Repository: KyleAMathews/docker-nginx Branch: master Commit: 2054105b9342 Files: 21 Total size: 25.9 KB Directory structure: gitextract_26t4qpi2/ ├── Dockerfile ├── LICENSE.txt ├── README.md ├── basic.conf ├── default ├── default-ssl ├── directive-only/ │ ├── cache-file-descriptors.conf │ ├── cross-domain-insecure.conf │ ├── extra-security.conf │ ├── no-transform.conf │ ├── spdy.conf │ ├── ssl-stapling.conf │ ├── ssl.conf │ └── x-ua-compatible.conf ├── location/ │ ├── cache-busting.conf │ ├── cross-domain-fonts.conf │ ├── expires.conf │ └── protect-system-files.conf ├── mime.types ├── nginx.conf └── nginx_signing.key ================================================ FILE CONTENTS ================================================ ================================================ FILE: Dockerfile ================================================ FROM nginx:1.10.2 MAINTAINER Kyle Mathews "mathews.kyle@gmail.com" RUN rm /etc/nginx/nginx.conf /etc/nginx/mime.types COPY nginx.conf /etc/nginx/nginx.conf COPY basic.conf /etc/nginx/basic.conf COPY mime.types /etc/nginx/mime.types RUN mkdir /etc/nginx/ssl COPY default /etc/nginx/sites-enabled/default COPY default-ssl /etc/nginx/sites-available/default-ssl COPY directive-only /etc/nginx/directive-only COPY location /etc/nginx/location # expose both the HTTP (80) and HTTPS (443) ports EXPOSE 80 443 CMD ["nginx"] ================================================ FILE: LICENSE.txt ================================================ MIT License Copyright (c) 2017 Kyle Mathews Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ================================================ FILE: README.md ================================================ docker-nginx ============ A high-performance Nginx base image for Docker to serve static websites. It will serve anything in the `/var/www` directory. To build a Docker image for your site, you'll need to create a `Dockerfile`. For example, if your site is in a directory called `src/`, you could create this `Dockerfile`: FROM kyma/docker-nginx COPY src/ /var/www CMD 'nginx' Then build and run it: $ docker build -t mysite . ... Successfully built 5ae2fb5cf4f8 $ docker run -p 80:80 -d mysite da809981545f $ curl localhost ... Docker Hub ---------- The trusted build information can be found on the Docker Hub at https://registry.hub.docker.com/u/kyma/docker-nginx/. SSL --- To use SSL, put your certs in `/etc/nginx/ssl` and enable the `default-ssl` site: ADD server.crt /etc/nginx/ssl/ ADD server.key /etc/nginx/ssl/ RUN ln -s /etc/nginx/sites-available/default-ssl /etc/nginx/sites-enabled/default-ssl When you run it, you'll want to make port 443 available, e.g.: $ docker run -p 80:80 -p 443:443 -d mysite nginx.conf --------- The nginx.conf and mime.types are pulled with slight modifications from the h5bp Nginx HTTP server boilerplate configs project at https://github.com/h5bp/server-configs-nginx Customized configs ------------------ To modify the NGINX config, you would just create a custom Dockerfile like the following where you copy in your modified config files. ```dockerfile # Guide here: # https://github.com/KyleAMathews/docker-nginx # Build docker file # docker build -t CONTAINERNAME . # Build from this repo's image FROM kyma/docker-nginx # Example if you wanna swap the default server file. COPY path/to/your/default /etc/nginx/sites-enabled/default # Add src. COPY src/ /var/www CMD 'nginx' ``` ================================================ FILE: basic.conf ================================================ # Basic h5bp rules include /etc/nginx/directive-only/x-ua-compatible.conf; include /etc/nginx/location/expires.conf; include /etc/nginx/location/cross-domain-fonts.conf; include /etc/nginx/location/protect-system-files.conf; ================================================ FILE: default ================================================ server { root /var/www; index index.html index.htm; # Make site accessible from http://localhost/ server_name localhost; # Add 1 week expires header for static assets location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ { expires 1w; } location / { # First attempt to serve request as file, then # as directory, then fall back to redirecting to index.html try_files $uri $uri/ @root; } # If nginx can't find a file, fallback to the homepage. location @root { rewrite .