale for Windows** -This will download the Tailscale installer for Windows. Run the installer to install the agent. Then continue with [starting the agent](#private-connectivity-agents-run). + +1. Access the [Tailscale Download page](https://tailscale.com/download/windows). +2. Select **Windows**, then click **Download Tailscale for Windows**. +3. Once the Tailscale installer for Windows is downloaded, run the installer to install the agent. + +Continue with [starting the agent](#private-connectivity-agents-run). #### Installing an Agent on a Linux Server {#private-connectivity-agents-install-linux} -To install an agent on a Linux server, follow these steps: -1. Run the following script on the server you want to install the agent: + +To install an agent on a Linux server, run the following script on the server where you want to install the agent: + ```bash Linux curl -fsSL https://tailscale.com/install.sh | sh ``` + Alternatively, open the [Tailscale Download page for Linux](https://tailscale.com/download/linux) for instructions on manually installing the Tailscale agent on your specific Linux distribution. -After installing the agent, continue with [starting the agent](#private-connectivity-agents-run). +Continue with [starting the agent](#private-connectivity-agents-run). -### Starting an Agent in your own infrastructure {#private-connectivity-agents-run} -When you have installed your agent, you can start the agent and connect to your network. For this, you will need an authentication key. This authentication key is created when [an agent is added](#private-connectivity-agents-add). You can find the authentication key for your agent on [the agent details page](#private-connectivity-agents-details). +### Starting an Agent on your Infrastructure {#private-connectivity-agents-run} + +Once you have installed your agent, you can start the agent and connect to your network. To do this, you need an authentication key, which was created when you [added the agent](#private-connectivity-agents-add). You can find and copy the authentication key for your agent on [the agent details page](#private-connectivity-agents-details). + +To start an agent and to connect it to your network, run the following script on the machine where the agent is installed. +You need to replace `AUTH_KEY` with the authentication key of your agent. -To start an agent and to connect it to your network, run the following script on the machine where the agent is installed, where you replace `AUTH_KEY` with the authentication key of your agent: -```shell Windows -tailscale up --auth-key= ``` -```bash Linux tailscale up --auth-key= ``` -### Uninstalling an Agent in your own infrastructure {#private-connectivity-agents-uninstall} -After [deleting an agent](#private-connectivity-agents-delete), you can uninstall it from your infrastructure. Uninstalling an agent is typically done by your internal IT, Infra or Network team. +### Uninstalling an Agent on your Infrastructure {#private-connectivity-agents-uninstall} + +After [deleting an agent](#private-connectivity-agents-delete), you can uninstall it from your infrastructure. Uninstalling an agent is typically done by your internal IT department, Infra department, or Network team. #### Uninstalling an Agent on a Windows server {#private-connectivity-agents-uninstall-windows} -Tailscale for Windows can be uninstalled like any Windows app, by using the Windows Control Panel. Go to **Settings > Apps**, find **Tailscale**, and press the **Uninstall** button. -If you'd like to _completely_ delete Tailscale, destroying any state or local information, you can also remove the files at the following paths: -``` -C:\ProgramData\Tailscale -C:\Users\%USERNAME%\AppData\Local\Tailscale -C:\Windows\System32\config\systemprofile\AppData\Local\Tailscale -``` +Tailscale for Windows can be uninstalled like any Windows app, by using the Windows Control Panel: + +1. Go to **Settings**, then to **Apps**. +2. Find **Tailscale**, then press the **Uninstall** button. -The path under `System32` was only used in older versions of the Tailscale client and may not be present on your system. +If you want to completely delete Tailscale, destroying any state or local information, you can also remove the files at the following paths: + +* `C:\ProgramData\Tailscale` +* `C:\Users\%USERNAME%\AppData\Local\Tailscale` +* `C:\Windows\System32\config\systemprofile\AppData\Local\Tailscale` + +The path under `System32` was only used in older versions of the Tailscale client, and may not be present on your system. #### Uninstalling an Agent on a Linux server {#private-connectivity-agents-uninstall-linux} -Uninstall Tailscale by using the uninstall command of the package manager you used to install the binary in the first place: -For all **Ubuntu and Debian** versions, uninstall using `apt-get`: -```bash Linux -sudo apt-get remove tailscale -``` +You can uninstall Tailscale by using the uninstall command of the package manager you used to install the binary in the first place. -For **CentOS 7 and Amazon Linux 2**, uninstall using `yum`: -```bash Linux -sudo yum remove tailscale -``` +* For all Ubuntu and Debian versions, uninstall using `apt-get`: -For **openSUSE Leap 15.1, 15.2, and openSUSE Tumbleweed**, uninstall using `zypper`: -```bash Linux -sudo zypper rm tailscale -``` + ```bash Linux + sudo apt-get remove tailscale + ``` -For **CentOS 8, CentOS Stream 9, RHEL 8, and Fedora**, uninstall using `dnf`: -```bash Linux -sudo dnf remove tailscale -``` +* For CentOS 7 and Amazon Linux 2, uninstall using `yum`: -If you'd like to _completely_ delete Tailscale, destroying any state or local information, you can also remove the file at: -``` -/var/lib/tailscale/tailscaled.state -``` + ```bash Linux + sudo yum remove tailscale + ``` + +* For openSUSE Leap 15.1, 15.2, and openSUSE Tumbleweed, uninstall using `zypper`: + + ```bash Linux + sudo zypper rm tailscale + ``` + +* For CentOS 8, CentOS Stream 9, RHEL 8, and Fedora, uninstall using `dnf`: + + ```bash Linux + sudo dnf remove tailscale + ``` + +If you want to completely delete Tailscale, destroying any state or local information, you can also remove the file at the following path: `/var/lib/tailscale/tailscaled.state`. ## Resources {#private-connectivity-resources} -Resources are services, such as databases or applications, on your own infrastructure that are exposed via your agents and accessible via your networks. Applications on Mendix Cloud can be connected to these resources. -On the **Resources** tab of the [Private Connectivity](https://privateconnectivity.mendix.com) page in Control Center, you can see all the exposed resources of your company. The page shows the following information for each resource: -* Resource - The name of the resource. -* Agent - The name of the agent that exposes the resource. -* Network - The name of the network that the agent exposing the resource is connected to. -* Status - The status of the resource. This is one of the following: - * Enabled - Users can request connections to the resource. - * Disabled - Users can't request connections to the resource. -*Environments - The number of application environments on Mendix Cloud that have an approved connection to the resource. +Resources are services, such as databases or applications, on your infrastructure that are exposed via your agents and that are accessible via your networks. Mendix apps can be connected to these resources. + +On the **Resources** tab of the **Private Connectivity** page, you can see all the exposed resources of your company. +The page displays the following information for each resource: + +* **Resource** — The name of the resource. +* **Agent** — The name of the agent that exposes the resource. +* **Network** — The name of the network to which the agent exposing the resource is connected. +* **Status** — The status of the resource. This can be one of the following: + + * Enabled — Technical Contacts can request connections to the resource. + * Disabled — Technical Contacts cannot request connections to the resource. + +* **Environments** — The number of app environments on Mendix Cloud that have an approved connection to the resource. ### Viewing and Editing Resources {#private-connectivity-resources-details} -1. On the **Resources** tab, find the resource that you want to view the details or edit, click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) and select **Details**. -The details of that resource will be shown. This includes -* Resource Name - The name you gave to the resource. You can edit this. Make sure the name is descriptive and recognizable. -* Resource ID - The internal ID of your resource. You can copy this, for example to provide it in a support ticket if you have issues with the resource. -* Resource Type - The type of the resource, this is one of the following values: -* Route - The resource is an exposed subnet route. -* Route - The exposed IP range (only if the resource type is _Route_) -* Agent - The name of the agent that exposes the resource. -* Network - The name of the agent that the agent exposing the resource is connected to. -* Status - The status of the resource. This is on of the following: - * Enabled - Users can request connections to the resource. - * Disabled - Users can't request connections to the resource. -* Environment Details - A list of applications environments that have an approved connection to the resource. - -Click **Save** to save changes you made. + +To view and edit a resource, follow these steps: + +1. On the **Resources** tab, find the resource for which you want to view details, or that you want to edit. +2. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}), then select **Details**. + The details of that resource are displayed: + + * **Resource Name** — The name you gave to the resource. This field is editable. + * **Resource ID** — The internal ID of your resource. You can copy this, for example, if you want to provide it in a support ticket for any issues with the agent. + * **Resource Type** — The type of resource, which can be: + + * **Route** — The resource is an exposed subnet route. + + * **Route** — The exposed IP range. This is only displayed if the resource type is **Route**. + * **Agent** — The name of the agent that exposes the resource. + * **Network** — The name of the network to which the agent exposing the resource is connected. + * **Status** — The status of the resource. This can be one of the following: + + * **Enabled** — Users can request connections to the resource. + * **Disabled** — Users cannot request connections to the resource. + + * **Environment Details** — A list of app environments that have an approved connection to the resource. + +3. Click **Save** to save any changes you have made. ### Exposing Resources {#private-connectivity-resources-expose} + Before you can connect to resources running on your own infrastructure, you have to expose these resources through an agent. This requires you to install an agent on the machine running the resource, or on a machine that has access to the resource. -Mendix Cloud Private Connectivity currently supports exposing physical [subnet routes](https://tailscale.com/kb/1019/subnets) to your network, via an agent. You can expose a single IP range, for example `192.0.2.0/24` or multiple IP ranges separated by a semicolon, for example `192.0.2.0/24,198.51.100.0/24`. +Mendix Cloud Private Connectivity currently supports exposing physical [subnet routes](https://tailscale.com/kb/1019/subnets) to your network via an agent. You can expose a single IP range, such as `192.0.2.0/24`, or multiple IP ranges separated by a semicolon, such as `192.0.2.0/24,198.51.100.0/24`. #### Exposing Subnet Routes on a Windows server {#private-connectivity-resources-expose-routes-windows} -To expose subnet routes for an agent that is already running, run the following script on the machine where the agent is installed, where you replace `IP_RANGE` with the IP range(s) you want to expose: + +To expose subnet routes for an agent that is already running, run the following script on the machine where the agent is installed. +Replace `IP_RANGE` with the IP ranges you want to expose: + ```shell Windows tailscale set --advertise-routes= ``` -You can also configure the exposed subnet routes when starting the agent. In that case, use the following script, replacing `AUTH_KEY` with the authentication key of your agent and `IP_RANGE` with the IP range(s) you want to expose: +You can also configure the exposed subnet routes when starting the agent. +In that case, use the following script, replacing `AUTH_KEY` with the authentication key of your agent, and `IP_RANGE` with the IP ranges you want to expose: + ```shell Windows tailscale up --auth-key= --advertise-routes= ``` #### Exposing Subnet Routes on a Linux server {#private-connectivity-resources-expose-routes-linux} + To expose subnet routes for an agent on a Linux server, follow these steps: + 1. [Enable IP forwarding](https://tailscale.com/kb/1019/subnets?tab=linux#enable-ip-forwarding) -2. Run the following script on the machine where the agent is installed, where you replace `IP_RANGE` with the IP range(s) you want to expose: -```shell Linux -sudo tailscale set --advertise-routes= -``` +2. Run the following script on the machine where the agent is installed, and replace `IP_RANGE` with the IP ranges you want to expose: + + ```shell Linux + sudo tailscale set --advertise-routes= + ``` + +You can also configure the exposed subnet routes when starting the agent. In that case, use the following script, replacing `AUTH_KEY` with the authentication key of your agent, and `IP_RANGE` with the IP ranges you want to expose: -You can also configure the exposed subnet routes when starting the agent. In that case, use the following script, replacing `AUTH_KEY` with the authentication key of your agent and `IP_RANGE` with the IP range(s) you want to expose: ```shell Linux sudo tailscale up --auth-key= --advertise-routes= ``` ### Enabling and disabling Resources {#private-connectivity-resources-enable-disable} -Once resources are [exposed](#private-connectivity-resources-expose), they must be enabled by a Mendix Admin, before users can request connections to the resource. + +Once resources are [exposed](#private-connectivity-resources-expose), they must be enabled by a Mendix Admin. Users can only request connections to resources once they have been enabled. To enable a resource, follow these steps: -1. On the **Resources** tab, find the resource you want to enable and click **Enable**. -To disable a resource, follow these steps: -1. On the **Resources** tab, find the resource you want to enable and click **Disable**. +1. On the **Resources** tab, find the resource you want to enable. +2. Click **Enable**. + +To disable a resource, follow these steps: + +1. On the **Resources** tab, find the resource you want to disable. +2. Click **Disable**. ## Connections {#private-connectivity-connections} -Mendix Cloud Connect connections allow applications on Mendix Cloud to connect to Mendix Cloud Connect resources over Mendix Cloud Connect networks. A connection has to be requested and approved, before an application on Mendix Cloud can connect to the resource. An application on Mendix Cloud can have multiple connections to multiple resources. - -On the **Connections** tab of the [Private Connectivity](https://privateconnectivity.mendix.com) page in Control Center, you can see all the connections of your company. The page shows the following information for each connection: -* App - The name of the app for the connection -* Environment - The name of the Environment for the connection -* Network -- The network for the connection. -* Resource - The name of the resource for the connection. -* Status - Shows the status of the connection. This is one of the following: - * Pending - The connection was requested, but not yet approved. The app environment can't connect to the resource using this connection. - * Approved - The connection is approved. The app environment can connect to the resource using this connection. - * Rejected - The connection is rejected. The app environment can't connect to the resource using this connection. + +Mendix Private Connectivity connections allow applications on Mendix Cloud to connect to Mendix Private Connectivity resources over Mendix Private Connectivity networks. +A connection has to be requested and approved before an application on Mendix Cloud can connect to the resource. +An application on Mendix Cloud can have multiple connections to multiple resources. + +On the **Connections** tab of the **Private Connectivity** page, you can see all the connections associated to your company. The page displays the following information for each connection: + +* **App** — The name of the app for the connection. +* **Environment** — The name of the environment for the connection. +* **Network** — The network for the connection. +* **Resource** — The name of the resource for the connection. +* **Status** — The status of the connection. This can be one of the following: + + * **Pending** — The connection was requested, but not yet approved. The app environment cannot connect to the resource using this connection. + * **Approved** — The connection is approved. The app environment can connect to the resource using this connection. + * **Rejected** — The connection is rejected. The app environment cannot connect to the resource using this connection. + + For details on how Technical Contacts request connections for a specific environment, refer to [Connecting to External Resources](/developerportal/deploy/connecting-to-external-resource/). ### Viewing Connection Details {#private-connectivity-connections-details} + To view an existing connection, follow these steps: -1. On the **Connections** tab, find the connection that you want to view the details or edit, click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) and select **Details**. - -The details of that connection will be shown. This includes: -* Request Details - The details of the connections request: - * Name - The name of the user that requested this connection. - * Status - The status of the connection request. This is one of the following: - * Pending - The connection was requested, but not yet approved. The app environment can't connect to the resource using this connection. - * Approved - The connection is approved. The app environment can connect to the resource using this connection. - * Rejected - The connection is rejected. The app environment can't connect to the resource using this connection. - * Date - The data and time the connection was requested. -* App - The name of the app for the connection -* Environment - The name of the Environment for the connection -* Network -- The network for the connection. -* Resource - The name of the resource for the connection. -* Resource ID - The internal ID of your resource. You can copy this, for example to provide it in a support ticket if you have issues with the resource. -* Agent - The name of the agent for the connection. -* Agent ID - The internal ID of the agent. You can copy this, for example to provide it in a support ticket if you have issues with the agent. -* Network - The name of the network for the connection. -* Network ID - The internal ID of the network. You can copy this, for example to provide it in a support ticket if you have issues with the Network. - -Click **Save** to save changes you made. + +1. On the **Connections** tab, find the connection for which you want to view details. +2. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}), then select **Details**. The details of that connection are displayed: + + * **Request Details** — The details of the connections request: + + * **Name** — The name of the user that requested this connection. + * **Status** — The status of the connection request. This can be one of the following: + + * **Pending** — The connection was requested, but not yet approved. The app environment cannot connect to the resource using this connection. + * **Approved** — The connection is approved. The app environment can connect to the resource using this connection. + * **Rejected** — The connection is rejected. The app environment cannot connect to the resource using this connection. + + * **Date** — The date and time when the connection was requested. + + * **App** — The name of the app for the connection. + * **Environment** — The name of the environment for the connection. + * **Network** — The network for the connection. + * **Resource** — The name of the resource for the connection. + * **Resource ID** — The internal ID of your resource. You can copy this, for example, if you want to provide it in a support ticket. + * **Agent** — The name of the agent for the connection. + * **Agent ID** — The internal ID of the agent. You can copy this, for example, if you want to provide it in a support ticket. + * **Network** — The name of the network for the connection. + * **Network ID** — The internal ID of the network. You can copy this, for example, if you want to provide it in a support ticket. ## Approving and Rejecting Connections {#private-connectivity-connections} -Once a connection is requested, it must be approved before the app enviroment can connect to the resource. + +Once a connection is requested, it must be approved before the app environment can connect to the resource. To approve a connection, follow these steps: -1. On the **Connections** tab, find the connection you want to enable and click **Approve**. -If this is the first connection that is approved for an app environment, you must [redeploy](/developerportal/deploy/mendix-cloud-deploy/deploying-an-app/) the environment to be able to use the connection! +1. On the **Connections** tab, find the connection you want to enable. +2. Click **Approve**. + +{{% alert color="warning" %}} +If this is the first connection that is approved for an app environment, the Technical Contact must [redeploy](/developerportal/deploy/mendix-cloud-deploy/deploying-an-app/) the environment to be able to use the connection. +{{% /alert %}} To disable a connection, follow these steps: -1. On the **Connections** tab, find the connection you want to enable and click **Reject**. + +1. On the **Connections** tab, find the connection you want to disable. +2. Click **Reject**. ## Activities -On the Activity tab, you can view a log of activities performed on your Private Connectivity assets. \ No newline at end of file + +On the **Activities** tab, you can view a log of activities performed on your Private Connectivity assets. diff --git a/content/en/docs/releasenotes/control-center/_index.md b/content/en/docs/releasenotes/control-center/_index.md index 38b89d3b01c..8132bed22c7 100644 --- a/content/en/docs/releasenotes/control-center/_index.md +++ b/content/en/docs/releasenotes/control-center/_index.md @@ -14,6 +14,13 @@ To see the current status of the Mendix Control Center, see [Mendix Status](http ## 2025 +### November __, 2025 + +#### New Features + +* We have introduced **Private Connectivity**, a zero-trust security infrastructure which helps you manage connections between your Mendix Cloud apps and internal resources, bypassing the public internet. It allows you to create secure networks through which your apps can safely access internal databases and services hosted on-premises or in cloud environments, without exposing them publicly. + Refer to [Private Connectivity](/control-center/private-connectivity/) for background details and architecture, then read through [Configuring and Using Private Connectivity](/control-center/configure-private-connectivity/) to learn how to create and manage your own private networks. + ### September 29, 2025 #### New Features From b7b9c523c2d96e98ed484863902b5550dcb9b80b Mon Sep 17 00:00:00 2001 From: Olufunke Moronfolu Date: Mon, 27 Oct 2025 16:26:09 +0100 Subject: [PATCH 5/9] deployment updates for configuring private conn --- .../connecting-external-resources.md | 84 ++++++++++++++---- .../environments-details.md | 12 +-- .../en/docs/releasenotes/deployment/_index.md | 2 +- .../releasenotes/deployment/mendix-cloud.md | 7 ++ .../partials/landingpage/latest-releases.html | 2 +- .../connection-request-staus-flow.png | Bin 0 -> 78608 bytes 6 files changed, 81 insertions(+), 26 deletions(-) create mode 100644 static/attachments/deployment/mendix-cloud-deploy/connecting-to-external-services/connection-request-staus-flow.png diff --git a/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md b/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md index ca52a4f0cea..b78adddd95a 100644 --- a/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md +++ b/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md @@ -8,39 +8,85 @@ beta: true #If moving or renaming this doc file, implement a temporary redirect and let the respective team know they should update the URL in the product. See Mapping to Products for more details. --- +{{% alert color="warning" %}} +This feature is in Public Beta. For more information, see [Release Status](/releasenotes/release-status/). +{{% /alert %}} + ## Introduction -[Mendix Cloud Private Connectivity](/control-center/private-connectivity/) can help you with connecting your applications on Mendix Cloud to your internal resources (on-premises and in the cloud) securely and privately. That means that the connection will not go over the public internet, but through a private tunnel. +[Mendix Cloud Private Connectivity](/control-center/private-connectivity/) enables your Mendix applications to securely and privately connect to internal resources, whether they are on-premises or in the cloud. This ensures that the connection bypasses the public internet and instead goes through a private tunnel, enhancing security and compliance. + +This document guides [Technical Contacts](/developerportal/general/app-roles/#technical-contact) through the process of requesting and managing connections to external resources using Mendix Cloud Private Connectivity. + +## Prerequisites {#prerequisites} + +Before requesting a connection, the following conditions must be met: + +* You are the [Technical Contact](/developerportal/general/app-roles/#technical-contact) for the Mendix application. +* A Mendix Admin has created and configured the necessary private network in the [Control Center](/control-center/configure-private-connectivity/). This includes installing agents and exposing the specific external resource you want to connect to. ## Connections {#connections} -Mendix Cloud Connect Connections allow applications on Mendix Cloud to connect to Mendix Cloud Connect Resources over Mendix Cloud Connect Networks. A Connection has to be requested and approved, before an application on Mendix Cloud can connect to the Resource. An application on Mendix Cloud can have multiple Connections to multiple Resources. +Mendix Cloud Connect Connections allow applications on Mendix Cloud to connect to Mendix Cloud Connect Resources over Mendix Cloud Connect Networks. Each connection request must be initiated by a Technical Contact and approved by a Mendix Admin before the application on Mendix Cloud can connect to the Resource. -The [Connections](/developerportal/deploy/environments-details/#connections) section on your application environment's Details page allows Technical Contacts to view all submitted connection requests and track request status. +An application on Mendix Cloud can establish multiple connections to various resources. You can view and manage all connections and their statuses within the [Connections](/developerportal/deploy/environments-details/#connections) section on the application's **Network** tab. -### Requesting a New Connection {#connections-add} +### Requesting a New Connection {#connection-request} -Once a network has been created, agents have been added and installed, and Resources have been exposed and enabled, you can request a Connection from an application environment to of the approved Resources. +As a Technical Contact, you can request a new connection from your application environment to an approved external resource. + +Follow these steps to request a new connection: -To request a new Connection for a specific application environment, follow these steps: 1. From [Apps](https://sprintr.home.mendix.com), go to the app's **Environments** page. -2. Click **Details** ({{% icon name="notes-paper-edit" %}}) on the desired environment. +2. Click **Details** ({{% icon name="notes-paper-edit" %}}) on the preferred environment. 