From 546b52b806a9bc1611beb74effa89ac494d0f03a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nils=20Norman=20Hauk=C3=A5s?= <mail@nilsnh.no>
Date: Thu, 18 Jan 2024 21:29:44 +0100
Subject: [PATCH] :tada: initial commit

---
 .gitignore                                    |   7 +
 Vagrantfile                                   |  19 +++
 ansible.cfg                                   |   4 +
 group_vars/all/all.yml                        |   2 +
 group_vars/all/vault.yml                      |  31 ++++
 inventory/production                          |   2 +
 license.md                                    | 149 ++++++++++++++++++
 playbook-vagrant.yml                          |  17 ++
 playbook.yml                                  |  17 ++
 readme.md                                     |  71 +++++++++
 roles/backup/files/.gitkeep                   |   0
 roles/backup/files/backup.service             |  10 ++
 roles/backup/files/backup.timer               |   9 ++
 roles/backup/tasks/main.yml                   |  67 ++++++++
 roles/backup/templates/backup.j2              |  17 ++
 roles/backup/templates/restic.j2              |   7 +
 .../backup/templates/status-email.service.j2  |   8 +
 roles/backup/templates/system-email.sh.j2     |  14 ++
 roles/base/files/20auto-upgrades              |  18 +++
 roles/base/files/50unattended-upgrades        |  36 +++++
 roles/base/handlers/main.yml                  |   3 +
 roles/base/tasks/main.yml                     |  38 +++++
 roles/caddy/files/Caddyfile                   |  16 ++
 roles/caddy/handlers/main.yml                 |   7 +
 roles/caddy/tasks/main.yml                    |  47 ++++++
 roles/caddy/templates/Caddyfile               |   1 +
 roles/firewall/tasks/main.yml                 |   6 +
 .../public/assets/img/apple-touch-icon.png    | Bin 0 -> 6889 bytes
 .../public/assets/img/avatar_default.png      | Bin 0 -> 6471 bytes
 .../custom/public/assets/img/favicon.png      | Bin 0 -> 5835 bytes
 .../custom/public/assets/img/favicon.svg      |   1 +
 .../files/custom/public/assets/img/logo.png   | Bin 0 -> 18427 bytes
 .../files/custom/public/assets/img/logo.svg   |   1 +
 .../custom/templates/custom/extra_links.tmpl  |   1 +
 .../forgejo/files/custom/templates/home.tmpl  |  14 ++
 roles/forgejo/files/forgejo.service           |  20 +++
 roles/forgejo/files/forgejo.sh                |   4 +
 roles/forgejo/handlers/main.yml               |   7 +
 roles/forgejo/tasks/load-backups.yml          |  19 +++
 roles/forgejo/tasks/main.yml                  | 105 ++++++++++++
 roles/forgejo/templates/app.ini.j2            |  79 ++++++++++
 roles/forgejo/vars/main.yml                   |   4 +
 roles/postgres/tasks/main.yml                 |  22 +++
 roles/sendmail/tasks/main.yml                 |  21 +++
 roles/sendmail/templates/ssmtp.conf.j2        |  25 +++
 scripts/build.sh                              |  19 +++
 scripts/restic.sh                             |  12 ++
 scripts/restore-latest-backup.sh              |  12 ++
 scripts/verify-download.sh                    |  32 ++++
 49 files changed, 1021 insertions(+)
 create mode 100644 .gitignore
 create mode 100644 Vagrantfile
 create mode 100644 ansible.cfg
 create mode 100644 group_vars/all/all.yml
 create mode 100644 group_vars/all/vault.yml
 create mode 100644 inventory/production
 create mode 100644 license.md
 create mode 100644 playbook-vagrant.yml
 create mode 100644 playbook.yml
 create mode 100644 readme.md
 create mode 100644 roles/backup/files/.gitkeep
 create mode 100644 roles/backup/files/backup.service
 create mode 100644 roles/backup/files/backup.timer
 create mode 100644 roles/backup/tasks/main.yml
 create mode 100644 roles/backup/templates/backup.j2
 create mode 100644 roles/backup/templates/restic.j2
 create mode 100644 roles/backup/templates/status-email.service.j2
 create mode 100644 roles/backup/templates/system-email.sh.j2
 create mode 100644 roles/base/files/20auto-upgrades
 create mode 100644 roles/base/files/50unattended-upgrades
 create mode 100644 roles/base/handlers/main.yml
 create mode 100644 roles/base/tasks/main.yml
 create mode 100644 roles/caddy/files/Caddyfile
 create mode 100644 roles/caddy/handlers/main.yml
 create mode 100644 roles/caddy/tasks/main.yml
 create mode 100644 roles/caddy/templates/Caddyfile
 create mode 100644 roles/firewall/tasks/main.yml
 create mode 100644 roles/forgejo/files/custom/public/assets/img/apple-touch-icon.png
 create mode 100644 roles/forgejo/files/custom/public/assets/img/avatar_default.png
 create mode 100644 roles/forgejo/files/custom/public/assets/img/favicon.png
 create mode 100644 roles/forgejo/files/custom/public/assets/img/favicon.svg
 create mode 100644 roles/forgejo/files/custom/public/assets/img/logo.png
 create mode 100644 roles/forgejo/files/custom/public/assets/img/logo.svg
 create mode 100644 roles/forgejo/files/custom/templates/custom/extra_links.tmpl
 create mode 100644 roles/forgejo/files/custom/templates/home.tmpl
 create mode 100644 roles/forgejo/files/forgejo.service
 create mode 100644 roles/forgejo/files/forgejo.sh
 create mode 100644 roles/forgejo/handlers/main.yml
 create mode 100644 roles/forgejo/tasks/load-backups.yml
 create mode 100644 roles/forgejo/tasks/main.yml
 create mode 100644 roles/forgejo/templates/app.ini.j2
 create mode 100644 roles/forgejo/vars/main.yml
 create mode 100644 roles/postgres/tasks/main.yml
 create mode 100644 roles/sendmail/tasks/main.yml
 create mode 100644 roles/sendmail/templates/ssmtp.conf.j2
 create mode 100755 scripts/build.sh
 create mode 100755 scripts/restic.sh
 create mode 100755 scripts/restore-latest-backup.sh
 create mode 100755 scripts/verify-download.sh

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..9c56044
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,7 @@
+.vagrant
+*.retry
+
+# Ignore built binaries
+roles/backup/files/restic-*
+
+/backup-restore/
diff --git a/Vagrantfile b/Vagrantfile
new file mode 100644
index 0000000..a428167
--- /dev/null
+++ b/Vagrantfile
@@ -0,0 +1,19 @@
+# This guide is optimized for Vagrant 1.8 and above.
+# Older versions of Vagrant put less info in the inventory they generate.
+Vagrant.require_version ">= 1.8.0"
+
+Vagrant.configure(2) do |config|
+
+  config.vm.box = "debian/bookworm64"
+  config.vm.network "forwarded_port", guest: 3000, host: 3000
+  config.vm.define "jake-vagrant"
+
+  # Common Ansible options: https://developer.hashicorp.com/vagrant/docs/provisioning/ansible_common
+  config.vm.provision "ansible" do |ansible|
+    ansible.playbook = "playbook-vagrant.yml"
+    ansible.become = true
+    ansible.groups = {
+      "vagrant" => ["jake-vagrant"]
+    }
+  end
+end
diff --git a/ansible.cfg b/ansible.cfg
new file mode 100644
index 0000000..ac1c221
--- /dev/null
+++ b/ansible.cfg
@@ -0,0 +1,4 @@
+[defaults]
+deprecation_warnings=False
+vault_password_file=~/.vault_pass
+inventory = inventory/production
\ No newline at end of file
diff --git a/group_vars/all/all.yml b/group_vars/all/all.yml
new file mode 100644
index 0000000..2648905
--- /dev/null
+++ b/group_vars/all/all.yml
@@ -0,0 +1,2 @@
+---
+hello: world
diff --git a/group_vars/all/vault.yml b/group_vars/all/vault.yml
new file mode 100644
index 0000000..e6c6fcd
--- /dev/null
+++ b/group_vars/all/vault.yml
@@ -0,0 +1,31 @@
+$ANSIBLE_VAULT;1.1;AES256
+32393031303830663865643061386435643163366533356536616637376563343435303134326331
+3866366639613362306363623963323964396431656136300a353262663533636435353239663039
+64653566623339346537653236323935346333356633646634393539306238323834363663373161
+6234666363393566620a613866623637383763663639653262303362346665636565623139646439
+37623034303666393462656263383535323566346138623131656161366434333664396264636339
+65383336653932356335383133356463653266646137613865393532663839316531306330633234
+64356133303036666334663034343134653062636639623732373136656565353234346633613937
+35333139386131313462373262393336653661303661373039616561366636656563633838663964
+62663765383363663933343064366131646637323837333133343738653863376638326337663261
+37366463656563613734656334343162656236343463643062356461643639393161353061383139
+36323539333966623061646661373366333838323066353764343833346463623064633066393130
+38663633373537356339386635666236653131363763393736376566313431336664666131623164
+61303666303131663165363462343965323731393566393663326537613164643065376334386133
+33303062626436663631303433323232613731626330326238356633663464663733353432636166
+65323565363566333235306334626336653238346362666630646134663133633237633766613435
+38343762376338636137303832343531373264333535366337393036303739663863646539313433
+37326630383834316265303664326138343132663039343133643132316264383439383261636235
+33623861633537313062323037363830663339663538653034353838643966633662663535346339
+35333736323334656235336437376466613866616432636636626563333666373662626433306534
+63613436623635343035383366396265396362373261333839333362643062373461333233313861
+38346232353864323138656161323535633431313761336563333433643966396130643333363633
+34636632613134383064343334313464393462356539343836623865386433643431303633656166
+35363431393135346530616561363434666535653031393566393664666339383737336333636362
+36643761663039353039313937373861363361656463393865323535356534396565623365636134
+30663232376164323163633165656234646361313939303364316161343236656239653663623930
+34636566383836633064303132373535396337633132306362353632613434396132346564346434
+61623931616630633034633862633165323463643137613133323863633632313861303134343963
+34646263623935313030303830323930383230373462333033343236336539666565313766623739
+62666166643966613462633437646436376565613236356631303066333864613662396336373839
+6362326139663138376239356437343430323637326466373934
diff --git a/inventory/production b/inventory/production
new file mode 100644
index 0000000..1d76916
--- /dev/null
+++ b/inventory/production
@@ -0,0 +1,2 @@
+[jake]
+jake.box.nilsnh.no ansible_user=jake
diff --git a/license.md b/license.md
new file mode 100644
index 0000000..59cc64e
--- /dev/null
+++ b/license.md
@@ -0,0 +1,149 @@
+**HIPPOCRATIC LICENSE**
+
+**Version 3.0, October 2021**
+
+<https://firstdonoharm.dev/version/3/0/full.md>
+
+**TERMS AND CONDITIONS**
+
+TERMS AND CONDITIONS FOR USE, COPY, MODIFICATION, PREPARATION OF DERIVATIVE WORK, REPRODUCTION, AND DISTRIBUTION:
+
+**[1.](#1) DEFINITIONS:**
+
+_This section defines certain terms used throughout this license agreement._
+
+[1.1.](#1.1) “License” means the terms and conditions, as stated herein, for use, copy, modification, preparation of derivative work, reproduction, and distribution of Software (as defined below).
+
+[1.2.](#1.2) “Licensor” means the copyright and/or patent owner or entity authorized by the copyright and/or patent owner that is granting the License.
+
+[1.3.](#1.3) “Licensee” means the individual or entity exercising permissions granted by this License, including the use, copy, modification, preparation of derivative work, reproduction, and distribution of Software (as defined below).
+
+[1.4.](#1.4) “Software” means any copyrighted work, including but not limited to software code, authored by Licensor and made available under this License.
+
+[1.5.](#1.5) “Supply Chain” means the sequence of processes involved in the production and/or distribution of a commodity, good, or service offered by the Licensee.
+
+[1.6.](#1.6) “Supply Chain Impacted Party” or “Supply Chain Impacted Parties” means any person(s) directly impacted by any of Licensee’s Supply Chain, including the practices of all persons or entities within the Supply Chain prior to a good or service reaching the Licensee.
+
+[1.7.](#1.7) “Duty of Care” is defined by its use in tort law, delict law, and/or similar bodies of law closely related to tort and/or delict law, including without limitation, a requirement to act with the watchfulness, attention, caution, and prudence that a reasonable person in the same or similar circumstances would use towards any Supply Chain Impacted Party.
+
+[1.8.](#1.8) “Worker” is defined to include any and all permanent, temporary, and agency workers, as well as piece-rate, salaried, hourly paid, legal young (minors), part-time, night, and migrant workers.
+
+**[2.](#2) INTELLECTUAL PROPERTY GRANTS:**
+
+_This section identifies intellectual property rights granted to a Licensee_.
+
+[2.1.](#2.1) _Grant of Copyright License_: Subject to the terms and conditions of this License, Licensor hereby grants to Licensee a worldwide, non-exclusive, no-charge, royalty-free copyright license to use, copy, modify, prepare derivative work, reproduce, or distribute the Software, Licensor authored modified software, or other work derived from the Software.
+
+[2.2.](#2.2) _Grant of Patent License_: Subject to the terms and conditions of this License, Licensor hereby grants Licensee a worldwide, non-exclusive, no-charge, royalty-free patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer Software.
+
+**[3.](#3) ETHICAL STANDARDS:**
+
+_This section lists conditions the Licensee must comply with in order to have rights under this License._
+
+The rights granted to the Licensee by this License are expressly made subject to the Licensee’s ongoing compliance with the following conditions:
+
+* [3.1.](#3.1) The Licensee SHALL NOT, whether directly or indirectly, through agents or assigns:  
+   * [3.1.1.](#3.1.1) Infringe upon any person’s right to life or security of person, engage in extrajudicial killings, or commit murder, without lawful cause (See Article 3, _United Nations Universal Declaration of Human Rights_; Article 6, _International Covenant on Civil and Political Rights_)  
+   * [3.1.2.](#3.1.2) Hold any person in slavery, servitude, or forced labor (See Article 4, _United Nations Universal Declaration of Human Rights_; Article 8, _International Covenant on Civil and Political Rights_);  
+   * [3.1.3.](#3.1.3) Contribute to the institution of slavery, slave trading, forced labor, or unlawful child labor (See Article 4, _United Nations Universal Declaration of Human Rights_; Article 8, _International Covenant on Civil and Political Rights_);  
+   * [3.1.4.](#3.1.4) Torture or subject any person to cruel, inhumane, or degrading treatment or punishment (See Article 5, _United Nations Universal Declaration of Human Rights_; Article 7, _International Covenant on Civil and Political Rights_);  
+   * [3.1.5.](#3.1.5) Discriminate on the basis of sex, gender, sexual orientation, race, ethnicity, nationality, religion, caste, age, medical disability or impairment, and/or any other like circumstances (See Article 7, _United Nations Universal Declaration of Human Rights_; Article 2, _International Covenant on Economic, Social and Cultural Rights_; Article 26, _International Covenant on Civil and Political Rights_);  
+   * [3.1.6.](#3.1.6) Prevent any person from exercising his/her/their right to seek an effective remedy by a competent court or national tribunal (including domestic judicial systems, international courts, arbitration bodies, and other adjudicating bodies) for actions violating the fundamental rights granted to him/her/them by applicable constitutions, applicable laws, or by this License (See Article 8, _United Nations Universal Declaration of Human Rights_; Articles 9 and 14, _International Covenant on Civil and Political Rights_);  
+   * [3.1.7.](#3.1.7) Subject any person to arbitrary arrest, detention, or exile (See Article 9, _United Nations Universal Declaration of Human Rights_; Article 9, _International Covenant on Civil and Political Rights_);  
+   * [3.1.8.](#3.1.8) Subject any person to arbitrary interference with a person’s privacy, family, home, or correspondence without the express written consent of the person (See Article 12, _United Nations Universal Declaration of Human Rights_; Article 17, _International Covenant on Civil and Political Rights_);  
+   * [3.1.9.](#3.1.9) Arbitrarily deprive any person of his/her/their property (See Article 17, _United Nations Universal Declaration of Human Rights_);  
+   * [3.1.10.](#3.1.10) Forcibly remove indigenous peoples from their lands or territories or take any action with the aim or effect of dispossessing indigenous peoples from their lands, territories, or resources, including without limitation the intellectual property or traditional knowledge of indigenous peoples, without the free, prior, and informed consent of indigenous peoples concerned (See Articles 8 and 10, _United Nations Declaration on the Rights of Indigenous Peoples_);  
+   * [3.1.11.](#3.1.11) _Fossil Fuel Divestment_: Be an individual or entity, or a representative, agent, affiliate, successor, attorney, or assign of an individual or entity, on the [FFI Solutions Carbon Underground 200 list](https://www.ffisolutions.com/research-analytics-index-solutions/research-screening/the-carbon-underground-200/?cn-reloaded=1);  
+   * [3.1.12.](#3.1.12) _Ecocide_: Commit ecocide:  
+         * [3.1.12.1.](#3.1.12.1) For the purpose of this section, “ecocide” means unlawful or wanton acts committed with knowledge that there is a substantial likelihood of severe and either widespread or long-term damage to the environment being caused by those acts;  
+         * [3.1.12.2.](#3.1.12.2) For the purpose of further defining ecocide and the terms contained in the previous paragraph:  
+                  * [3.1.12.2.1.](#3.1.12.2.1) “Wanton” means with reckless disregard for damage which would be clearly excessive in relation to the social and economic benefits anticipated;  
+                  * [3.1.12.2.2.](#3.1.12.2.2) “Severe” means damage which involves very serious adverse changes, disruption, or harm to any element of the environment, including grave impacts on human life or natural, cultural, or economic resources;  
+                  * [3.1.12.2.3.](#3.1.12.2.3) “Widespread” means damage which extends beyond a limited geographic area, crosses state boundaries, or is suffered by an entire ecosystem or species or a large number of human beings;  
+                  * [3.1.12.2.4.](#3.1.12.2.4) “Long-term” means damage which is irreversible or which cannot be redressed through natural recovery within a reasonable period of time; and  
+                  * [3.1.12.2.5.](#3.1.12.2.5) “Environment” means the earth, its biosphere, cryosphere, lithosphere, hydrosphere, and atmosphere, as well as outer space  
+                  (See Section II, _Independent Expert Panel for the Legal Definition of Ecocide_, Stop Ecocide Foundation and the Promise Institute for Human Rights at UCLA School of Law, June 2021);  
+   * [3.1.13.](#3.1.13) _Extractive Industries_: Be an individual or entity, or a representative, agent, affiliate, successor, attorney, or assign of an individual or entity, that engages in fossil fuel or mineral exploration, extraction, development, or sale;  
+   * [3.1.14.](#3.1.14) _Boycott / Divestment / Sanctions_: Be an individual or entity, or a representative, agent, affiliate, successor, attorney, or assign of an individual or entity, identified by the Boycott, Divestment, Sanctions (“BDS”) movement on its website (<https://bdsmovement.net/> and <https://bdsmovement.net/get-involved/what-to-boycott>) as a target for boycott;  
+   * [3.1.15.](#3.1.15) _Taliban_: Be an individual or entity that:  
+         * [3.1.15.1.](#3.1.15.1) engages in any commercial transactions with the Taliban; or  
+         * [3.1.15.2.](#3.1.15.2) is a representative, agent, affiliate, successor, attorney, or assign of the Taliban;  
+   * [3.1.16.](#3.1.16) _Myanmar_: Be an individual or entity that:  
+         * [3.1.16.1.](#3.1.16.1) engages in any commercial transactions with the Myanmar/Burmese military junta; or  
+         * [3.1.16.2.](#3.1.16.2) is a representative, agent, affiliate, successor, attorney, or assign of the Myanmar/Burmese government;  
+   * [3.1.17.](#3.1.17) _Xinjiang Uygur Autonomous Region_: Be an individual or entity, or a representative, agent, affiliate, successor, attorney, or assign of any individual or entity, that does business in, purchases goods from, or otherwise benefits from goods produced in the Xinjiang Uygur Autonomous Region of China;  
+   * [3.1.18.](#3.1.18) _US Tariff Act_: Be an individual or entity:  
+         * [3.1.18.1.](#3.1.18.1) which U.S. Customs and Border Protection (CBP) has currently issued a Withhold Release Order (WRO) or finding against based on reasonable suspicion of forced labor; or  
+         * [3.1.18.2.](#3.1.18.2) that is a representative, agent, affiliate, successor, attorney, or assign of an individual or entity that does business with an individual or entity which currently has a WRO or finding from CBP issued against it based on reasonable suspicion of forced labor;  
+   * [3.1.19.](#3.1.19) _Mass Surveillance_: Be a government agency or multinational corporation, or a representative, agent, affiliate, successor, attorney, or assign of a government or multinational corporation, which participates in mass surveillance programs;  
+   * [3.1.20.](#3.1.20) _Military Activities_: Be an entity or a representative, agent, affiliate, successor, attorney, or assign of an entity which conducts military activities;  
+   * [3.1.21.](#3.1.21) _Law Enforcement_: Be an individual or entity, or a representative, agent, affiliate, successor, attorney, or assign of an individual or entity, that provides good or services to, or otherwise enters into any commercial contracts with, any local, state, or federal law enforcement agency;  
+   * [3.1.22.](#3.1.22) _Media_: Be an individual or entity, or a representative, agent, affiliate, successor, attorney, or assign of an individual or entity, that broadcasts messages promoting killing, torture, or other forms of extreme violence;  
+   * [3.1.23.](#3.1.23) Interfere with Workers' free exercise of the right to organize and associate (See Article 20, United Nations Universal Declaration of Human Rights; C087 - Freedom of Association and Protection of the Right to Organise Convention, 1948 (No. 87), International Labour Organization; Article 8, International Covenant on Economic, Social and Cultural Rights); and  
+   * [3.1.24.](#3.1.24) Harm the environment in a manner inconsistent with local, state, national, or international law.