* / redirect; } include /etc/nginx/basic.conf; } ================================================ FILE: default-ssl ================================================ server { listen 443; root /var/www; index index.html index.htm; ssl on; ssl_certificate /etc/nginx/ssl/server.crt; ssl_certificate_key /etc/nginx/ssl/server.key; } ================================================ FILE: directive-only/cache-file-descriptors.conf ================================================ # This tells Nginx to cache open file handles, "not found" errors, metadata about files and their permissions, etc. # # The upside of this is that Nginx can immediately begin sending data when a popular file is requested, # and will also know to immediately send a 404 if a file is missing on disk, and so on. # # However, it also means that the server won't react immediately to changes on disk, which may be undesirable. # # In the below configuration, inactive files are released from the cache after 20 seconds, whereas # active (recently requested) files are re-validated every 30 seconds. # # Descriptors will not be cached unless they are used at least 2 times within 20 seconds (the inactive time). # # A maximum of the 1000 most recently used file descriptors can be cached at any time. # # Production servers with stable file collections will definitely want to enable the cache. open_file_cache max=1000 inactive=20s; open_file_cache_valid 30s; open_file_cache_min_uses 2; open_file_cache_errors on; ================================================ FILE: directive-only/cross-domain-insecure.conf ================================================ # Cross domain AJAX requests # http://www.w3.org/TR/cors/#access-control-allow-origin-response-header # **Security Warning** # Do not use this without understanding the consequences. # This will permit access from any other website. # add_header "Access-Control-Allow-Origin" "*"; # Instead of using this file, consider using a specific rule such as: # # Allow access based on [sub]domain: # add_header "Access-Control-Allow-Origin" "subdomain.example.com"; ================================================ FILE: directive-only/extra-security.conf ================================================ # The X-Frame-Options header indicates whether a browser should be allowed # to render a page within a frame or iframe. add_header X-Frame-Options SAMEORIGIN; # MIME type sniffing security protection # There are very few edge cases where you wouldn't want this enabled. add_header X-Content-Type-Options nosniff; # The X-XSS-Protection header is used by Internet Explorer version 8+ # The header instructs IE to enable its inbuilt anti-cross-site scripting filter. add_header X-XSS-Protection "1; mode=block"; # with Content Security Policy (CSP) enabled (and a browser that supports it (http://caniuse.com/#feat=contentsecuritypolicy), # you can tell the browser that it can only download content from the domains you explicitly allow # CSP can be quite difficult to configure, and cause real issues if you get it wrong # There is website that helps you generate a policy here http://cspisawesome.com/ # add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' https://www.google-analytics.com;"; ================================================ FILE: directive-only/no-transform.conf ================================================ # Prevent mobile network providers from modifying your site # # (!) If you are using `ngx_pagespeed`, please note that setting # the `Cache-Control: no-transform` response header will prevent # `PageSpeed` from rewriting `HTML` files, and, if # `pagespeed DisableRewriteOnNoTransform off` is not used, also # from rewriting other resources. # # https://developers.google.com/speed/pagespeed/module/configuration#notransform add_header "Cache-Control" "no-transform"; ================================================ FILE: directive-only/spdy.conf ================================================ # Nginx's spdy module is compiled by default from 1.6 # SPDY only works on HTTPS connections # Inform browser of SPDY availability add_header Alternate-Protocol 443:npn-spdy/3; # Adjust connection keepalive for SPDY clients: spdy_keepalive_timeout 300s; # up from 180 secs default # enable SPDY header compression spdy_headers_comp 6; ================================================ FILE: directive-only/ssl-stapling.conf ================================================ # OCSP stapling... ssl_stapling on; ssl_stapling_verify on; #trusted cert must be made up of your intermediate certificate followed by root certificate #ssl_trusted_certificate /path/to/ca.crt; resolver 8.8.8.8 8.8.4.4 216.146.35.35 216.146.36.36 valid=60s; resolver_timeout 2s; ================================================ FILE: directive-only/ssl.conf ================================================ # Protect against the BEAST and POODLE attacks by not using SSLv3 at all. If you need to support older browsers (IE6) you may need to add # SSLv3 to the list of protocols below. ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Ciphers set to best allow protection from Beast, while providing forwarding secrecy, as defined by Mozilla (Intermediate Set) - https://wiki.mozilla.org/Security/Server_Side_TLS#Nginx ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA; ssl_prefer_server_ciphers on; # Optimize SSL by caching session parameters for 10 minutes. This cuts down on the number of expensive SSL handshakes. # The handshake is the most CPU-intensive operation, and by default it is re-negotiated on every new/parallel connection. # By enabling a cache (of type "shared between all Nginx workers"), we tell the client to re-use the already negotiated state. # Further optimization can be achieved by raising keepalive_timeout, but that shouldn't be done unless you serve primarily HTTPS. ssl_session_cache shared:SSL:10m; # a 1mb cache can hold about 4000 sessions, so we can hold 40000 sessions ssl_session_timeout 24h; # SSL buffer size was added in 1.5.9 #ssl_buffer_size 1400; # 1400 bytes to fit in one MTU # Session tickets appeared in version 1.5.9 # # nginx does not auto-rotate session ticket keys: only a HUP / restart will do so and # when a restart is performed the previous key is lost, which resets all previous # sessions. The fix for this is to setup a manual rotation mechanism: # http://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx # # Note that you'll have to define and rotate the keys securely by yourself. In absence # of such infrastructure, consider turning off session tickets: #ssl_session_tickets off; # Use a higher keepalive timeout to reduce the need for repeated handshakes keepalive_timeout 300s; # up from 75 secs default # HSTS (HTTP Strict Transport Security) # This header tells browsers to cache the certificate for a year and to connect exclusively via HTTPS. #add_header Strict-Transport-Security "max-age=31536000;"; # This version tells browsers to treat all subdomains the same as this site and to load exclusively over HTTPS #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;"; # This default SSL certificate will be served whenever the client lacks support for SNI (Server Name Indication). # Make it a symlink to the most important certificate you have, so that users of IE 8 and below on WinXP can see your main site without SSL errors. #ssl_certificate /etc/nginx/default_ssl.crt; #ssl_certificate_key /etc/nginx/default_ssl.key; # Consider using OCSP Stapling as shown in ssl-stapling.conf ================================================ FILE: directive-only/x-ua-compatible.conf ================================================ # Force the latest IE version add_header "X-UA-Compatible" "IE=Edge"; ================================================ FILE: location/cache-busting.conf ================================================ # Built-in filename-based cache busting # https://github.com/h5bp/html5-boilerplate/blob/5370479476dceae7cc3ea105946536d6bc0ee468/.htaccess#L403 # This will route all requests for /css/style.20120716.css to /css/style.css # Read also this: github.com/h5bp/html5-boilerplate/wiki/cachebusting # This is not included by default, because it'd be better if you use the build # script to manage the file names. location ~* (.