3. Go to the **Network** tab. -4. The **Connections** section allows for managing connections for a single environment. -5. Click **Add** to request a new connection. -6. On the **Add Connection** dialog, select an available network to view the resources exposed on that network. -7. Select the resource you would like to connect to from the application environment. -8. All submitted connection requests appear in the Control Center for the Mendix Admin review. Click **Send Request**. -9. Track and manage your connection requests from the [Connections](/developerportal/deploy/environments-details/#connections) section on your application environment's Details page. +4. In the **Connections** section, click **Add** to initiate a new connection request. + + {{% alert color="info" %}} Contact your Mendix Admin if the resource you want is not available on the list. + {{% /alert %}} + +5. In the **Add Connection** dialog, select an available network. This action displays the resources exposed on that network. +6. Select the specific resource you want your application environment to connect to. +7. Click **Send Request** to submit your connection request for approval. All submitted connection requests appear in the [Control Center](/control-center/configure-private-connectivity/) for the Mendix Admin review. +8. Track and manage your connection requests from the [Connections](/developerportal/deploy/environments-details/#connections) section on the application's **Network** tab. + +{{% alert color="info" %}} +If this is the first connection approved for an application environment, you must redeploy that environment for the connection to become active and usable. +{{% /alert %}} + +This diagram shows the progress of the request status from when the connection request is submitted to when it is completed (approved or rejected): -### Cancelling a Connection Request {#connections-cancel} +{{< figure src="/attachments/deployment/mendix-cloud-deploy/connecting-to-external-services/connection-request-flow.png" >}} -To cancel a pending connection request, follow these steps: -1. On the [Connections](/developerportal/deploy/environments-details/#connections) section on your application environment's Details page, click **Cancel**. +{{% alert color="info" %}} +Mendix Admins can revoke an approved connection. +{{% /alert %}} + + +## Managing Connections {#manage-plan-requests} + +The [Connections](/developerportal/deploy/environments-details/#connections) section on the application's **Network** tab allows Technical Contacts to view all connections for the environment, track pending request statuses, and delete established connections. + +Depending on the connection's status, you can perform the following actions: + +### Cancelling a Connection Request {#cancel-connection} + +As a Technical Contact, you can cancel a connection request if its status is **Pending Approval**. + +To cancel a pending connection request: + +1. On the [Connections](/developerportal/deploy/environments-details/#connections) section of the Network tab, locate the connection request with the status **Pending Approval**. +2. Click **Cancel Request** next to that connection. ### Deleting a Connection -To delete an approved connection, follow these steps: -1. On the [Connections](/developerportal/deploy/environments-details/#connections) section on your application environment's Details page, click **Delete**. +After a connection request is approved, you can delete the connection at any time. + +To delete an approved connection: + +1. On the [Connections](/developerportal/deploy/environments-details/#connections) section of the **Network** tab, locate the approved connection you want to remove. +2. Click **Delete** next to that connection. -Deleting a connection, will immediately break the connection between the application environment and the resource. \ No newline at end of file +{{% alert color="info" %}} +Deleting a connection immediately breaks the connection between your application environment and the resource. +{{% /alert %}} diff --git a/content/en/docs/deployment/mendix-cloud-deploy/environments-details.md b/content/en/docs/deployment/mendix-cloud-deploy/environments-details.md index ee0d2ed6926..7fc00274634 100644 --- a/content/en/docs/deployment/mendix-cloud-deploy/environments-details.md +++ b/content/en/docs/deployment/mendix-cloud-deploy/environments-details.md @@ -219,20 +219,22 @@ For more information, see [Scheduled Events](/refguide/scheduled-events/). On the **Network** tab, you can manage the elements described below. ### Connections {#connections} + You can connect from your applications on Mendix Cloud to resources on your own infrastructure using Mendix Cloud Private Connectivity. -The **Connections** overview contains the following information: +The **Connections** tab contains the following information: -* **Resource** -* **Network** -* **Status (Last seen** +* **Resource** – The name of the service such as databases being connected +* **Network** – The name of the network associated with the connection +* **Status (Last seen)** – The connection's current state, such as **Pending Approval**, **Approved** or **Rejected** You can perform the following actions for connections: + * **Add** a new connection * **Cancel** a connection request * **Delete** a connection -For more information, see [Connecting to External Resources](/developerportal/deploy/connecting-to-external-resource/). +For more information, refer to [Connecting to External Resources](/developerportal/deploy/connecting-to-external-resource/). ### Custom Domains {#custom-domains} diff --git a/content/en/docs/releasenotes/deployment/_index.md b/content/en/docs/releasenotes/deployment/_index.md index bb444f8ce9d..368089588a6 100644 --- a/content/en/docs/releasenotes/deployment/_index.md +++ b/content/en/docs/releasenotes/deployment/_index.md @@ -15,7 +15,7 @@ Follow the links in the table below to see the release notes you want: | Type of Deployment | Last Updated | | --- | --- | -| [Mendix Cloud](/releasenotes/developer-portal/mendix-cloud/) | October 19, 2025 | +| [Mendix Cloud](/releasenotes/developer-portal/mendix-cloud/) | November 3, 2025 | | [Mendix on Kubernetes](/releasenotes/developer-portal/mendix-for-private-cloud/) | October 21, 2025 | | [Mendix on Azure](/releasenotes/developer-portal/mendix-on-azure/) | October 16, 2025 | | [SAP Business Technology Platform (SAP BTP)](/releasenotes/developer-portal/sap-cloud-platform/) | August 27, 2024 | diff --git a/content/en/docs/releasenotes/deployment/mendix-cloud.md b/content/en/docs/releasenotes/deployment/mendix-cloud.md index 9fd1b144576..7301460fb8f 100644 --- a/content/en/docs/releasenotes/deployment/mendix-cloud.md +++ b/content/en/docs/releasenotes/deployment/mendix-cloud.md @@ -16,6 +16,13 @@ For information on the current status of deployment to Mendix Cloud and any plan ## 2025 +### November 3, 2025 + +#### New Features + +* We have added a new beta feature in the **Network tab** of the **Environment Details** page that enables Technical Contacts to securely [connect Mendix applications to external resources](/developerportal/deploy/connecting-to-external-resource/) through [Mendix Cloud Private Connectivity](/control-center/private-connectivity/). + * From the [Connections](/developerportal/deploy/environments-details/#connections) section of the **Network** tab, Technical Contacts can now request new private connections, track the status of their pending connection requests, connect to external resources, and delete existing connections. + ### October 19, 2025 #### New Features diff --git a/layouts/partials/landingpage/latest-releases.html b/layouts/partials/landingpage/latest-releases.html index a01d0745583..c58362252bc 100644 --- a/layouts/partials/landingpage/latest-releases.html +++ b/layouts/partials/landingpage/latest-releases.html @@ -14,6 +14,6 @@

Latest Releases

  • Deployment -

    October 19, 2025

    +

    November 3, 2025

    • diff --git a/static/attachments/deployment/mendix-cloud-deploy/connecting-to-external-services/connection-request-staus-flow.png b/static/attachments/deployment/mendix-cloud-deploy/connecting-to-external-services/connection-request-staus-flow.png new file mode 100644 index 0000000000000000000000000000000000000000..c781026c0d8cf07cc166fe6c54314448c13818ab GIT binary patch literal 78608 zcmeFZ2SAfqx<3q&C}k8>1f?q~BGNkuL`6WUf^-8?0)!Si(h2rLvCymZ4gvuo6tU5y z_l^bWpj7Gq6G#A^ncdmFckkW(zU$0ja^CZvbDs8l+F|aiD9P?6rz0mKBHDXNPFj_S zXtx~^5k!-8HyB9@s(wO5B(UUgQOm*Vh6&OVL3D!u!se$Fd^~0-dxsPJ(kJ-%3~X$; zjFASWb_Q1VT-FE&Fa(|(m?Et46BJRdNJ~qD6MQm)Ts+{>DMbS#q_qRe-s}YbdGP&` zwFANu{0)Y|Ph~amLks-J%cIXLs4vV8KAy9&u|#Mh4CRqvbs0f^VJ?0lFnmg0?y91~ z3BC*9vnA330sfLj7+IijuUs&*Ls@|l8D0TiE*{)JU{KA##J~=@bBT+_ra#ZYo!tpx zXOBc#Z<5C+!o|lWvPqP^k%1**bC`E?#1Lg?jIi4r0z2@X;JkiJYT>U zYXfka4SuNr)^OrqM;dRAT|pYiU*R;kDtZnjuPov$s3WZ|`0HwfHLY&Q+8NlGDWZ%w zxMqA~a|u3C9{eedUGO7(g2J1pG_@magx?o8poVlM(6VuIJ|0s?q%p#N^JV-*2NcTE z0crE|pb^U28exQ&E`FkcogK>g=V>M=OFVh_IW~aupH{~WsQr$oxKT}{u>(*KoPLQ2 z;*W;%?La5^5CCX84xDp2kgxZj8V>;?{5t46w4+f3GB2(p}=}Oq_*=hVUpF2 z3kXY`juQBY-v{W}DY>onzcR=7Z3I8Tu$_9pn>G(t17;K+=W9r{#-Zl$m5x^oH z>|6jF@jGz}3*#5Xt1PD|LDpNes(xc=nK|5Ygp@)5*C5TlR?7r%%wkEoEa zumGe%)04MBRw7^uH!fbre#(e=? z$A6W^8PwK8X`C2v-|T@}A+1dn5GFXt+%a+<<=}v_!jEmL4vq{k0KVXv{#O-;kH;S6 zXt$xh;N?G5G5*ah91QGCL42^W$sf++6~ImW+ot%3cw&dJG;lyV{Y=0gY0Y0*dwT~J z6o^x{;fj~{7q}7@;Sv@W6c7~@5a8z*5*8HQq?54mCcXGY{u(3^_TB)dEx`QSr{)Lo z&wnqB@#9tCClnL11fn}{g4*E7w*Cv*I^rDY#sg0KjhF%#|L_Xf0G$Nk9pO3nWQv=o ziZBPU1Asri%>}{PH`m;Jyvf1s<@s=WsbF9TVx6CG(ZCXEii^;UfH~j-u=6+%h6J(1 zIs5}Fq_Hv1bDg(CfK%bU7|sN2a6;Yi7=q_d2ug#If5c4wNk{p|>i#D&-lh`l{E72F zTiU?K^DkC+g8rgROza8qJP^}gG|c~9)#U?;!A1=KH{zcE0mS}CRO;UXc{g&0zl}2l zZ2IR^5%>1rQ=xwWk^x=#ojUwCAsNU@?NCnthh!k#*tEKTrTYApwYL?N;JESe=r3X9 ze|^P!zT`e)EWd@f0%sW zyfHo!1@YL=8ORAfeiIWDJ|m;8)d*<_cw#JMC?qI^d-4y2oqym@|7zg*S5)E`$BEB7 zg@y2G+RlVT1V6SjAK?|`=lX*@hTtIo4H8a5%=t^i^nVG--%Ln&@v{EA8Hw<}JR|wv z@rwio?7$N>zzmS=;JoEdWwNvcvC=k=GfzW*gi!K=*-Wd2>`J(OxYQd;DBOhQFJ3DK?waxNFpq12$}@{0U-(RRx<;SH3Gt1 zJfModqZ+!2%{#z`kAUJo!HX!D$j;g;9;5z!;AK<)L6_}sW$0U8XGbXuEfv}ko0^#59{oos0zV-*#VZ0oFCP~VK8@WWd_pO5r|fZM_g`v| z|N9{-AE9}=-FW&RD8L|YARTZOa~!_lK5w{^P0s?pZTk}37aXJiQQi1g7HxR(9Q!wL zC4a?D{XXr+r&+xGgbp2EmH9;YxcK=%Q%F!qfQLs^L;&ASA%N2+!T*5;bArTnU>Xjh za9KC57`|O8`j`5_|L72#keU;8VhjC*e(DJR9ti(4y`V6jkR2NH``pXg_#Ez91+L9u zX<%=U#FbrkIK=HJ3Wr|XO+qd{5fQ?`Chmy}@e>BNp%2$o+`>KrUh;5>3gRk51kB_F zH)nW7@dMlM?u1R;R276B5;XTWuEJ~`=GVc0q%QRDfv^8;_P@hV|6!XOUw-(@5&eG& zhD8PO#X|xLgXUg8w@K{(tzLn9a)aU#J&tUV{2pYBWwM|L0q?1P1(9uu|wx zu#y0TAmYGv#&>u4Zw_o{$46JNGU}SA*kNb{~g^2V*`YU$sb;b5Hb=$7@GVifQ|s6nv9Q2 z|AU$j8+XS3RHWs+# zcB#>+`P2IHS;x%&lHQ`_zWy5v3oD+cXNQht+1IVMFZK7K?bbB$h%7GYe{5l(p zfge>gECEj~&y&kp5m(FpyfKUj-9Q_2m#}dGSnwsh;{pCCRl4M*P{;2 z+B=B=Yps)Lo!{Po}^2PFeHz1`jrj)4=79EY*6MGmCUY|UUf z3mq0DFoZzJ{r!ND!x^ut*5>|T74WqoE?hR8) zj?!Mb{nO*)7rl*kuFeue0;p&iiQy%^&0ghC9o3c-4O7|32?rWFDb$d(BVJWx|B#ldgH7t7lGX3PqE!TN_d_91Wfc7 zr2-;df_z^HfGMrWeEFS%W<$*ww+;iVB&Vt*>r|7k0DMKirLZB{dPE@T*2d=Ofdec7 z2d@o1Y{Mx9K`Bo`@^)=;bn}3Ffk@(s`P3s6y*>WuT(ea87oMC3B&XOh5R41S4fFlO z7kKUf)j!OTzNtT3yWe_1w7P>h7HY8Zt=HP|l%y;HVUTBkA`n2O_aQ(@cG8_YTRbEs zi6-Kd`9&F65I9z+n^r%QVgJK(5eT7@^9BbbVR^i1>u4BFjMX2$z~c^9yfsyrG_>o8GgNdXb#I74=Lq!T9v4ea()3BQ`hvgY`n4Tb= zElwTRW-)_^UYb0*XNT-IpTZhQ8&n8y6QM)Ef`+cycW@G>qJzvrcAjg)@-|?BiU!Pk z{Yjwt($=eBqDU^0+fM5wLchXs`sL7_AZR$z#P5x58{Xny01gW5P7))m2ZJ0ZeB2TX zsR#Pm@KJQcGnM$?etoE_?EPdL4qs~l4jztnFY+UTd^`#B+J1sRA0DM|g@J8V#N%f7 zY}1K;MiukR@@Q`=KnGRQQ3v{S^*>RFdkw$VhIYnBfdyM~6O8falZzlK{KL%+jsaCT ze&EsgPE7zJL9@W&BV5(59=aV z`JFBxIf2n-ysJ&#zfCdz69Moy_Fz8-=3P9@PO|Y3-Etu2+OI6%)WcVyfRKpJI}$$~ z4Q4~uptJJ@Qc)ZZI$s{4f>hDQknDW4VZ+-x%>Y!(=kwXd%Y->BDo``pEvg9E6CVrn zCb3g}ahLk{hE9A8#=p(P0~~;q7lvOp+^d`yvCfuVYyrv!RKs48QB~Uh=DsxwD1s%E zH*gaUvWagYfL@ZB&bSFAI}H94(Hlmy1i=Fw+WR0-8k?kByYVms`$o~Q>!-DF3j(Fi z8v#n4XPZd#>%&hp*Ex0&ZVFtiJq?2sZoTs3Fx@{?ED(F#iUvyfO?>EQRM}?8#wQiV@M52;E-5VxH0X)-4v;5HZ$q#VBlzwFrL>X**Ir?Drg)N}K zdxf1;c*E#`bT6@*rEa=#7B1raZTQEF95zhRaDn6rE6^8FSB4GGzNIVikwk(!Uw|FP zInFmvm4e^Ez1Mzr<~XW1mI5b7s{pATJZ<{Kb4#yMj>1B>S%?1=kO@H^sJzt9q$>Ig z{~{n)+%&qszPowt0sk)g{c`a{o!gRE)dSR5hpQgLy#$*k5uwAgx(W7*;?uA$vUa>K zaY`UL?DQ5F$pQdop@C2jkX{tp$xTve;;v`ZXsI?uKc?FUL$S{eooRh_D6UboYe?hA z4o?d_=q4VbW#X|!dv`oxQ6QmC?pz()lUYDM@GP_M9r+K4s7{;Agc=j)Qyen_4#r&A zB$(tmP*Rq&NP#1S18aJB0lLuF52<*|py@FBXnLqkUV1#jsyS!+R94WX9W1+*28)>u zhbhHGkaeL6h_J!m_*m~mMKy03^;6g5Uik*CKFvo)=d*K{Gh8|@er4y(DiF>*JtMgf z=k=Q|d%F_YgN`SYp3t7?yBmiJR4H=R6b=jv`h1!E>nZ6&WPQy2MAKR7=&cUf{~ z|M*r&iQ`WT?o>KCM^(7sJJ?Eu9yrvHXGZ=hc@Oy~z}AZo?_U;sA8xLQNckXr2xbCM zgq)b}KAt=@4&t-xDKj<=f<=qO4A>gb4kEHs1F^`)mg7)E>VQT&)hCHMYDdI05UG|M z!okbowW_yL(oG;72UyY;25*=a3xW)gB(P0utz~ppI*IFt$O6NuA`ag$bHsr zodoLj9H(BVFG_-woh8<}wZ(X<3$W&B_J&yBgfwSC==Hpa1D6nsd+e`jUVbKjWK+Oz zIbgVOhUEh;R$7F@76=QYZT81RlitdKwM4ZhzIssFstmO~W*^*Q_~0be{%StCI(*I1 zoStka)NEMCCxxn?T?EN9Z!g#hK4Z=7K5}FMK=|6Z`7&v4?U_PKubsBK3f-SRrKSHrD_Mv9kf84xV8r z1GX2lf7=wEbH{k!hp>&NK-kHX%|s=hjB3zdE$E8R$G;y?1bGI6AfS_yKqRk+t~IL> zOr9m5XbgEL8&b}Ec1h8-4*!l;~!sO&j`IZSm4yno5}3jJz#s#UxSRSXEp2|zk>6c8fOl5!Bp ziPV&MY2$F<;eDEKl#ispav{{|<}onxPd6AVta> z?UD(#0AMkO&!~Uq7AMTb#C7PAOhM)O=HNh_#Sllf$Y9icuXeZY*{SV7(Z1t!74?39 zIUDRDLDz7HyG#s);bg-TJ5uA5z-pe>l|G+JIr?w|0br-eRRlIqb(9@YbX=Ju67R~; z@f0@4aU4GkA$LDT6x()+CHB?5pquO|wdUBa^wMNyos&B}Nx&MUycq%!Ew|4!W5?6E zsciSX6Is;;F7$H3OVZd`Vh67)m}9+oWIZU}dq%vd9p3>EEP*%$+}y=*2sBkYmG?R9i%LZyOSN z_F&9cszWN*Sxu;t9^O7rRUr-^l@Gk*;o)(5P$(r!0rU0LP6siN4p>@OeXv@5BW2jx3{o;Ls_ZR03#GA+klGLkeHDXSW49d3A?OF z{F`GA&R|~M33|hxQV$F!^p@KC$VRy4eQ;nSDP~~;Bzz}&LBGXGmct}wtdMfn4U4({ z9OoJoHf-i*(k}KMRj9pjj3FY&#L2X|plzqWW4SKFQn7yeI>A?NN=)t|G4zz-ZrdU) zkv+C&&5v9~cC?