+* [3.2.](#3.2) The Licensee SHALL:  
+   * [3.2.1.](#3.2.1) _Social Auditing_: Only use social auditing mechanisms that adhere to Worker-Driven Social Responsibility Network’s Statement of Principles (<https://wsr-network.org/what-is-wsr/statement-of-principles/>) over traditional social auditing mechanisms, to the extent the Licensee uses any social auditing mechanisms at all;  
+   * [3.2.2.](#3.2.2) _Workers on Board of Directors_: Ensure that if the Licensee has a Board of Directors, 30% of Licensee’s board seats are held by Workers paid no more than 200% of the compensation of the lowest paid Worker of the Licensee;  
+   * [3.2.3.](#3.2.3) _Supply Chain_: Provide clear, accessible supply chain data to the public in accordance with the following conditions:  
+         * [3.2.3.1.](#3.2.3.1) All data will be on Licensee’s website and/or, to the extent Licensee is a representative, agent, affiliate, successor, attorney, subsidiary, or assign, on Licensee’s principal’s or parent’s website or some other online platform accessible to the public via an internet search on a common internet search engine; and  
+         * [3.2.3.2.](#3.2.3.2) Data published will include, where applicable, manufacturers, top tier suppliers, subcontractors, cooperatives, component parts producers, and farms;  
+   * [3.2.4.](#3.2.4) Provide equal pay for equal work where the performance of such work requires equal skill, effort, and responsibility, and which are performed under similar working conditions, except where such payment is made pursuant to:  
+         * [3.2.4.1.](#3.2.4.1) A seniority system;  
+         * [3.2.4.2.](#3.2.4.2) A merit system;  
+         * [3.2.4.3.](#3.2.4.3) A system which measures earnings by quantity or quality of production; or  
+         * [3.2.4.4.](#3.2.4.4) A differential based on any other factor other than sex, gender, sexual orientation, race, ethnicity, nationality, religion, caste, age, medical disability or impairment, and/or any other like circumstances (See 29 U.S.C.A. § 206(d)(1); Article 23, _United Nations Universal Declaration of Human Rights_; Article 7, _International Covenant on Economic, Social and Cultural Rights_; Article 26, _International Covenant on Civil and Political Rights_); and  
+   * [3.2.5.](#3.2.5) Allow for reasonable limitation of working hours and periodic holidays with pay (See Article 24, _United Nations Universal Declaration of Human Rights_; Article 7, _International Covenant on Economic, Social and Cultural Rights_).
+
+**[4.](#4) SUPPLY CHAIN IMPACTED PARTIES:**
+
+_This section identifies additional individuals or entities that a Licensee could harm as a result of violating the Ethical Standards section, the condition that the Licensee must voluntarily accept a Duty of Care for those individuals or entities, and the right to a private right of action that those individuals or entities possess as a result of violations of the Ethical Standards section._
+
+[4.1.](#4.1) In addition to the above Ethical Standards, Licensee voluntarily accepts a Duty of Care for Supply Chain Impacted Parties of this License, including individuals and communities impacted by violations of the Ethical Standards. The Duty of Care is breached when a provision within the Ethical Standards section is violated by a Licensee, one of its successors or assigns, or by an individual or entity that exists within the Supply Chain prior to a good or service reaching the Licensee.
+
+[4.2.](#4.2) Breaches of the Duty of Care, as stated within this section, shall create a private right of action, allowing any Supply Chain Impacted Party harmed by the Licensee to take legal action against the Licensee in accordance with applicable negligence laws, whether they be in tort law, delict law, and/or similar bodies of law closely related to tort and/or delict law, regardless if Licensee is directly responsible for the harms suffered by a Supply Chain Impacted Party. Nothing in this section shall be interpreted to include acts committed by individuals outside of the scope of his/her/their employment.
+
+[5.](#5) **NOTICE:** _This section explains when a Licensee must notify others of the License._
+
+[5.1.](#5.1) _Distribution of Notice_: Licensee must ensure that everyone who receives a copy of or uses any part of Software from Licensee, with or without changes, also receives the License and the copyright notice included with Software (and if included by the Licensor, patent, trademark, and attribution notice). Licensee must ensure that License is prominently displayed so that any individual or entity seeking to download, copy, use, or otherwise receive any part of Software from Licensee is notified of this License and its terms and conditions. Licensee must cause any modified versions of the Software to carry prominent notices stating that Licensee changed the Software.
+
+[5.2.](#5.2) _Modified Software_: Licensee is free to create modifications of the Software and distribute only the modified portion created by Licensee, however, any derivative work stemming from the Software or its code must be distributed pursuant to this License, including this Notice provision.
+
+[5.3.](#5.3) _Recipients as Licensees_: Any individual or entity that uses, copies, modifies, reproduces, distributes, or prepares derivative work based upon the Software, all or part of the Software’s code, or a derivative work developed by using the Software, including a portion of its code, is a Licensee as defined above and is subject to the terms and conditions of this License.
+
+**[6.](#6) REPRESENTATIONS AND WARRANTIES:**
+
+[6.1.](#6.1) _Disclaimer of Warranty_: TO THE FULL EXTENT ALLOWED BY LAW, THIS SOFTWARE COMES “AS IS,” WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED, AND LICENSOR SHALL NOT BE LIABLE TO ANY PERSON OR ENTITY FOR ANY DAMAGES OR OTHER LIABILITY ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THIS LICENSE, UNDER ANY LEGAL CLAIM.
+
+[6.2.](#6.2) _Limitation of Liability_: LICENSEE SHALL HOLD LICENSOR HARMLESS AGAINST ANY AND ALL CLAIMS, DEBTS, DUES, LIABILITIES, LIENS, CAUSES OF ACTION, DEMANDS, OBLIGATIONS, DISPUTES, DAMAGES, LOSSES, EXPENSES, ATTORNEYS' FEES, COSTS, LIABILITIES, AND ALL OTHER CLAIMS OF EVERY KIND AND NATURE WHATSOEVER, WHETHER KNOWN OR UNKNOWN, ANTICIPATED OR UNANTICIPATED, FORESEEN OR UNFORESEEN, ACCRUED OR UNACCRUED, DISCLOSED OR UNDISCLOSED, ARISING OUT OF OR RELATING TO LICENSEE’S USE OF THE SOFTWARE. NOTHING IN THIS SECTION SHOULD BE INTERPRETED TO REQUIRE LICENSEE TO INDEMNIFY LICENSOR, NOR REQUIRE LICENSOR TO INDEMNIFY LICENSEE.
+
+**[7.](#7) TERMINATION**
+
+[7.1.](#7.1) _Violations of Ethical Standards or Breaching Duty of Care_: If Licensee violates the Ethical Standards section or Licensee, or any other person or entity within the Supply Chain prior to a good or service reaching the Licensee, breaches its Duty of Care to Supply Chain Impacted Parties, Licensee must remedy the violation or harm caused by Licensee within 30 days of being notified of the violation or harm. If Licensee fails to remedy the violation or harm within 30 days, all rights in the Software granted to Licensee by License will be null and void as between Licensor and Licensee.
+
+[7.2.](#7.2) _Failure of Notice_: If any person or entity notifies Licensee in writing that Licensee has not complied with the Notice section of this License, Licensee can keep this License by taking all practical steps to comply within 30 days after the notice of noncompliance. If Licensee does not do so, Licensee’s License (and all rights licensed hereunder) will end immediately.
+
+[7.3.](#7.3) _Judicial Findings_: In the event Licensee is found by a civil, criminal, administrative, or other court of competent jurisdiction, or some other adjudicating body with legal authority, to have committed actions which are in violation of the Ethical Standards or Supply Chain Impacted Party sections of this License, all rights granted to Licensee by this License will terminate immediately.
+
+[7.4.](#7.4) _Patent Litigation_: If Licensee institutes patent litigation against any entity (including a cross-claim or counterclaim in a suit) alleging that the Software, all or part of the Software’s code, or a derivative work developed using the Software, including a portion of its code, constitutes direct or contributory patent infringement, then any patent license, along with all other rights, granted to Licensee under this License will terminate as of the date such litigation is filed.
+
+[7.5.](#7.5) _Additional Remedies_: Termination of the License by failing to remedy harms in no way prevents Licensor or Supply Chain Impacted Party from seeking appropriate remedies at law or in equity.
+
+**[8.](#8) MISCELLANEOUS:**
+
+[8.1.](#8.1) _Conditions_: Sections 3, 4.1, 5.1, 5.2, 7.1, 7.2, 7.3, and 7.4 are conditions of the rights granted to Licensee in the License.
+
+[8.2.](#8.2) _Equitable Relief_: Licensor and any Supply Chain Impacted Party shall be entitled to equitable relief, including injunctive relief or specific performance of the terms hereof, in addition to any other remedy to which they are entitled at law or in equity.
+
+[8.3.](#8.3) _Copyleft_: Modified software, source code, or other derivative work must be licensed, in its entirety, under the exact same conditions as this License.
+
+[8.4.](#8.4) _Severability_: If any term or provision of this License is determined to be invalid, illegal, or unenforceable by a court of competent jurisdiction, any such determination of invalidity, illegality, or unenforceability shall not affect any other term or provision of this License or invalidate or render unenforceable such term or provision in any other jurisdiction. If the determination of invalidity, illegality, or unenforceability by a court of competent jurisdiction pertains to the terms or provisions contained in the Ethical Standards section of this License, all rights in the Software granted to Licensee shall be deemed null and void as between Licensor and Licensee.
+
+[8.5.](#8.5) _Section Titles_: Section titles are solely written for organizational purposes and should not be used to interpret the language within each section.
+
+[8.6.](#8.6) _Citations_: Citations are solely written to provide context for the source of the provisions in the Ethical Standards.
+
+[8.7.](#8.7) _Section Summaries_: Some sections have a brief _italicized description_ which is provided for the sole purpose of briefly describing the section and should not be used to interpret the terms of the License.
+
+[8.8.](#8.8) _Entire License_: This is the entire License between the Licensor and Licensee with respect to the claims released herein and that the consideration stated herein is the only consideration or compensation to be paid or exchanged between them for this License. This License cannot be modified or amended except in a writing signed by Licensor and Licensee.
+
+[8.9.](#8.9) _Successors and Assigns_: This License shall be binding upon and inure to the benefit of the Licensor’s and Licensee’s respective heirs, successors, and assigns.
\ No newline at end of file
diff --git a/playbook-vagrant.yml b/playbook-vagrant.yml
new file mode 100644
index 0000000..901d561
--- /dev/null
+++ b/playbook-vagrant.yml
@@ -0,0 +1,17 @@
+---
+- hosts: vagrant
+  vars:
+    mta_user: "{{ vault_mta_user }}" 
+    mta_user_pw: "{{ vault_mta_user_pw }}"
+    machine_from_email: "noreply+jake@nilsnh.no"
+    machine_notifications_receiver: "mail@nilsnh.no" 
+    forgejo_load_backup: "/vagrant/backup-restore/forgejo"
+    forgejo_domain: "code.on.nilsnh.no"
+    forgejo_from: "\"Forgejo at nilsnh.no\" <{{ machine_from_email }}>"
+  roles:
+    # - backup
+    # - base
+    # - sendmail
+    - forgejo
+
+# Tip! Use Valet proxy to setup local proxies.
\ No newline at end of file
diff --git a/playbook.yml b/playbook.yml
new file mode 100644
index 0000000..1aa96bf
--- /dev/null
+++ b/playbook.yml
@@ -0,0 +1,17 @@
+---
+- hosts: jake
+  handlers:
+  vars:
+    restic_repo_pw: "{{ vault_restic_pw_jake }}"
+    restic_repo_url: "{{ vault_restic_url_jake }}"
+    mta_user: "{{ vault_mta_user }}" 
+    mta_user_pw: "{{ vault_mta_user_pw }}"
+    machine_from_email: "noreply+jake@nilsnh.no"
+    machine_notifications_receiver: "mail@nilsnh.no" 
+    forgejo_domain: "code.on.nilsnh.no"
+    forgejo_from: "\"Forgejo at nilsnh.no\" <{{ machine_from_email }}>"
+  roles:
+    - backup
+    - sendmail
+    - forgejo
+    - caddy
diff --git a/readme.md b/readme.md
new file mode 100644
index 0000000..219ba7c
--- /dev/null
+++ b/readme.md
@@ -0,0 +1,71 @@
+# My homelab documentation
+
+Servers tend to get weird over time. Hence, I maintain this overview to remind myself of all the stuff running various places. This makes it easier to get everything back up and running when the hardware eventually fails. 
+
+I also hope that sharing this can inspire others to try self-hosting as well.
+
+Services currently handled by this Ansible setup:
+
+- [code.on.nilsnh.no](https://code.on.nilsnh.no/)
+
+## Getting started with local development
+
+Prerequisites:
+ - [Ansible](https://www.ansible.com/)
+ - [Vagrant](https://www.vagrantup.com/)
+ - [Go](https://go.dev/) for building [Restic](https://restic.readthedocs.io/) from source.
+
+1. Run `git clone --recurse-submodules git@code.on.nilsnh.no:nilsnh/ansible-homelab.git` to download this repo including any git submodules.
+1. Run `./scripts/build.sh` to build binaries from source.
+1. Start local Vagrant with `vagrant up --provision-with ansible`.
+    - Use `vagrant destroy` to fully delete box.
+    - Use `vagrant ssh` to ssh inside a running box.
+    - Use `vagrant provision` to quickly re-run Ansible changes when developing.
+    - You can use [Valet](https://cpriego.github.io/valet-linux/) to setup local SSL proxy and get URLs like `https://myniceservice.test`.
+
+:point_up: This will fail if you don't have configured [Ansible Vault](https://docs.ansible.com/ansible/latest/user_guide/vault.html) password.
+
+## Deploying changes
+
+1. First ensure that you have Ansible Vault correctly configured. See section below.
+1. Call `ansible-playbook --become playbook.yml`.
+
+If you're deploying to a lot of different machines, you should consider a different deployment strategy.
+
+## How-to setup Raspberry Pi to use SSD storage
+
+1. Use [Raspberry Pi Imager](https://www.raspberrypi.com/software/).
+1. Flash a new SSD
+  - Use my default SSH public key.
+  - Activate SSH login.
+  - Skip configuring wi-fi, if you're relying on ethernet instead.
+
+## Configuring Ansible Vault
+
+A `ansible.cfg` file in project root is configured to check `~/.vault_pass` for Vault password.
+
+To edit Vault entries run `ansible-vault edit group_vars/all/vault.yml`.
+
+### Current Ansible Vault variables
+
+Credentials for accessing remote mailserver:
+
+- `vault_mta_user`
+- `vault_mta_user_pw`
+
+Credentials initially created by Forgejo and then stored here:
+
+- `vault_forgejo_lfs_secret`
+- `vault_forgejo_internal_token`
+- `vault_forgejo_jwt_secret`
+
+Credentials for accessing the Restic backup destination:
+
+- `vault_restic_url_jake`
+- `vault_restic_pw_jake`
+
+## License
+
+Unless otherwise specified the contents of this project is licensed under the [Hippocratic License](https://firstdonoharm.dev/), see [license](license.md). 
+
+Any code in the `vendor/` sub-directory come with its own respective licensing, and is not covered by the Hippocratic License.