+)\.(?:\d+)\.(js|css|png|jpg|jpeg|gif)$ { try_files $uri $1.$2; } ================================================ FILE: location/cross-domain-fonts.conf ================================================ # Cross domain webfont access location ~* \.(?:ttf|ttc|otf|eot|woff|woff2)$ { include /etc/nginx/directive-only/cross-domain-insecure.conf; # Also, set cache rules for webfonts. # # See http://wiki.nginx.org/HttpCoreModule#location # And https://github.com/h5bp/server-configs/issues/85 # And https://github.com/h5bp/server-configs/issues/86 expires 1M; access_log off; add_header Cache-Control "public"; } ================================================ FILE: location/expires.conf ================================================ # Expire rules for static content # No default expire rule. This config mirrors that of apache as outlined in the # html5-boilerplate .htaccess file. However, nginx applies rules by location, # the apache rules are defined by type. A consequence of this difference is that # if you use no file extension in the url and serve html, with apache you get an # expire time of 0s, with nginx you'd get an expire header of one month in the # future (if the default expire rule is 1 month). Therefore, do not use a # default expire rule with nginx unless your site is completely static # cache.appcache, your document html and data location ~* \.(?:manifest|appcache|html?|xml|json)$ { expires -1; access_log /var/log/nginx/static.log; } # Feed location ~* \.(?:rss|atom)$ { expires 1h; add_header Cache-Control "public"; } # Media: images, icons, video, audio, HTC location ~* \.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ { expires 1M; access_log off; add_header Cache-Control "public"; } # CSS and Javascript location ~* \.(?:css|js)$ { expires 1y; access_log off; add_header Cache-Control "public"; } # WebFonts # If you are NOT using cross-domain-fonts.conf, uncomment the following directive # location ~* \.(?:ttf|ttc|otf|eot|woff|woff2)$ { # expires 1M; # access_log off; # add_header Cache-Control "public"; # } ================================================ FILE: location/protect-system-files.conf ================================================ # Prevent clients from accessing hidden files (starting with a dot) # This is particularly important if you store .htpasswd files in the site hierarchy # Access to `/.well-known/` is allowed. # https://www.mnot.net/blog/2010/04/07/well-known # https://tools.ietf.org/html/rfc5785 location ~* /\.(?!well-known\/) { deny all; } # Prevent clients from accessing to backup/config/source files location ~* (?:\.(?:bak|conf|dist|fla|in[ci]|log|psd|sh|sql|sw[op])|~)$ { deny all; } ================================================ FILE: mime.types ================================================ types { # Audio audio/midi mid midi kar; audio/mp4 aac f4a f4b m4a; audio/mpeg mp3; audio/ogg oga ogg; audio/x-realaudio ra; audio/x-wav wav; # Images image/bmp bmp; image/gif gif; image/jpeg jpeg jpg; image/png png; image/tiff tif tiff; image/vnd.wap.wbmp wbmp; image/webp webp; image/x-icon ico cur; image/x-jng jng; # JavaScript application/javascript js; application/json json; # Manifest files application/x-web-app-manifest+json webapp; text/cache-manifest manifest appcache; # Microsoft Office application/msword doc; application/vnd.ms-excel xls; application/vnd.ms-powerpoint ppt; application/vnd.openxmlformats-officedocument.wordprocessingml.document docx; application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx; application/vnd.openxmlformats-officedocument.presentationml.presentation pptx; # Video video/3gpp 3gpp 3gp; video/mp4 mp4 m4v f4v f4p; video/mpeg mpeg mpg; video/ogg ogv; video/quicktime mov; video/webm webm; video/x-flv flv; video/x-mng mng; video/x-ms-asf asx asf; video/x-ms-wmv wmv; video/x-msvideo avi; # Web feeds application/xml atom rdf rss xml; # Web fonts application/font-woff woff; application/vnd.ms-fontobject eot; application/x-font-ttf ttc ttf; font/opentype otf; image/svg+xml svg svgz; # Other application/java-archive jar war ear; application/mac-binhex40 hqx; application/pdf