#bskVBuUoAtFTvAou+m4{mXck=dF3t8ZaU%mH2_nkC$3eUha)nc{ z=SBjNS|g+IJh|zE0rxHQE;ZLxDb#GGU@Q{QWP0>0u2$7&>b*o*6-O7#7wDRna3^($ zitM4}1_wi(laX93^hc2XA4tE-`D|MyRUHn07RQ?xSg2#Fwk1*y#CZ#Hz`OuLO@7rZ z)WL-KNY!OgW3~&M0mHZbF-e<~R{#PINl^rCL36`_7-0~ePU6IYCKZgwiGv8p@H<82 zWs_?53)<#8Ar$tK>@9sInK0GT&vD&xO&0Tdb6wz#N5p|kP=g)gbFTVAL+?~kGae6T zHysJR!zfMX7-CM?mzV^CQ;h3Tv^u!r6iFJ<#AfAyWgJRf{9VRB;+?<8C!%R!_H%9iih)S(e}7y#CQJAffgRN<-H3sb>f>9foR9lEX(b55dJT#wqj zfscI=lJhL(a?@3doVFbb4&q8$Akk4%5r!pM<{bhdB_f8>P+wP3qqb=f*UMA5EJ_?& zt#P7S=PM3%U?HRpiklAL^;JMcNYss@P3H)EN#20M$y1O-fLs<04a|VugzVEfnNaL) ziAaBfP~wq2u%!<~=nly9JS7&kXLTn%ehOd&XjQ0Wr`}z8x8dOF!2S}%M{0BgPld$U z#|&PTqb5WtK&Y@H5aC~1P=oCP+isRkH-RtK+eg^K#93$)wax(4I`RO%w^FidDc*(M zd0(;p{s7;EO{+El&KgjUZUKJ!saWQ-9jOVdiA3b|DH5Da(3>)$@rnI@v_&p7IFoBx zHB(cJ?HAx8J&H?G9r#wUulWe(j)Q`DKW_+>{BW{EN!mp;3Fp%$W!MmG=sah`RSPj$ zz*c}MvxIyaWYI9C;b^1H3XM0+9WuU|c*b}`NXV&AVIg~5HGvNq;f}F?ZXX*o%rJ6o zr?02te04qmms&I(l+E2CR~U;G6bObG(wgdxhV0SVS4RC(qD{21@Ct=v<}ao;4m8VW z^|vNZ5+8MMCsuD*1BGRuOM{7LZk1lh%G13!RxQR>S0D#=8`$q14r|9`xxp6BH}p3+ zu;>v(ZD;iu5NB{M=Xwl6b%1QRXP6-cLH>2PXXBWrG(X%HRF{o9jq(v16uQEtA*<6G zCI@!2JMSfVnULuMUoP6?z#XxuWPo!*0iHM|ua64bq=fV`+P91``^rN@Cp3FUY9$wFoSwgIGE}w6}AX5u_#T zFe(sBYx^6RE>R3Kr~}kF`nNmX6e)el@K)mH1`PljWy2}j9pW*6>us2%HSmxysYw{UB6Z!hcn=z#qyM6c*; zpL@dqpt_@peMHI~d>reFQ`#K3Ld`it>hyBDs>{i!I#zq%PfS1lZk4CG!8x^=GO+OD0fxHI{fr023R&fc1E*?Sm|+9eTE263kkclOfDy!N(W z*_%b&>zuMMbNk6EbRV;*HA+DrX&+>18$JeCdB4{F!cQ;*-d9aij}m3g?GPQ34&WgT zw}7=5XL|JRDx!5z4w>?w+~3PlWa^%_Li-ltI*_$zebfg+OipSRO6?8_Ggll^;cN$5 zUx3s4ObDCbWbTB$cvrNP#B;X`3-=}u_42b{ z5kkcKdo#_Bq07uQiC}0V&S=3G{4r36eU4nMa*?``M!?6A%AzAFPdXO}K+ zrN>XpBan%1Y}vXBV*qnoK!Eht_Kxs+VVfjeuu5;~(-nQ!w_h`(K2fx!=al)$Xa{{L zJcIHx43d&1tBDefW?UcA?=EtF>QS=B?>02{QOLb+RcLTo*s|3xVZOeM?bE49#Z7Nb z;{WOn;Dcf&u1*}Dp zat)(E&PW`o7O6WYSIz*P%u_he!a%ZbeJyZxu~{uM?IQPK%OkloHZ`D32kU_p$vR}2 zWlb{nUf7JOM_536Nhu}z$Iwd;tU)HX%}jFbweL~fX7(NCK}ZuTiyp(d(|Xpe@O##+DLsWHV|CAvf|;C5Av?F0s*w*kj{|%Mv2Dw5FPcN=1Lpdj*?jeS(WVR$RNRm zLhDdUP*=x#N$2A2CqT*y zFywslLg?Djmw}Xz_OV;RreE;os%n<4EbFhU+I3X1UKT(mkVLA^wm!Ng` zS}b6ud#!eU)TexYrf#q;M%67%JwNbJrS_S3N-D-d5gHlN5*GGrzBG>GD7Wu3#QDab zhuAeFp_|zgX!39fMYu2M4mLs6a_OpNSd5{?ZWY+z^Z9Y6BU&+2O*h>Xvl5&}(WOk| z7NOLV8~CLs(T0h!I1ggm^NIrvK_i*+g%9*Ul`eu9;w{;Y1wUu*6O(3kxIC(gmb4pI z_r!N*yyRV6x@GyOlkK8Br?T;=M0|C~(cDPQ*iyl?rYg^_{Em}c9#ye^OqbU>Df|x% zgIYaMPBF3@Q}d_P1yEubZ}a`6*2GhN-zO6WCKZP8Tp5FT_d=xm6f8{8`vE>>xb><|YTd4o z;%n{4(wm=eY8;~yf%KJp?v+P3^XbGQ^JZV^9dPx|+Ow#0@^+SYCNZ4iKm+C+i2dSK z4v6HSe8-g9dIEcefu0A5Y*O@=QPG-&N{$iz?X+MzMAVDzrCYIc69>rmz}sukX6ko7SAL_v&Vx2BM?8`MfxbAo6{|y50AYHu+1GBmg+uP1^2@hxOn@ zG7WuwGQfWP?UnH9Rr(;_3qs;$#-G2`oXEY^1WoO@ILQ6tySz;2dnr#P6C{Hl>^en+ zi0x}XCJDL@Uj^9M+S)Qo7h@inp<7UwH_rH)P?R7k1>veIPu4~@M>)=FAN;x!mau(;*eG>T01AwsvpJv-$WM{BqH!xA&di9nw6W_8VhQk}~sH zcR?17+HtFn?D9F?^3dEvKbEJ;y5Y{fh+sX}lwQx}38!X7VeN1stMPZV`gw2eQbtcS z9G~dUHTBQXi_D3eqrRak6&D-(q~+wkjWUKDFERP$J;aJn6IlFG+jcEAwPJrTwH$o= zcn`ZZF`TvUszs5L!`^q1Pct_0ej{*?FNJB5*wLg%THp0!${RgFA75&A%;FS4R&{pI z7al*}gx?o=l1>^Q@ycVN*L0!Zt4zM2$L=AA7Mc+iUdo}7KAfMlAnQvfn0|*l0U_R& zrH>Nsch9xz&aYism_m_X-pef6)0J;!@sv$DKPlQ%>|OZG;!t#Vq;p?r>|p9D`S}zn zb{!skZ=7lX;!2c-%xO`O2x;Ht3Vi)NWtdvVNZ1ug_=Tb%oM*9uChsLA=R6dPu)3w* zG^@pYREEjOS7Nu)8rq^)cE+`){K5Vd9YRgn4TsG7OG_Mw8_E;fGIX(i8d-Y18E)MV zX*fr52QRSh9q+QpQfxLUUK&lCua{cy7;cQqP*2m)NY~=U{`mB80=kHm`xQyK3bj+S9aN5Z+bTQKh3jhM=p$@gfT~|Ee@(%n@9Ey18fV}DU+mGzurpng4;x9c-H?5Cq zOOU6f7jsCq>MxbpeMiRKtSi@PqN}j+I9*}vNbw5)>U0hFd?l;DR)rtqM3md4?Ns>p z`T9ul_T7|B`fg%v5r838i) zm#qKz{&{|Fc`96nF{QYI$?bzlUBrlwRR4=>;J z()vujRJVP-gee^BgwaKnwCZ^-B7`r?Rooa+7=j^wqZj&spcl1^PuW-S8lQI`JrgsM zJv#u03klS0&jbIoSkJ7}cy=&dCG$y2S_mXT zRyx8+{b4)C#X?d6-E<0qes<`_*HBXhVp3n3D+2~KL7Yw%jLspY>dlkA*a@%oO{7ahC!;N^aC*YyA& z<$B5G^zJN5MXULbcbU7MDoY|U=B<2CpP)0^hW=7(FP(Hl`4HD0+`DJ9s>MOBW_AqHzqh9aG#IP?kCqw`mA1(xQUP9AAq zn-$252OyVdRCr|DpO80T2EBZd8%29kBVt^;9ypfWkfZdKi!%*M%LX;a(p1Mk30zkQ zJ^f&i6Q#{>T96R_HAw;e%m)UN5^7(W7pDTg4afO+scXU!bghrs)lLfANvl6P!vCJn zxbnKI^M^o9y%C?obdLO}zO%wP(k_0C;wB}ob9}xJ8nHL-{C31}4<%DxZMd*SfxOr1 zTrmAy+~ZS`;?7QJa;us8&wNXg)IS<45BR=sTs9UkH+g$+e`e`z3fd*R5Tt{jOtu-F zfFk|Ez)i|9AF-}UzPB?Up|{9sxfqm{_saAO3bfLfsFf?s;9DPTj zTrB&k?gv~p=4LkD5}kvnDN0}zcY29hr&Od(98igq@r@N8st&C2B{6SH5A6os90*f& zQsV{J=vwryJqlx77tS(k=NQ|HQcK%Xm@cZo5TD=s(zwm~wH^A>*kacA5nw9jKq--L zfnK7*k>*)Tw}r_$p?5ztn5CA6S!<#suS;YKmeuhipJyW*>|=`Y#jEpIU{hR; zr^x0M&qV;IX7>0N>;c7a*L0#zvtW`1_dAZ~uW~7}X$f9|lph`N+ZP7O`CyN-L3s}S zVV@ZBNT?lkZsi$KE0Fb^Yj>h!2!qfC#=g2MQ*3tiZt&L+p`T@1RscL%>j*$uSD@4m zA`3nCa4NZOR#sL;wQ!{NC05tjjF^DZz-O|oZh7g{noL%jO=i#T-6Q3I7v*WhJ#7=j zgbJCZV$R*%9V+wLY*esBU-lgPguL9e52v{EOhX(;lqfg7R1v06PY*C z;E#Vq<9vju{V0c+%jz@4tV|hn(d%3Jp2<~dMllDQ=Jb)`8`=&LGN;~wD%y&BH1z;_P;QUeDvVRzfaH;an2WRuR#!bC zpRRyT4LYHgA9Ggr#I$-obAc!0GpnS==WH6Y zQX&GxpBsDeVbNo$wTcL2C%s^NBbV)9xGi6y#wg-(FK#>tHTDJy}>f43{p2Pf7&_2iOnr&209KVfV;}iHn%x({x?4Gxv<^ zD1DT+C5<>4W1-j{;WSLwf=Nak*ii~(=cI~7MF=mcu=>7VG%0TqC;%JRI_ zC$3G>EFv82>Z#AzL9E;_$#FGV#bN2&8%o7yj}*-?$OMR4nhYJ9#C2yUX`xqRg%byS zgqNh%(p}!AM!Mdu$N9EpTY<|7z+opYfWA=zvJ!L|p&G?Tb@LgG5@H&01_BA8UV4Gg zV;(>*&yBX`etP#18`DN9wK5Q0ThcE>e_A6wIqUcds2$hK0Z6mkP3n8912W~T>#v(W zGyG_;$Counj>aG}W{KdAAeC#Ky$%Oh-E6;uu4u)6#Z_=E}lGB@?Et8$#A5f@=kYQ^hlW$XmXB(74AU zpDX-@p_C5Ekl*NBVh8;C=B5XO^}AY9)G~lT8r9O+^)H_+ag&)VTj+C3M7|eT?F7ED zcNqmDT}$#=vuD)>{hnj_R=q{7yZ14e$@($avOl+S89?vpp|&gNbqe>G?=(&HJgvoV zTuId|?rdE&a+0>EDLJ8r3;W?~ZMZ2p7kfjTSii>toK`Lsc+~T0c?_aeUMtTJH_B_9E*MSstlOS;K`J>*ijzDAQ(}g5>+6(yD z?}3XE@ido6;|slgM2mK-zsS6_ZlTsKw*y=w)LDqdFK`9KJw9{WJ`nKrbKUeZstkL# z)OJb{o3Ut5om=absfZ;{Aw%<%g67M}8zIY%>l0lV{t^yZRz2&oRVRza*xTZ%+PNl9 zV;Kcq$yegWo8-AMK!3XE1kH_|`#lP}qv@FG0{I+*_|6gyKVZdL9Bod>ZVTe9|PdE#TDr*6bKPxOE|D&M&3 zfZJ@NtfHeEv?|_pZnP~;liQ**C&6*7tyUl*3?io&b<4dyRlR2J+~66#;*QLhpU63` zz06LNM`K_2Wx}$5zh=dtJ74 zn|-Komy%g&+<-l*zc<=z?TCk0;teSEJ(xEcgM`zE1%~k(-k1kpH*%e~G{7k8{5-g(D|BIl2vbBD`SCug;MxxBb&7-FY_e{CC4xI zSKj7N^u~ZV2zfH*)vMRHDSD~()&e!sG-^*OgbYB4$j!}CUvR;Tewgw?MNI0WtZ+u< zvGTnF7dNVXyAVp<5F%(1L=&ghSL~wb$UgAg*LJWfkVEs)+4{3HkM`0FDRjb{986N{ z-Ms2KvWg8A!-X7|XB*>WDM9=ZhQ#(gj%(y^zh>|2Ryf5fI_=}FFgyw4W(O{2F!hAV}U ze97zr&@Dw)Yk|}hgEx1qyM&wzQEr*yY}G@e(Gv{G*E*46XQ2^!OtOXt zAt}ecO~i7KH^~fX=XMQd$S=Qd%dtijoOOBK%{!{Q*vz-QS}?(z|E?g%tzBt(WckE* zg#7o_?tII<%NO~gg19nOJ0^!48--BUfR?R-d$~lD6*)Xt z>N1k%?=m?EVv~LNweo+YwPbR^tEU`i1fA4^g+^3`1K)GTI0u;J-JF+M@(}^;t46~o zO^4vj+2gnAyV6ifq7y%+Jhdj~12a4qk;|%vZ_qcrw9$N=mfe2v%$H$%voOLHo?n8V zPTRU9xxwAa;6=y!-YiqPc1}+6pY3zEMaU_M>*kmB+EF8o3m*vjDJ@<;0Ug+rrvI8-g3|kF*-F%r=D3>=EkmH>OM(Z7Q_V) zi}^Y_)vzRP?ZX#+;;GN2CF~4{o$8*9eZV?gLqnhnWyhVqUK=Mvp!=PtUfeUpD9aa~ z7R=v0fyyz}V+tRhH099kk7AZM+E@`e;vI=y%X`oKveM&?~8ZwwwGAyRp9nPeWiX za`mL!aso*14JDtrMvPWQW_YjK4h#2xDl2{Kg=XRLT63otFjHX>I05epIC^1svzwlI zOY+CWwFhbY0q8lF@AnP5Z{cNbrABmlz2iZeJLb|lON)R-pXcD54|8AsE%!0TbFQXJ zFAU$EId<&Rqq}Ca52x8#?B6Spbv$=k(jASIFu&=XTzB6`yRWFURp0mQw3JeJNj!3z z&$MnlW18_R1o_?GY6#Um?nj@MbJk_LORc^PIYX0$aZaksD!g;Vb=mymS!|(&?(*_f-fG6D zvo15*SPra~b+n`Tte{gU9US8^cCsdbH?H=Fjp2B2`rX^GY4OmI=nJkalb`@jSv~ja zY$4|~_!;^}OAIQJd+jq^kbn&>2QnW3mYFs+)iRC^#yZAamBTeRzo3r5u z{fJAdXj9Qsq7zqN6!f+<`c1(PM7D89C)Tz#(S8thoej}d8kOyqr|*gtMe~lngr)3G zw7BZgD41rUS@S$f;LvxF!Pm<7i8CJh0%n^P_qJEsm(cU|J^F6kQRW5IwT3g_qP+@+ zJllD}#M#g@>W)H^S|Mv>S3ypJ>{*&frYYyUgSAgwqFSQK&K{G?g~eGV z)p5L5)>5F<-fKv?m(F@uv}?H{bHSG}D6;EE6N00|KI>7gDxx~+QVFx7OMR=O_OgZL z{A^Vsvac!L@H81a`qmml(@h%*D$Sue?`xFRn1~(+WQ}Y74{TuK^?RB@GT|jsbNm)w z+D53S%NkJ@*2AU=sri_%6Ruq!lxYhmmJSQqrTgAM7E8>mXr-wxn~P^DvAK=)`eSMm zK36DfMHAQSVjhZjCTR8{C}=#U^4*wkM!UYD@tBG8D7jJCigJ0n=$~FV;#V$oy|PBH zt-172F|sQ=sMlUrGyDt1Wn`G(x?{n02{kYOy{~%<_HHzMP~ew+aka zu>w0$F=#On*!VPK^kTc#Tv4PVE4+9`PaM-Xmw4BzEh1~&%UQxYAuZp2LNCWM(CLK8 z2znS^;F!N_&w5U;*SKQ^vKqV0%w!N~?vzJC@0j~BuFtW1{ehUJFZXJ6?b^6S!KBAE z4-b8}snyQ;-i5S@=V)%%@Ck)MGi>$Z^ceFsJ;lYg?73QA8I#`S0sHy+m+N)WH6fLh z@VFuk$B;}o{Eg1Oq-Vk?J?vN}R)O`J(^TI?QRaeFpV#_oqBBhI#>d-A8b*2w}x@*Feb9T*<7sp1vSA*_m6>RUjqGm!_7al<4eydJ3c;3Tpc;y1t}k z7FD-p!qaNG7#EA;vY#x|$tU5`S12K=*f9L8@dRDC0!=5%= z(&QHWYFw&f6tD1=lF-@Fr)`<)ang(zz~xO`U2g?i_g$at_F$PGL$+mT4qGY*X0*+2 zrr*h;y;jd_Z7*#|l_pCxcR+LB^p{#AiK&SZw{KUQCh2XmI5f+{PPf)!QlgbHyKCt> z_)G5!bv=)%w_w!=In-i>SZ~8f-sfj*yzFUN%%jSNen(NGn=3H(!Y4jZvXYLQYgRa3u1r&>@G*TB3S)iO-x?dnwT;3Bd>1XmhXIC zVn(TRr4u?9*K!~Ab}Xv8A-jp4UWuT5N#_pV5O}4|&rx-Hc>M^X^xY;f~VmT}D2Su^5>Q)x;vIi2A%Wksc z1NXXGQ>=Eie{I*h(KY)@dyvEG+WNy@SGZeu-rAQpDW-SM8dsNnn^7KL^5aZLX4p9m zDQb34!o>q6#5h-0)YQ7KPUT+M(=p8)q%)<9?fUrUN~4P*H|Vstn0U>ikt8bNHCg!* zUX%GK8jt;~-Jo`x!+x;;#eF0F0~hNfgGTYH=cgaJngo>0_I#eN4UX=1 z)D-gHw>DB-tvaOAF1x;r%3WPnmLzSPwG$h9XasEza?fpmbA&4^dL+5;Vjdq%T*i(z z70u5Mc;+MDWbrPQUmm4+yI?QZtTuA)rH(4NpWM95jx$NRI+EkApvBehzV&ZqZmQ>~ zq2l1`fv3YE*ChFpAmOFV7Z>K6a#zQ5+V+m8jxBX1&6L`@2w8TSklVR0&iT)eH@Iae zq!@C&df`#QRj@u;THi6u+njD+q0#p8oFaB2imk^96d!{o#GQ0k#fEh27#=$_hlecd(Scb^DOVGG&qDguIz*!zI?(>OgkucMlKQ-G#f&5YZkV>mNEf=BDiIHh|YpU3}JNzV^#zVrNyu4Ou_tp1U*?gCU z6)5<$m3evLS}+pJPkemQ zT9(T5?ZS)zDVEws(eK{9Y`zl@7d`dXj>K8ze)T|Pi1iyJm=|F7NlfO}(?qQt`HUF7 zVb8pLqwYMabsy6MK1EZF3?v&i=Az~p|Chz)KF379vHURumwGD`&7K=&CBlyRBlQna zWhm~_xzgqJ`(N8<^SEiFe^VHnx?Nu~A2kv(JtwBM;Kr0YSGw-i#H*)T;w-t6r;h6D z>aOGj$RZA`{9As#1OoQV}5+D#NQGxIAb5`nS|0A~r0e~qn}M7;bXpxVeW>11>aL?Z+UK?vNNDpd ztGp=DR|A+v-IrV4#T~AfY4pxom3W{ZkO!u9?b>x`X>I*%*<8^g-Lh?`*ZRPk>&LUp z#!JS*QZJZuCD&dts*bi)h9H?AvM`_4HZ>WZ?)jO*}I=-EaEcTm`=!;nR93 z-_`vA`Se=MC65M|ndx_HdOXhgQ|Ng;3%84=79Hsr#KRAsU9;x$WpFdrDA$(u_p}pF zoHRorlH}t(9`ZxOpAI}Rov7!SXbx3VBo_0XJgrk44?0e7GR+)ctS(k?jV%wWIT_XW z%?EN*warbRoODgQI(SyMaK&x;M)i;3qP%Y(<6q>rI{OayBtM#L&zp~2K=pp7)1FP? zwz;7eT=PuuU9)HZ;?ao(xNs7iqHI^T!5cIC^)mgDa%b=x0#4H&B5;rX6LB*MZ+%Yk zmVT`c60)66YJ8^{HXRCgap9kdPMpOQBrZ*6oC;rCBgGag8o3Qjj!o>=|Mn%JUAb>c zOiS&BhluA(ifMO&@1ix&*yA#^O6r`}U$oDzh3{AHHT9SLA?5Z19iHA_vfg`FtWBy! zXw+cYu~&nh&oZxfp@Ecs)n9Mgw=S+`%`o(}Ko%}}Es^Qge&JNFaQfB&)y0Jg@xycRn?+-Q{l zHQ2Y>RcEvzKSe@tmRdOQL!C@Ue+yz?QvFAaF zis2?j!GWXgSyM9AA3}KFBq~Qw7A?J@l*_NW-8s)43u7^gKfbA1IL%oldQ`{9)DQMfVLn|X?^Iiz%JEuTY|k8< zyQdg3pQ4_j)t3506*P7*NR9pnKRo@$LUfnU8mvYgMhsp)RM5AMZS&MF>(s1QoYY-b zj`&fb<5b!Uy_IR%{2|a|f^pY)MW6*HeB&xL=xHC_y!zom>2RPw!{;_d7pHTt;gpwH z)mIOxdOCp&6y@yrXSZRyw}$JY?mtl2@2TPG2CXvlP2Ylz#wDkG%z4|M=Ekl+wd$Vd z)Au?iS6UV$ElqOg&C248vUtX>J^LJnhVvLL!7r{Cfg14s{pj!ZM~@wQ*=?H`ZNY9k zIrj~?hDoRLK>AE;1cu`fkHp#b%BQQ#^Dj^57+0AW^nCZ`e)YIj;Jj?}Gi1f5ELyGJ zJGJAjFPg_6D7EWOdEOkK_JhNi3ID7(BN=IZs6NBQdBNpF z=A>&}iR7eFbLA6#4Q_u)r{R0TmMgL|aqabaF+`0a!ZM*xe7MLv9?d{CQ#G;-XxmYr zWH4v>znsISUtkOW)(F8)CW>2qvG|-Zm@qN%?&D1(>hN;f%CPAX!>8>5rg|?ZxHG3H z_#%GeT3zdQqU|VLC@)X+SXy(h$|~LSF7$)D*TVfP0sYle;sxEe{AoKTN|^J-r|7Rs zSdUprd6c~!Y(QDOZSxWuJ^^isu?EZpODcnA%A&R;M)?(_!)k<?X@FFa>I*7n&6yXdz(VI5tb&q)uDsbqZS!<--=EYuXbw{&?D z+nl!tRMrur`|=VvoOD~(IJqK&*r7sZ$7?8Sym)=}8t10V^9r3D@6zyIZp(vTBp)g; zV6Es1NRq|o%`8Y+&DGP#&a@WC z^{%nz1+75X(05r>!8zqp>x9eHFP5i@xSWE9=bZb(4FXR;%keki%KpymZs;=eC1)hJ zEDsmxoyAqh;`;2}rMSa|QYYqJn1`Y@dBw~ExlvsG5|N#BZD}8!hN>c)J*K2=Dm^OJ zlHs|RXHWVjKkjGtnta$t>t2s@6K}kjU$pnHH6T_e@3v;HDGzym zeuOBwF><*(cfq?#mzcxXPv=ML0@r$re_6J5B(VK;{~y)J-r`KoMeD$ke%-L9$^7ul zoXX1d`OgpZEzw!yiN5BA`d?Q57!kLx z`WgFEPVJnxQ1iUW=&Kq4L(=NggynuZeOty=)mr^NugVQTZUnGh_C5spCq$(hBto6E3dQ5h$u$$Q6IR)MI;7{fusP z5U0KoO6ff%kl&n7krr&ubQ?YRbrB9Uv?mNtvVb@LdGqjECi}}thar-xhs+xU_ z_-&{oJv6s>{rRW?`AENa_Pw#$(Q`NJl&>v!fd3sr3R}#w-?NoyU)#u|tJfY{xT)sP zF;7QuYUMXZ-Iy1&aO^xZKUSZn5GPO9ddiACH6rE19%gzIBgqgWSDu$f%QVfWLIZ1p zJ72`f);q}gK(nft2sz)u- zC`aQf*O@(Oie0JBZ1f7Q0)+6!shII=4w(!^jjCFhCKBf*7UCP0d z#sZaGCpd@Bc-ekxt1kVCZu5Ne#j3m6I+x^_A}OJ7p6QR&EZV1=Ot{j7O5D|er#e^* za%jCw&iL_NydcxtcWLpnbAOQ|w0C~l=PqMrX~N?=Q8J< z9c!<>_S)a|{f?|e?EjLnx&;?rnQlS4HvUXywi|LY=NwiKdsS-KlZf!~c|a8GoN2fn z>ZlvllDrDG_*<@nUQb64L?iD#JFRTch|TkUQ+}=A>3La>l^uZVxC_hN7_yxY`syF_ z0h6=Ya*pO8lG)5JaLGk(%?;Vpcj-IvcV14%;X=uo=PUcyp6EZjX8(%3bm?5x_)tz_ zXN{Adg*4HV8s6%Bhnk&BF*fF6;js^PX@4wj!UKC8Zw(IjXUA|9gm#i?n0IH@66+vG zc4COD?H31jN-D=$(-*~iJ%l%Z(r^^tKF?lq`#gvJw7y7kAKRaJHDe{7ndsqaLmz=^ zgYOpeuWA#{e5*6Fw@y>Bja&7I1)+!IQq5*%>gHHAfSmP}TBvvbpd7VQuD@+J_0#Hk z{O0Q2lqJ`yrP^KhX`bRDvGlDKbFZXFFOydjkRmSYPG|GwJuI?HZ_7o0N{}-5l~{B( znrMk?*FM*5M?UOa2j73Vu5EM=1smNj!E8EJ2BmcGb_*A?VV!n7`oeD|L$68 zug*zWj8?u`GU@d?q`SM``fJ1fFbw}@-T2V>T6-<${$6d4xbMt;F4sb-8ZGX2%3vjQ z(Da=W^N1GBeay5)Z(3z(Ru$6fWe@>zYEQdD^LGD!tlZs)S1%IUL22jbO&@v#X@a(~ ziGSmMYpt7O=go>Ou~W!S&FS`!OK!ZRX5VEfpwrL5Q++&10JIpGJ-DZu|3Y`uE2EpS zo%c5h&Eao*%ST~RO9O8h0Pum^I${Zr^a{Aic&|3Y@oh&~&zgPwih!uW)k7=QR z@S=`mHzy?0^qXI2(5h`R+ZEby4?%L)CXM}yDR>!8_gd8RN#eR z&u-*{gTtA{Q7=3Egm>9w_iIKcQ3BRBb~ZqI=mN+&TTml%6y$h3tD3OOI~qF z4_*!$nszHF=@-`aiKM&6`?L1YLBT$HcY$MLEu;L7buDahi!G+FYN^U<_Bo~6Ps%vj zS-UE%=U9(`Zb_(sf}V$Xy6ngM*f(DCpB&__MzLu>x392DSxR~G>qc$+gTpAsb}y2Y za2caN+Dqh^T8Cna+@4J4v7xt1DZw09#&`LDdqvxVyEq2!oyqB(&+uEiRC^sw{zMOi zVoeXc45Q+({qZ^#tDl%VtKHKKd+F5U!KwIDozv`<{lm8~H%dJfh3tDuX8M{`FH-}c zv#rm|w*w{#?y0J~&l|`DmVC6-^1f79>3TR%uTSTS$4RR#RU2BR4n!(1wY|8y_4om5 z%ku(xhE3@#{wJz%t)Xb8_aPi58P`Wyb8&Xo*H=7YfgP-*RWn<_1kwPP_MXZo44Qr_J)}ovHBd71OW& z4{B|YTBQ>n+7(-Msr3z2=_3p&or3xtdU^AmQmD5x5qKJ=AcK!Bbqk`VQ7*H;*S$-< z=1F^%)r?9&E)LB+-lGHe6pAnH;G~jdh~ZR{#_lV-PcrfLk33nXfU3E=aKtTuIl6c25Z0VtunTZ6@7Ee!)m^Alo0gwefq#-eBR8+hnG{ zEPnjO{JLqvz694m`}M;et;J@!fTzN081j7 z`bW#7tD`%p4~LJ==9Jya8k<(TI8aS(8# z+nUG|;6bIBxb9w%I-5{Gb2j(2D7|LP+NvykMu5vR&!M6^B*1;=p6bOo&Oa&NZ$)XR z&si0ExE+>^I$8#dOxNAD{Nc-O^hJPst%7Ih$D4e0OCC9?DYxXM1h$dM1uS>f!#@cW zWC*H<^G3T3>hWk*3ruoA&1M_x#>}a53#Yf}c|Li08BW)|bK1-M4c$t!_sNsz1g2vj z9G2d>@8&4r&iki?xz1Cw`2Nn;CkoC59UW|Gs|A*>%B$bp9#eK}(dnu4RiWs;_=tRs z?~9A88SB+m2{KM2{iAZe>6=vI`|G2lUjrM6CK3RKp7TbA>EBSj7qw$LKMlNeT#_H` zQcR?V$W%Ffw=B1g$~{~+(O*VqPz-a7o07E;4boMddA+k}BoMAXI<(Jc_PuRrho0E}b2H zKLZ1KD%0xdsLK$3ZBQ&KyE{lJ?C~@x=*sv=*y=&- zX0Ax_>AYB-3cJA}BRk|ki$c}<#gv5NdvvwWE*l4wyU|uQqP?~Yhn;r=`f5y^sMqGb z7`P4TrZ32kHNNo*#QsY0zvEQqe)ge{WhPtVs1;FE9jO<9IdR)gJkHiG&l6nlQRaRz zF1AUM=drsn=u0B>VWN|d*(K0+x(x}y?j-=7S!q~~#7@EF=lU5BIg$ij*KF#TGe#*? zx`fv@7Ki7`%mR_>PlG*DQx$?8;-=!o>DfHqkgkO15^*xc`h1+gja{S_~gD zl=@;%2}nqMv&+}s4eZCPC@b4CD@doUkheLA=kB|t#Td$Vzh`FC-itUtJBn><3jVwh zv?PkUJgK>}5ViAGUZzg-N=@v*%S&m^AAD|%-r2d)kW|>e@5I8iF+48bmx-0Dwd-b; zsNCMzonNXW!44@11qwayeS3(0(%rBW<+(unXVyJ5BUj*Ogf5(;W-XCQf zJ4w}TrPO@(=G1gBt=}B#llf@PBrCSsFd0jh<018aL95d=bUtLza_HM&-(*&w zqiBDbTJ~QDwNLIAZYzW33uQ6svoI_4Ib+R?4A5&uX+f!r?cn!z8;NF6#q81&ADDpcR9T2+GZD%%J4tsy= zz{`1lpl}1!5^2=BZ|gjn29Uzd;e@lhhtu6u@qysDw#rEpb9GJCWO-jUe~h^8+QYS| zxt0p@mQPC&!uiFa--#sC#brE8s?I$8T@@*RsOe?(@_yMwqbfS&?#R8DL=&ZMv{$Y4 z-Phx0<9I*;0=S53+!L5j>mM=FbrqWb^KL)sKFPJc7RPPau-?ZV&+Rx8kYrTW*H?GbS%#a`XWxeON$p5yKzSuEgSj3NggT0_FZVP(HGp8Bvmyh)Jmsx6A3tE5rqIOX7Gk|5V z)*&o_X5U997h_)l!t|=!6U}k`YWaJeoM~E9KQ(jQzuPSc=#LrJE#X&71XSO3FYwr( zoJP|JQC?|Y5Rgz#Xa1B(|ETv5m)u;?!;Wrl_@<_UW9L?