\ No newline at end of file
diff --git a/roles/backup/files/.gitkeep b/roles/backup/files/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/roles/backup/files/backup.service b/roles/backup/files/backup.service
new file mode 100644
index 0000000..02373b3
--- /dev/null
+++ b/roles/backup/files/backup.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Backup relevant services
+OnFailure=status-email@%n
+
+[Service]
+Type=oneshot
+ExecStart=/root/backup.sh
+User=root
+Group=root
+
diff --git a/roles/backup/files/backup.timer b/roles/backup/files/backup.timer
new file mode 100644
index 0000000..3104d9f
--- /dev/null
+++ b/roles/backup/files/backup.timer
@@ -0,0 +1,9 @@
+[Unit]
+Description=Run backups daily
+
+[Timer]
+OnCalendar=daily
+Persistent=false
+
+[Install]
+WantedBy=timers.target
\ No newline at end of file
diff --git a/roles/backup/tasks/main.yml b/roles/backup/tasks/main.yml
new file mode 100644
index 0000000..82b1b6d
--- /dev/null
+++ b/roles/backup/tasks/main.yml
@@ -0,0 +1,67 @@
+- name: upload restic binary
+  become: true
+  ansible.builtin.copy:
+    src: restic-arm64
+    dest: /usr/local/bin/restic
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: upload restic.sh script 
+  become: true
+  ansible.builtin.template:
+    src: restic.j2
+    dest: /root/restic.sh
+    owner: root
+    group: root
+    mode: '0700'
+
+- name: initialize restic repository
+  become: true
+  ansible.builtin.shell: /root/restic.sh init
+  # Handle if restic has already been initialized
+  register: result
+  failed_when:
+    - result.rc == 1
+    - '"config file already exists" not in result.stderr'
+  changed_when: '"config file already exists" not in result.stderr'
+
+- name: upload backup script
+  become: true
+  ansible.builtin.template:
+    src: backup.j2
+    dest: /root/backup.sh
+    mode: '0700'
+    owner: root
+    group: root
+
+- name: upload system-email notification script
+  become: true
+  ansible.builtin.template:
+    src: system-email.sh.j2
+    dest: /usr/local/bin/system-email
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: setup status-email.service
+  become: true
+  ansible.builtin.template:
+    src: status-email.service.j2
+    dest: /etc/systemd/system/status-email@.service
+  
+- name: upload systemd unit files
+  become: true
+  copy:
+    src: "{{ item }}"
+    dest: "/etc/systemd/system/{{ item }}"
+  with_items:
+    - backup.service
+    - backup.timer
+
+- name: Enable backup.timer
+  become: true
+  ansible.builtin.systemd:
+    name: backup.timer
+    state: started
+    enabled: true
\ No newline at end of file
diff --git a/roles/backup/templates/backup.j2 b/roles/backup/templates/backup.j2
new file mode 100644
index 0000000..db3e39d
--- /dev/null
+++ b/roles/backup/templates/backup.j2
@@ -0,0 +1,17 @@
+#!/bin/env bash
+
+# Fail fast
+set -e
+
+# Dump data from one or more services
+(cd "/tmp" && forgejo.sh dump --file="forgejo.zip")
+
+/root/restic.sh backup /tmp/forgejo.zip
+
+/root/restic.sh forget \
+    --keep-daily 7 \
+    --keep-weekly 4 \
+    --keep-monthly 3 \
+    --prune
+
+/root/restic.sh check
\ No newline at end of file
diff --git a/roles/backup/templates/restic.j2 b/roles/backup/templates/restic.j2
new file mode 100644
index 0000000..3229c0a
--- /dev/null
+++ b/roles/backup/templates/restic.j2
@@ -0,0 +1,7 @@
+#!/bin/env bash
+
+# Helper script to target correct repo and password. It passes
+# any arguments to the restic binary.
+RESTIC_PASSWORD="{{ restic_repo_pw }}" \
+    RESTIC_REPOSITORY="{{ restic_repo_url }}" \
+    restic "$@"
\ No newline at end of file
diff --git a/roles/backup/templates/status-email.service.j2 b/roles/backup/templates/status-email.service.j2
new file mode 100644
index 0000000..4bdc1bb
--- /dev/null
+++ b/roles/backup/templates/status-email.service.j2
@@ -0,0 +1,8 @@
+[Unit]
+Description=status email for %i to {{ machine_notifications_receiver }}
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/systemd-email %i
+User=root
+Group=root
\ No newline at end of file
diff --git a/roles/backup/templates/system-email.sh.j2 b/roles/backup/templates/system-email.sh.j2
new file mode 100644
index 0000000..508933e
--- /dev/null
+++ b/roles/backup/templates/system-email.sh.j2
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+# Tailored to be called as a systemd error notification.
+# Inspired by: https://wiki.archlinux.org/title/Systemd/Timers#As_a_cron_replacement
+
+sendmail -t <<ERRMAIL
+To: {{ machine_notifications_receiver }}
+From: {{ machine_from_email }}
+Subject: "$1.service" stumbled
+Content-Transfer-Encoding: 8bit
+Content-Type: text/plain; charset=UTF-8
+
+$(systemctl status --full "$1")
+ERRMAIL
\ No newline at end of file
diff --git a/roles/base/files/20auto-upgrades b/roles/base/files/20auto-upgrades
new file mode 100644
index 0000000..f9c2ed0
--- /dev/null
+++ b/roles/base/files/20auto-upgrades
@@ -0,0 +1,18 @@
+//
+// !!! WARNING: This file is managed by Ansible, DON'T EDIT it manually !!!
+//
+
+// Enable unattended upgrades.
+APT::Periodic::Enable "1";
+
+// Do "apt-get upgrade" every n-days (0=disable).
+APT::Periodic::Unattended-Upgrade "1";
+
+// Do "apt-get upgrade --download-only" every n-days (0=disable).
+APT::Periodic::Update-Package-Lists "1";
+
+// Do "apt-get upgrade --download-only" every n-days (0=disable).
+APT::Periodic::Download-Upgradeable-Packages "1";
+
+// Do "apt-get autoclean" every n-days (0=disable).
+APT::Periodic::AutocleanInterval "7";  
diff --git a/roles/base/files/50unattended-upgrades b/roles/base/files/50unattended-upgrades
new file mode 100644
index 0000000..e1c8042
--- /dev/null
+++ b/roles/base/files/50unattended-upgrades
@@ -0,0 +1,36 @@
+//
+// !!! WARNING: This file is managed by Ansible, DON'T EDIT it manually !!!
+//
+
+Unattended-Upgrade::Origins-Pattern {
+    "o=Debian,n=${distro_codename},l=Debian-Security";
+};
+
+Unattended-Upgrade::Package-Blacklist {
+};
+
+// Automatically run "dpkg --force-confold --configure -a".
+Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+
+// Do automatic removal of new unused dependencies after the upgrade.
+Unattended-Upgrade::Remove-Unused-Dependencies "true";
+
+// Install upgrades when the machine is shuting down instead of doing it in the background.
+Unattended-Upgrade::InstallOnShutdown "false";
+
+// Automatically reboot if the file /var/run/reboot-required is found after the upgrade.
+Unattended-Upgrade::Automatic-Reboot "false";
+
+// Automatically reboot even if there are users currently logged in.
+Unattended-Upgrade::Automatic-Reboot-WithUsers "true";
+
+// If automatic reboot is enabled and needed, reboot at the specific time.
+Unattended-Upgrade::Automatic-Reboot-Time "now";
+
+// Enable mail notifications.
+Unattended-Upgrade::Mail "mail@nilsnh.no";
+Unattended-Upgrade::MailOnlyOnError "true";
+
+// Enable logging via syslog.
+Unattended-Upgrade::SyslogEnable "true";
+Unattended-Upgrade::SyslogFacility "daemon";
diff --git a/roles/base/handlers/main.yml b/roles/base/handlers/main.yml
new file mode 100644
index 0000000..2c5f8d6
--- /dev/null
+++ b/roles/base/handlers/main.yml
@@ -0,0 +1,3 @@
+- name: regenerate locales
+  become: true
+  shell: locale-gen
\ No newline at end of file
diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml
new file mode 100644
index 0000000..1dc2d4e
--- /dev/null
+++ b/roles/base/tasks/main.yml
@@ -0,0 +1,38 @@
+# Learn more: https://wiki.debian.org/Locale
+- name: enable additional locales
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/locale.gen
+    regexp: "{{ item }}"
+    line: "{{ item }}"
+  with_items:
+    - nb_NO.UTF-8 UTF-8
+  notify: regenerate locales
+
+- name: install basic packages
+  become: yes
+  package:
+    name:
+      - vim
+      - git
+      - curl
+      - zsh
+      - unattended-upgrades
+      - apt-listchanges
+      - tmux
+      - ranger
+    state: latest
+
+# Inspired by this guide
+# https://blog.confirm.ch/unattended-upgrades-in-debian/
+- name: configure unattended upgrades
+  become: yes
+  copy:
+    src: "{{ item }}"
+    dest: /etc/apt/apt.conf.d
+    owner: root
+    group: root
+    mode: 0644
+  with_items:
+    - 20auto-upgrades
+    - 50unattended-upgrades
\ No newline at end of file
diff --git a/roles/caddy/files/Caddyfile b/roles/caddy/files/Caddyfile
new file mode 100644
index 0000000..57bc874
--- /dev/null
+++ b/roles/caddy/files/Caddyfile
@@ -0,0 +1,16 @@
+# The Caddyfile is an easy way to configure your Caddy web server.
+#
+# Unless the file starts with a global options block, the first
+# uncommented line is always the address of your site.
+#
+# To use your own domain name (with automatic HTTPS), first make
+# sure your domain's A/AAAA DNS records are properly pointed to
+# this machine's public IP, then replace ":80" below with your
+# domain name.
+
+code.on.nilsnh.no {
+	reverse_proxy :3000
+}
+
+# Refer to the Caddy docs for more information:
+# https://caddyserver.com/docs/caddyfile
diff --git a/roles/caddy/handlers/main.yml b/roles/caddy/handlers/main.yml
new file mode 100644
index 0000000..c2dd35f
--- /dev/null
+++ b/roles/caddy/handlers/main.yml
@@ -0,0 +1,7 @@
+- name: reload caddy
+  become: true
+  systemd:
+    name: caddy
+    state: reloaded
+    enabled: yes
+    masked: no
\ No newline at end of file
diff --git a/roles/caddy/tasks/main.yml b/roles/caddy/tasks/main.yml
new file mode 100644
index 0000000..0d10e34
--- /dev/null
+++ b/roles/caddy/tasks/main.yml
@@ -0,0 +1,47 @@
+- name: Ensure dependencies are installed.
+  apt:
+    name:
+      - debian-keyring
+      - debian-archive-keyring
+      - apt-transport-https
+      - gnupg2
+      - curl 
+    state: present
+
+- name: Check if Caddy's GPG is present
+  stat:
+    path: "/usr/share/keyrings/caddy-stable-archive-keyring.gpg"
+  register: caddy_gpg_key
+
+- name: Download Caddy GPG key
+  ansible.builtin.get_url:
+    url: https://dl.cloudsmith.io/public/caddy/stable/gpg.key
+    dest: /tmp/caddy-stable-gpg.key
+    checksum: md5:2d4a43cd25514f24ddf35467d6abfe5f
+  when: not caddy_gpg_key.stat.exists
+
+- name: Unpack (dearmor) GPG key
+  ansible.builtin.shell: gpg --dearmor < /tmp/caddy-stable-gpg.key > /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+  when: not caddy_gpg_key.stat.exists
+
+- name: Add Caddy repository.
+  apt_repository:
+    repo: "deb [signed-by=/usr/share/keyrings/caddy-stable-archive-keyring.gpg] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main"
+    state: present
+    update_cache: true
+    filename: caddy
+    mode: 0644
+
+- name: Install Caddy
+  apt:
+    name:
+      - caddy
+    state: present
+
+- name: upload Caddyfile
+  copy:
+    owner: root
+    mode: 644
+    src: Caddyfile
+    dest: /etc/caddy/Caddyfile
+  notify: reload caddy
\ No newline at end of file
diff --git a/roles/caddy/templates/Caddyfile b/roles/caddy/templates/Caddyfile
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/roles/caddy/templates/Caddyfile
@@ -0,0 +1 @@
+
diff --git a/roles/firewall/tasks/main.yml b/roles/firewall/tasks/main.yml
new file mode 100644
index 0000000..f59e307
--- /dev/null
+++ b/roles/firewall/tasks/main.yml
@@ -0,0 +1,6 @@
+- name: install firewall
+  become: yes
+  package:
+    name:
+      - ufw
+    state: latest
\ No newline at end of file
diff --git a/roles/forgejo/files/custom/public/assets/img/apple-touch-icon.png b/roles/forgejo/files/custom/public/assets/img/apple-touch-icon.png
new file mode 100644
index 0000000000000000000000000000000000000000..cb6ef4451c33e5ec0efa57377697708e1da2bae1
GIT binary patch
literal 6889
zcmYK@1yCH(k^~ml#oZw|1Y4W{!4sS%Xt3Ze!F_Rem&M&B!Ciu6k>D-?g1eL3|L>}<
zYUWK(O~0O=p7xGZQ<2BUAjd#JK)_a1_@Dv5Hvi{DLxHd2lPJ6h2;}vOAEdNA-yF{f
z0|V6vd*46nD0ojvhlU3nPYp^@$I0A)8BW$EuK}n${9!0EA<#Y;=`xIz919zMXJ*C2
z|6gzzW^5(#ZSsv=786F1u5D-Q%Sx;L{~xbLr&qhT1vHkT?nxb7_PMoOFZL4t&k@9&
zdbDC<lwOy+eTTDUiHtyL%x>R@;O(Jk&G2Vxy&7Uv9Lo1e(rBFb7dxnI;A(~3KIt0p
z&cSq%0xudA*|6i=OY)#tXJ@C=;SAHFn6y=2<JWOxOG`_zRa8a>X{Y}SxnMM&p3~E<
z{lSeldQeG`+u;nqc+eyrgxL4rE7ekyWjbM-yO}B^TuAxV;r@IJZ!rfJT%lQ}grVR1
z9pwwn+wIj?7OT12<2wfjhwt7uYyd%q=FOpKlJnbJi$)Y=p{=n!Azz;)g&=KL8Dq<l
zl3$s8Wf|U!aj@XhPuaYRimOyr{R-wq1&85t3KBlIc4)62P~><T$*`&_c7kSaWUA!M
z?UP*35205NZsz8U-Tp5aK^)LfU(2bSz9RYf*9INmcxv&C9Dbc{53V#oT1?IO0Am@o
z>z|1}NkB{DvXVWx5EksP*50?i{_5eClbf3;=H;SQt`_u-{NNgAquVcpQo{G1R@mco
zW;uIMfI{}NO1FJ+@$)ig5T%utq{}W^7&e8RJycMA#sAlAUtbWl2opM|P{6BLvOF6<
zIX0ViC4`6_oKRgq*y(lknVM_ro1I%)R7f^G<59iY2u>9>qew4w$Gt_*UVDYhsI#09
zirl<e7!aL9t4=Op136l#8z5v-N-;jP(N4<}RhEA>U`y*($ra&2wm<t__l1TnRms8U
zV2ePSJ+v<bb)2a8Al0x$i6}?hCvC0t>ipa|pvTqy`)_IPJnD&=r-z4z2XRBulIe`U
zmn17vn)r0h8V8FFMIYZ34>`<NlNoh+BX6H?4Lr{z_PzN+tvJq3bau+zyB15+n$SBq
zp3Xh}-Pw$*@wos~Q`)Ko*7#L<zE6Dl2`2F_?D|sXLfVG(dR~!$oIL8~>CWtD3hS{4
z6K0j7maaN2C|_bCN0`9p?o?JmAwt`|usxlnco??szu3Y|X}EG8YSZ!U1OiinDkd{m
zhm7Fdg7A-KLjZOL_)#L-H!$nT@sopth`9>QrhE^_eNO!Yu9_ddtQy4yyc6?Mb*}H%
zY`pFC$fJJY62x3mt}n#D_*H>x{zLCmwqSLLwYebE(m2Hh>FPMi8-I%u(|7i61$I!&
zSlkqCxq=>ou$zm4s_YBqtK*Hy^pc~wiex-JI+#TDZpuKC-Psva!o6D6aZOSzv6oAz
zQ5(-(JEv@mcx>mr6ZaN(?4#e)Es-=kKyRxF$3btwxW#Qjb&%H8`z}ECAXb?JGnX@2
z)FCgXLF8AM05(UwdXXGDG_^m8N%=D>$y8Yq)B4C0dbzHmCAbq^2FV<=%UrI0Nz6L$
z<CRYyc>VSEXDWLrOlb>l#ML1?g@)$i@^@KB+6&n!b)N`Sm%LsF*R|ivr*f{)(S3^W
zDNBy?3GUj&TV30N_N@)CHN<yxbPRm&=%5gcidkuU3<&VctX$EdP^fEKsC>(JxZ>iG
zFHvT*z-7+dTnjRRBz^%>3uhWU0}R9I-HZ_)48DcPNLSW}q$a+XgL)-9B?iX+4bAK}
z>Y-NOZaJqEE32VNmtZg4+>8>BJ#c>BOaFox0mI<&F)0@Q@pfPa<9<uoOG`Y3hES^5
zQG$cNWxIo*Dr&*&s)ACv?qu}Vt%45JJE({OQ>dr#n@s^E^lB&!VGfq=4QqN>jVIN<
zD|c-Ey%1`T+p+%Ld4~{+gbjC#W}x<B*qlVxUS)Ff{a-!3j`l6vYNG`D+9}%hp@q<<
zHywXY*E)#c$oo^d1TVZs{){WUUf{`n$cF-NOY;tOgWfSvLHf<_hoxj+ePnE*!Ph9*
z8?-Tt&9kl=0<;RTvAhEJCZ{W8qNguBZW&ESeT*9J)c_VjyG7d9!JZ5AxUcv%x-4}w
z+!DLl8MNX@uMXr65AL0pRyfGW7Yji(Y4mP^+wqdGwDBVh;OzwZrgkOE(oiRzVlH(z
zD_apM0P-}x>5v%iR=&6whvqXrtxS-uo&pp7*U{Sav^2SZ*M~BCH(Il;{!seN)9y%X
zQ9H`h&pgpc6|fM$meBo?bXniLuj6SIwP){9!5sWWmjkl`&F&=&_|T~U4VI&dPpmf@
z9O8FjB^BEw#l^({?B*y~P=u=FOA1U2BM~2R8cQxPbD&fa{Cl1dD&hGqzT{{12miR}
zb)R*Ec85bsT%#t>F6K{Jc<b!zS3yXq2Uou&bs)79Rp*feZ><I+fGH^{=2-?jkw5M$
z{D*K;hYwg<dG+J&7mdA-)k;sVUOg)#td(LQD<`FJWuG2Pe#<_vt_OU4x!Wk4E|NF9
z4zYJB@sT+gJjKcv1VDc``xS&#8pzyW81R=W1J(qEqVS4D<kfNw(!a~Tr={-?@wG5?