pdf; application/postscript ps eps ai; application/rtf rtf; application/vnd.wap.wmlc wmlc; application/xhtml+xml xhtml; application/vnd.google-earth.kml+xml kml; application/vnd.google-earth.kmz kmz; application/x-7z-compressed 7z; application/x-chrome-extension crx; application/x-opera-extension oex; application/x-xpinstall xpi; application/x-cocoa cco; application/x-java-archive-diff jardiff; application/x-java-jnlp-file jnlp; application/x-makeself run; application/x-perl pl pm; application/x-pilot prc pdb; application/x-rar-compressed rar; application/x-redhat-package-manager rpm; application/x-sea sea; application/x-shockwave-flash swf; application/x-stuffit sit; application/x-tcl tcl tk; application/x-x509-ca-cert der pem crt; application/x-bittorrent torrent; application/zip zip; application/octet-stream bin exe dll; application/octet-stream deb; application/octet-stream dmg; application/octet-stream iso img; application/octet-stream msi msp msm; application/octet-stream safariextz; text/css css; text/html html htm shtml; text/mathml mml; text/plain txt; text/vnd.sun.j2me.app-descriptor jad; text/vnd.wap.wml wml; text/vtt vtt; text/x-component htc; text/x-vcard vcf; } ================================================ FILE: nginx.conf ================================================ # nginx Configuration File # http://wiki.nginx.org/Configuration # Run as a less privileged user for security reasons. user nginx; # How many worker threads to run; # "auto" sets it to the number of CPU cores available in the system, and # offers the best performance. Don't set it higher than the number of CPU # cores if changing this parameter. # The maximum number of connections for Nginx is calculated by: # max_clients = worker_processes * worker_connections worker_processes auto; # Maximum open file descriptors per process; # should be > worker_connections. worker_rlimit_nofile 8192; # Process needs to run in foreground within container daemon off; events { # When you need > 8000 * cpu_cores connections, you start optimizing your OS, # and this is probably the point at which you hire people who are smarter than # you, as this is *a lot* of requests. worker_connections 8000; multi_accept on; use epoll; } # Log errors and warnings to this file # This is only used when you don't override it on a server{} level error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; http { # Hide nginx version information. server_tokens off; # Define the MIME types for files. include /etc/nginx/mime.types; default_type application/octet-stream; # Update charset_types due to updated mime.types charset_types text/xml text/plain text/vnd.wap.wml application/x-javascript application/rss+xml text/css application/javascript application/json; # Format to use in log files log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; # How long to allow each connection to stay idle; longer values are better # for each individual client, particularly for SSL, but means that worker # connections are tied up longer. (Default: 65) keepalive_timeout 20; # Speed up file transfers by using sendfile() to copy directly # between descriptors rather than using read()/write(). sendfile on; # Tell Nginx not to send out partial frames; this increases throughput # since TCP frames are filled up before being sent out. (adds TCP_CORK) tcp_nopush on; # Tell Nginx to enable the Nagle buffering algorithm for TCP packets, which # collates several smaller packets together into one larger packet, thus saving # bandwidth at the cost of a nearly imperceptible increase to latency. (removes TCP_NODELAY) tcp_nodelay off; # Compression # Enable Gzip compressed. gzip on; # Enable compression both for HTTP/1.0 and HTTP/1.1 (required for CloudFront). gzip_http_version 1.0; # Compression level (1-9). # 5 is a perfect compromise between size and cpu usage, offering about # 75% reduction for most ascii files (almost identical to level 9). gzip_comp_level 5; # Don't compress anything that's already small and unlikely to shrink much # if at all (the default is 20 bytes, which is bad as that usually leads to # larger files after gzipping). gzip_min_length 256; # Compress data even