(ZGp7xQx)Ti$ND z-uX1su|{NpUU9AN_~`&THOSg7JPW%FDv3(V^<3IEwqTS8+n0)SF7l~6%s!=4aA_ZL zp1s<=YpdtF_`<{yZEGwWXK?Z2MMq74`E;Yq(N8a#gSo$2yOwgXdaY=Zl=+_7z@pbJ zkR84?ITE@2j=#j$Q-Ty8$Itvsr>Hz!vI05LfcA9<0nhml)PrfAToty{_tu-__cQfU z%G~-p!A-t~Zv$K0cBZb{cc)pIP#oh9OXz{Oi%n#LaZ}Ydt^Ea;rQY_V1(A8ObSw@>&ePC=8V^vvOv!KJ% z$Tlac>~40L!`zOYQhhMLpicXa_WbIfAO6Un7QW$Z{75~)uW-eZB*)gQvZvdU8{0qC zk=XWPIsE9~Zc!SUm&8l3o_gHht*SCp-1L9G@sP<;3t+Kw1H}!<@8w~Zec>O38>J(e zESvkYG-;yR4@DWIFC3J0oL;LL9L_h#M)p2Hj;yI$wmOB$%~{v%WeAA194yp=D=mS7 zXGz#}l7Nlv&3dQ45=FLLiE?FD^VNX<(*9(b=r&oG8lj2+Pr7$g)n@tcoqt%jG>H$+ z@B)0MxCf@v7~Pt%U&(f8oXoa2ah_E<>w}{>Bit?7^RRi1dS;}7UA??))N{W_yL78L zQza=pQ!mbhhV0_SUu}molysfup`m%=@E6JM{l?F0vlg{_okEF-i+m~Aw8*9(M`B7X zVkBM-*?c{pCrOoA=P;)hBkWbnre8b68K4Q4{E*P39dWu)TO`ko8(-kh)>_nr54KXM zKX!xkwX$S%YcyBO{)%Rm)5^>(;x`FQ()20zDW{409VP?0$de;B`7C4Yk|8N6xt0B`JxuQJXs_3aa zA)7I8vxF6k7$4^7P_Z+a)t>u19}li)coAFxSmPMv#E%fP*{_o1*?v$v$k$zBGhF4w zvtJhHRK3A?+f3^a5<)YB{t2swENetoTm~!hS3C3Bv28`2f zx&?;o!5COTjJ~<3$6=z*-``Gse?$2lMFw^H=97sweg^yJn=Yj-)ovUw6hwY=U_4u&eyZb57_^a>`pSAUy)PWqMWa2r|kV3b3qRI zt6Cwa@B4Y^9t&GS(x5rFqbiGfgD)!asd_|mdd~Uc_-J%5yEUKPbeaE| z^P5Ej7%tZN#--W-J%zR}$_%3=$={_lVkCOymYS}vb?BlqCu!a1C)#uU!gFV5^sepK z(roPCF;!jC5vY@uk69$nTC247-j46lQaXG%F=sc|l2@Ym^|U7THs!#yow3HKWV|g2 zO_8y{HZkjgkr$^+b#GpG2N5OPV%;DcD}8^pgMfC)*aPKdIcn`4m_tI_2g6cU$^scG zwPJu##RAytY;(V7n%{(?(4oCcW1geil0Pz$IIFKfNs9 zK5d3Rk&UJq*HjhcaXF-w&a}PM^_NK>q1bN-E~yqVD)pUJ5|?e=c_*7fZ@trnAbnoi z&ij3wraNx7zrMVzky{kVtF~&)42rF-ONe6E-RaT#$szZ9>X7*I4!i(FKbr9mT?~!a za$VLs>LVYdiQd*`!`tG5Pv^$%QD+zxxjNzfAr*A{w)S``ii+Gx)5u&4O7v z!wn_zZf<=*{M?#OqERcWuRslOV#rRzq8YVTMOg`x0kac@UOBl~hH`qKwxIn?@II(f zLL0oq+WZl z9fQ{Y1W=Yb1`>xqx=YSRx9@->Pseq1<$7Cm-N8eaRf`)Ua=L4Lh$ ztEvU=O_J{b)HLXK_OedxH_wdRodDs8C7Nu!fT?bFwVV%TJ6ydkppf>{=!!CJ#q2OY z)%TP!=``sG%dO>K8?)&Nm3ZMR86JPH(gOAyxG~waZebzq64R%vQ>}I)oD0f)RN`DV zV~BpIbsqIR9jLH*0MrAHuXWzLNpSYsV%teBpi6q}PaaRD(^uKUy)&c2kJ1NIufChl zp2X^SGg|Z=`oPO~X@7F))pXx>FRAB}6G3gaa1We$P*-%z!f{Z>TCS|2m80{ez2@3$zbTXv^rElMaa;Ca%hsZXxvl?dDaR4b=M1|HnfIEF1v2X;m$b$n zrg(5VeGG7YmhACx$*o+c`uWvzeL5n-i~y}bRx=j%h{1&hfpHAYGwq}s-{*%jS1lLI z>jtp3h_BN!{ezd=Ypg;B?Zl?F3%7&K!ll+ukA6uJP2gE?EuT4npftPooh&gsvxYGh zV~jEUCU1ski6@+0*ukxja!gi##==Svt#G%V=kA0Gm6h+(?@&h?-FTmu?{@lr!Uf~6 z@nJl5>e@Y*)0h+7EkZ&Db7d=}(Ta-fVWW*XFI$j9{t3ItHx*ky-#xQj@B11lpdeJ9 z0xt!OgRK4V+AAor$6RJm5&~NGxnRh6R@pO*?CQ1$r`&5A z2EVD62i}6e@}>=^%yAB|c#kfW&Nc|l4kjT0R2mD+uT$hIZ#y8(KZe`j%LSAfw^F&S zG%-4mo<-S{cRY^va&kBESmfmkz2o?7jW))sjH47pmle9-i6~1rZr2&l)y5kq1bTIH zv&UPdBzSyVlc$Qh9!L`KY1?D_n)coG^Sj17*fQf^&n>#EJ?-Ubb`LBR1{Wjj7N$AU z2lDm3OoN8pWY!KKCq~@$=Hm>o>b=$e@uEmtNep*b>->pITMJar~G`Zf# zHL2CqWpW_5_`WvrMZ_xmGW->LsaZ`F@iAK{+^(4m@(a*uJ zU%$Q?^_#|7%GZ2jOpqr=Vvi{UJv%FOgs_3WL<^XU1Iv z{}btVY~i;0j{J)%=9|NLSg-nRu5OE zk6Ug5ZFZ)VK*lBwgo$J=8HF<-J&8{Km^ME_%8Vm-ijmx3*;E2mK z4JB{K>nn0Ext*5{=7uWle0;7KUS+SEFPf1fa_q@a{K|=8bWO2N0s&%ed)Og4v(h(! z3o?u@-kG2%26qjb^C3bbwF9Hkks{q0f(Ki_t$Knb@-h~v)^XX_{JH~7Yj$o$DOZ;` zgVzNb{t0xrGB!fr<-YMxQxL;)1rRB9RdM&^16yEz*OUX!!i#B{z<-G{yyKLMvA*~D zkomE4g{@Kd8fliK)P7hesFj>(1vW;RVR!>;9aB1SkZ*iQil8*jul7&vM-qCJ-L zxN=q7ph_~WUV;7#G!IQlF1X(g9I|{we-{p>iKL^KU+_u4uLBz+OUPB!O~M(dT3poO zJeV;YDdRH1lxM{^qJ+`rB1z+72?wPON~3E2EgUf2%AoNhM<3h8%-_sP)!j{SAhzB(>Q<>@UMP}XTj}i^@BQ;pEJG|OnbS`J<%G zVT?hCx0MYH4-fXy2Jal1oKpeAbp$B0*BSfb6;sB@39_?47OPhQ?^B1HJ2+lVOMJD& zlrWFncy)p1&&bo1&4FrA6$xr)6Ew5ca_0fp!@YntMSNF|U>{L+eUDP=^F4r8U^92N z{lX5d4@;25A=w>`C-3fsO8odXK-&1WF6mDfA$|UZC2bM5eD;83a9Kko?(jQ+M+=^_-8p!ytG^)xzSLVHG=2i6k9T#%11z0f4s`eMOf-r*q&1m+^&B zKipO2NP5<3O1<9YYI6Qe-mqS8`FsQLS9Nfu(aVP~QFWJ2>Do1Me7poo{mI~*9)rCL zTCv>2T1*=eLbw5pRiqbp^m|S(dEcSAtiYk}@QQtkZO_!sB!?p9W5U#T-V(v4sg2+= zpS+?9CL^1vZRau(-8kBT^BKfX`$RCQc+|_N{rL9HhvT z=P{+MoetpG-@_T9rJ@oppw?Z@JeG_IKy$5j0l=my5t>Q)@A!A*TwgAF^Uze+Y-ywh ztth9ZCjI*9Y*(7x($~%&b3H-V#$bsd_rv{7mIk;ruD*MwCtJO}=JMl|*Y>e3^~XFf zPw7c_ai%2Ot^ZP_f7XzSP;49KTZvBYy7fBjG)?Nik}5z8hL_PmJM!nN$)C}URH~L1 z!b=*_KSR3~m*u>2%H9KuT9xUMtC9w#+8Qv|GqUOOaYLMjV9$!C=1W0*0~dWrKnYT2 z-pc}!p$KFFe}vw%uKxRqm@^05t8l`^usWyfNNVgPKU2enIgJKEvljrT&EJ-g>hH09 z3bnjS4yIzk7_>nf$X+Zg|N4qX5>wnM0G>6*=eks;9K*Bf%x2D-j}l}xpnThLtR8>$7Wi~$Hh9G5~|pz`v(s>Pyr9JRds z3bvG-(vQ2}WX|)9x_7fzFF(rGEJjmjCVRidq|x_yGP6qg%}mOXBMd&2N`XJf$v zU~A$_t%fo7o*)D=0a56Jn8<7)7@<^y+LV{iP znqo1Mp zYSkJg^|EviNKa;8DL~3T`pSFrF`P{2Nxg)!AM@Rn9%Y4(J`6-EO!dD<+2E!^09fd@ zIqW3IU{Ipp!ZT#!+tQaRbvZ`BDGyi9&o9v(*BUP<&|rFPAqEtZw=8)ubvyvqR@S{9 z7G!TF&YGnG-^h-zU96Zk?@a^c+!bc6WU`%Z$av2kGs->Z@i&a~ASL67%H((W^QroU zhiPhv5Bq`9&NQ`vV@@l8ecMhpPja)?-+%grz~lkA9P8e7?(r&L?U4jrIJz-CRxU!o z?OBm2i-~>9yf)>dWAZ>n0{+f^kC>y{z;!xEVw%Y&%|lxJE!n+*3tcW$oTkAw>wVhn zW>p)k+qW8Pf-7nMnH9hR8T6QFOe%0G9pOJ$Mm1k0r={@YiO5;L@vShG z1qCu(2f5aSdt`9?+!+tvKQVdNb!Cp&E{`}TZmN6# zzRXIxg1Uz4Va9%WJIRh5wT@2j^_He~%qh)IHq^#pGV^K_w`k~ zeVsk#KJOi6x%-~X>TPW>M7ZWz{GQ+{`flIq+%M0fDp~j+YKw2Iq!g%Y%sOiOTJL_6 znF(7SJj%uo;a=1;tDE0zbxW6X?NNv$ys1Jz z-gD0T@F1px;RlfYIyj=|JJ{8bcS8-3Oz?mlk!)$?#`N_L3l#u&d4;*U8{Nr$2`0iy zy6+{i_nqCe{rY)@GQB#t9r4A1awiZzE(=_WbFWx(W0B_KlVvol)DKD?C@_PM445EtQ( z54o@B8VbMGRsH|)53&R^S3bWUUFqM#JmV*Ed_i7I#y=zRIcEjroOSm;e`0p|~uVp-w|!mx@pV zL*{eS9yvn=5hG5VC1~r^Tv4+N*mgUl`oB*?ob-=t5d&~rvA$$!Neh+2fL3j;PS4@( z8tybHOodmNN3Cn}WK(3nmDN__WLu=L+@G{dkO86SDIPbX)tN#XduzAL1s7ugL+RsK zZ>J^aO{MX`+fL@hGa@y#1KG5K_5Hr?Y++v%3|8O10TiKv{ai^Fq7d<>6uoxH?K}am zg#(NS#KZIE^710hlAiQX=Y#}Mrg<(pb_e$K>W>h~^>K&!yeWl&q`J+4FA3=b*1O#1 zc3G*uwfvFDSPRy2Pb0Q$9W!LMlT3sw6WP&lg_H5tx#O!3wZ}LPc0OYqx({(x-o+n& zQ0Wwot%?GitatDQ3pUa1T@d{yNe;#BTCQs$y!dge8T;BpB9#>OauBB$C{&M4!&cGK z3aVl&XzZ8H={iGMl&7mUf-%N>F#5JT=_njejL-WuuapX$9?P%gFa)IQg{SDHNsxwD;Qe`H1R z<9>%tyS@|HBpRQgdi?eF6LOdtOYp7H?Z^}rf!*nEqZ`weJl!Q$EX1bxR8e@ik+3J3 z)swEjj^mP6(xJ~e#TRc}3dm#IZwG09C5po2ork0dzn&IKzB+`5XVl`S9>>?)344#YDlR zVNozQk}%hZ(f7LJ2r>TF55n#9XW|vvmuS0i=dQ;VsCuA$;gH|{M87w=bbhCDbC4~7 zw#*jJf^GAdL-r|H4_2%GMmFszSbpyl-)ONO9R$Y%-L72+HRNssVAb?VV8oUfaSXN# zP-u@>y5xR^4==PC`{wFx_eJtOi+s@Y;adlN>n9q&Ipw^9_Qn%WjX^~2apf8; zFzW2r?Qdo5d(clB-+b|M1qIPj(RS7(Tg^huyEy8pU|QI8s$?2U&t&9>k6O8oOjX`u z&Bl`$%3&ukQyMRQRPT5_$8U+eS8UW8++=IgicDLLD8{5wYc@vnXxGW;7id$H6i}%0 zYc;u(zZb?$Q6>W-(~PxaXS@r_@W0#H&5+x5PeTsXG9sxFNJ4@)-Vl{JG+lspIuzY4 zD~#{M=XvFNSq6O|%>GX#)E%$|k;=oiEgo7{u&x*UmOLoQeYaF1T2*^4eX(1e;1U>> zVsU>x|sAbzfv(U)|EXB4FrCH$4H+N`+ zogF)rMOM>6G|lo9a9i4x84gh1hCw8Vmrm=P%Je$#*Ax`)Jv-$P6>G7cMPB+&SuWn^uia7*DOLua5I0*1H#I%l2=c`!Yt=QJQC=*I&DcKTKT7Xm5uz z3L_;O;9Ki>79s&d5CMTx(3j$M#!>$Vo#4dx0*^nPzuf923BebQ#K$R}Y8i{g@&=<* zO=SnGEl8}>CU!(_NxLVWZhl5z+uh8f16`5OUUpl3f}(gVc)bq0v7Wq0)OK=O!h9u>Tee@TqSOfNfC(D4~fRfhD_{y*oj z2PN>)-14Rbw(`R6y5f7OVW)ZhN__JibXO}k97tx2JC11D`=pYtlYY$4QZ;+fw3dsg z2Z4w?J}NhRyLXMthv1oK?B<_)lbXq^86&Bo$Ii$kaRkt z?2kF7?AKz14#6hmk5l4+SOH=5vD614ISS@dGe?SWA^YQ^$#VSO}6{Mn0miA-F%u zVl5sMSo*gA@aZirujktwGbVg8`cFe%Qtv4Fddmx2vRX+CN<1%K{Mwp!t8R~Ra5}Qy z%Io=44CR&6=ZCrSE%Y~!P4S>A8Yk`B1xZirB%Hzt9H#o=8PNw%!9p}2Xsz3B=X!j# z-Kg7`)?8}iTF?W^4>sp#wEB=vC3B_*joD&kpcOtM40s{HX!zMmkbD)ykd-F|5rTEuL^Hp;Vs_h*wl=) zg?oj*y!<9+SeUse9;$@&N#YbZ=M?}BkA8>@t~XmfNHKS#aiE^)=(s8Zbl4bwC>T_7 zCo~_aP2hrE!Uy>9)11ws!+jYf@C!hX#0v$soanYUTFG{)cDNHlDv(B_R0Q0X0Ije3 z-k|MSkRU}p8`|tRyoMC^##?z$q)#u{qATj`R+n8K`T0IIznABBnFfR!itQ{%H z!dTR{1+;}|Lzi=pv%uc0PD08})y%hWx;!{$ zG4Sr!#9~v~=BgOk`yQ;`1;(9s->tyO9#vz_25Sg@q3Y|WQ{vilVmMnEHb8`QX) zqkzxR3ZfOX1nDcsrdv^Bn`t16*x7RD=#``_K!@Yeq-+=X?rTx+W0HRGr9VWbYyRlJ zN^C?-cYC96cHM5$n#z*H=ZYhS4y8bq1!Oo(1l>058D2#5STFMD;00dl&f*KayO-Dk zje;p8(zviHv-I!L;t~r&h#-_H(X1M`3o3hGe8%)<-=<%!f zg5620si(HCeo7*=l}J3^ldpeRa@tg^&5U{wtY@fogoL1VsIbSBxYqfodB4KhnqROt zjEIURncb}92go>338K4ueewQ7vx@K6e`qXyf58fA z7W^Qt29%V5@9!?prF6g!dwo>@SOXhj3Djo_#Wf^>F2l@m4hHH(77`e zQ?dn2K73N#QNvT@_lL%11+h0Nf1m(cqY4Z_B?^EM1K|h23+bD+Fgv0_g&PLa`_SA^ zsdQaDIseg5!kK_xO(=V!BE;lPBsMe5F2%w2Fev=ve2*Kv;dvGmdHDHzOZ<|J;ckV$ z$WqC?L>q^W0?h&a{dPT=0u{@fWpw#J%$T4JJAh!nm3Rugj7ZkcGhZ3)UljULI_x@_ zasu~c6k+OzdI0%Y=vELez4xp^%Z_SiesLPLuJNS+o`$z^% z`*^#_JbmD~%lbr;;Ex4F=V%{-(y)XjA6}#8@UwkZ9e{xTwYv8?5a>SvV|X^=#=pY{ z+Dj0R2rhYyA`D}Be*KUKClbgYA*$-y?I~&~ff2!^c;g|z z9LJF#c`XS%z(d6R1rmJM|H>Dc6Eo2#)%*QndRVpY96ata3OM2bw@VoXebF%fb@yMLyM9VWiKEt0tv06ZW1%yRs5ex zZ!=gW(zJZR9j_Rg#0R9OedH6tC0m){cOt;Yym`m#U{9pqlL}{)q@ghUZe|!Cz8#Ax z;eY4I4`gySUI+yhk$4_#n^1mhiW6{h z9~?ZE!x;ejsb{N{<^6$n0~6fzSo{uT{=9*Vui$8843^I#I_Q}lc=qUTJBN%uiCR(O0s(>kA- zDg-D)C+D64032FqP9T+E$^`sY4+SQzAKZSC0GrUMc4<0Vsiv?JMnOnF-Jjp#zZ(J` ztdM}LBcsbWbXL0xhote8ZAl7Fc1JOs`csjP>|5uy(rAw)Zr-X1Ab>Cc zWo~>S=I~Q*oJAJFnLyr%l+X!`@Gnnzhu1&e`se$!BwL;AkItOpOnJNVfF^ zN#qCA6DJL%&5JR4+}Rv|!ayJb^n%!ArBLyLZh$#w&=Ta|nKkbi9o+Po~1ln;PAX@?&D2Z75QUOwoY$k27 z8}r5OuM`?*fgU3eQx=r?AAQA>(Swv0d6jA52r|OX1CTqgY)yVj0r~w?_cM`z>3kbQ z1wz}*g`EpO8oHQ3l7tHd(mYtsON`bd)f+z_w5Mtbk{xX#2wrHT@-LR9`zqyK`|r&A z0nxDQxG*5w4cP5nIc@YLLRzsFFAPH=PRbZ8PmC0yZ-s+v(&w&>@}P!u9zbK{S9iXq zKB~ldDpCn(IA)%AtNt@vXgmwxt1V$v!{freTJ&(c9t!x2=ULoYxlmFO;d~alg|Bp& zGY0;-7!cvUQlFk>J8~kKH-q;O@+@5M4gV8hK~a`GC6GcR3O5ZJ5lO*2k`Oh22c%Fl z1AvUk2fSesdRi1f1mXlKD0OU5(7o^93F8w5jhm1Z-J>)pB?w&j4H(&pd}@_)ID&2;kduvuMOz!kzlv})$8I4cxiFs2>i>|JNMyAU@19A4rLb0IAmExbX5O;ovuud{|Gd`^jeu4--rL%gf0uveh-UALqC7TqWes<# z>vt8<0DQ)R7r!Ouz>P;7DAa|3NvU?b8Atlqs17J1j-HOtJF;bOgc6(=3W5mlqXtmn zz-&LD1!Quq09b%u#dE&0Gyr75e=!s|E@)AHtC%lpnNRYkB}xc9l6XaRkP;^A0kcXD z6IcG9`2yb8ROS7MV#;vFs@K9+9c@eKCf%$+ZMolXQ_R1H7?fyR@Elpug!1)=)s zonwi>XkevMmyKDVFs+TH{vRoBdU1laKq|O~iiY$VJF;(zAAu%t20PA=>=8tA=r8*4 zLXeS>S~5@A+7+<3+0a81eG?3&l;Lms6Vn85?UM0!y$JMLO0xnwAx9~fj9lfJV1WY-9;u*0B&XaH*=T9D~Ay5?7 zmA^}`429^JIpfs( zs{QcIFlehG3|tS|h{S?WPZKcrism@kpTX^PsCq~ca%=iE#SKz4%>F;3qiF=3(Gp8# ziZ0RS3zna+Ev$kQwM63|UMR*(uLn1cx}?*f7!1glRK8?{)yNy+zr{%wzJ`?5-5(w4 z7akp^-0`(Qr~VSn4099xWcvNlhmUC7Gy%wS2Oc?5jXjvxRNvwYl12v8?ZlWPmP25}~wbW=Qdm(WjvP6Zy#1M;6z_)E6 zvXJwvG4L-P;=-}TJmv!9mnk9h88X6`OUwWl4Qt+AxE%ly(?y=Pha}UNFB@D$*@F=bTTJ&p{ja|Oo8$~Jff@8MZ3m+6Cl`-5x!V>2X`hONQDmma_NMk`j8G>Wx=%*>;rFklRiRK@^!vs7U5(^qi7 z0F{DV#GQIwY)6CUqfB3mkhj@*tM>1)`=nup1V5-7VAeJ3k>Gg`_SfBjcl>T-B2bBj zTqgk-GBrRvfeMs-g^J^`6iBv+H<5px|ziZk-AH(mE6#&Fdq@&p5s8pZaK7M~{ zD3}`+AGvA6%%i>J-&X*8(5Dv>be}J5v;-IntDExR-^=#rJ|5W>ByJ2&UTqbLw~nSc zH4N`~0HI#{Wz{nTJv6kNZYu?NT}=>TJSvS@!wsM@M(1V43Nh-M-`Co__V%ig(~#SMV_;yI{5A+kQ_ zdVKnM4FzZ+m!)`cqo$H7oG6I7(M+V8j0pK%ZM&yz_PkQnc^pp9V^b5k9qTZtaeHQxY zG*E@>^+93&lcmfEEl~SoArX8S z?n>$84XAq3nZDc@aGd@E>Ov~&O-XaXWCdSJd;k`j2Cx9woO=iGqPWck`sb0jwC9 zR=^Twze~EuD#al7A^pJ@b`En(J~rZ$MaIiq&j|Z`qrjw{wp-u@5ZH4^D-%bCNeCQ$SL; z&n}NNyW`*4K+@|bn@>58#zlk!apvC{@{utBOAF%gv*^u=IDh3X{U<5~3*0BWNqpv>#Uj{rL#~?89ajm(O|bAveuCdYZOKJ7$e5B7H< z#W^5JovLvBn&5L_#G2}VKY>gcl}MiW>*W35^8|kNkc^2BFTe^F0;Mu8dW;wY^gGf^ ziL8Wve!z1F^9I=ePr$0A;2jEj1#plWC8i<7!pCA%~zW{)5 z!K$ff3!jWh&XZIOi0%>cu1(62VUgOvI0^rG6wI)avH>X7v*IshRz?p1nEJui*ZMvL{V!hJ2eLs^C9rN{ZAOu!i7N1Q}jXaa(@yyTl97 zLR~7}&5%LiK@n#?qd)rJrwF3(a*wCB=kYrZFGxJ<9ud|9@IdcnUw@nWhtMX zJvLcHG<4%@XUigXV(=$@Mj4Pf14S_;$PRG>Y+nl?iNEWJ;yw;E5Ya@bvPJ~9N(~`O zCr=!&7$6agFMXa6d~>kGEKDwzx3dUT=8z(jFCGsBC`ADA`tOI`GN51e^#5%wD)sEc z<@!@)xJ*YAn4B)6Um&A~pbsF(I1Qo($RuXsl#hdO+|UC3VqRP*4AA8g;{bu&0*tWd zcI`>4P@Lqz=+Q&J)UNLTpY0q$?+gdPM_O!+TX_JD0JpP1$ZfWC9QX;EY&kF;nVB+! z$ITA5!MFV<2Eo7C0Tg<6fwbuYaKGmg)jG+JOyCj1oBgI1Xl8N~@BbN6`Wko!9jb@y z6TtT_0R1a&aFFTAc~x|>6j21g^+}Ol1_3+07<`7}AH%`96wyS51R+3jP65O&pTA$o z0p|6DxWgG5oD67#Sf5S#dtzxI)@DQ;-TfuqS%&mUL5Zi{3KaNm>LYWGBTgkW1OLqsQ3MoJ^=Tw zPS3*99Pq6P3L*E`x-+$}rX3lL&1rmY1{-cLswUk}|8XrizfSrPRsvvMmzZq;?s;ys zu1+;iXAt0ao5X149FGPT^b-lzbZWqZQhHJ`*gt#CQQHYUP{N0M-B3D{&vv4KG2Z#c znt&|HMP51Y^SDv@d;=^HjW)7{e+(U_=zV-VAWekrcpjU5reiK4%MXix1{?lmStSKRl-UT4CG}|ZL>j5gL z?Xwf!;@+nu=KTmjWx~O5DwDeZ;*+mRgU-=Qb9)&7ot@twOpo6xBQ+vGNWtDG`IIUKx`PpV_b@W7; z3n<>ns{tAR&e5X(hpq39r@DRP&v~2%6++66tc1!YoQ9n(*+lkA_I4^|kId{i$j;uQ zBBG3Q?46PAWOF#q?>%%OV8iw&C^1? zAz`3@BB*AQ0I|SFh4CHoww8z0@{>z%x`LrkE4pA@1{+sy2KUjKB%XrPwg5E#>e){x z6g#F46CB9&#J-_0aSXej)OVmy+VScdH53_l0mOEk?tKJ{Z3H|PANL?KN|0qJFR<4Z zS{jA#QG&NO@x7m&feN&8Y0U(KOMf`8jLg3bBxh4RU*L^AmbMUOaLrC7Q^X&+0BN4t zO_~BQ;_uq!=HTCLN}edqb|mG?$8vM)fkB}HMoni?AJc&N8v>^2q6u-89rP1`DI4OO z{D5(GJkuEIw@17FLx@~R0Jf>D8p;3O-BiejeV8!pJ2oMDvK`+e)(dRyc4p~NjY}br z$ejgXf&gj(?^5zxAe-c(*q;K>Y6$?QOU>?r$ag--@MmTZaMx|9a)S0EpqtANFy`%Q z(k#fbato*S@=o#=h`?UzG&>wx!~ zX;F>O)Pdd#p}eS} zC}0~vx!{QKN6;QzY|xT zW!^w}Ck=y^EAJOp?>H?F^+K6@JJ)8~6NWO#6vhr1eD=Gm@<6-sg4#7XkGT(TN4Pg- z`_;fCt-NR7-(@cTthtOYTvl`Ap2{YvYJ1ZEQh?)B&RP#^nM(ib0(=jGqbr{bv=~w? z#wKg%r!OsKIM`1I@hqbzYY5OARON;CWhblb>34hpzU zU^>;%x}QA&7KQfPi*&kwrogbZPn(PV3G}5k=j+4pBM!wX8-Bf^$piDToxz;UxUrV0 z;h6(ejR!?|S0Lmf==NCzI;LCoo<4uY5Z~x))Dfj%E4KCaWiZjSxq8r8MOyidKaL=6 zGM5+sZ4rb-KUohJ4+3Y<6vW_OjO(9<(oqa7bf>@N=(-Jxse#A%zBgZ|AMX_4OTZs7 zo6&o1sH|g_$A7=R;_B4AonOqSEjfD)0QI;%3iazoWa!F%fxxohroyZ;wrkG@IDItO z`fGHlsUx6)m?b_Fq@ibM-JK?xIT6|604yNgaAOeEwr#+*s40n=VE49NRsc{#!h58a zu?@tbCOd*WofMrCJJJizR9RSxLmfBjlR#X`!X;7mGih|LL&kcV%ReCu65=9g5EM)* zd1*n!*p@C6!Nd)#v_P@OqQQ5I0c51R&R80&`dkv#?S?Al*g-htq^5SDSz>i3rL4Yl z-MNFL7(h`tkCo*v&H?4KKgtEn&!SS_mt>XPD6d( z{#)3ob6r5)pOpqe|CejuJn!Gz4s#{$+DpA81ZIawN=iZ>Cy*mGH)WZHFTIPs8$i|d zz)?(jJG7_N(*3!22N)9g54*qpa#{ZnsD+r2k~J^&lNt-A6-J8ogw(r&I+??<((}Kz zcsuV-Nokt%g-GqrJ*}euW~JU#w>@UnmV0Km8@j_~{>+a)6ttK|;paWpoO<(;ikje8 zESJ0e!Tv73H>qIt1DakQC}dw6%g&BCvlCzNh-4DfH(9!0DcnDhg%gy4xYSAkLwu$J z^9u@J)vG}8I1|w0jB8Dx#65+T=WFlUdvVIB7V3+ssg8rOtLQN`#Hsi-PMLJyS9kfo zNZlh(;tYYPgx|YIn#5qE=FI|~D>m!21(Sds3CN%+>Tg0H`?hlGEI;<<$qo}~h>tG- z0?oGMr3J-V$#OqGqW*^K z$8L!OI4$}LbRS>-C>SX3)Mn8Cp`t-CNn{0M4n_cbs3(RB8R{7B2XYlye&UKUCi*#&o+1^1#L?H&Aw@MA%&W+`T?^Z zUr2OjHIn^`g7FN`C$Bx{;c}Y<8iKSl1Ny4oxNMYTFunDnj;xwS5@?(lQr+#89dQdl zr24pH`I_HDNNrg{NudAmB}LOua{8y8QllLlVHNWSliDlref%gKyVSL*?LVBswWXd} zr(RAcyQ;nY4svd+cpF5SZ0x#2egM4}MiZSL0yKT5JD-u%qJ0MM)u!nF;mip6c%w(M z1lL29yZu?AG*M_pXYu7fat+|OLcCS6RQj$T65JKlR6l z@B%nKWs%(#F_3#P2I{bAR@3h4BSjr+XFw%f0_G36Y90wcd>RBS#kQjC57eM-_ucjj z#X|TZBX3f$tJc(=%96r@E@WS)bJv_kLFc^TG1sXJf;o@eC^u9arS|}05igMuS-_0i z=*hA@I;1bszDHP*>-S(JLz@Y!_-W?~JkhV2gswk=^2OgHpb8o5QrDus`isGuEJzA5 zr$bWD|MHtWwb&((9A2nWl%TWf!~Wa}lFpTFGl%}-c%nk;0Zs>`T zN@HhF-L7Wm2v0q;MtyDr7ALp7D4^%m1;cMn> zhi;E^3ns-$wan34j>=PipOwJKrCZ_)wYTZ1721E#s9{CU`o z3QS(>xvmf0vIMU|HLJ&92PXdxUyd|0cWp4WN!oU;>ta!Z)3QZr_yQ2r@t3%q>GQ3g zwF13rLNvr4H^Gv>NKhx0$=;RP*zpod>?q@?nhbgYYb&3UPhX-yJT7q@w`_VlcJDd~ z&-VrpT45#JfGh% zkbR@hy@iH}Qj4xmi*=H~&*y`-c<--DZ+p|%1^os{C1>W!jS`qzX%)oC%bYM;>YCeZ z+g{(<+huw->larUywaC}h!(7CVJ*N83An6`T-hu8De;|Y%PCbw1fw;j)vDhgocTL4 z%ct=LK-8>w-6Ps)eXt!omO@Sz@y9U5$3ye5njOZ-f{z^{SOMS$W_a%3=sjaAbc1HY zUFlUOAM&4NP}wZGErY($?I?@ka)GLE(BQl<8}{fz<;Q)mrh@l!ER}RU7bOb$Df>Sr8#(Q<|CBdx&)Z7^_woYdgI`t zSYEG(`o?qDjk)d{Z=wPrz@&-K1$_z;+=d=8jw^g%D7n1V(V?S5sV3CRN$PM!tl&&juBU;g+?Z zFn;ww2TCd8)6m{vG=reRd#Rd_;|DE-$YQC8rSXPwep$4S3ghGLKcJW#lyRqd%z{k6 zbGoB0>-gJDQ5=G7Hwl1l4_uGEFQLlVqtt+uFUmp6%OiVM0x8IlN%P*^~BtjjdW<-hlvqj?LLwy z*{`tDk}w8i4sED6)0{H!Q{&s-`FU%YJ4UZrq#*G&rK2^`(7bjRKlPKrwp>JNFeH%Z ziiIBbT~OxB$dYmkiWn(TvHd?