za@yTyxB?Oo$e4}9b&<y|5JA6qZXy4L(?ez;D=V~*M)N+ohysYdfF-<ET|mm^RT!U+
zs1#`&E@1H^ou-{VV=_A(vI$j{&!MB|VXy_7=bkoHULMreV$Ea}leiv9Ukh=c+YhsK
z^w+7w@E8VL|HT%lf{GKf80P!x-CcSFEEHmZtQ%xw&5%c>>$J0iv|mlH&&XnHovf-G
zdTvLaOrtvC!kWqCvm}IagPgqc1#F2sQ?b`LJ|ojEVEJ7fcdSB^1Wbod9Nc^{^-+b-
zJ&=6HS2Dw7xgK2{*&=M%RL+#3%ffV~Hrx_Z_pf5_y4kt`2XCKy?!xb)?pB*kNF|WW
z^0hyc`hGNyE=BVbKED{D(HscFc6Y=QX$!xOmZC#q&#et3B?~F^wOxvugBU-WXO939
zABY)Qho86byW$QC`=m7Lcp$$vH|O2RS3$!tsaEHm;ZYn`=_i74T$*|Db1D4>^VV>G
z5kvC|hCS#@=3K)kfav#!sG7FHkc?K-J+~cQ%!n*C7x~r!rBm{FeSSVNB9*m}okRwC
zLg))Zah5OjqmzPun^5T8hAtK*0P0(nvA?IzCkpWw!q8ZbR+jHf8M&P`xCW>b)UoJc
z_=4|E3&wi)p%;CqG+K~v7^|d-Br*;eDF}YN4oN!~)8k(JtzyKrh1*vfn$+0RBKRPj
zO`9L*=d_dxx}`&Xy=j=q$oxH>qroiFqA^gJ@F*I=(Xj08v-h^zVdn%d6Zmar5dZW1
z@61I~td6ATIx(b-jy^xf$BCd+C|Fn})3}RA+m=_2tLL6lbr(ZZgk@;419UnQC1D0}
zcPQEgZVvC6(Wk1SVEzt8ro~1=3`=z&%BT4P+SksFtCyy|dz&wnTEf?&nd!e$$6^-0
zI~R!%K5mq$&<h-Q;Xee8^(iQAhL@?fiMC1ibmjTDnU_8|hRRi{RxOb@&wc_`G_QTl
zSj0ebnaqYYxu$I3M6@W~r|ma9D8>OF53p3YQaWDT@s5|Jd~$~BO$MHYMAd;=KlaUt
zqi|W7vw>D17|~3%vyjIPCFve1^zGd);Anwi*_l_;mv*+S*LpO8u2RD@GYFTm%rW1P
z?%ezJwn%y$M2$a_Yuj}`1|vL|iFUrI_u~!l;2|QC&r8E<M_C3gcS*$Rh)p5`RLeOY
z*~t5PKI9FSpq&J4zP-rvIlW*~>4#!?+3Y5}I|^0Xm>~1)JAk4{>oNJXe(3YE&I>{<
zW9HI3`*$g=m5lz*dw5Id35#)zTE5xqemXT<!IC{-*TUc5nY@pR&EfKe#-B_C{w5w(
zUeWP6oIi}5t9B-By5l8pNR+yM%rYN0_jeA>rmxJ_#OmKgN&T4eKqH=k?n*B5&za87
zV_H^5-lKRY;p2^R)lu37-CH5=>++;{Bl|)ote}yV9{j|!nxFhIx$QM<>YtZdT^e;1
z-BhF`Wq?<mBVzNH#~VTliX#wWGY4jw;3R{&xS|1%I6r7i3(P<#qA<Qox%2k<R$_a5
zJHhOaKAi6=*V4O|1tU!RItCEU4lQ$BOi^3@!x{5DW<FuzJFu(mY*n?0xQL`8NBd?z
zba1T%+M3q!Emn<Xo0huJFMH;k$t7kqqsH^)W?|N2!>`O6gPme3Uou{J-RiK-?dq!0
z5T+RIb#nJ*bbxO1P6EW0Au@+sVsg@NeGnk`<P9a#F{fr(HwK{ibnnwl3@-|SYxv1C
z-gH|{)3<wG6#jk00T>TnRBBhjNR{Au&(I=&zQ$Zjv_^u@e9OjVsZbl|=#<mTSzVw-
zK~P$J&ZgP^IrW8+PMy&tCl)-oVmcAd&?8aa^zbEi3>SDysEzv0Rgl>*TjCft|H7g0
z^%907;i$z~SKOX<4P{X+^1W@eCm?^aX!;f1;5s`puxS7u>$+R_frpzs<mm(XK_2CC
zA|d{=%lsEM2^@=UiLA^CQmhG$IXBgQA20+*&2Fhtw)0}t_%qX01?XxhYP(UG+WRGv
zl2E9gM&5@MLu3)j>}zTxW5&W{t)rzNohdw`!--eEjE;>Z4r?sVD6H~wN`20C4@ZTH
zus#M9e6-(lfA%d^Sk)ZJz+Z;{GK7IVai2k=<46Ww@E8_8G+Ne0f5z`v8F&2YbgXE{
zuHvBBw!c~(DAEfnQ6~9T1T{qh=G=z<;WRNt#p3AsP=`(EP~Ba6TjQyOD`*Y(0_E#n
zkAJJ`v)YfR(n+`s3KA0VI>LD@R)h0B30AO)XNMKZFpidp2O0X=3~TfRuxPa5K215D
zt43`!aFtI~G`rpXNX}#3>#g|n`G9|}Thw;&+%iOa<`Cx)Jkv`nT)#Hm{Cg-xKiXc~
zs`~4~pf8!M73zN~G?yROlPC?rX{o7Dv1p*(E~AM1-@&}IKNY?QrASvlF3vuZb-jN}
zZ-|;@S5<fR82Ma)@r3}s_k2!MRkzVIl+bM?j%rk8aZ)_`Z-)*|lldy5eK@yYgEh%3
z*U48Z4`~CQ>&Y}DhR&+YOf%C$0%2=et6ixREf_B!pY_G|(DjOAkFJ0e$!}M1snKNn
z>`C$j9$#kHA90YaDrw+SajHEK>|Y^@oaHQQ_4H&Z4-qx0TbPO1n9K$>*|u0yJ3Jzw
zxg2)M5rQU?9AEJN4E6o-*B?tZ`vbk=!z6-k2~2dQbP%hTbzqc_jecaa&Qx)B*kNE4
z`F3n&Gk0d+wl*x<Qbx8eDbs4bXhA|y@ev=_j5`J`{aVYD!y#wlZdxdCC4`=zoO=m%
zrQA^hd+ELnW7^LG`1|h`)YCBqx&?x#WI|*J28T;K>S6N?gG(M5YWV5cSbOiog?iFj
zfMXnLMk6M;tWs63qb91x1W_<P%PDgjyR|%B+6D`^@0|IaEk%B(I*G!4P<2$EQ;T?6
z%?cDC?W%lubL~zSe<Cq<l?8g2S*%X@L}#?$MEz&)N6)mn7XjbeC9`)&tJH+h#IT(;
z0;(?BS_iiuZ3#0<X1-I%ebh@N5W4Jxgj%Po3)k+=S96<nMuRpP@|oEh{k9o+()8<<
zYFILZ>H4MZLdN7|xrHf`J$jXcB#MueWw3e9Q9O4%b|yNS2zp`)fA}0?pNi2>9tWOv
zW#JeuS;}=jUVJwr?ZW$uOqGlvUK?i~`D64JJFU3vJRr~=@oBHZZ26IxuW!jcjr)s=
zWA_6y5ixNVSzC;{o6vcG2T~T^Er^wsH3}vegkI}w_rW@eRhr?Et5)$e80|--02>A;
zn6WPs$LStCkqeJ;D$mDDO-Xt<J_dZZrlhw6wIT1^5yDP((t9f`HXsmytW}5SNz1}L
zYBsTb7Azvj_DIdUi*)k0CR_jD$cR2OLWJAZB*<1UjhKk2VWih`N#&5@7y4Ou0H9IC
z$*@IKjZoA5L?*TSA+k$Po4m143<?aH{|!yaa$z<fiXu9GfRerQ*|D7~4>FB&2)~X6
zt&jdf9fF2M(+!{uW|032+{VZ0rxI~1*fhS<Y;tjRg^Nw*b?Hp7XcQj`L;}whjxwfE
z4BJd-eXW1D2}-})XtAC}5q9<7i3N?atoz*=UU)x&$_|qrCRUJlU9=kvo_i}}rDq2t
z2~1{<BQ}K!*ri1SZ%<aPmgr<=I0(q6FK&IOi-AbO|Dr-rakqzyYG_dSc{~RvOLj)$
z&4}|kyU_UGcH$LwD9KPVIiUOhd+}&QJZ`%{4#}YTz0`5q9u3dLA$KwVN@c=vSe=t3
zU8l)z%<O>ViJHTABcnD#6>Ub}o#^!1jOXaT`HS5ynpsqZ@n{jY5W^iYw>Bb+wB+5Y
z>$9cAjBLpKe1q(P(UlTQgwAD-UTpm`U*wTIjo;ua4l<^75@#zBB6RD8&cSE%S_{1Z
zEmqU#13>jhOHP)(PwJFa@7+GU&~-1AF<74I-Gm*m#ZvMyT#bplR8aW4rlM6MD`!P-
zv&J=kIuKmgS7Pw9KZ&OCKA>y(iU|nVOVv?8ut+*Uf88p;&3>nzeK~+Dsm2sc&p&*m
z1nQj4MQ%kC_w=K}h~3owu-j9Epo^1HmYs_c+AWKx`S%^<8$gz@B8VvHOUO@TSt~c?
z_sYGZtS<eNe~NWIkIsXUa9k}e;6;k^GA<yD@bE!@6BeOuu&RoC%s?WW@TRi(RPN_6
zLTuK|ry9_xZ8XdswfOSIw$3On_KU+(Bh!p&>mL@IG2@=sN88F`HOOmvzynEf&wX)O
z0_|?<$!@Vd`*`sb@rN3{mV*(R0R9{5*qGt>bO4{5pV(jdkxaVpn<&YF(uQYkVDaO&
z=F;Lwo=43%GKTGLvP`n#!wE!GF<+oB(EIiIfsj^hN^!PKbp(@05!<<kNJ9sAzr^Wb
zKc}wT{b-)(3$7ah_>D|%43@Ag$YO#NgO)|wOj57M->>tt^OL$`!NRrFJErXPB(JDg
zB=(Yd1f>okzej$66o<S6T}e5bAsNck?%tj?O$G-2Cwr+zo6EHFxB0#r=}sDbsC7qW
z`Tq28&wuNDnJ!l^GA@+ivzX}RMnq;w(cOVpJibXHEaezq1tUth?g;<li}V<g`#i&o
zw=vX&C<0tt?w)5}Ru*Y}#NlWGn>mHHE|wZFM{4YNaZg<(Cw{w}X01=yPZcEE8c(5I
z5qCB?>I&kVbAr1|@P$)on3}&Ct^k{A*=bYMzj&BH_Ic{MP92@gxW-$Mh8so{EN*jJ
zo~Gpa+1K^O-#JmsKr$SE)j$bDM-yFD>;iIp)M<eYrzo2DM(T;6y60FhwEKQLT8;uo
z?GlVCC~Ni4L1w;2e`LnU0x^852eI^MX2aAxG?>15<Bb&Fj3eCC<SDvMcn4aH{u;1y
zb6W;P#}TGdfFa%VdUz>QXWdT@lz(A+P{jivgIxVcQ4rXB;_>E4Q4082Nh?%ZV%iZ{
zIJ7&KjQ(TK>*`Nr)fK#ZGpORsUkVmsk!DXxOXHPhF#Nn!fL4Rhf#__DSSJ#&z3?TV
zq;1_hdNUOD2tepy%*kWii|}`$j)v~>?o3sP!I&MH`#oAVAtCgWyA#9T-&OJ|NT+h~
zVwY%Z&LdQF&DNUh+2u4&)Y^L1`4BK3Qz5)-Nf#cN10wXE2$-^YKT!;S-S6J0F})c6
z#W11idRV8I>l35kvU3qyO}*oWgdFL8-x7iatMp2Y?E}+hOIZOLr)fU~ef8S+Ct)L6
zMBYatFViG?mZER;du>X^JvX1AVSCndcD~F4*$J|oZ}&8;Db}sy5EI~H1T5}|SdfJI
zwdJwZ>wQN1DiBvRT*O<xzlv|j=}|PrbWGl4`HLBDo2*BH4MY=f(AR%4zv<x0{}6W*
zrk*@a#_#mWUh~8(Gt?jg*-{IR_wK1z&eZ(tl9SpVkoc&u)QlH~YCU!&!jeJrdAfZF
z{%Q3#zuDx{*1LR?$qJfl8zuv73G4_-)hDq&Bzcn)5ki?Z&qvTgObSqfOg?1&*z0eN
z<X<d})pe$jpmn`In1)M-vk=~HjNySV0)I!!GR?RScTwo<DL%=4aJ|{6HSAE30_q`#
zedg`&yq-}G6E9@qwVaD@vFC}j@-vJ(xChKCz!^n9kFqERhHtngf17?_SvI6X6~>$S
zR-Ashm4U|zS4ms8HHZqaOrA%!pnVd%Cumnh$|B>SH?Pmh-vFrhrh<FAviJQ;`T;?%
z(N7dAU2H<5LAOGiIc>=NU^tCG%Qp{KryUn-_fub;AOiC+f|Lv&xhQowW0*qE?`C=#
zHBfn!E#sAI#zutoC+!$5<P~}-tBF3s5j;e+;VsVV&Rn|syOs4H7H#JHrJZcj?9y!x
zYs<~a0p<pzVDO5$!#gGll$630B3&ZnFA#8GJ}Lw5u<U(cxignTx?TDNi}S!!mLWxd
z1&NVo5L_AEFOHjjW!czEi{M_hE)`emU)m-9m_B#Az>5fc3H}OK_Y$gVpB998+_W~F
z7K#2JXWLms%xg-??FsZ+Y7jw4+lK$j$0MT7>&1=zbc+mTmw#Vd%2gb3e^l!HX5{-5
zB2!gk91W|i4_*q?%Mi3De|lnmiHRNRWm`Wj75iyTtXivPPtUO2Vq11i9tBGa`@=`Y
zhhw5wat5D?@Lsm$_M?j%f93q^;z-w$k@Km=#|w>bT*iPtQr4Qq?q~ITpq|tm@0WJB
zNI=AV*A~!Z_kuZ5R3NCosK35UP}*QxMpgHAnW-7E+9h^5K&t)lJJlP1AUwpHSBAsI
zzC6c~3LhLa_Jm0CGaC!bnm_Xz_p*Fk$c5VgVreUHBj@M(Kt{LY#c7;K=ty8Lw}{Gf
za-SLmoFVGL#Xucn$(SP<Kpif4T;k^-X~0Ed@*UWX@SQjeTWV?F5iYyl;WQxr5*9-*
zzwWW$G|SV&em((CvK9G#{OxHGf;0<CK|$%_&vzCK7U}+>eC~1sMXzB6+^+nOBtU{-
z|KflDdPMzyRF;n5^RIQqP1!5w@Lu`UVF#l~g%n7^(8vM*3j+E74`i^y`(IEFM*CmT
Z!s$vAlxGH6f{(Be6lGOD)Jhu%{|~Y<Uc~?a

literal 0
HcmV?d00001

diff --git a/roles/forgejo/files/custom/public/assets/img/avatar_default.png b/roles/forgejo/files/custom/public/assets/img/avatar_default.png
new file mode 100644
index 0000000000000000000000000000000000000000..f889c1fff47044100c9ef24df59893ebdc56fbe5
GIT binary patch
literal 6471
zcmV-N8Mx+&P)<h;3K|Lk000e1NJLTq0077U0077c1^@s6tyr#}000>dNkl<ZcmeFe
zfdBvi0Dz$VsTZjN0000000000000000001h**ga)$#O1^e_d_cJ#F`5xc1ndwQbwB
zZQHhO+qN~n-~ZM*t90^^R9B<!|D4~lI`#TY?n`o&MALL|C%6Ml1&~N2Vr>uTUn~Z@
zfP|Mwv^iJ|NW-2WVI>lc0Sf?mupLM^i9{XXCqO<d1d~9*NF>SxuK^0kPoNcuL<ylY
z0EOgLkPSql0j<e^bZod*0Uf$enU|5A4@9B?t1R##AeG@mGU<=cI%(lIU9`!%g(d@8
z3`PNwXh7-^Kq}c;5qkZJ=BRNnzr#?54bC(f$%h~Zh(rTQjo?o}D(9Y5#fI@8-g~~4
z^7E2SMshR|i3XI;1EjLzvRSm?Yc`7RoN;WG$v}PwWk4hv5GvEH9?8i`^umKpTH|2Y
zaMoBk+hioifVfB`8Ud~W4})vL$zVIM1}FutItY-;RvQ(uA$aoYW6f+xIs^GF2G5oR
zTEPskFE|(63LXY0f&!TuqBigcAP?RI=YVxVAqb-k@QrTuc>9?aHUeMPnvrjMt^+|>
zb%I^MP2f8~9y}q_Lv%Qx5X=L&fek@E@Y57PDl;bK1u_oil}DQ?645@(2OufnOW*+T
zDxi=o2}B93s{mQ@3pfT;0+TKQr1J2s4S@}WnL0k#^bE@blU4$^gT;VsklGZ{Lx3Ea
z3(f+yK-K5!=j&=x70;DFH(XL{`tE}bS;CJ3iUC^!Q3C5_Kr!MsuqQ|btVTd8+ij*E
z&i&!wVNP~L_nnV{zf=cq1QaWzCPnm?Iw{z-`t&`G9Keg_M>W-_g`HGSfkrR`kjho(
z4GL`_%)~LdCZmjiIr{W@J*lZlwCu1<+I_ncy6&Pu{QH_dyFU;mus%>H1@HIO$;lq4
z!}cwwrI*MEY9v2{TL7uN^>mAsfgHGpF_H0VKz^jBCDG(@xpc`HHT2^L9se2o=Z`u}
zKX(WaC9vL9C&l<tIi3^s#fO?`?V0(MlA^{Z{NbOO`$eaffn0OJAggUsSxHJXOZdBY
z+l^y?`%b&*=l27m1lDuvq*!_RtUwd?oo8EU)Ab4sE?7N9g~|N0Ry=ZBLny;2El#16
zkF2C$Kk4ut`=ggyP2=ngMB>Hzhrvr`gqpZd-Q7r?ZRvp~ZADp%wSi#e3TzyFcKYUR
zWySD`*c-;$0*De=*Q%4E*y1h!%f}tG{+t5ei3?AZwSmA8eaFwth|pzc)r21Vj;rfT
zV@?O61lG}jRK9=D@9nEkF5GX|Qol*89FT)^>lJmr+qcK=Xs{al)T1j+<1P(E39Kyv
zsXTjMll7Z^&mBrUC-RebHCl~((h<f<%tcq$#=-2ob+KveTp&tdjRvHGS`6#S#w*FF
zRdbA!`H20?t;U@_HP1Na>Bm;`XRLu^LO1T$GCf4aV39gG)|{U2G~wQTu7%&~+R2Q`
zXk~Qer77C+*r_n@%TDWOWiJ<EB)YM02O`n`UQ{OsCZjoD$}zBqScvLjviCB9n=h+%
zdd_>UuQ!doJNTbSbV97oA!>BGx-wNe`3~8;EYw)%om{OQXXw(I&W60pHpcVEaG;k+
zdR6VXWid}6C(b{m+8Eu|2k`X35VYeU%h&1oII3S+uHCx*2$I47M51i)i#kaP3zEaT
zWEJ>q(B7gCBA#+ou!HseH|n=Q9j)oktH+h+)@a8DmjIFIZ(RUL<;VldomY`d&(u%C
zhT1fKgWF~Cg0oMka(b@$Uv=>T-((;ofk^bXh67UJ-c+Bz-sZfDv^DEj5oFeS{wz0?