for clients that are connecting to us via proxies, # identified by the "Via" header (required for CloudFront). gzip_proxied any; # Tell proxies to cache both the gzipped and regular version of a resource # whenever the client's Accept-Encoding capabilities header varies; # Avoids the issue where a non-gzip capable client (which is extremely rare # today) would display gibberish if their proxy gave them the gzipped version. gzip_vary on; # Compress all output labeled with one of the following MIME-types. gzip_types application/atom+xml application/javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component; # text/html is always compressed by HttpGzipModule # This should be turned on if you are going to have pre-compressed copies (.gz) of # static files available. If not it should be left off as it will cause extra I/O # for the check. It is best if you enable this in a location{} block for # a specific directory, or on an individual server{} level. # gzip_static on; # Protect against the BEAST attack by preferring RC4-SHA when using SSLv3 and TLS protocols. # Note that TLSv1.1 and TLSv1.2 are immune to the beast attack but only work with OpenSSL v1.0.1 and higher and has limited client support. # Ciphers set to best allow protection from Beast, while providing forwarding secrecy, as defined by Mozilla - https://wiki.mozilla.org/Security/Server_Side_TLS#Nginx ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"; ssl_prefer_server_ciphers on; # Optimize SSL by caching session parameters for 10 minutes. This cuts down on the number of expensive SSL handshakes. # The handshake is the most CPU-intensive operation, and by default it is re-negotiated on every new/parallel connection. # By enabling a cache (of type "shared between all Nginx workers"), we tell the client to re-use the already negotiated state. # Further optimization can be achieved by raising keepalive_timeout, but that shouldn't be done unless you serve primarily HTTPS. ssl_session_cache shared:SSL:10m; # a 1mb cache can hold about 4000 sessions, so we can hold 40000 sessions ssl_session_timeout 10m; # This default SSL certificate will be served whenever the client lacks support for SNI (Server Name Indication). # Make it a symlink to the most important certificate you have, so that users of IE 8 and below on WinXP can see your main site without SSL errors. #ssl_certificate /etc/nginx/default_ssl.crt; #ssl_certificate_key /etc/nginx/default_ssl.key; include sites-enabled/*; } ================================================ FILE: nginx_signing.key ================================================ -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.11 (FreeBSD) mQENBE5OMmIBCAD+FPYKGriGGf7NqwKfWC83cBV01gabgVWQmZbMcFzeW+hMsgxH W6iimD0RsfZ9oEbfJCPG0CRSZ7ppq5pKamYs2+EJ8Q2ysOFHHwpGrA2C8zyNAs4I QxnZZIbETgcSwFtDun0XiqPwPZgyuXVm9PAbLZRbfBzm8wR/3SWygqZBBLdQk5TE fDR+Eny/M1RVR4xClECONF9UBB2ejFdI1LD45APbP2hsN/piFByU1t7yK2gpFyRt 97WzGHn9MV5/TL7AmRPM4pcr3JacmtCnxXeCZ8nLqedoSuHFuhwyDnlAbu8I16O5 XRrfzhrHRJFM1JnIiGmzZi6zBvH0ItfyX6ttABEBAAG0KW5naW54IHNpZ25pbmcg a2V5IDxzaWduaW5nLWtleUBuZ2lueC5jb20+iQE+BBMBAgAoBQJOTjJiAhsDBQkJ ZgGABgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRCr9b2Ce9m/YpvjB/98uV4t 94d0oEh5XlqEZzVMrcTgPQ3BZt05N5xVuYaglv7OQtdlErMXmRWaFZEqDaMHdniC sF63jWMd29vC4xpzIfmsLK3ce9oYo4t9o4WWqBUdf0Ff1LMz1dfLG2HDtKPfYg3C 8NESud09zuP5NohaE8Qzj/4p6rWDiRpuZ++4fnL3Dt3N6jXILwr/TM/Ma7jvaXGP DO3kzm4dNKp5b5bn2nT2QWLPnEKxvOg5Zoej8l9+KFsUnXoWoYCkMQ2QTpZQFNwF xwJGoAz8K3PwVPUrIL6b1lsiNovDgcgP0eDgzvwLynWKBPkRRjtgmWLoeaS9FAZV ccXJMmANXJFuCf26iQEcBBABAgAGBQJOTkelAAoJEKZP1bF62zmo79oH/1XDb29S YtWp+MTJTPFEwlWRiyRuDXy3wBd/BpwBRIWfWzMs1gnCjNjk0EVBVGa2grvy9Jtx JKMd6l/PWXVucSt+U/+GO8rBkw14SdhqxaS2l14v6gyMeUrSbY3XfToGfwHC4sa/ Thn8X4jFaQ2XN5dAIzJGU1s5JA0tjEzUwCnmrKmyMlXZaoQVrmORGjCuH0I0aAFk RS0UtnB9HPpxhGVbs24xXZQnZDNbUQeulFxS4uP3OLDBAeCHl+v4t/uotIad8v6J SO93vc1evIje6lguE81HHmJn9noxPItvOvSMb2yPsE8mH4cJHRTFNSEhPW6ghmlf Wa9ZwiVX5igxcvaIRgQQEQIABgUCTk5b0gAKCRDs8OkLLBcgg1G+AKCnacLb/+W6 cflirUIExgZdUJqoogCeNPVwXiHEIVqithAM1pdY/gcaQZmIRgQQEQIABgUCTk5f YQAKCRCpN2E5pSTFPnNWAJ9gUozyiS+9jf2rJvqmJSeWuCgVRwCcCUFhXRCpQO2Y Va3l3WuB+rgKjsQ= =A015 -----END PGP PUBLIC KEY BLOCK-----