^SF}}p<%XjvCc4>g)$Pf)EYK;&mn(Vod8_&ocijaN zl(7k%{_CA{nI8WJ70!_}QbFLXsbn`X`B;#Th^OBN2!Or~-=T&ijDkamoH;5p#3Sof zraiJpO+R^O%gQnbI4b~AyLc}jbnN_a&wLE}3A~*JDaAV>p32Ct>zY~$=`|aS`pj~C zH{|yy&-c7?=lPUsBUjzWmm{@XMlU)KZ=f&c-1+c!jZ3@q6L@!Jz4*?=t4v0fC1Z$* z9y930+7;zObkn>kY7EX?!6X?N_mYIDK+myTvRi>$yYyqiX=~7?`!=H8ns3|MXSk`#!&(XT?ZSpF?FK^1jE%iW) z9q*coy;3{9ubB54DYvOr5ZmYR9az{fVN$40_BtBr&t|yn5enZvr!3=M4d_26U`i4n zD(Xen_@EPjXia zyUt1M3a~cvD=b%+`~P_&w$wvF&61AUAXQtGa~FL3@*efMREr=!qWjC;;!xX-gR^Ce zAZA*U2Sz{xpKw9Sc<$aBaKT6SL^l*k6xI<`0gFN`V(O1awOKO~ed(*M9!f>BDx?uV z_JyU>KPw1vcL`lH4;0N`gqKOFT3ipIU$MF#D`o7uyZOasrhoS_Fg!7(3M9*A-T)Y1 z$x*Sfayew$4Mg~?LC=lMGYdn7ZzqUOEnr#WE#=#R3A9Hsq4xYf$#B^U3zU*#VwK_X zTGJs#5Q0{hm=y!^G{np+YqFU@i(`i`^t4~KwnbG(rw6`vAeTv~BvX$b! zrMom#aD!KhfH8U|Wn+ad$p<~OI-ccF*jV^dYRnmG#z!P`?`fFKo*hywe~d;NuL?y@LR%jvL}Ja--kj%r|OQAO@PVJ?aFy=Hp6240)dG#m(* zId-9f^6Y%G9JQ8r$7Zk%J{HRLX!l4MB&zt*9sR3`E0yC7P`s#{Zs`23uRnl-Mg3!i zX2+!lmCt{!ppUcE;;6?`&!>CJ0UyH&-PBba%lA04BF`?Q?+?kec{Q6&|5r`1Pkj`! zM0_0cprEwes;19a;!h~{l*UXrQVDiXB4j9l?z)V55TE;ldua&zlrHy<7^QSs%f38| z>aC6#9@1@-*6`1DxiX(MwOGqTs0Y&6Y4EV=yJ3LO)oO8y;NHDL z^;lf}^vzuTGGV644G|D$#HVr9J}EAqlO<9VH1BGp@B~&~%}7afI);y^wLP6oJ(zKW z543oJBZ!}0hkOV4oXEQpp+`#cB*d$#3qx~s+m$U=eCIFzoDt2bfReQkxn6i5yHyD` zi|?L`<9MQ`MHovcD2mldF)m0_3SX+&e?Yw9>ugRzWLMo@{Z2;b~~#hJGUG zAglwL>81J5)PokceU8FvAWCsXBNeBc~tkI!GX_ke(- zF6cg-R$&!Up5qgrEQ{wJ##+LS6?%pKk1i}p*|Qio@ZvDuWm69bwDmA^OezAxDEDV| zk>n@76=MdJodo2%?!nM;ae{Wq#HmdM_^y^QVjj-xW4tP$=g;;5t%6$SwkscqgslKq zc<$@uFhf#zMe5sJd`pgbJyL3TdSkF%iG^cGeH~)Hx7=>rcC6HLs31FdgPws!;X@`z z0pHJf$i1OL!>$X0BZl!9Sri36$OIZuR9H}*gFies7mwsebQ=eVg#RF5PF3*+B?z~1 z7L3M%iW1WMS%N`zDNe_ph63XS5D1Wx^ZB13F<_Udn_9??f&`6x?IaBu5TqKVFa=4R z=X(?|d{|F`hrM6^Go?(oD9ecAc+22c81VhU>|!s20^9+ry>nC5zV59VKy_u#cN#UU zKV-Jy%gK}sx{RZn(^2)He2r{ntSi-PS$LXn7Ym>$ar&8JINHXJ$KxORwrBB4Jp#u&=7)ts!H_7gZ?U zkp>n&3rI;Sn(=9vwNEiIrC-0xyIs{OJX@dA@311)zU|qN(z)jmW+Lv;!O~?12eF$L zkT4urbmJ8n!#3^yPT<*lu%@oOP~X6_2x7HQ@=7{HiogU0#R@l!&X!ePkrbjOU!ek? zMCeYovl`|@E6w2L_$X26_FnKN@`o*i@GL1K%ooN1rFbDHoc~S^a{2g2rwAY>m*dQm z-NZk+@}^Ijlt<`P5h@D(dM)D;o*`=Ar|aA|jL zE%DxzIC@tq4`c{@CG|N3Wa3;N#q(wNSDHE2_LI{whBL!KSWN)mCTq#wGB>YSE|iI! z2)qw0OIaCy|4n|lTB`*)-_cKCzW7hYv)y{u8vfg<@3NR|F(pJ|=QGJXx|0PF0>8;b?^FxxU+WFrKeXxr{+anIfAUAFsTRL;{>bb{Y z>rdiU>BA}hyJmoM%5MbCQ|NtmzA_Yx+Q(=b1&n;t@@;%AbF`)?8Svc0NDj)w?{(=C z)RBR6!EaZa?N1Wglg+YBI}wzI6}2)2mD(CIAO03zPIW5Wg}^VdwljR^a9j8X@T4Oo zxP2)O3jcah^d=q~AJP?J602sqX~X@X^Q4lA80tA6yi^ z4#GtpLb&~PW8nEMN7q`PD=qTv!T(t*8a(J#fqZxTDHx*xB<&h_8vc?vm`0GB-eajK zPRQQq2Y-WfUy60r?sXSNOiJsk7+nn~A9 zcCyYm@VVwhK^1ba!bZb$S3sTq(UBO&Kre#arz02Atj0fLQWSYYcy$7M{7O&3J&BgU7{S{uv<^+OY)Mg_ zrz9nhxvw?5af4V`_=1M!F>Ox14-5c=(()iCoFOh;1f5n^{&MUMc#q#%= zt^&v!D=bxk5X7v1=J}WWxYORWUB6u?@LfCpT z(I5cz5!TSQ$k_Qs;uF_@tNHO+f_s;a_=reY{GX%Oz;>a}j#<3)(F92S2J1NwvS?_T zL<<4Hg^oZ0{Df~+R3Uze?-cV&PkwMj;NOIa{Ob@9#n%m{7ZVX*4Nz)Qk*4EcrxQM* zIV@ET+?~iT_@j=$k;?n;jkRIHBT`#HCnV~{{0e;lBL0y7BK9T$#DOJ$tBha)9rB?<;n&K8yKcf9HP) zLuy{sm>woh4UBdV5SPAFzc-35cij-6Qye;`hR!+m>C#?D`ItjOI-b*HK0cBkIgKD8 zMGG#EwC8G&L9m_IqD~2@>O8uca01dUlT{$g0wvzwIU@1V3maj?b18st0X`EJOwE6z zeAIdPilFTXU(52}KQj*n%XOgL1Z5v}V4+(bt9BH>xS z$1pSe+q)hCjx)7f2s-9KSgISu9sf97muLjQ@``}=X}R{6_7W%uGvGF+I1zZMk02R5 z(@_@1)A#=+EdCv*)$pZGtt(C08o5Q_%Os}ks9>8j$0SV616Ro;Ny`l{+8TeH6?*&k zyHxOD+Zry;Nm{Rs?jiu2*+RA*X)a|v%dtm+{e8%k|8zu>!>6XDVb=+Vr12%jT4b|` zNX0<0t$}o}OR*fsUt>H2z9t+;c&)U`cjG_ek1^aBPGehnt$e^JNNBkfWfZID{M{aL zpE=xt;MbAReNUm>`d(Hj>qJ1Ge$W_q`03PW2ynmJR+@x?V431H*p=gaD{%Q_d->36 zw!(0f-dB<1pBxj1J*@Gj$&22{PfR2egSe~Nod=%2)mmu({&zRLJmB`OJ9k_Me3@`o z=3llSCB*B^0n-GVNsy!R&#xG(9!19TfY%SH!vM!k16{;c$ji+A?~Rb8Amt^1_)%4Y z0eHqBu^0@hqfK3=Da5b+r2!FlYPi~;b2qJa*8amQ;MDtwb)SER7J+imCQ!LSmta$_ zwfN61qv3NhaYrW=R|Kw8a7gJf=dE!u0$UY-n^Vt0@JR9{V0mhhnSq49!kh}#@&4eM zM5Q)nM8Yz#;Af|ZM1kZtXipl!qdw<2lX<67cv+#)v06X^? z`ugN@g0EeNm?hdv(E>sax=eavP$}H98c47xSR|q21F#X=v+UE;hL>Ld{hG2Z!5}zI z#zKh1?suh0f96oYq`T8>67PXnI}zLFR^U2JK5CHpOR2+^z)*yW;=9vAzvGOHnL4zs z@_S3Yo%q@zA}9B6gH*Y7{`1pUhdYasgwdaDd<+^2`u0}>sBsBX$3kx5n8yR@qs_q+ ziO&|&5mLMudKxoxEIki3G@Rtp^SpdQq@Ga2!DitUD3uEafWWFFp>{-Sf56w0iTt<8 zTeE#X{iPMKKPnox8*tb-J`2@EfU_^!Uu&Ng)$Ar?4A&um<5?MI1>}qNq7B~(x4D#Cb2fFb8k*07ipXp{3X>3QvsXVlN)ioi!HJ%65gJ= zPQ8zB+fO!WT4rYu#Z`u%kZ+kYH5^s%z~cbESDNA*eDZS}_CKR&Z@~hPM+b@t@M*;d z-zfYqQT(9p*$B>DvMuuc^&he@-eQN0WBMv4fq&5%Cy`Vueyk;69I!o2dpXSWTQ0ff%s*bO~^epNv$I3;&fca1G)sVSwX_J*Q~K{Q<g2Uu27s*(0xiY~3H1I$Q@{_r(2GJ7zOJBK-c*#DqJ?P%h6z~3ipQ5U{u(&G z^O9c2&-}xdYId~uiGQGgmJL_#Jd;TTfFy>2j(f*MffYar`*VS?F66uTzn|(R9O4=S zfCsVPz>pW3M??;BIqe?X5`;riK)u^!YNrvN-FN^~JE1TEq>5?)?8c~Dk}3pXe8jhl zh{6FCg(*q#GM5OfPtD)r5~!s+JT70DH}oOcHN1}qn6{!tQ=y{YROPuSfe_TSIwJ^h zh{u1{j=u(qW9`1qhlbqA&riXxo&`m^EQe;6ZPmb^m)#5kgc=)% z=6^XeNUgA&?dd26@a1&Y;?J zo~b|_pIH-<@rA|u^8ZUV!qX2X3~-nyczdc32rQw6kLjnG35_o?c4*(BEiE5<8O1~!Tj7urTHOWYxT}JX;T=E|a|%aQ0yeJfxX93oimnM$9H_}@296Jz zj&+eFt^3@ES2V%hhw`lP)Y(VaacVU?lE(1r>&oWfuH9EknK+{dJ9Wfv_|FruD`%^x zsT!!xWv51tsS&W%36`U(Gd3Y0!S92&>hLB3fJR#bb;|@C7^+XPr{I~ydfbJ@lx*@(yLCU91jtU(_Kdw@{EqiNdWGiwj& z4rA@wu?zj?QH~;pzdOq(dI4B{K?`9==X<2ZprkS`(})a@j|WoLE}%qV9C%NINkVVw zoHg;-e~ahDhs?nK7M6cmCD)lLv*{!jAc;WF(g@#4D>{Gm5<27jB06agS=7VLRi-Us zc@36|w>6~y02v2gBWevk{v>b-dwl+JURWOMbVR&|fM~skMw2j5%aaYby@rIrvid`g zvmtyDWuD*nxKvg$UOh@yp2&WG$N$@!eqAt1lX?&7VHq3as3_8)GLqek)F+0Q1GCMd z-6HniSOR?h>_D$GBwCK;#wH7ke!d1OA)^^IzIM0T5-P)oCF(J~h2^e}Uk~*foRtXi zMSeR?{ze<({!ax#Nd${c7H-A-=IC47C3$qVo;Ff=e!rBbOaYtqMbTYp_%g%>IH4%1 z$k8125MXy4k_g-s35ZhNhUWeOTCf=*VL%!?hAr9Y)icx7HvhC<(Qw5;#1*A!oXb*G z(Iw{9S6H>ZFSJ@}JoV8yrwCZVo3q8;F)(gI!h3*bAA6ZRZff87)MH8KGK_#c(x!&S zX_?4LCY2(@QSUJFQyg>G&&ekMbEowCL-`}aaatV){La$s#u}VA8>@t)WTGqf+G>eT zJym~CkdRAHkg$*U+P3|;1kTXn!)KHleE`3}fzbNp_^eJ>Odjrlp-j`MMsjkOWu?8q z&rtzkm9Bs*Vzj}F7xs6s{63XNS(gdKOND9&R!S`-rpK+vlB`U-R>ax5wzNZJb;&Zf zIg+#BN<`poG>?Vovd>bk!OtO+@ho!Gt}HeyO_7?1PH~oV?s@>zO`}98xG!3b4ktki zJPol_mAGut5{c6K-4C2o(HuPAKDk{EouR@#%&QrhHTp_f9@v>zS>|_-Ck4LdDS$K+ z^ZNZn-#uxGTBiSgHLI#UuO2hDp*RuH4;+a0^>8A#QDUL&Pj@!EHoyGjT+F8mBVkCU z^t9dkLNy6oX%%bGFLpJ04;|JG{IdrOvwSh7Nn0tq>nUc-z?-S`caLCA!l`2pD)~$w zZAN~3-1VNQ*;ET?f;N#7U_qz45S&oJ#M%I=s`<-mb_QNB#z z#`h#uKQTZZ%u=0SNl=%W7r*a?Tcoij%|7MO@=>K|Gs)$fEs%Q;m?nAc>L}-jcPz=e zHPeQbj14R!W9$p-w zYyw8cFR901VH?;V0UxOx=|_#j;(oJHIwCtTtNIK-V?uS#QYZuKfIrfd;$H=4!}Yx1 zxS}cFr;e3ZCM=4&ejt9Z8dzrTLl)a%idkgv|`hH za6%GoZt#7JF7>8)Zz{zhi5JgkeP)v)h&Zzw-^G_%%1&k2qm290^t;~wzL==qCHom6 zgz~VZf|Jc908?r_vGhM)njtHcdVI5JgekZA4sqe#$U33?Cj@8YIKm5}H|Rt-suDa6 z6pcRNwFE2|N-Y^Kr813OO&PE%tX!|0GJ57EN~ykJ_i8KQo02`kRaI9EV$n3(n%;7c zhA@x?Nb0=ZOI&aQ@~+#*qRfzyP~Q_JOI3n|OiHI;Sv!zbDy)66ziB2Bw5jjKZy6B=xGiwjXTd&W$Ngcie?x>) z*eijv6w=^eg&bH^j}I26PuO%XwG-mwh6&Re4&yF0`XSoCe|WGM)?4Vrb?Itn)x~dR zQGHy8s?`t%b{Hl_cKw1zt|ZVtSz( zyTN+P-!F0OesRi)qy{Hie0G0o_e_a;jOHKX!5Y9r7`CoTXX<`cTt|nzmHiJ;?uehqHi!AVwq(8>xnr2{AgEt zX3xVnKKXyWw=e$i`x_5ZHG)2BFjKpH;#170l2o-vc$XHL8IGG3ZM&b22vk%FtC4;p zI7*?CFV$ly<~)oK`uZg@{djlf(DFEZ35EIukdUSkBuNgMTVpv?Q>5%cu&E&nU3ru5 z@`sLS_yf3Ogs%$fb3E!w|>Xb z20Z^m7<}Rj;iKd@Z}hkp$%8jL24UyF5W~HR_zIG~mGyL@_}O5ob`WjgUZzcBs__% zAKows5h6{hY$)A7l87!0ga&%Hr6PP(_c_9%l+5VoyY0a>&hM*gCxRcGE3GfPuekU# zPj?Di)!S^8pNJA;yN2Zf z7uNmODJMJ|^#~^NuhDj7I_*MF-~6in<72P;NXYtxMV2JS`#k}T1E~nT7Q=cKcDt~l z9;cJ-mzA$*H;z8bz!QugF;4rB)EFQ4D31Ha~nk^$+C4-#U6N2w*=-rd7#zZWefY zzt-dHg>D zmY}8rjEE@xs#MKv*1d;D%ay4H022;u-%CLobpdV)g2R0BsuKTMLX_eJ2uCS9Y(K1VGUB>$V7C8>86jBl+J<9*5bpUl?v+5Gi$a`*FWXtG-P82}!hE ze>Fcu7}&nwe<98Wz}BG~e=kIr0o-7JpK5iGU#cmF#)h)Sx=P-%E;~rkoZwZhx6^acdvZEju4($a-f-X9X%JgsGb3lB zJwEKlRN}LMf*jgmmFXt zWJTkKSJP~YM*%uS9(f1b-SPjG&+}1Zaj0C1(G2pBM(cO282Q!ROTmm6eilPGgp1+zacQFZjBTwjQ^xak|i+;wIhc-(T zyFRLQG@^e%p#~>>edzPdmy*WHXDANhS8l>JjlXJz%uQWmLi?VZb9dda1B}%~C{62Z<3+-wvRdT9u|x5!1FEZgXC3z^yk7u5KV> z1+quIYtRhyE1AR{7!&KV)xL-qa(g~5?P#NozM5~CcDwLRTuG$QWpw=>+L4`G96fmx z4NQ2JVcXh7k8f@fn7!==(IM(A*?;eJ(H5=F3WN%qrZC6Q)$8V! zd=}9%j4Vu`J+rd;6BP4v-2Sa&%tYzq?Y^%hN_;bW^h*#oEiregVax8Oce3Zw_sYf4 zn&NdD9=qBDsS*1{y48htI?0%go$^=p0s?Oe`R-oa?+`TpOu|DtzOx`WnJkL7NW9cg zw_9<0K2SDk7^PD+Imu}h(R?{T$+ptlvtGYdwzIk6*FwR|E`Zx5k1T8uzL-OmM(;WC z;Y!`?oTl4mbn#9n=DU_wtd~V3b*53*JX;dkxag8c(X@1IaMf(G=;EH0s5e&(W=>T_ z%-PfPY3|R-mX^dz(zGugim=2OxcS{gfA8P+RK&VTi1NJQx^)xeAIf)zANU0E`26Br zZLA|{QpA<1f+5b||rJ*S4pKT?T^U!_WRcxsKSqMIzq^%3~i6T~`y`x&|xtLTge zFi_&kI(@z+I&@xLwEbjjy%%j$f^`|$+8Z!Tzc3l);7vR1>9#n43&)n!7*PAg_t*}G z@gz{*LGEU!EHz!N9pRhLbdNCJ9k3gzFTyGgH)qc#QKy&FP?C(|lxN>dCp~|b=&>uD zG^|!wyVp@;-?^ zwN%D0MQXUdRMv$;&uKB*eu&4LnwYCtSwmM=62XxC!tt`tny~Aa%F1aUp6^6_R{7fj zn(ps2Cg0@RS)Y%jv`*e>AusCnv3|cSKYp9fvHrvD)$)Kr+F&tHYg%2p*wN_qk&@14 zpigMB|2Q;$IP>tv<&14vmq%@ZcB4Trw9KIHSNSc~OZV=8LY`04ErtN(tKy#_X^*k~ zJzFxkg3EifOF|=%*V6DS2R)t`EK}Ln%<&w+C)zV9L;^jgw!Kz^f(Z` zbt%s7V0SXlAn9uCn4<-)})GpzIkCM2CT6^CxL!hqI@>8Q?x2Ug}sSn zZcKJx%Ubywu1iM6{xdJ?q1ydBZlOqPm6h^(sPN|7)eOCc9yfPPM}moX z`J>sb9?ptUPo4d72V5+rGO}pUG=WQiZnJ7 zBxSsmGd3_7vR-ReNFzg)C`r)xc>O6XdTR1jifVB04YNRSRA&m#)u23yes3!w!JFK! ze%BQI4@bqor63b%v3hXz%r~8d=8r!oL;4NEHsUHuJuRn{Ov23efNCP0A5nk4hb+KF zB&F#8W)Lv2E}t>ADElP8iIsS5HM{-KMIpwUySMQ%?Jr1^iIVpzou;BVhvJAmP>exWL>Y1)IW<%2YR z{OGd%(raUn5VS$(J}1(+PC$2tw`jgPCG5eL7~hz839d6)2^zHW3ei&PF)p6|8F&DTJw!ZfWOH*gL~N+PPTo-Q4`dG{N}5>XEwm?K?UJwbMB=#tK-O@-XiH z62^`08S(g}z5Ryd&M}m{!O+bH!8)tXMBQ zd>vy|*iZbZ!fY658$IhH?8l`dOPuFqidOAxqPMN}r!QF|vH21;3VmA{RQiEzi&H|ROur%IgB3n0ufPoGZk9{qPKy|WP{DMzQqAAs;4zCnn!?4rte zsCItIPx7yCrCEj+*=7>fR(@0i>t9_&FrTy)?@f=HKD-M=&>Y35a)>V_slU|unLL%g$gy=lkzVkbsE?D5_b&>HKV)r>jDY>2PCx~fmFdr>Kxl*oD7 z{LnAzC-5+BCwRNUAb+#!A>M8X6CaDu+1XfYFMQU5O1d{Fht1%zS@(+! zc1$D|Xkv3`X~p!eJD$zIijbC^%^^?5N$0z*eQ?9$#<_ImZ9^nUcII34+k)GnG%MBK z@hoEAHe(;wzeNdV_7FelG_|4OA(8l_Y}_k)Xmhtlz#JZcOug1yKtawi1e2n6r?cYh z%mW5Ym*ZB9&y$+pdI#^h%-#STQQ{M=zq!BC1Yget)=xX{f?6WOB(6plRF?OP*HH0R z3(Ac%IE+U3H+L9}3JZ)Hp_W9SB3BzmaE2NmWfoC7zi9+~K)_{6#VGsdKWdag7jeIT z-CixuWu|-}WsMmWn%rSFYG1AhmcXrcX78SlU1S>zrxe_xt58~6>(z6=nO;76ccp%6 z#TApH9`D8L8G@n`dyFZd?^lCJbsD%$EISG1MmvNR|aHPp^m^vVyw;PXXRAx`KcMHUR17k#eU%}Qy9eAj0dWoFP&XeWiG zn0L*fUjjioWuHy?)GPSlT3l9)qy^)@KF>0U2~pPg*i=;Re`%k3jZV4}cCguvH@25* z^g=~8KJH90tOW4bmbkH@AjIc`&K&H+5Yjn6K{9cZ>C2zW5`CEKd~+<5*qf!EDaDWt zI=<}I^_3bBwV=_Em}LmtXQs#PO%1xt=M{guF*x-l$2d1)%fMr%%)aC5ES?jHd8(fy z>XF-D5#C5T(d_ZZeVSF>*F6wA?$+9~p|+e)bYDo`6!fgpbP9P~v%IXSFzyt&vR{QM zwi0pfG3b<7e_6R2Pg8=^Vnm9EJk2S}-YE5;eqG-9nVH`mP6lLfab-#_hO)oFY*VT%i|^*B1A4`8F`Gc`F>Z z)!ko@qLjqx+IxZ|nFZ*`IQn@NMa1YmHi}#UAZ02qC6SV6-=Gss&?d5eKUD#WQ1FEb zLy;~M8)d#I(m0z)1tv;?w4dIW_02yN1hXlHepIh6&nIg=0{1)=IyylZp_<2JKrJ zqWY@0O{aP#Xy!f4>1%PHg*Fq_fNmJ~Pm)@WD%+jxGiWVu*vbAm6&-63;M8ZpR=&H| zx4IZq;J=|+kwS|@?es;Aw+#vC*OxBFrs?nc*SQ?Hds;RtHP7}B-vri|5AEGw6H<|` zbMUuJl<^`iwGHnAA61O6)m$kX{kXlo;i+T1%wJri!|Lo&JLD655Vo@whwgDO;Mp2C z#^D_-<|;>t5+0lC3Z=y}bl%E&bq7O5!vZxeBJBkMYpn<9gGK6J19vg{BP7#)&EJ44zwc zAN5>U3d@=OWUITG8&K3K*pTc+rDP_3Y@2^4#Jo78sPPG)vv}8^>e$hx*p;;8{uFgI z$2QPip5yy;=K;Zm(^`h*_vpv}9G=Q?prJJhR$XEW+U`WwPyOBxXz*9-6l3A8UrDQ6 z4HGnlCa)0Swgu}iH&o$bgl5+qN=D~J%?ldVtA%hm22D03Bh+lzeZ+uyWXR;38e4z0 zj$QjcR-68nDh}lKETZLgMvZPg4p-06;Pt0G&T)_5emWFM`eHEjr`=~B2Peuc(uCo-MU2k&-1r;mC8zojAh5g*0b1f6nmkg zSuF?Oz5(^Hu&T#ErRVb081&PBzq#m!W#z8jinU({I>dOxw!7RP5>yZ5Ggbg<}88nFxC+?M;6iCJ?UZeQ)@K}2)Sa)^wJg4gVs z@lc%wd+buIS&trf2rtjBn=_SS`crq>;l~YCceoQb+ABTRX0+(%J)8=vH`}DhkA;>P zR4O=*6@3Au-QvAW#%`~a^)r17L(3Iu1YNnEW;IL=PdxV{ro{C%9!o=V`FYe)n1`|J zK75xdPNGlO?B|u$U9zG!>fC40*Yg)7@Wv5r% zEAHUe0>4Lg3!kn4dA4#G=HNY#^`@UieQc(OhL;7ZuFmOb<&3jnsd;+~xher`IK*9# zyHfcY3E$Bz91YRu*Fm;CGNp?2-0?2)*Jzm);CGKMRioiq^&52QeIQi1+22nhF7&N` zynSDX?#^}9j!_{MzmeE2zYl8?1Qe8aodt9)Lt&Kcm<;e8(S0NG&;#$oKN&k{x@t*%1Ek`?Z}P~ znr`+}wFCzgk3~ne@pCk|$LlrpT0XpC?zCJa#TX0W)oT52!VS>f#}WY_BL+)2L4mTD z!9Zl0o@dMZ9dWX&(aoA4cT@siV0+s6wcs~q`rm7{)o3q|l->u>0U}|yWV#|?#H8MY z942%ALnFd9w(u3HY<#4yV<2XCw{vRF?f3l1O23>U4Nqy;{Z;f=67*HQvISevZNL1* zO+e+T?__@wC8yxd6u?nErZS8en$tVy{iI_lWl#5}gr_SAVPExDr5EL?diEn`rP1Pg zR9|lIw-^@yZvj-sQk;9v3QhbA*E!y4lmYAw;n^QKuxd`wus=7W-&$*DINIYUfrNu#?{-iBLSgfsf_)Z~Vq3cO zMz3XzPMDX#kW6Y^_Kj%@hp~tMVxCe-A;ctlcZ1e5`YTJ9dro2jDeYqbv*iaPj&z;h zoGs}FDV6eHNB56UCl$m+HJCGR{H}GI`(VH1xz6uV8nY2Qskkbgf#lZ*v1GXns}z0+ z6hP}Z8n2&=I0b(})EanrdrMz6A{h=`V}6(LNF*QcD8wquo@*0rosVZRMiPi$z_ron z$d?Mup&R-JzcHUljCRGggNJ9AE89hg)*RNDf}YuD?T9|Go$hTdS@)&=R#is8nbO;H@5mNUnPH8WU4{9GFz`cnOOwwi4AX1TBIdP7yDbQn?vVo^D zNqAm7fns(}&pCj?h0hyYDocK*nf`&7-m-ld=mIydx_){O3A z3MDF>pQn?tSHceSm<1mkxhU__{i;xJGz1qpP8KegF|}umWbOm0qn;Y=KTYJun_k-? z+Y5`EFJ!R%J`J0#%wAbafxOMbSD)rz9%P=fm6I0T*1o39j(6D=Vhs;(B4E_>0Q(4M zJ?Dv;N-z-{-EOj*3aKz?@2ewa{PP(kcxC$^S@u@GK~^7~+xbcm=2rQUt-)MP>F^s& zF}23+xS!f&-t6Ds&vY%mqfnxd{@4TcywWD^)!(9aO$_u^p?0ro)e@p9e*P5`O}}vdUl7B%kVUic^ahw zmi*OJ4#h^T9_Z!@!6Eig1_A5SN$2-}$$9w?|BmMjVq35`S?%36X~_0h%Xgku$$nN- zOUj-D{5};k#Sy|b4o1$SOPY#+=oAQxT&Awpyt}tHwVLpjJE&qoGU;9B4K7H@_3(la z#}EWQt35yTKI38%2pWQHiGR*nuncK3gmwshbE5l_!^jJH+FPcN&iAGF-PpW>q!Y5x z!cDwlZdM!b-OTkznLN#>0AeR2PD=Lhnt^LMqyp=ZycFlsu{+hi=p`n87oE2HLq4o| zb6bxz3;;4f>o`t00o7q*9m)Uhh!SRvX9SK2H>Z%QI?w*Q$MUw*ZL=-rP=80NA7chM z_jV$YX!pcy*T|U13sae^B|-~(qCTkf9?P=OO3vtxQH`?{S|H2STEgahETq8upqDfq z4_J)1FSLAH3(BXrtKF0vS#3pBt{xbCGf3GruDvtk2Qgt%hx{a$Nx?c^Kv-SVBcC6V z>6fY2K=Pw%BQ_|&kRhNue-qw_4o#C0@i@e&mF#3^nL?AiwugB*=V*By&DGPZB%0nd;mDZ3kk zO8v0v%Sir+qhmDbD-bX{y0NUp!3^UnjM=?L3r33677>w3p|0pUfT!18Dn%(q(AR7Y zSIvg1_hdiBd8_U@>WfHhI;>J#HNENAPuNTe;dOGE2WFK}S;9g_^6FHUxQN=YB2zdU zxK($5zWEQPuQZ_1y*xPcxB8+NE@KXmLp|RcV;Z;lmPm9%z*0d3~2lhOo z(;f38tJAysG_owbAi&Y4^t;4q#9>NQk^%%S0);uY9Jl3fBqKIg zBU8HNn!&!0J*=*>1jjl~O#G_Y=ky`;24yCp_s_gGJ35*h6lP#pQ^D-GbHNM@Dm*>U z$g=Ls-I(jK95fA!m17b2M9LP;d2KtD7N(SJnZ!0@p6F4g)c=kjc#cFYiP>afwNf?( zvaxp?_VgZN_vx`2A%H_h;gK=g`RTsA-ku^x*OavZt&xiPO-JGrV7|in;1J>;!Y#T* zjet2`u5%kbRmOC}FnL*>o;ydW9m&fw&?xs`Eb`YVHB|4haSev*>#N#lR%FDg71!8- zO9D|`Xt-_b9;LmITd}^xrhExLfBA*ny9B;}h4kSKhLey!_dmRfe3Gdunih^RD@a*9 zfFz@+p%8tTnpUZt*JqTQVjtUhtWt9cTwn~vs+P`O6U*)3m0CalX!Tu+1N)20j`8z6A_^i^AO)uK!cl)dxj&UGd#z-5^2>2mytdhf#!Ja22C$ z{OB`6tAsCuBcgz`MqEGABoNb#U)d*#K|-3P65Vx_u9=`Vwy7~x<1|fhOb7z%IvOWq z{h$gn*hY;;GfGtYyYIex-+c@Ix3Kr!dp>^moO91R=dL=FGx+rZ7(Nn-y1DwY$VT=& z2`&{S+E3GCG}Np@Sxnmen=PaLf3#Ex^`a`LY9tJmI*E%ZaIE4%oPVtOK4(t*5V2%j zmuImN0Wx{(&HQ5hJlN=_f|T)OOwX6DG%jNe?Bw;ojGsfQsCjzP2YRcQERC~V(gI_3 zq&x&;7PwXhTOJ?PsYQdF$Ncr?VQL|O;*Ca|OOb;Y^)DD#Ho!~yX%pt^-3^>4q0Iqp zq$El^GPaGB;s+(8Cd7bpjYsJqeBq%T!_`&eg!olnuaS6n^Fk{Uy__ z8MIzdm$`;XRCzy}JED9>C}&Erk=ml3Wx%a>*NWSlT7*NT0V0I%JdA1>ae(T`VSQns z6<;J(_m7?