zOG?6LHBN-zKJ9dRE~N8&)!;|Ke<Tv!2S{c5#60I!<l-~5XAu}qT6Fy7M`Tg`pj0X;
zN{;4rja(%=nol)zvOe~4(4J*Z&-3xit^8dk1K9+KMBTK4seb!}!z!Ftk=CX(9?O}m
z%m{t;R=f4Ha1Y>BRxtM4dK;txtwf?r0qNTGpc2q&zrWSSMKLiDq}V$ds=6vEOaM`d
zL}_4Iun9N>oDClEDt0>O#PA2>pFZqRyOKD8=U@+*Ra^!Yg<fO-0WJflfjz-&&;&#Y
zq)M<2xF5^~6qYSFEDC%;=Ax>ucKrd}l^wPy4xD0wNPO^eVSP^4MPM?>00T^-bg(IS
zRLQ%thR+lC-B9m2DRE9<SFV2zM|u)1)1F3?mdm7dM`qLLVHwmmC?(KyY`=N2Z#NW9
zjzpbEtPJyKa5-23^mB;{z+T`BKs^C(S@3q&9)#5lS(ViWr_<&87SmVPRnyP6)^y{w
z^DF7_P4lV3>}@i}LwGxdjAZ|gEN(morie?p|0xaZ7Q79P`<Y;i4GZbB*V_E+D?n9A
zGTm@+2^&EmzPz@YcAJw&ktF?iX~@KV{()%T7{_d)t$Ygdqec}kUIeRwejw2#@Q$tf
z6nRO!EiznQ<6lmD!0u&SJI<3<`<Y>_Y4rBRl|1o7!>dhJhJM^t;kMm&(<0tVSs6Iz
zhBeluaaE$ZTZ=!}fjS`SgDL`-0SW?lBH_zx4&Sdln(OrCo86=3KfK=&O%oZjdX6TV
zZN@Z7>nl>|gUhRUvRiY-e#Od4V#iWl860fnDnvEih5w!FS-8y*Cv0*6Gi<-&EkP0x
z^%1SC>w#;!Ec3KuD(TZ#!=;bB@nj2ojjUD{CIc(Vvu9TDBzI=_HS?_dV`0MUFYWOG
zofmoQrjNesxdRk~UY2NkFdvW!e*2GIBS-IbvWRIMe`o~_s!k2(lAWGwZxjk&U0+Sr
zCBY39sq&oj_17)BPM~`W$6$Cn7Ua7>1cN~@Ni;pkih+h}&J#oDrQ%wTj#mE|M;i9@
zA70_MwNg21^8)gFDU2JLL-$_q`clyI=jWZ=L;`0PUqk(>_im~ZT?a@9YB_iUBgMmI
zBKX7ObMxmBLo<z&WaQ8cccV~v^TJB)xhOX$LL0ABNH0I4xSo3mE*;){gF?SE+APou
z5}gl7$1RsDm3DF9Ce(&&Yf3gNh`E6<UG=Hmy;&<}^RvVq^eXl;kTIYaBw8BGGqw1%
z?V@fAZjI7TkjwTd?hykSHzGqD;g7d*sMl31ydb5!y{l~i0c}x{`&Prf`}#e{l=X;#
zY&fQS%6eXIB;Lm1)x7(MKA!9-TP?UYox78`_P5nX&E1)?a#r^!eML&#jN_;S%e~GX
z3&1$g2P8@cHyL9PNCv#%)N1!hVcC8CjGYR5#6VW)O79-2ADr3azb6tP*%9Eity(Nq
ziG5Gm;88EP=dRn7xW)qfvUj!Ly~+6Om>b78H&jzjW|A&>vPX^Mz2{rmb?)cd-3|0n
ziILn7$OP)W4RH~7cPG1*vo!5SD~r%R=$6<T$h8OR8)Ty}%Y2iRW6AKb2Ul=ARlk*E
zN6?2Q$^^Ij<zb=d>96ctYxshHZVQC^Zr=pIOZSegCyQ%Fytb6wTln^?>Ud(u!aJvJ
zT&J*5u8i(qXOiQCBo%J8QPE$i;=b@jo_v-;O?bEjKG0H~Lf_q39TVfY{Rp2sNR&hS
zPFoez6L&SD$y~Thfve9S#Br4%-}8eU$or?(1Ahdq5adKY&ROF7JNPyyj*w%8;3fxZ
zdrm91oSfrq9PeLNMYUyi&%(ySS16o#cm;dhqAMVun?8K8H5xN|@a6{2v*OQiCPL70
zUjxlR)K9e(cotA!06A3F#_`$JRkVDkIrl5hECQ#2954VRTdtkJuYh`*24uR{d2GS9
z!b<Y}P2r5=rE@B%-8`m!&n-J%1<Qj0CQ%)@94rLnihA&$Fglm-5#$6$j^K0Rpm{>q
zq(mzOfAaBeeR@?D?J_%;8#@@s8ogQ$AIAAC#fgJl+1OKt@h#Y6;5U{NwShCi&wyOu
zbnm@(EQwa&sR!K~FRAstL!Ik7HlLV7XYW!(w;f(e51vp)S07M9$8A**&9%x*OY%KC
zv0GPlIrHT`#cC?LJ#T@XWjmF4$_8tJOTkxRFX_i&m%E2}dV}y8vynJbQ<ciitvwsX
z9d}3tKda68;uUZ-SW(Jn|B|Q*OafndMdaDrg?jZ+*Eg%Bx~?ocEHiM~FhA=a+m~>B
z#BbbN!1A(Eh`e;9S9b6{mKAz0J={dKHK{Q%j>>Yos}DF$WYSpA)}!;mFrbx4w2G<o
zA{wwc)t4af<`zp)K+MAWS<tk?EAsyq$O8Y7NR$fR&>o~KQ#qK{Blm-Nd7L5<v-=h~
zSI)OynN!u#$Xk&}w4*7nNlituVfYa9C7gVgc<%nD=ylGQomIo#SGb)icTmCkL4Sui
zu4CZF*iO%M!0x49UEb?JR3cG^>0pi)KhDPS=<WJaT(186JwW<B;w#4P?yecSxY^2N
zBxi!CM53(#so;Xkm~=(q+$P=l>&_|&^z*or#AsmOzt`?u<b~BpH~ycX9Ee2vT&-C2
zl)~A?cp$zp;2q~^i)xz09OrO;Mr0>z#|FE~)DX3r;tZHP&LI9^x4lv@rJcid>|7-Y
z@0`g1p9P{gD+?S6o&fiQOTZCeeJ}*1gLvvdKq{yXbT$s8%o~Gq>&(gzH5R%UYR3Uq
z*TShFpUX6U3lPOoR{`>1E_ehS0!GClG44%`=gN6+|HT_^p8b0-Kf5N>c<;Z^Y8(qO
z8nr`vXz)TXjlVw-#YqJgnY2HE^T6mHXh2ro6ZfJcdC;>&6=xEwy7A@)b4vS#r@5_o
zcp;cpyN7@%P8tlzfv>>6F>HoB6Oammde##SaSP8ry$ovDt;WVJR>m>0T5;!fCnG@z
zeBIc;gA^c&gC+oq0l$KiK^1V(aex%818^U_&>H9_S(Ncwjeq*Fm7e2nxK@FaTl(O=
z%JgGPepcMHKA;%#JJ`qJobrgS6QgbC4<s`NdTt!vt-b?pVc)UmOv|TVKe1a$kcep-
zcN-vzgErSz#O={SBX@14Au}r%mbK;llAIcuAJS0XuzbsXsg5;qOm65dgM02!68K&}
z?DMS;)G(|--?2nT1~+7|+8!G6vrYh_IB0u7D$|bXqV+Bq@;B?AH<-rm-Ae7FN+~@z
zWkEnAnH#ccSvFX#j)Pi{z!Qr5PH`i;Fvg53KkF^fGxr8F5GFM>iLXox>kKfhf;WM_
zA~6uvSVryEOw~&TzL)Q;fZnbyKq`ngcupYnmf~bW;~nS<i!@1w*5`x=Zc?{E{&1ld
zmju80RIqc^a>KR1*ULZ@2W_gojQ_9>HU?iN9@I{CBYbZ&Vr~fFd0E4dU27~hLO1g;
z-9v5wN5#?!09US8p%eLm#6&*m^Y@3%8~YN7;-Iwwsf^#hjSV0$;}2+~;(FgV_{AV8
z?EQxPmgXQIXW*WFLKSVZNm1CAI&;BZAYyVOqamG@f#9rT`py->b7AY*Ia%`PgUacq
zOKZ8dozv@0uH-*}C=QweNCgLUf5Xshy_TF@;kTL`3QXDnP>gv7bb-Ir0!RfH{#zLc
z?sYc>Qd#NX2=&IT7?KJ^J*;7XRF>PYmM6UxtMAlADd~~L9%q1&aWIh2!Pc5>T@v_0
z{XDKv##ttObUsbr0_axdJKMpn{nJ21MOwGy#Byr`VR(y{nvv`^dGif@d&!Y6!EPWE
zm~;^!6~s+K8OTMa8_yrR1D%G0E5V<D+>vN{yz~>Ge^a+ip_73y97~CqV-d##RU;jG
z(%u242Yjne1*C$*uwn#O-X*3rK>phn;4!cmkOkiWQJnOG`Uj9*oVL)_K$sEh)OdM$
zS~UH7p9U0wPr*fC9Z&|sC=Gn8Ysi3Lo?XeVz5BHs%m$}|S3%Gi({4Z%C!GyQWyWzz
zEX0QMhfvj$#(2rOKvgc-7hDCd0q27g!9id%umULTsa{)a%?MT#GGmhQciIxTC=GOg
z>0l>t7&r@D39bQ`fSEuPN38=$WrfY^+zkXwJ+hM``s%p3pc2Gd72q831US`TP^IAi
z?A-%!WZ4?P@z*`EHmW#-B%@esd&kDJZQHhO+cws=ZCjb3zxRKBd-r@7ozoqC|Egbc
zYJBSI-~rc1L(U?JoL-VntG7L+m}glnkf4qOYds7QVC50&b~dku&l+$A<o}!qSMS&6
zO=(MJ`Qk47=u_w4f_a*C>7(Wjl`hIW_A>)s1_)DEB$akvMJ|M|%5fURp+~v@e-IMH
zPV9+xGr|36z&y?RXfAKF5H@#f1*Tg;#6h8};Of=d3PZLM4X!N-I|l7Fn8#V8kf55j
zQXaJZ43LAKtxoKF7N%1QUxX<B5HYaM&^E@t?!1-%92`uC4|}b9If^mQv(AGA9sJy7
zUIxgHkM(KOP`-)j^!kW{X6g~vp!Rx|LGjOJvrM@Ud*!+Y^FB+N>cKY=+3o3Bq`Iv%
zqkLJ<wj(ha@-eLoae5uZA!>ce7ho-r3URgbOz}hOy$lc*TxtK&mLX~FxE<nfABGXP
z6n+Rv;4)OgT0rfB<m!R_;OD5%Ax9%gY5Y0lEB&!ZS~V_%#PARXVJ)yy_$wrck9~5)
zOFO4EK-Ru_rLPC|S3ndmLAG_oI2$p8$HH2mb!w;0GWk%r3S>P%c7D8H`%m{C#H|}+
z5Qp!2dZTwAMDb==w$e~PG?Rr<!UCzR21!A&bBB~~CAh*J4{^B4<1@i1?t}z<43_oJ
z-X41Fa#y*mfBWjh1Ej3B@Bzoq_Y1`7Ss_#24~5T0a18{Lcz<xouw{K3qT#tDvywMc
zNoM|5H5R*WU;c!s>Tnmt;l0R31?bZbuCc5X-V2EuD4hq_$;NkeM}G@xEp`1TKLt^J
z1mbWt%3)bE)^jliiBjKDHpxOM+4kXH?PK9>SsV<rEacZ;2g{oAhF!CMLmuWcHSMJj
zbgyZcVk3utPBmeGNJT@j>ow{L2<uxAhaX_pWLc$nXSQ3}@CNHXroFqa1b>89CnnWp
zyR$IMT8=My-1F&2P*P{=ejKwp%WB6*m4!!1d{X=Ql|lG0nlUG`tU5dgf58+aq1VCH
zyVL<SN3*OJybwRZoiX>d8c@DL+z1JnL?`BamX$^yo`DbJ_qYNNLvSaa0ash~`Bs)S
z|Jw^GX#E=Ea0D!CL07LVgS`SN%w&sDgBH~MTLJQxWj#aPM=L+oU=!Yqui|gGF5(5m
zUAO?>$NtD!mi0S`LkDtE0oLHdI9nMAN$kM@yk}X}7+2<N`ED6Lj9Vd|eF)yOtj+4V
z8~*CVH!%Upkx#>Wmh~}+LpP>d8QzUCNRGV`-m|O=Apy5|cze~S{M=D%U8X7;ipH9|
zD<AGUw0^96O=G5ibJN7&mX?S5H#OhYHnf*^d-gPV&9WMi$-(Z6yW$>wR#I6owRGPa
z+2={^vf-VpqYnvsLfZq%&vg*IW?5?>4o^q6y)f#nRJwo_ksSAM^sAT4;}h;h+;L#t
zZOYGE4JFI+yU%Vfvg!E|w@?4v?Qz?O0;?YrsHiV;Eg`-R-m|RlD^uGGk+dzC)RzXA
z>$gxz_W4RVZwbE*?^)L6p1yyq#QhML)yFo-<36wK>y^NvFYM5+PS1tcEUN&M+F_pw
zD#qE6M`6>u(Z{xVI}~Wyel-*7iB_JotfijjU%eUPGP0}H+u-1MIw>ehy9UU$NWp8C
zbtuGPH{#Z%z0O^6n0|yqHV%2ddRF@Tk)JF(z$f9%*snu^Y8IEuV?R6Kb$~RjuGC%~
zkHCAD^;(ES3*yw_np>4hKPI#GEvvi^jx}#ok8!vHImxoLEl!INr_Vrw*gM$c-~if(
ztF;003gj)zHp+eoacaSsYtLZ)BVcycaWzW0zkS?^3gjfq`ld2TF-~vD$AdZ3P=sS2
zw5!Kkkh3i77s^4IaXQcS?6LX1-ChR>uZgw6aX;#ivn=ZmkbrX$RW~H4rN3&z_k;OA
zZrSYWF`Ke==;tG<w?cvreC85wgM%xPlvEXHgX1!kAa_}ovJcipi0V|w!}-LnPxX5l
z9Gl+LEzH=}ZmlM92y&if{Tvc-DZ;9Befwzcsd~W2;5g>B%Y`e4@N?ROxi#bcB#RGk
z$3cQdA3MD{SC9SNp!98Q63#LS8yr8wBIG5@`VJ)E=4?*l<;!{2uW=84?oz32D2`g1
zdos$9w=C-ukbnuKp!HM7^4W)zE}Px{kv<vO-Kq|ZfD=%Iyk=Q%$zpBy6~Q0RfASln
z2E^`956BTO?UbIijZ)uPo^gB`*Zj<`9M(+rLWn~bTot)CV<@XFyk%fZ%RT!%v3-IM
zdor}W<(~tg<AB<U`mXXlJaq3-mdS?MgI6L2%bJlMn{c}OVn`mGgdtegjCK^nVHaHO
z2g#vJ@OY$PSu@@;h{NmQY6#-l6n>8_NW-#bO=)Gh>{mj5{8^A`x)VRai_r$lnzda7
z2{;j24fr%J!aa}>594C|3ZKLaF=$tcxt@JZzYTFKMGcms14~eYQdriU@BNT~4D1X*
z%c3p%ghk7;()c#y-|ofXuq^BU8o@@?{=GdoAOHY>0089wYA=8)=m7u#0000000000
h000000000000}<?-Coo;K3xC+002ovPDHLkV1o4waj*aY

literal 0
HcmV?d00001

diff --git a/roles/forgejo/files/custom/public/assets/img/favicon.png b/roles/forgejo/files/custom/public/assets/img/favicon.png
new file mode 100644
index 0000000000000000000000000000000000000000..70601bcec1492809175df6a7a319d9b4f4372e86
GIT binary patch
literal 5835
zcmV;+7BuOJP)<h;3K|Lk000e1NJLTq006WA006WI1^@s6J<SF(000(}Nkl<ZcmeFe
zfdBvi0Dz$VsTZjN000000000000000fZ4kX=r*pV4ZueRnVC^$3bqY5%*@QpoH8>r
zq~UTyW#*>L%*;$-v_1cO{nLKZtX2z3Vx4)<c|MF+ax+@pz1TPs4cEdq@C-DEMj44D
z5*`H7*bePMB571{!6qQaPG|*<CKAa7Kz{rQl^~HE^%(*6Kn6aCM36|1+7!Y+KmocJ
zTp*DgbqRwPfV?f6mqx{fZoQ&j4id>xmzhA`Mhr@%L%%nnk6tdL#Dp-ep!Y%<NF+y1
zQs56Dt^C|b`s4E|s{Nx$gZpnUB$tc5OK+2=hvaC=4M19|aG$-uNENb{YJTW7Jtl)h
za>SDf`+&42jZXF{W@Xn8)l^o@wx_>>2#`oj6<;&Ra_}quTp%sgR{rUuO17Ytr|v1z
zYkEuqr;-KDAQL1ZnDe0y2$Tcx0c?il&<euAOk%jU^J&X6_+r-R-z$MD=+7Vw%p?L@
z!wT38AHV_4HEZEqkc3cbfC8`sHo`E70i#R+(u#7syzkDeS069Ydk@_L{2+~hO|TOv
z097CfkxT|MX(!wSC7_oFfV8HL<J-=hUR~q4*If^KDT6hz3&^AiAPJG21Y}Vy+zCyY
z*>t;sw4QsQIN*ZbyuN^Yy<eI3eRJ3ZwLliF07;1C5+Ivu;d)2{l{P?H>8as#@Hf7A
zIlF(Xq1YI9u%$VuB*RMch0MADBq5S(fV9p!F|(nc__A}dX;9w;N=*q5v@pJd4loNy
zYe>HYRj8))?#4Ddrb0*f9>|D#?}PC>Tz+mgZF{hoPG6qE{kh9Q5+b<~NbCAbbN-{S
z_Wx2tk8SbL^a&}HoMc$shu|F`tus%^FkR5-5#g@?J{$tllad@xGbX0c<6Av+;Mbb}
zxaO7TXLCPuHAq4vR|09_&a7Kx|9(?Vm!6YFx!Dn>zSh@Wn`gS9Z@Dqg)NADBMA8-K
zWz+U=t97q=;Tc)n&t43Y5Xre*lf$Uk_WV@SQ1}V)Ogoo>hdk2-{qRN)e?4ZfM%{V$
z;yqcs>z@IV5XlN4tpzhu11`F+->IPXtz&~y&}iluUbkbrSo-$eih!><XG$t}oh2X%
zk&FV;>en;gRN?LWxrU~UP4-)OD=*JAUC>)L6!^WSYA2(8&-|?E{_UY436UHNq*YZO
zWxDv(yylscQgn-N`TR7~*F?{R?)BzPGyWFgloqj*pPGRrM3M}o6&dN`AFK?h9)->w
z;@ARg*DBWZ^+pXzWUqzSFz(Z4{PT4+g@?PmuU8LoAPJ#-1ElrnW{;&i;AgLwQ%tn)
zgQ6;=-#)7{b;r-jh+wbt-t(oF-rECr6!HslB_WsfKw2j)O1D%rzz<%)%{K(zb%$kH
z>@~)ZOtSpG(Cp!^xe6p9mWe=GO{z?^qnW<y>`dRg>#;3j0=~woD|6YqGYZ}E`@*vU
zSI}cX5@N~Y_RDzVsS?Y@bJG>R1*u^4E}-T{O{H(~jTvVB?)=iD#oYU;gDeQONVshV
z#tye$K<LV2w<qY{DbDhMik%M_R+w|wd<H@^lIh%6{JYyqEf>-1tN6S0YftzuOccG(
z&vZFH&hq<s^XXCw3uC+gCPIit5(U3-BXQ^=vwW8>Dv0zcq+tUR>Au?v)g&l2X{o`D
zm*+J6Z`&R!;tEgoP^fEK>PkeHA$QFmzzrcB$ub~sXP?B+?J)mvXN+4Qi-$S1tF660
zJ}i2#wGcu)5;uGXq@}*DZ(Esfsi6M+vWlBeZE~hwuBF#re_fv53i6LacUuHWDU5&>
za5=mRY?m4Cwx$Z|)7Q$Gt}^o~O5ODFE9ScEuDc}1dsI;CWw;zxz;GyrMjDA5`ojkJ
z9mou|NzC708ISm>k;bG%i+5&58t(GX+*f4yx;wtB=I4|c`wiAXKWSSxj#R^1*bZbz
zVSXe%vdQCj8-nO4ox3B1p&8Js(oM4l#M5aL5*y6uA5SgI+&WDJfcUsDzr8MaaO5W+
znfEWOmW|hs&a{L3p$^DNJ-fuy+s|qW48DKAf^xF>)hy9&7cCi{K%d>3LpvVIXMJ*W
z4$U1DPwoi*1L47k>DN#He{T=f19Q)<h18)9)01Ie9oz?P;0Q<JflW{k<QV3GQ8h!p
zd8a~u*CVL$MACa}viU-0ys<Ki%JTRR#^|9*YE`(JV~zGTe@Av$J=_HaaF`>BfKy>F
zkP)?2fa+^j^NTM&E30A1TDjo#EVbgBZ#pp4pBpzkiT(fDR=ervEqSU?P5FLfF109)
zWV`m#QUh<FXQV}_4*}K_{{Qc%epmH7AKx~X-!6f-2Tp=;I1G`L!)rkPsFm9jM<uI)
z40We7oI|X745}-v^;YDihtrq0^GysE(*(&(Hve#mwT@~Pje3wov&480kbCjZV#3Je
zKp$jZfl`nJF++?V_|)8rYcI~Bo!?hmT9NX^-9^;5N4)-n8{@W9(o|vEvT|wQy%uUx
zlNxeIZ-=G6YxQ$iUzp8~a54{$gFzC6^z--7rykPQUX#nOzq0@jf@<a)+s~`jtR#}Q
zKd6e*o_`+5r*g0MG&ku9lbS4#D1y&kB=}%x7a4HspbtnK&I5XbAtx+I$NXgOZe`!+
zZ<N#QDJc}?<_r6rDM{9fm~rA5-`R3;abfC#RNK?yIMw9B$pZd9y!U~`;oJt~4aMgC
zUot~2t@1Em(Jx+`<yb*KeyQ)Aj5f#e3kHH=+IZb&&n+NvIL%=n*BgMZ&BO8+p2p1A
z`1Y<`#|jz`hd$RY$csEIzZ+%+>OD8?g{B}0)-o!tsIR(!-`dM5s@)nE=KH$;T5Ufw
ze%YGGjT{EOm~XgDx0sb_APHiw)GO+<PRw8)n4FWD?)&ic)g8{=p+8vXyGKV+LD25d
z=<3rf_T^m)k{~Ax?gZit?VlL52gK%0qJ3WPnJY3KE9eI=@GUM3cL(i3aA2PVf5m(&
zxZp5E5(yjqOvPl*2((A73hC6|ciGe_;}RV!=!HXl3vASoB*%;S$$N^7COF+LBZY@Q
z;c$z;RUvAx=ifCaxtgV>klwW>U+t5jJAq%##rXSv`^Egny?JWH(YIR??RGVHWYf9=
ze#FxRHQ@;(i$;S+>mdw|KqM|W8|wW{$5j2)=ubBM3s+m!s;vMnIXkOi5F;`&usI&r
zE=aLm&=*W+=7=zxoTHnP8R|CP=}Gl7$Hj&j4WOJU&5WZXLtv-TIzH8>tM-L{=q^vg
zR$Hog?^u;jr!LJvb0U`A-YXC(31Rfk>TJu!{MwCK6d&U<^_psv8#R)thWVeqx2R!r
znm@m&YS?yHt)hAG&ccR=<kt9|0~p5N4ue2)6r~)t0UZey`4P+<Xk#C(&!OTRX6X6w
zc?QZraumh|GvFVfVCdR0j(T*C=jW4Py5|#@Wt!^MNKXpW-Q*m{PXx1&|AuMO#AqDJ
zgsWf=kX`CHi22h~>4O&=7O~P_Smlj{vARv0VI5=W=_@kXK^OJEsUhwGZDVv_uSL`7
zh8b~c^3c|s3)F|m$wJ-@S3m|x8d=g|IeY|UR(XkA&68&PwLf{aTs@@uZ|CBU-KTXl
zP3{#(lc0C2Xw4m&rv`6u1cuM+y@EB2I5ti@T4~k?uoO}u1R^Pcxv&~uf<ykMqOQ3*
zSM@y`ZoieE>s+&-#N+<IZvj16K+7IE;pGs#1gl|A=x<>lSqQ{YJL>;oqVF09)$<1m
znbfjbw5dLG%!@W!VKWzyP>-ak-mJZIPqDTg*o%*p*e+<ao0)4HA3L{nZkpaT_d*SX
za3n6h^@vxTXMMIF7N`1LFG90L0XJ!%``?W>nc?9qMSr^|xgbO%nGEC&Js6gY`MdWj
z*b&9+@i6($bERs4L$$}%@-Q`^quRjg&dT<Z;Jj}Bb*!IFsEmUUj3gYs;*O=TGe_c-
zCF#uF+4%4vj83xqe_)u}()-x;L$zL;`ZJlE5t<nd<n6f!iY*s2iilmsg58!3fA;k!
z`F8ihnW?sB(cv1L;SgexJPf3zX0f3V9N!n3T@uEufWeku>|PrfxUu}6dUs>H^zH|T
zBgus0pa9%(IFkkktv`gZ8@I4u@qBZGw`30ALt(YIMR|(9OYetda43>RUIQ8R@HIRL
z=RvO^pL9BhTiS%Xq~j~3yRiob@zC7S-BuT;+*)2%g@v`;b*F;^k)*%@AOi>CMOX@X
z;A9>J(mHuDf9R&&^SSZ=ncC<D^F-L|U{1E>_qSqxI(N+nz=23QTioJx8;o~gDUges
zefQQg);4az+z!9<i_PxBKcF|it}i_`9P^v4wWYClHFwQFq)*zJj03XaTUY`yU?tVu
z>^Uo^UR`u%7K+*bWG1uMJm=(0-RohqNlVQl-1+rZr<8*Ok@hn=;75x`{7wPV>d`sQ
z^aCJ@%kVv7aKm)*t-ChQ?=`WW(NaG-&ODSe3xkxCe0B(JpZZI`vnr|G)Pg!stK{ub
z2@$(Z6!v2#kNUk3NDG4@0T%|QZ3eu}E>5H}U3fV5BA|&&{46|uCoW{$(dU89NX`V(
zs_C2c&%_PKkk;S}tEu^r9E#73+8^NIH{BqR+y$hCVQ9mG`0>L^H6*UHfguko#F=ZE
zJtCQ>hS$}@9=ZhWoI`#)*o@>fpMvg_xmy*no<65lP+p59qhlrxz<4mqD?nOURH|DD
zYT`atNE_~W&z(q%1*@hD`p(t){Pq2;VxKiRg<g2L*l+t9`&@HB{{q;IWGRqVWsi*g
zs&I`AIJb%lj!7~)7i0?PhC5_at&rCK<*TprE6>lS&K=?cSs}d-Cczm%S~&i}bU~kg
z8v9WA9yi6+TUoJN4bG?og?#2xzyCrR_cI@Z%}8eXtjy?;wwEtrUbm&C6rC7R=Vx`s
zK+wytKw67trK!7|+PZ+5i{aO6Pz@?WfV7TlX@2WloC(go&H`uwpPD&tSsg{E9(dK>
z9heis{kfmPW+Wqg*4ov?@8OGA-^gp4QC6ky(xV+v0$iL}0lpnh^y(AO=Vr^HjcaOq
zF&y^8y<R&|iGnknTI>sdg3U;d^=SuYxS2b&v2kl!QemrP{ktbW2=f<^MSI{9NChsR
z0BK>LWxGS)dms|D$$~2#I8gL=uo+2;&z&s7RXcIL`GQu)uWd=W&DgJLWj=W4Yao+8
zge3v2kiHB^t65ESz=I)^$0VCQ{vig&!{bm3WYU*lFB1N1f6xWhsz5Cnb7OPd<)gS>
zkiVE&Wy^sK?1iV{BxnhNrU`ewyKgBlEao3Rs3f=BWoPgs3&y~W@KJyTz7!mY<O!d%
zLnaoe;<T*q=@oiC5~qT9hQW=n8m@w~VJQrNQk(Ndws8X?Mt5mUj?!xqM1z$?K@%7b
zi{M<i0an8eFcg9n>5KNXPF96!OKC@TKJl*(&$nI%U%>}DD?hrM9W}&;ih6S`&H_mz
zNCzM-cWij=_%$tU74)#nn~*Ea#WXz}yBnR#OmVFM@4UdBWQ%46ThQ41L$BGB4w6QY
zNZ94G@!{eU+jnVC8+M}oR)<!Ib03yzf!?Lj$Lv$gk8ai->b?RbjVO2e_D3hw+b!rG
zE7%dSe{Hsld&5DUk;zuT<yNB!|JXraZ8N4fHzf%qjVOJ9y!AV?(pEuFSl5ywW5T&7
z{A0mNTEb2Xr$VK{Z`>L~%pFmKDEtCefXN_fWO2dAKw254am4gVo08vxo$s*>%qAW_
z17d81Fz}b*P|vle$BodPlk$YDBx$^v4&<%X_<UOhecTv!lKj0+9ls3EL6r4#6m|Uu
z*&u18iGUB7k;8iQE8FRlc4B7P6d=a?kZAIE+y-Qz7J7rEk*6E?wd{@yuOE26wb8>-
z*EM73M40$0FVkr^?}7?2n<RK2$d45eB9UAT#1%Cr_ggCJ2zMCQE0G=G9rZ0B#(1!r
z0{9Myu?9jYk|=lsh--ed8kcYSK`|lI&D~*Jfl*fI9zbb7h43ZQM;;C#7D*<20mR9y
zj5pN;N%h43%Uq|6VZkv2KJW!3fD_4qb?_pb4iONdk$B(>KdUh6)kxrgbE*srI<q{U
zoA=xg{AHug!&+;QNGv4-UIp?er%A%0j&q7=>`g7$g3hXn|Bd;%VW5}RIz!vnf~`m-
zZn%mmFs_Y#DF2wGJ?*9x(%_3~{;#0ZOX7ZF{`^4D%X2y_xf8*WNF+VrbD%&)M1}26
z$&dL7y&T-y!Ct_nD-dHgI2ws03YNf+KsL1vbio09CJ$_qV8#tInQkvLJm8(<fEc4e
zA_;oJpbOjte*y()zs|~)TY$WLbtL+RC6Wl}2Is(Yuop<j2JlX@&d<z%qaqS1@ERBm
zr^EHI5l+y#J1^E*DIN_HNu$f#Kwho_iKNk`6o^p`!AvYPhas>Ou7%aG3AQM(8E%4e
zU=|dBL}F?MxAG=9ofzl|=fg{I5Xhu`26Lq)5_XE{$>3Dl!g|;a<bW4JB4LvT+;+UB
z4lP)C9>`%IgG9n+B#@Vnz)tdDD^QR;4H5~Pl|Wvu1FIQmW{?M)weQ2;)_cplq}3fW
zGMCy;DWFbsi>TAQV&za?i^QLqpSuMl5;h+?xLw%EMzaDVqr>WO(igR#;h~|IH8Gsa
zU2t6T56pE=0f~g|bvVTAfRqYma|Mu|<h<y*4l_M8ZZ$t=TTfhi)bGso27pAu_CAo8
zZ>;X1%85yetUrF12kRiM?RAZ{>D&Wr4){bOnG59Q9x#*9dd-admPu+Gg}{rLIS`3o
z(<qVfxemz7nGk47^!k>odS=iBo7<R`bx!9F8eIz#37ZFiyo`cC;?nD5ZqhHyd;#+t
zO>zZ279<ij?*VyfV`7hJ^5$us!nBvo>%P2HZ^x&2kVx2Y`*mc2Q6jmWkK)tawRn(I
z1!-Ge%Oq|a;7uTru!+@K$>IW|Oa=1R<AgFtiW!^ecwO7Le_SHTVYezUP8hdOG|nAo
zP8_hNs9j3EPIqDiNF;13+11^~84l#F|5=re6f<^$(mU*EF6c%gX#?ct4KT{R%+5`9
zC`LzmHqwe>>vX<3qCqzj33ocxvjObwyf0X7=VpVl9X;h$A_e`7*`55cZ}ooMS#1|{
zmqjHF8&K*@WsL-h#BaI)dD#ZK;pRA3^hmF@Tg+;RJ1l~2Hy?s_U>J$yc#}(;T;MbF
zt@kPAwu-sk)ItgiXNy@m9V8OVGwoglz0?3{p%4#RJ;Hh9HO(|9-Lme5Fpx+BN;8v7
zuVw;i;bef{%@*?L>zh-{;W=uezrTe5FF*`PB(?@tegnN+<1?eKcjg~~6tTLC_d2PZ
zN;{=dxI0YKEysG&%6tupBogYGhcFj#c?w9Y<804vpGo;Eo6~@EtEkJu5^6ClN1Yx}
zhX+2Uh*@jF4HAik@N=0{fXkOm8+vbKZ1`X3y88!r-hHY~ZE+R%Urub<E0KI<V*9T>
zKn^<uH$W=bjzq$pr7{S-6AraN4%rS@g9jXoM6w3R%W~lI7?2IWz(yD=Js6T;<wPJa
zD}hTotc5QPnjZ(?b9f9^!fdDni6rP50_5c>2qX!R3MEhsDG&=1$q`Epke7ErB59Nf
zXO3UK5+ssFn<{t`zJVL1*&z9^_TWGO0000$kiYdHS33Xz00000000000000006_Gl
Vt9yy#bm0I1002ovPDHLkV1oGJFT4N%

literal 0
HcmV?d00001

diff --git a/roles/forgejo/files/custom/public/assets/img/favicon.svg b/roles/forgejo/files/custom/public/assets/img/favicon.svg
new file mode 100644
index 0000000..30ae832
--- /dev/null
+++ b/roles/forgejo/files/custom/public/assets/img/favicon.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 72 72" width="32" height="32"><path fill="#FCEA2B" d="M43.278 20.52c.275-.645 1.445-3.289 1.915-3.859 2.592-3.144 7.54-3.344 7.54-3.344s.742 4.896-1.848 8.039c-.7.85-1.573 1.484-2.474 1.957l-1.864.85c.816-.435 3.59-1.634 4.574-1.757 4.043-.504 7.777 2.748 7.777 2.748s-2.823 4.068-6.864 4.574c-1.504.187-2.966-.145-4.208-.637l-1.513-.562c1.072.4 3.645 1.562 4.525 2.46 2.852 2.91 2.528 7.852 2.528 7.852s-4.947.219-7.798-2.689c-.63-.642-1.885-3.776-2.243-4.541l.767 2.397c.238.713.392 1.474.407 2.268.074 4.074-3.555 7.443-3.555 7.443s-3.747-3.238-3.822-7.31c-.015-.833 1.347-4.705 1.347-4.705l-1.14 2.622c-1.772 2.489-4.516 4.144-7.555 4.449-.925.093-1.544.066-1.544.066s-.323-4.942 2.529-7.852c.828-.846 1.834-1.427 2.844-1.826l1.71-.71c-.003 0-4.314 1.454-5.75 1.275-4.04-.506-6.865-4.574-6.865-4.574s3.734-3.252 7.778-2.748c.837.105 3.842 1.578 4.56 1.92l-2.21-1.211c-.77-.449-1.507-1.023-2.114-1.76-2.59-3.142-1.849-8.038-1.849-8.038s4.948.2 7.54 3.344c.502.608 1.854 3.216 2.136 3.907l-.91-1.94a7.721 7.721 0 0 1-.507-2.55c-.074-4.073 3.555-7.442 3.555-7.442s3.747 3.236 3.822 7.31a7.713 7.713 0 0 1-.411 2.559"/><circle cx="40.792" cy="26.177" r="5" fill="#F1B31C"/><path fill="#5C9E31" d="M23.365 38.967c2.344 2.868 1.647 7.316 1.647 7.316s-4.498-.203-6.842-3.072-1.647-7.317-1.647-7.317 4.498.206 6.842 3.073zM36.653 52.501c2.858-2.334 7.289-1.64 7.289-1.64s-.203 4.48-3.06 6.815c-2.858 2.335-7.29 1.64-7.29 1.64s.206-4.48 3.061-6.815z"/><g fill="none" stroke="#000" stroke-linecap="round" stroke-linejoin="round" stroke-width="2"><circle cx="40.792" cy="26.177" r="5"/><path d="M23.859 38.563c2.79 3.414 1.96 8.708 1.96 8.708s-5.353-.242-8.143-3.657-1.96-8.707-1.96-8.707 5.353.245 8.143 3.656zM43.278 20.52c.275-.645 1.445-3.289 1.915-3.859 2.592-3.144 7.54-3.344 7.54-3.344s.742 4.896-1.848 8.039c-.7.85-1.573 1.484-2.474 1.957l-1.864.85c.816-.435 3.59-1.634 4.574-1.757 4.043-.504 7.777 2.748 7.777 2.748s-2.823 4.068-6.864 4.574c-1.504.187-2.966-.145-4.208-.637l-1.513-.562c1.072.4 3.645 1.562 4.525 2.46 2.852 2.91 2.528 7.852 2.528 7.852s-4.947.219-7.798-2.689c-.63-.642-1.885-3.776-2.243-4.541l.767 2.397c.238.713.392 1.474.407 2.268.074 4.074-3.555 7.443-3.555 7.443s-3.747-3.238-3.822-7.31c-.015-.833 1.347-4.705 1.347-4.705l-1.14 2.622c-1.772 2.489-4.516 4.144-7.555 4.449-.925.093-1.544.066-1.544.066s-.323-4.942 2.529-7.852c.828-.846 1.834-1.427 2.844-1.826l1.71-.71c-.003 0-4.314 1.454-5.75 1.275-4.04-.506-6.865-4.574-6.865-4.574s3.734-3.252 7.778-2.748c.837.105 3.842 1.578 4.56 1.92l-2.21-1.211c-.77-.449-1.507-1.023-2.114-1.76-2.59-3.142-1.849-8.038-1.849-8.038s4.948.2 7.54 3.344c.502.608 1.854 3.216 2.136 3.907l-.91-1.94a7.721 7.721 0 0 1-.507-2.55c-.074-4.073 3.555-7.442 3.555-7.442s3.747 3.236 3.822 7.31a7.713 7.713 0 0 1-.411 2.559M36.242 51.997c3.414-2.79 8.708-1.96 8.708-1.96s-.243 5.353-3.657 8.143c-3.414 2.79-8.708 1.96-8.708 1.96s.245-5.353 3.657-8.143z"/><path d="M34.366 41.03c-3.438 3.547-7.676 10.245-5.829 20.734"/></g></svg>
\ No newline at end of file
diff --git a/roles/forgejo/files/custom/public/assets/img/logo.png b/roles/forgejo/files/custom/public/assets/img/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..a3eea42678f682bad6a51527b33fd1ddabe65663
GIT binary patch
literal 18427
zcmcdy<zLiKv|eKA?nVTpyE_z7M7q0??(SAv>5!Cek?!u2?(SNomfZX0ckkbDedB(1
zXXeD5Iq{ssHzfsGOf)hy5D0|%@xwb65C|Ul2oFL*0{*-5oVf>qWV=7UlT!19J6Wb5
zjW-6pS6-pn1b=(y-EDOhljX?R_~{qTcch>4{cLZ0#5Oq;2mJ4R_iY<)9T|WV{@?y7
z)g)ONHvgzBytMk1o{WS9O8v=RcwX|D%V4ESh5|B@YR(uAxc^>Xl!X8y`ZZ7zo!3)R
z1Pb&z)L=F}ustFL8Cf)c9~Kl&@rDPbrdJlJNHM5jgFq>&CDo^>po8kw61A0yKYVZ?