$J6jaut<+AjLGLaUcl7$X>RS1v^();NP+~N)(bR#}9<7SgYBUfQ4;CDh zsz~LF;HZDPPi+nThxiJd=%(f=X|+ax9EW<8rW;+)?Z6kpVUns4$0>r~{7G1B|FJ!5 zb@7EeH@c<^e@gBl7*m{GCAFnU@D$=#!ZtvgfjjNx1FP9qyOk%e=s);=M}ETYKbLLe z^@^0AslnB(9Ypp`14_;=Zdd|es$8&sKY#(4i83vm&^{3RE@Ms=>4K-A zlI5>l&a?-hjGly5PEZ{m;>h{!X$_M&b@d7xlp*2B1%$$@55A%{RC58;jFuMYEH)0s zW;$P=Rc%s=V*L2cC4;22-K*u4$IRg+J!l0hHjI?ZOjyhoe(+Z%D;|asvLzm%-v3r% z_8N5^`yI>30huH@)0R%2J|PS(iFU^b)MdiCB;Wjg(+)XhP%UezVskN2x~BjG=W;f= z81rAp;HrNki~e|JYD~qp%{xokAdN3&>X2%#na&`nce?4D1oCjwpIq||h6H@6#`0(E z@TQB~+qM2RMh-V);YrnCY(`?1=WbMZbO0f`r96yu$gu2ni#51i9VHbSX(j;9IRQ*w z`S2NL&b388eX?_{KKL=fW}w3!C7RCWE;{-VjCoO1U{0 zx5Ep{1)XHUM-Uh-En9b6bmgc&9O|bDA^PkUpfCH8uh9xyGgcCgxhk((n1zfi?7@lR zc9zkW%a)t}ZIA|TjR8qH9?94%2dV^Emf2x^Y%|ZRUBUk2mI_^dROU2A3QN9hc%#}q z#WdkxX}&K6D=4E6aa?^c*!{+u;8uR&f;O0=vYsGd`@Grg!Sd2(uaRi`a z85lQ(*1OhoRNCf4k}hSH+Dp4G!q4s=U`U}$dWJ#0-Z_;bW~;`Oy&xKoCSqISat_R0 z6Y^bPc9!cm|5Z%%!3m#cqm+5Uu>qBn(65}DHn;U?cT=#SO<M(AWTM zi&tlm4ML=)>84yl@DL=u&G`+EnjzO3LnQIQigZPg5CDdtucyFwG?MnE zv~G1d*-F}E#J#+{k2u&hwpzV28Jp&{a5uG9l(IB(ekfR(J5ny&XRUphBlcqy@S=opzNvA=UCG&kgv zFwsXV*DPmrp}|@|0Vxd|?8ue+EF%NVHjjFo1sF7G$Lq_OTYOUL7y8e#q!qR%Kfm#J zfzeQTZgUZ*tqNUYX*~s!3FHd=FzTt9Yi`Eo4XxcvoF@~4$6;Q|c7>`Tc`|7FeeAsU zQMj0o&#!*aY=DXun5Mq?b}iZKsdHU64kd;)WZO=%j3ue z3MG~^17L(K@hM`=wDvc7zc|F}xAYoJhVmLh`enPlTLUjo;V}rp0vu_RzkM}}?%9cX za-M-Q>J2<^fTDXR>VgF!Nw`7gh9D)o40{q}-Mi3YE&p}1V}M!I0^<8f$X$7F3+m!E zdEbpNyja5jok7Zhaa~P^}2c@B0-%`=skh!;=}huaekBjKwE zC|lnLC_mmc(=JR>{~MXKKI_U}1>TA#pAHH|aenZ84t(A9}Wexi3GP zc>En#x;O(7h+5LGN~Ai!^+vMBY+I_NU9H3%2Z=Bnk0HWj2?8#b9z&*}3+)VJ7X6qo z9PjBy;!TK1hjv(lPI!WVf89S*(369RX|ngy)foNAOjXBajeAxSVYteNrk1D+`4c+d zHv&QR-|aBV1sjX%4Tl-q^YTT$I!frbArkVPjPuAp52mftf~2@7)bax?Md^|UNEDnN zlvUdLm!&=Y9wFvVaSsTavm4tj`TDswwIQ`P#W!srOeT4tw!?|pp9y4k&6J~rKf|4G zVN6Q>yEF7IKt7eO+m0qMmwn2?c8Pzv`LeJfRcqEA)8mE3$@}F(aek;Q-m;(TI*BZo zylYM*#>A$Zr}YE2dVt{h0j`VwiGm!G3!Jd$8oK-+0uu6YFUhsVjDC^IO}Q6R&02U> znn4BpcihrF?o%zB$7wI9skljzm~Mlj2$q~_iKXaSmL%IlP??IITQNRtgU;^XT^&qi zR4UCK$VPO0Ub5oEME&(^KU7+G!B%=hzM`fksmc{^oJHMs`-B96t}|n%K>7x|+tCoe zGa_k=%c=9D8YQk@mLT9N&9HM8v=6(^b literal 0 HcmV?d00001 From e51cad23ea50f7df4be65a51429bb67db07ab670 Mon Sep 17 00:00:00 2001 From: Olufunke Moronfolu Date: Mon, 27 Oct 2025 16:48:31 +0100 Subject: [PATCH 6/9] fix: broken link of flow image --- .../connecting-external-resources.md | 5 ++--- ...-flow.png => connection-request-status-flow.png} | Bin 2 files changed, 2 insertions(+), 3 deletions(-) rename static/attachments/deployment/mendix-cloud-deploy/connecting-to-external-services/{connection-request-staus-flow.png => connection-request-status-flow.png} (100%) diff --git a/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md b/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md index b78adddd95a..2d4533a127c 100644 --- a/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md +++ b/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md @@ -56,14 +56,13 @@ If this is the first connection approved for an application environment, you mus This diagram shows the progress of the request status from when the connection request is submitted to when it is completed (approved or rejected): -{{< figure src="/attachments/deployment/mendix-cloud-deploy/connecting-to-external-services/connection-request-flow.png" >}} +{{< figure src="/attachments/deployment/mendix-cloud-deploy/connecting-to-external-services/connection-request-status-flow.png" >}} {{% alert color="info" %}} Mendix Admins can revoke an approved connection. {{% /alert %}} - -## Managing Connections {#manage-plan-requests} +## Managing Connections {#manage-connection-requests} The [Connections](/developerportal/deploy/environments-details/#connections) section on the application's **Network** tab allows Technical Contacts to view all connections for the environment, track pending request statuses, and delete established connections. diff --git a/static/attachments/deployment/mendix-cloud-deploy/connecting-to-external-services/connection-request-staus-flow.png b/static/attachments/deployment/mendix-cloud-deploy/connecting-to-external-services/connection-request-status-flow.png similarity index 100% rename from static/attachments/deployment/mendix-cloud-deploy/connecting-to-external-services/connection-request-staus-flow.png rename to static/attachments/deployment/mendix-cloud-deploy/connecting-to-external-services/connection-request-status-flow.png From 8ff8a2c91e64c552d2b9308d7135ae7641bae065 Mon Sep 17 00:00:00 2001 From: nicoletacoman Date: Mon, 27 Oct 2025 16:48:45 +0100 Subject: [PATCH 7/9] Changed em-dashes to en-dashes --- .../configure-private-connectivity.md | 140 +++++++++--------- 1 file changed, 70 insertions(+), 70 deletions(-) diff --git a/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md b/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md index 808dc0e339c..d696aa1ac35 100644 --- a/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md +++ b/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md @@ -27,10 +27,10 @@ Mendix Private Connectivity networks are the bridge between Mendix Cloud and you On the **Networks** tab of the **Private Connectivity** page, you can see all the networks associated to your company. The page shows the following information for each network: -* **Network** — The name of the network. -* **External Agents** — The number of agents that are installed on your internal infrastructure, and that are connected to the network. -* **Environments** — The number of app environments on Mendix Cloud that have at least one connection using the network. -* **Actions** — A list of actions that you can take on the network: +* **Network** – The name of the network. +* **External Agents** – The number of agents that are installed on your internal infrastructure, and that are connected to the network. +* **Environments** – The number of app environments on Mendix Cloud that have at least one connection using the network. +* **Actions** – A list of actions that you can take on the network: * **Details** * **Add DNS** @@ -62,13 +62,13 @@ To view and edit an existing network, follow these steps: 2. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}). 3. Select **Details**. The details of that network are displayed: - * **Network** — The name you gave to the network. This field is editable. - * **Network ID** — The internal ID of your network. You can copy this, for example, if you want to provide it in a support ticket for any issues with the network. - * **External Agents** — A list of all external agents that run on your own internal infrastructure, and that have access to the network. + * **Network** – The name you gave to the network. This field is editable. + * **Network ID** – The internal ID of your network. You can copy this, for example, if you want to provide it in a support ticket for any issues with the network. + * **External Agents** – A list of all external agents that run on your own internal infrastructure, and that have access to the network. This field also displays the status of each agent. - * **DNS Details** — A list of domains for which you have [configured DNS](#private-connectivity-networks-dns). - * **Environment Details** — A list of app environments that are using the network to connect to a resource, as well as the environment's status. - * **Show Logs** — This allows you to see [the flow logs](https://tailscale.com/kb/1219/network-flow-logs) for your network. They can help you troubleshoot issues with connectivity on your network. + * **DNS Details** – A list of domains for which you have [configured DNS](#private-connectivity-networks-dns). + * **Environment Details** – A list of app environments that are using the network to connect to a resource, as well as the environment's status. + * **Show Logs** – This allows you to see [the flow logs](https://tailscale.com/kb/1219/network-flow-logs) for your network. They can help you troubleshoot issues with connectivity on your network. 4. Click **Save** to save any changes you have made. @@ -84,8 +84,8 @@ To configure split DNS for a new domain on your network, follow these steps: 2. In the **Edit DNS** dialog box, click **Add New Domain**. 3. Provide the following information: - * **Domain** — Provide the domain for which the nameservers should be used, such as `myinternalnetwork.net`. - * **Nameservers** — Provide the IP address of the nameserver to use to resolve DNS queries for the provided domain. You can add multiple nameserver IP addresses for high availability. + * **Domain** – Provide the domain for which the nameservers should be used, such as `myinternalnetwork.net`. + * **Nameservers** – Provide the IP address of the nameserver to use to resolve DNS queries for the provided domain. You can add multiple nameserver IP addresses for high availability. 4. Click **Save** to save changes. @@ -101,7 +101,7 @@ To add a nameserver for a domain that you have already added to your network, fo 2. In the **Edit DNS** dialog box, find the domain you want to add a nameserver for, then click **Add New Nameserver**. 3. Provide the following information: - * **Nameservers** - Provide the IP address of the nameserver to use to resolve DNS queries for the provided domain. You can add multiple nameserver IP addresses for high availability. + * **Nameservers** – Provide the IP address of the nameserver to use to resolve DNS queries for the provided domain. You can add multiple nameserver IP addresses for high availability. 4. Click **Save** to save changes. @@ -139,13 +139,13 @@ At least one agent is necessary to be able to connect from a Mendix app to your On the **Agents** tab of the **Private Connectivity** page, you can see all the agents associated to your company. The page displays the following information for each agent: -* **Agent** — The name of the agent. -* **Network** — The network to which the agent is connected. -* **Resources** — The number of resources exposed through the agent. -* **Status (Last seen)** — The status of the agent, or the last time it was connected to the network: +* **Agent** – The name of the agent. +* **Network** – The network to which the agent is connected. +* **Resources** – The number of resources exposed through the agent. +* **Status (Last seen)** – The status of the agent, or the last time it was connected to the network: - * **Connected** — The agent is currently connected to the network. - * Date and time — The last time the agent was connected to the network. The agent is not connected at this time. + * **Connected** – The agent is currently connected to the network. + * Date and time – The last time the agent was connected to the network. The agent is not connected at this time. ### Adding an Agent {#private-connectivity-agents-add} @@ -171,18 +171,18 @@ To view and edit an existing agent, follow these steps: 1. On the **Agents** tab, find the agent for which you want to view details, or that you want to edit. 2. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}), then select **Details**. The details of that agent are displayed: - * **Agent Name** — The name you gave to the agent. This field is editable. - * **Agent ID** — The internal ID of your agent. You can copy this, for example, if you want to provide it in a support ticket for any issues with the agent. - * **Agent Key** — The authentication key of your agent. You can copy this authentication key for use when [starting an agent](#private-connectivity-agents-run). + * **Agent Name** – The name you gave to the agent. This field is editable. + * **Agent ID** – The internal ID of your agent. You can copy this, for example, if you want to provide it in a support ticket for any issues with the agent. + * **Agent Key** – The authentication key of your agent. You can copy this authentication key for use when [starting an agent](#private-connectivity-agents-run). This key should be treated as confidential. - * **Network** — The network to which the agent is connected. - * **Status (Last seen)** — The status of the agent, or the last time it was connected to the network: + * **Network** – The network to which the agent is connected. + * **Status (Last seen)** – The status of the agent, or the last time it was connected to the network: - * **Connected** — The agent is currently connected to the network. - * Date and time — The last time the agent was connected to the network. The agent is not connected at this time. + * **Connected** – The agent is currently connected to the network. + * Date and time – The last time the agent was connected to the network. The agent is not connected at this time. - * **Resource Details** — A list of the resources exposed via the agent. - * **DERP Details** — Information on the preferred Tailscale [Designated Encrypted Relay for Packets (DERP) server](https://tailscale.com/kb/1232/derp-servers). + * **Resource Details** – A list of the resources exposed via the agent. + * **DERP Details** – Information on the preferred Tailscale [Designated Encrypted Relay for Packets (DERP) server](https://tailscale.com/kb/1232/derp-servers). 3. Click **Save** to save any changes you have made. @@ -298,15 +298,15 @@ Resources are services, such as databases or applications, on your infrastructur On the **Resources** tab of the **Private Connectivity** page, you can see all the exposed resources of your company. The page displays the following information for each resource: -* **Resource** — The name of the resource. -* **Agent** — The name of the agent that exposes the resource. -* **Network** — The name of the network to which the agent exposing the resource is connected. -* **Status** — The status of the resource. This can be one of the following: +* **Resource** – The name of the resource. +* **Agent** – The name of the agent that exposes the resource. +* **Network** – The name of the network to which the agent exposing the resource is connected. +* **Status** – The status of the resource. This can be one of the following: - * Enabled — Technical Contacts can request connections to the resource. - * Disabled — Technical Contacts cannot request connections to the resource. + * Enabled – Technical Contacts can request connections to the resource. + * Disabled – Technical Contacts cannot request connections to the resource. -* **Environments** — The number of app environments on Mendix Cloud that have an approved connection to the resource. +* **Environments** – The number of app environments on Mendix Cloud that have an approved connection to the resource. ### Viewing and Editing Resources {#private-connectivity-resources-details} @@ -316,21 +316,21 @@ To view and edit a resource, follow these steps: 2. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}), then select **Details**. The details of that resource are displayed: - * **Resource Name** — The name you gave to the resource. This field is editable. - * **Resource ID** — The internal ID of your resource. You can copy this, for example, if you want to provide it in a support ticket for any issues with the agent. - * **Resource Type** — The type of resource, which can be: + * **Resource Name** – The name you gave to the resource. This field is editable. + * **Resource ID** – The internal ID of your resource. You can copy this, for example, if you want to provide it in a support ticket for any issues with the agent. + * **Resource Type** – The type of resource, which can be: - * **Route** — The resource is an exposed subnet route. + * **Route** – The resource is an exposed subnet route. - * **Route** — The exposed IP range. This is only displayed if the resource type is **Route**. - * **Agent** — The name of the agent that exposes the resource. - * **Network** — The name of the network to which the agent exposing the resource is connected. - * **Status** — The status of the resource. This can be one of the following: + * **Route** – The exposed IP range. This is only displayed if the resource type is **Route**. + * **Agent** – The name of the agent that exposes the resource. + * **Network** – The name of the network to which the agent exposing the resource is connected. + * **Status** – The status of the resource. This can be one of the following: - * **Enabled** — Users can request connections to the resource. - * **Disabled** — Users cannot request connections to the resource. + * **Enabled** – Users can request connections to the resource. + * **Disabled** – Users cannot request connections to the resource. - * **Environment Details** — A list of app environments that have an approved connection to the resource. + * **Environment Details** – A list of app environments that have an approved connection to the resource. 3. Click **Save** to save any changes you have made. @@ -395,15 +395,15 @@ An application on Mendix Cloud can have multiple connections to multiple resourc On the **Connections** tab of the **Private Connectivity** page, you can see all the connections associated to your company. The page displays the following information for each connection: -* **App** — The name of the app for the connection. -* **Environment** — The name of the environment for the connection. -* **Network** — The network for the connection. -* **Resource** — The name of the resource for the connection. -* **Status** — The status of the connection. This can be one of the following: +* **App** – The name of the app for the connection. +* **Environment** – The name of the environment for the connection. +* **Network** – The network for the connection. +* **Resource** – The name of the resource for the connection. +* **Status** – The status of the connection. This can be one of the following: - * **Pending** — The connection was requested, but not yet approved. The app environment cannot connect to the resource using this connection. - * **Approved** — The connection is approved. The app environment can connect to the resource using this connection. - * **Rejected** — The connection is rejected. The app environment cannot connect to the resource using this connection. + * **Pending** – The connection was requested, but not yet approved. The app environment cannot connect to the resource using this connection. + * **Approved** – The connection is approved. The app environment can connect to the resource using this connection. + * **Rejected** – The connection is rejected. The app environment cannot connect to the resource using this connection. For details on how Technical Contacts request connections for a specific environment, refer to [Connecting to External Resources](/developerportal/deploy/connecting-to-external-resource/). @@ -414,26 +414,26 @@ To view an existing connection, follow these steps: 1. On the **Connections** tab, find the connection for which you want to view details. 2. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}), then select **Details**. The details of that connection are displayed: - * **Request Details** — The details of the connections request: + * **Request Details** – The details of the connections request: - * **Name** — The name of the user that requested this connection. - * **Status** — The status of the connection request. This can be one of the following: + * **Name** – The name of the user that requested this connection. + * **Status** – The status of the connection request. This can be one of the following: - * **Pending** — The connection was requested, but not yet approved. The app environment cannot connect to the resource using this connection. - * **Approved** — The connection is approved. The app environment can connect to the resource using this connection. - * **Rejected** — The connection is rejected. The app environment cannot connect to the resource using this connection. + * **Pending** – The connection was requested, but not yet approved. The app environment cannot connect to the resource using this connection. + * **Approved** – The connection is approved. The app environment can connect to the resource using this connection. + * **Rejected** – The connection is rejected. The app environment cannot connect to the resource using this connection. - * **Date** — The date and time when the connection was requested. + * **Date** – The date and time when the connection was requested. - * **App** — The name of the app for the connection. - * **Environment** — The name of the environment for the connection. - * **Network** — The network for the connection. - * **Resource** — The name of the resource for the connection. - * **Resource ID** — The internal ID of your resource. You can copy this, for example, if you want to provide it in a support ticket. - * **Agent** — The name of the agent for the connection. - * **Agent ID** — The internal ID of the agent. You can copy this, for example, if you want to provide it in a support ticket. - * **Network** — The name of the network for the connection. - * **Network ID** — The internal ID of the network. You can copy this, for example, if you want to provide it in a support ticket. + * **App** – The name of the app for the connection. + * **Environment** – The name of the environment for the connection. + * **Network** – The network for the connection. + * **Resource** – The name of the resource for the connection. + * **Resource ID** – The internal ID of your resource. You can copy this, for example, if you want to provide it in a support ticket. + * **Agent** – The name of the agent for the connection. + * **Agent ID** – The internal ID of the agent. You can copy this, for example, if you want to provide it in a support ticket. + * **Network** – The name of the network for the connection. + * **Network ID** – The internal ID of the network. You can copy this, for example, if you want to provide it in a support ticket. ## Approving and Rejecting Connections {#private-connectivity-connections} From 9e7a4049e95d317be9fc55c3610fd3a8a3277292 Mon Sep 17 00:00:00 2001 From: nicoletacoman Date: Tue, 28 Oct 2025 08:45:19 +0100 Subject: [PATCH 8/9] Applied comment --- .../private-connectivity/configure-private-connectivity.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md b/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md index d696aa1ac35..a477125967b 100644 --- a/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md +++ b/content/en/docs/control-center/security/private-connectivity/configure-private-connectivity.md @@ -107,7 +107,7 @@ To add a nameserver for a domain that you have already added to your network, fo To remove a nameserver for a domain that you have already added to your network, follow these steps: -1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network, then select **Add DNS**. +1. Click **More Options** ({{< icon name="three-dots-menu-horizontal" >}}) for a network, then select **Edit DNS**. 2. In the **Edit DNS** dialog box, find the domain that you want to delete a nameserver for. 3. Click **Delete Nameserver** for the nameserver you want to delete. 4. Confirm that you want to delete the nameserver. From de7c06985881443f5c5c279278dd9a69e9ec50f4 Mon Sep 17 00:00:00 2001 From: Olufunke Moronfolu Date: Tue, 28 Oct 2025 11:37:02 +0100 Subject: [PATCH 9/9] feat: comment update and supporting text to status flow --- .../connecting-external-resources.md | 34 ++++++++++++++----- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md b/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md index 2d4533a127c..e6d4b5b55c7 100644 --- a/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md +++ b/content/en/docs/deployment/mendix-cloud-deploy/connecting-external-resources.md @@ -27,10 +27,14 @@ Before requesting a connection, the following conditions must be met: ## Connections {#connections} -Mendix Cloud Connect Connections allow applications on Mendix Cloud to connect to Mendix Cloud Connect Resources over Mendix Cloud Connect Networks. Each connection request must be initiated by a Technical Contact and approved by a Mendix Admin before the application on Mendix Cloud can connect to the Resource. +Mendix Cloud Connect Connections allow applications on Mendix Cloud to connect to Mendix Cloud Connect Resources over Mendix Cloud Connect Networks. Each connection request must be initiated by a Technical Contact and approved by a Mendix Admin before the application on Mendix Cloud can connect to the Resource. An application on Mendix Cloud can establish multiple connections to various resources. You can view and manage all connections and their statuses within the [Connections](/developerportal/deploy/environments-details/#connections) section on the application's **Network** tab. +{{% alert color="info" %}} +An application environment can only be connected to a single private network at a time. This means that all external resources you connect to from an application environment must be on the same private network. +{{% /alert %}} + ### Requesting a New Connection {#connection-request} As a Technical Contact, you can request a new connection from your application environment to an approved external resource. @@ -41,26 +45,38 @@ Follow these steps to request a new connection: 2. Click **Details** ({{% icon name="notes-paper-edit" %}}) on the preferred environment. 3. Go to the **Network** tab. 4. In the **Connections** section, click **Add** to initiate a new connection request. - - {{% alert color="info" %}} Contact your Mendix Admin if the resource you want is not available on the list. - {{% /alert %}} +{{% alert color="info" %}} +Contact your Mendix Admin if the resource you want is not available on the list. +{{% /alert %}} 5. In the **Add Connection** dialog, select an available network. This action displays the resources exposed on that network. +{{% alert color="info" %}} **Network Selection Behavior** + +* If your application environment already has an active connection, the network associated with that connection will be automatically selected and cannot be changed unless all existing connections are deleted. +* If only one private network is available for your application, it will be automatically selected. +{{% /alert %}} + 6. Select the specific resource you want your application environment to connect to. 7. Click **Send Request** to submit your connection request for approval. All submitted connection requests appear in the [Control Center](/control-center/configure-private-connectivity/) for the Mendix Admin review. -8. Track and manage your connection requests from the [Connections](/developerportal/deploy/environments-details/#connections) section on the application's **Network** tab. +8. [Track and manage](#manage-connection-requests) your connection requests from the [Connections](/developerportal/deploy/environments-details/#connections) section on the application's **Network** tab. {{% alert color="info" %}} If this is the first connection approved for an application environment, you must redeploy that environment for the connection to become active and usable. {{% /alert %}} +### Connection Request Status + This diagram shows the progress of the request status from when the connection request is submitted to when it is completed (approved or rejected): -{{< figure src="/attachments/deployment/mendix-cloud-deploy/connecting-to-external-services/connection-request-status-flow.png" >}} +{{< figure src="/attachments/deployment/mendix-cloud-deploy/connecting-to-external-services/connection-request-status-flow.png" alt="Flowchart illustrating the lifecycle of a Mendix Cloud Private Connectivity request, showing stages like 'Pending Approval', 'Mendix Admin Review', 'Approved', and 'Rejected'." >}} -{{% alert color="info" %}} -Mendix Admins can revoke an approved connection. -{{% /alert %}} +Once a Technical Contact submits a connection request, it enters a **Pending Approval** status. The request is then sent to a Mendix Admin for review: + +* If the Mendix Admin rejects the request, its status becomes **Rejected**. +* If the Mendix Admin approves the request, its status becomes **Approved**, and the connection becomes active. +* A Mendix Admin can also revoke an already approved connection, which will change its status back to **Rejected**. + +The connection status is visible in the **Connections** section of the **Network** tab. ## Managing Connections {#manage-connection-requests}