z%0EngiUr~Azc7KX<JAw}GV|RqRVaWYky+&xRjqRNt-RntI=to>E$f~w*%l0-9Qq<v
zt6Uo^6KfJswb0Xtf&#2xNN}J})5mH$C$c&jWFXL^$vJDz3G?qZ*!`NjhsSwr#0IL9
z2k{CGevdR{BmPxL3qA@S9R~i&8;mX*cqh#j%A1FIJfcIIkL#r_;}tFsFx}%@KShzE
zqpM^6qSBi+We6!FQ6nXhWC~3vj`ZL=#zG?Ee!)5vPgJDbPdL&jG{1=avHN<T+kWgG
zUt|9D>Ufu*-9yxU_7;UE6mdhE@lAbcTmr`&@1R5WpC5{vb7ioVZ{SW2M~(wd;5-x|
zxX5op+Ec%eev%PB!d#z_>r_;B2Aw*&Nw84?f?GIukWY-wNboR*2~m~8;Aa?gZAAS?
zB8j63E+;u2K)#oTD$Hc7sc5&<sN)lLW1UuB9>qt@73%+fi*HwwKbfNc=)YJA|8yqi
zCs(gp5S*X;=7ln9H@%YUXGQek=3ARvlE+*fy5hcI{HQ=HC4Au6&`gxRcXf4f8*8==
ztYrz0D_<CNkcqo+UX<{Gc?C{p{(^Q|O$mDujGZFnL~X>5f%~#c4?|{t<>bp^O`ZYR
zm5qTi!KxVqML0vqco9aLds9Hkwe7aw<aDFz(c*2$j5;|nsy8A3e+2bVWah<J6V!18
zZmz*eco^@~*x~QH#Uz1K<6WVI1eDv`d1kxIBI*x3&P%A;h3J8|#-JA|%>*(LWabYO
zYAMm5hdJi?KPU$|m26DKzg$ksD>#1($BXlc_Yw-iw>Nmx;7(mmx|bv89N|T=V#C^u
zXyt>x_u~S58M_CeEmSVF=>9%@ox>8%yJbvx0x#QTy73(Xdb0is@E_h~uH?Qw??~#4
zXMlzsL}>(nMH`iKpruO6B4KCeY6l1DDpSWpAz=e$1^d&H&2{5KYz2wi=cCCmMK-K*
z*$`hegxc4+zQGI?6h*%YEt#|smY%wfwTV*8ai4uV@GD~u{3VnhAN@8=b>j(w0L3Rj
zFbp38L>Z(K#Ee9L#!Bh5+2l;cvfI*N6xK-WACA){(>DZ_`!{H8nZ*2scL?XlMQ-Ur
z-#muMGO`O&pCJKCkO4kZLCJm54M4ZS%A9(1UFSImo|j2s%#uD^JEp+4j?fFvOtnrc
zh!7NkAdUhHm8O@Zuv6&#jVHnhX2|5H_ZcgXFn^bPOLWkzHs_l+!wyVAl$$b+T#1}_
z6f0mrH3p$3LCYIS)nZq{5jh8frls%KI&zWY<ZgS+J52-;*h5T$BsxhxpwR3%EFkuA
z6Za(OxAMg2v^>Rew;k!NU4lD(I5g8-(I3Hk(gI(Dwl~os9*oJ_aDd(L(jYx!^{I4(
z2y}ZN(9r^?S1U$Jy%MO^)XZ-Nspcf?bk}YYF%m5k0@h$94M#u?MfOFy30B}lj*PuL
zW5Qg9-{@M7{JaOzK0u6tuy3o0xnQ120OnzZ-e=j4<s*$>FO52zxD)8xFtqV6JNIZ^
zK@t6Ed^wI2_ecfHA*e&@;yXSKU^8#7Lbp_jyX`sEtN||k&C-o=1a4E`^0eCH>!AVb
zq%U&!r2vJ0CPDAp7f1SJ>>`8~85_5vj&}p@EK^iZ9i3ILZldeahFCI+-v|TR_=P$k
z^$pY!QY65$d#u2io1Tgj@4(L+>IVloj@9^)O<p0QIAY{Nf+`^W4Rjs`C_0^!R1WbD
z_XNvhfSECOslw%l7pNg$LK16*aMlqn5yhFEE)?f)sA^7V={@}Ew3xPBl&S3)Nh4f;
zPode{sf$cimvU{;ibsMnza$6LLq1eOx@M?6I>&WULRn{aAdLbSc*s`WX@!P8hUHfA
z^TcYybt!~{H2Kp7^~`gHCeksGDhiOyfF%`Etp!~5>9%kJe-}en#}8EM2t0fAe|hF#
zU<6G&nWA3)22Hlw8n^qY6XNu;xBKFlFL!DDCQ<2hnbs=~PHwlH+QTzkO*7O@3L++o
z#Y_+(g*tn1z<6i<bLg()vfhrcN`%2fI&3S)G3$EYOlBn2*eZ{VrNXzxqG4Ms;C<y;
z$EE0h!hXsLJ&O0wRqs&^SgC4!W!OxW`b+LGoOVGJ1Ah~&Bwbg-t`O71j7?tVhrK~r
zEXYD3^i)B<wL6;NY&KP!)Hu2DcwyjfkagB^$Nb-cEV-da#WW>LK{f-C-c8p>(r%Sy
z%FAnmG7xRXT;ayU-~o8cu~7l5coznOD%;|igsAc1hf5a2fim{LROjTtd;Nf48HiU(
zi&P+t*Q=)bGp%S}&Rn~ER$xd`m}{gN+!-7(Ql3>CeU&3G{6^L9P=wpy<dqW~;OsWV
z;YnuZ7df^J>l=OyoU<iS>Hiq@0P8{SwZU_2Abz%zT5d?$_78GP;^Fz@pKUx&LqekP
zC?cUa2Jr9Da%_T5d*(}bAx?)!TR-`vFb$WF7R!0~=dy%Uq8coz+1C4-+MD)2@6$^H
z5x|G+)%dwSwmmgR>37upzZid4GcQkxOUv~@uk6@QT&96w=5_eZd453H)S7=91b79h
zLTOa>UpZbxJ4CP|9sO=}n|R%8g_sz0P{@|xUcFWHt*hluFD=h!?iat!D1W)73^#dc
zbi4CZprTBcH4>bWGN;`H5<Cc`o7jKN#Pw=FE16cp_NJcgUn8zn^Mo&tEj;khy3+kF
zdhj4>JXAaJK7KcCsxrbE6k8YLUzwL`ot!-P@(d@;R`=T}_=5mV6Eo(P+8+ftK)_#^
z$9KfogjzRybXbT%2;M%mpbwugONV2PDUa7E@m;fF7z>EN`>c5MX0MdHe68D=0Qx$L
z2&`@NI=^4IJx(k>;tTaF54&3;rcw<2{3;aZ2b|1+=ANe3G%0r5Jzu|(pa#0AQT98{
z0Wm-4`o}+YTqoPTJgJHCR2Z-qSGx|FuuubmE<TF7KzAnVt;&|tufbukWXs$|Wwhq3
zkz|vFO@Gr(n@+-oYhVBZAS$7f^z~nt%W|~vk@a$?ip!19nyJWd1zb(15;6(mi}sh)
zp$D@?%<}z-nEz4W09+Mqe~~URjym~P>?s}vcI31|brms4?zDL-YkoLSwn0z5Sfr5J
zn7|ed2)e7|jt^%^M!T99H@nv=hTFD5neAdfD##ho=!AsdCoSFWxg=?{tMZ!urJQ#L
zJdzo4W?>qcg?Y77rB8>3T%-vFdaQYWSX`#ZbEe8bKQS>m{lpj#<GzgpX5he!Q`F}~
ziHtp#D6ZrG!m6#swwNX*3;(Os2Qn1teYx-4E)-jH<o>j>{Ap(5j|OX}>wpI;@Wg(j
zm*yNm4_4igV*y9vQr-qJO*V(eIN6rReZ{+2b5EIvmOli=dU1H}QaH~bdNsuiGY^Q8
zf;j)kcS)gZ&lYz0J&O!W&?}qn*1Y@?lTCB(eubAfY43?FSDZ&0bBzvC!*JaZmwe#A
zn2WaBUFM5rwWew+>%G7AxF<N}@9gNNdl6SauWFfeyj3OhVXL@XPzwqE#ueOp_78sh
z;>9CAu^yj#=eRd*-)>R?*5HgnKxz1(8O8zs5oR#dFLk*zg7$jvk$M)tBEYir!PGa?
z9d(2JzojaeGO~a6ulwMQ4v%N?C@XN~Sw;Rq?N#%g&O^jk$BxOMuVybe8<Bx$@~%s9
zY@+|veM>p5e*lz`JQF5T+XX!i*z91@>3%2;8VdyEN@y1PM^2o9EK?;1E-FZ$MG`#T
zp)lNs-5wpqRRx%vr@1>sP_n|U_yQsJ9i#9XXG^Dm6!>#=H2jzM-b(Fy%Q*G>625xP
zQ<o3B<Ne508fnp&1`F~4`9!HHCs^B<L!ysYxPgI5GLh%qD8yCz(bc@|Xs+mKMGRZ+
z-<XfExk>$y2pKZq#6vq(R!sxrh-aa18b_N77QVnKso~%!!wVB<8rMI?)i<|$N-)>`
zd8ODgIpx5K4@70uAniTN?VAT6ru|lwt*!6+qI`TeE@Keuf89Z)|9E)~t3r-p7iJFy
z?pyj73jyV)DAS#NyO?%VZYUYQ4roTL-&=Ssqmq%=dySZi<#w!vl#g!KtlUx>cyly(
zff+zP0~_mmM&aJGvq;Kvn|d(!VJWGIob?}9pv3dNR8ZPm_+`*TU5y7YGqs_@C|qwt
z8F%UiV+E~wxBo5HH5zb7<xk?~H!RlL_$EuX``m#B2>RtONM^ohKl#p@*a#|_e`-On
z=M>Odyj=C<tG-*)E|k7_ul$p)mt0*)lngkSYvXf|b5r{T;DFV`By2e5+n$1z#as0x
zMkM&i##56`x#!M}UjmFtCmmyRUPMb35!|+Hq4u)Ye*DyZSb%eF{_b)NX1gcy@mf{V
zuXp)Xum|9U;k;GZOi^-uhpPFj;*Nn9#D@`0296;~JX%Wj)GL2>`6)p=FK}+OV^o_@
z;t2wd-vXsbO%cl2_|~C2&UBH!{~QcB>!k}z;Rk{zHm7U8HdC24j=kqQuic|Gue&%L
zY1UlO^B26pxmL~N3~-?LTq?;^)hT}L;7ZBlq|Re25H^V25MX;O=)1${mojXTYCPH6
zJeM-N*Ak94HN|-XENi98#MjRZ*Bla>9gqo$*zv2rR#;$UWW~|8Jm835gg|a0jr<q~
zN_4xHdd2PVC%+k^v<2}?T)A6vMg2Yb@z#t}unuc+U(i%+sG%H>q6p0hFO<V#UqTwi
zDa#s4PM~ioKXx+)Z!{!b8x7K>SYYTQz7z{kC{d<FDi%cqwC@z;lQT45ELGWhi*=g4
z^#Ja4xjf-`XaR!3&^ShVtea4DIAC6SIUs)o8O_;Vi&>H9g&)u7JW1_X&lTh+RsF@n
zOzvwOQ{OIbLS7b{3G>=#h5X?+WQA{bQ}}lZzX9aw<>$SE?w;xRrhYG`<dmk>2p{>4
za;blW*ye;o{t}3D?HJFc#yIw~x|EMV{d3r>6%eXEi2%Gaj6f6Xd4z<WGB?aQq+%d`
z%f0uWOhFGc#U6>LZs1)C*j`_WdIhKo`)e>MP<0lTvU}?$FS=1c?vA`etX*#!H6IXX
zRpv{Z)cLStMMQf_xa`CGIFZPJP)i3Q-%t|7G(gzz>4Wev+J9wtV+=Hv&C$8CEl^9e
zzFKaWnMn*3_0+8)ba@yHM<V6#oDG{5a0L4jtzlSp)>Pw1he=8S=TKt>5%&;p%qvCn
z4q|!U4MkQX73)?q^By1=RWWxwmnXP5mgBA=Ni^Q#j(b5#*@Nf1LyR$Pxqvv#djii9
z5|z8~3$2|vD=q48!y0n&r|}^k)_0~I5iy?yiu=E4>>#hA*kvYsh7bu7ya7_>Z;V@;
zjL=t)@R6rChgm1u={Y*K@<QW}(&>ipoM<PSdHmbjrD7#Sr#aBes5f~a?^3~jz{7mk
z#SYPc(i3!~B@nXRt{nJNJ<M#6g><Y_Op5ef{|pq!Dp4!>>i;u8dlTOgF&el|6EPu(
zd?S$@-9nkoZySNdDcbevnqPECzjArs3(xk+HQYGKEf$Gu=p+q%u#oGVwv?)+)jUJ=
z{hep9dn@}_Kayj^tr`nY`m393phq`#?z{AFsBp8`>r?4)U%HNucm@XEf86JHa^CAI
z`8U%i^!qUj{_ehHYqi;3Ay?GJD^|}_E&b|{fMW>t3~6fmjk!qrn#WT){LnDU`=jw8
zY6$59HIk7Q5KjFe>WpksW@yE)Ok4e)h9A+c!;XgS9>y!Scfw0ZfA4O-CY*^`;i~#@
z_VYXa)9tsEgB%eT@A+$)eh)^fww8BGy!{QoOcMzqB!xtH(yedMutFWAt-j5v4-B>X
z$kjCz1Fn_AFAD@8(9yQNJ6q<WzTw_i;6X5m8j?UyGq)J_NyS7G@E5{6UXQlwZKL86
zhO>@J5=8~gR9S;Q@S!*y2gvI|f49Pr&oUURIEpb!S{*vFhGNBgr0lkLD#$O@;%|E6
z&Y9ykf8tY6zAd{KRR2|^?E>AjnJxW6O@tNDR4Xaag>TFYI4apg6vIGin8&hy(y9LQ
zUKR(MfuB>mDa_v6S<+sDZ~9eg#$9jNqDtoWiq`|+RaQ<{#3ZWpys7>~jDK|%qQHs)
z6lNlb{ETHj|2H+2(d|L6-tY1D8iAjqBH@pkCA>w%k=7lg-nZwK{aImC826Q=r8@$A
z5KOhi2UcsE*GzLZ&(!Px<Vv%G9F9Q~+S_>u5n<&0vvf=RGl^l{e#PsP&kBm{{rCt?
z+mD^vfiVuK(5~iXlzG3W<<ar^G?$eAk!tBP+~4}7u0HX5kygIMJZYf%qVz`$JJQu7
zp=~f!{S}<H)b74xsX(5V2hR>)<!2zq^)?vpl8egCF}&IAaHS<DyUWyw;87QNeWYt3
zSRkJLth?9#6W;D5*P-*7m5}qkn@p*8T<f)O0qcW99rJkp@bz#J%dz>a2;Xlr<GNO;
zXVZ$0X-#P*LyVg{B5qQah9S8n)uU`dv7}Ai{O6&sss2b^Mv2yztoU)miMmzni9k#n
z0#bmIb&<vPR)eRt5}20TceRd$-;i}e?)_wwCg_Q%&`mXlx};nrnu#shG<r4086r)n
zYnV+pC8MG!w<_3M``){bR()%R`UHSpF#n#NIO^TL3*iWG5Ie8tT_1OGR*`&<A*Wu4
zsuu6@OL8h4+h+HBi=5gNZC#GKhfKFnf7NEq3Z@c{G~OoP`;<qFe;vrTpOgtN%m56m
zQeegFX3F_`U=@O0eS5Y}!jLVI8(bDZvAimga<gTUuNLw;&By2Cv=4bD6!4DM4kaps
zn<q+84Avkv0_nka$AbA&cXirSWP3J#sHx3fA-!8EQU`}SSk2FWXZ3*@%F-aNLRZ%}
zr7>{|_dqwyrb%eRvi|sK-OTvD+jQ5O>s1NWtx2F^SC0{TFb*ELs4F|y)7bBGrk<N}
zyH}Jxvih#?Yzhf{P@R-q(x!~$bwRP*7k{Qn<5}X{A^h4IKiq2(qa<r7-}TRZe=BPD
z>#)uOQR8v&Hh*<_DXnPix|LNu0mxZe_I}Gro+XR<;~;NYEV8%jSIwZAc`5<M#mJ@;
zZ=)ZguCm`As~2-3LLy3ASY)Yx(4byqouaW?G)PIm&X{woBL+LgX2#P{b8y?`9=9E_
z2j5G}f5ZxHC{}V!Yz-*$%B3bp1Dh9tyXU%a8!ps2)z9Zr&Lr1SlHd})pM8wzao9ll
zfbxygyT>7?(cIQH@jis5Y@M%h((+sBR5bHmLJEGCi!H&!6h`wXn$q$kkK%-S*L3?j
zTS!z$W5bqA*|x;SAs`lwYw&tY)2xKCTDsIm!~8ivUnwiNq~xk{J5yL7;CAovt2W5i
zzgX$7*n%>UmZ_i1weeh^z5WZJb%WXr`$ir;*LR{+_Y~3}2p(}F$xHWG9XdAh*)&3y
zmyR%+R3i}Q5wx=vkSt-z!cJd)mo?m}+gP;Hww5Jt_V>9R#Rf8K?98?LV@Ku0(S%-w
zZ~Za<kn3}GhIc(s-1qGdo0^vkN6spr7|#|FsOpJl;zGY@6G2t|TI^aur~JHCYu6(G
z7kVzRb=3Vnc%5|GIsL}o;rnYBNy2!iKUa2gCX)3NJYTL%Yp&_{+=yo?pxf9Jk0W5!
zQf^zdiEk(J1Lw%CsD2nUJI0I(#lp31x6ae2{`Y{xJHiU3U9Lg6`TTWoqbie^RmR6a
z4Rv+Ia__WsmOD&0d3LB8u0(+yRR5OxElS$<yX*E^#i7NwSbXZAjo(mb(9_G@8#bp<
zB~aC%2S!Yc&1Dg@{!YK6DrSC@cqm`r`R2eBg=SxpOL;XAMwgh#e1`I6g0FO6<^&$Z
z2lprL6IFXHcujz-u{tuJiGc_-@j}H46Xv*8=yqv+tBS}{A*9izJUb~{9j%34d(|$l
zoRFJ#srZt$%;0vuJ8(gviF?cCh9Z3X)M}?V0J;ia1nXStCQ?QpY*dLB+hxwJ$cxaF
zk-8{yh%eXJM#XTVzFZ;P3S8d|P@<mGtfz1NPIq5k|6mBp>CT;7dA09{eW~Ek{(G_{
zI&s|?8!$bb`|kCe)JTbbJ;alK7lpB@^!YWPKG{e3jb0k>Yy5tUPs?MO(=R?N(B&sF
zknev8<wA(Wr*dH=hHJrFp4D*?Zgr9F<p34NO@C57UT5(lzWnU)P?X;lAdVpkti}cJ
zOFK!=ir)^fwc<~z{erh1+b<5mqxFY#>_=<^OJ<+xfgXR(>l<vCK@8!hU(wJ>e+)dA
zcIpoDQ%R+q?B!7$o_ZKwW%w5ddV@XxNs*k3v2I9o8c1whnh70Q01+IAH;5P&7Op$#
z{!H*y;CE&${9JzbOy5a+f2a>H3Y1*wx@h0OO`D|*Ef^Y6FG#-%{S$5|>C}A`sdaaN
zIcKS9;FD%RW@P8&3W!lXlFKK6;`z85Y*^)>bl9kX1e4g<tPYbxIYbKx-3rwvl>#7{
ze?&0Z`!({YYce(&*&)j~S$CS8^t>+>O;Q#zQLr`@wm^}3msZMars^<h6jIE9h^<hk
z8fEA0lWwA?h<gBDU%I?K8@t0Lf2?U#j-sgWYI+FIBYG0K{+B?g5>I^U3h6+rcSNCK
zkaSXU9q4g4A8Dn49u9k-dbRBCjDFPzwK~dF-n6z}$eTymUHi<++?8TBOn1SgNCH7P
z(hIzUA9ZI3hW^g$S`as^*tS*isSQUhfIFKa3aw!5b-kYoNouuKv-L%&`+)-PE+I`R
zlUJNwu7IVkF;7bWMsX&+YAZ9xmrsJ57^Khp0NUAq-_W?xv9Za`#2)QL3*`vB080Jm
zh|65T3OPc(Cwsdns{vv6)aUuL+S=Du^pJl(XmrKe)fPJ&$*Kq&BXyY0C&r`}d`}*y
z)0{vOH^?r8A30q}hrAPs{*U&zcMfy-Rj*&cQCtJTo@@r6-Vw3a0En2Pq~q1_2khYz
z*kE!W?AyuquNOG(AD(9WeNr5s02E((5ETHa6_&M#879Uq1DZF|Z>@I$n2tNgBa*Hc
zIa8OB9?5KbrTZ)Dv!UoB-P1&8+Y-Z|1P4<*CClr5g}~D6sVd9gWZAlF;E?J?pvD)3
zq7w+H>9&kKA7@uJXV>$Wy0WH;3+d`Rs+l^D)nb2)Nd<T6PxDY_XD=);lJdV&_v3qT
zm;K0QqL7hT(Z98K{#Tt7?In}B3OAH?>M`P!<0Je*kAA9$Vryu?al4{LXBtsdQt{<_
zG%GcUES?Sfp@VTU1;9T`Mf+!)hKC}PnFh><L^w3=UPBxn8Wj|>e^kWwu4JaHZ<b7=
z0Jw0dO>Ses(U-#DlYpMg^QWG@_g>c}XhII&l_xEl!8$o4(IfJ_;}=ix8%N(rv&OZL
z!#&gZcnn`qOLj<=Z_9gyv{bf_-zt&(cRd_QUQ)oppemnhS-qc^c{#BR%lD<u+14A=
zKo2G)Aag7R>p8pC-!97`1lEj<R+E66b*F|d;8yAXz$ar(%utR#jO@UYoP|tpRd+h;
z$a8`MAe72mn|4aAO0zghw}|!+mbtbDN2A0)?}d(5wCYYyXZaR=$>+?MH3x<n;_l8F
zC1<%wT05jxy(5SbR)rac%=dSPmO0d#3=+10GVR~ND!ub)F6ohH_ec$UXxJnl0Ir|_
zEt0Bt27jzW^WYoqw@d3)mEXACT6vv!sL%sYe;yicNmytiQAV~*M9(%d!-GAX<004K
z+<1|-PJ!?dP^@caW$C`rmEhLZv)9)6udU}lF_Y4M6tQ`o`W&d)O>!U%<d9gEp?K`G
z^AFEH48s64T58ye_OBE^TMEqQ({@J(yF&52|3UF>*7hEseOe{tZ?0WyG*x=34tANy
zE9bESu=6xwm`KTyRwfslY^<>0+tXJc4HR4(v!84Pfx`7`(XTF_TqO^6^{c(iBy&Fq
z?A*=kNAk{84VoXqTxT^<3HEGaG0uqLZ{_V=p#QGGdiElv`X%=_dxMk}Xl>SnQ3ztA
zxhdAw`43p7-Pk=CruP7upD%TN5KwASnr^&dbhX^x&Zn^Yhu1kF=q6w4`y5Ky1slen
zrf2Wp<q5c_6iu-6MWv}vK;#IQkg__|NE#U4<+<ERAiQSg8?DLqF*+8!JE#n<20vd9
zUQ*8qbxp;7_t4V~wT*itkuV<CHz@#=oP54$a-UQQ{YV!WWS*~$78Shqv#TmohJS0x
zo`Xk8vX87PKuOzGzww;^W-k9zR75YG8JE~UjIm@^w}|jcpbuyvaSv$^!;x<8PRV)K
zTndS@Ci-)~x}?7s({ZO)u#IV?)*yyxPJ!M?4&Bd6V577#q0DZGIA^_EZc=G^Q~Jl@
zv$^djw8xRn+}0ggly7v+o%=v(SnANZDnKxFn~^b}c2*koPv0x{ck7o~A4Bo>md>e)
z=Q79f_2%xM_h>LdVVAhef=F>T&qn$Cn-BaQvc^@^U8vtFpr|xEAgJIYVWi<_d6eQ{
zPDT!LZ(?D>$v4q*E_L>j^X^X0&$w3qhSi%6hNyKW4PD=6jS92t-=E{3TPsr&*e_k?
zm3*Ua)uE4w{g{$E*yIUCqCiKemI1&5Fa)C!Dbny=ft32qY@_z~Bh&RFpWl{zh)Wv%
zgJ0Rdal5^X%=G(Es^@OoT>L6v&De_DPAxL}FqzTXM}m)OLwmn{LgR2^^B&vU9O%Sa
z)9el8z`(6Y_2FzpKuI6mwt)a)VdQTH;EJa6LKDJ9N*jtx0CZ3vUx<Jk^~J3_d(x5J
zQ=0uJaZSDW!#032ID7LFg7aU;`!Vdx0;U00%93+CY^BwCzIh;5-!4kdkA)@nJAgPg
za>wx$lHDwOtg%7(1>p-jEdT)U7X}r$DvYCtqjhvW+e5L$K=SVw8XJEKqmCFir+dR^
znm@i-o@#|sg<<s)oei6(j%X*K{1>1lf-wwXlL<n@s8H%Wp<cFd&TnOVO%6q1?}?$b
zcjlUWmj6b{awL|asIF-QWay}fdgRk0KuZ^C?(#;QCe%|_To1XAY1ZrUH%x;Zk%~us
zD(9uq!%3oD;1&mf7DiI$doS7jd2A&`%_EA)TYy<Ayud0T_yc{eCdlZ@&(fQ)>69$S
zl<vnb>&VYQ4{{~I#c5$*wQc?-=UK5G*mo5feSyJ6O^^r})Pio3?g-DouR@kj-`*EM
zy#e1M<fSoIA}1nxACFNqa7Qq44>&<`;V#3R)Fr?v*g_{aRMJPD|I{fvyF9kwD;eTP
z<jLNQ9X|>c{K!5&Xw5>=2TuQhr-#+2He0?A%rML$1<)U1L7z!BN|1-kGj)^r1s9qq
zlh2J2Tu}i58YH>gt|rwkgT>Em{JqBDecV3RyZg_s2CBZX5aFBiFlGhZ`W7d0w?s~=
zp!J8+$JVjujSir&#QhGJlYZ+9)v23x@#_P}@>vSMbZnjCLB8aX-+tbH;{70dIrFs?
zH89E}d7{Bo1kSKW6oBY^X<~y-Oy1gM9&wyUZN$A7c)xmfBW<+_G|!wQRn6UIiJto`
z_lK16uN)=@24sfn<Bn$*%Ehrdr{aNehUNdj#}8r4IS1(}_-rrL&FOhfv6TaXZHLzM
ztD}8e9Tf%+aRYXNarVRnh0z~9{e>f6rAq!@=FlnMqN`!UUsGeBX1@k{*(o0f%!YyR
zjWg>LFy>Pyvbqs)Tfm&(`4wJvZlYz0QrOXOdr!Wjr|reI-m(jbg}j%%{0xD)n}(Q~
z9|W{vQ>Pv+)v71<TT5t48T?`Puzh-@Wt;i(oCJ|5#{?dx#ZEVM&VleXlyx03VE3~o
z0U0<u;*8PhbWtHI)%?oVL*H;G$^!yKB?SubRY*F}!fxvQ^FYyF>{kc+GEL&3;ypim
z(SE~GI~qENdC~5LEvvv;NdiTi0XhgDm>=;XV~_AwAF9;un4uC6Uz(IBNd;byT}L@D
z3=4R_zY>D<wJ5Qrk9;zbCx%1re3|ud_WrbVuZeYFr;&CBRPTBL{QxY?3#=7@j6HZl
z6}IyO?>Jw^8hX3flw3zgQOItxZr64l=18t973EPpRhFP>vcu8Ad1Tv>4c5Mw2J!U9
z+-nj><o|UZD9~i)$t{SXXU75mYP9<avD!Qp5|#KXxdLnM_u7iD28=j|%~~6}Ump36
zc|ufxMS*`CvDd>9e73TZAB6w>{)}4q&FX>ntd@kK{<;b~qCY17|8`&OR4!p><dMF&
z*8#g>7Ig>sTL?#g(=8_+7TOB>t(<EoCT?dhqBq$)jUBOH)JOuTW{%(c0DuO{GOhu1
z|9zM1LZI426d^r*`l(hT;Q)!N+0`0XPqa5rD+T~To`k<z!H^lSVZUBq?7%mizFk#2
zxpRr5ur&~%ZsBWhM#mvEcO|Vx11x+IES7ta`jb@6u(18%em%gUcIncoCSdOQR*h9S
znivG2<nBiTMlF8L3>ne46dzD7fRPP7D7PMhW~Yp!cq>sB(m)S_G1g3o9<t1U6$6yx
z9JVs;920Vo)4n-WrkMh*hI0BpGn}zpk3C5L1SizAqodM@Z_~wiUx{p>L&!W?SEvi6
zf7|43ATbL20}rq&80K<0jLDHK<@vz3x%~coon;YvhrPfsC2%g!#{(pS{6a{KfZH*g
z%M<Y6Yo&fha1Wh|2TkHe#y+^pL)0OLckY<6tfLRt$RV4jwE-jQVg05`dFC|^Yn1Nk
z^8Lc3c+$R-)Qs#8Y>&j5NV+}Aqjx|H16gbx5vR^ARtFsW_?+Y6r#0~VI=}hNEc*4y
z?~VX>xaw&$?m1!_nqFkq;H?_nO?^j3`9QXB9<Ck14IH<!%A`qo3k|ZrO*=SJex?xL
zaGe54C#`AM_pc5_aF}&V=#7TPXn#ngKcFUZK8X2ZP$BUc(IsF7MD0`!7<%wl<XE1`
zI)ru<KHu?-a&X_DvUf(8EWR;4#byh~;l_xRc}AfQMxeb~>olU)NaQKLcCZH!AHr?#
zhcM=W{;R7MZo}3Q09xiH-8Y{!0ji_7H8XY)xdjy3FqYhdgNSiw%b%I~T>JsQ#7f)I
zhd#o|_WwG2zmeKY+#&?Dlovr!Iej?NmEk5$0iF9BAd*1;J$=Sp9aT~rzv@(Rq2;98
zjtyg<_T(0ikIuGwu-0DcS&BH4>~S9uE*gzX4s>wW@wI%gKkdicM;I`5QvNKL>D_u*
z53BTn1vCt0aqRLaI@?Fk^3XDhXe<PjTvi@O$@eef>!8u>$S{guxd={M8j>Ju=_0J>
z7>xo09r`{KPu_2I`PP~mQUrzDr{1bo0HZ`+RdZ(1MN*$=LRo{hOeKPfdOW{~B;*`4
z0*#bo_#Vr$qXON1I?eTSb>c<0i;JJcWfaug0OnPGj<2L#y4rUk^@S-k{#5C8Cnn^}
z$T`XiD!m$u+^GmmR>uHEXzSh|Vx6SE{p@Vl!!Ep==C!ckTE+pU5|#5wu>}7CuscPi
z*MkDavR`PaB~fQ_Lr#|7_*2;V0Xc4E$H>*6SIsC(#27BM`TC^io#IUY#*jo>L=C)*
z+s_*PEgf(~Xz0+M;pn>`F%8hCbJ!5wh;@Npgw1C+3BBNHDEu5grl+q4<-`im6*QX_
zxhe2ze>4jlYP<<cmO}Y9UuorU(!{uoF`n`x_V5QVVnIcc>A^yQY?lLgPMA06qm?7j
zr03!YvuTIabUz8xHw)X>wfvi;q_3y+OTCg7B+x;kp`(n94dJkle|vUPov>|h&Cpgf
z|Dk0QtTMx|Zh{|D&x%O(+ejcsf`C$hy%OCfl3IAvilCG0Hcj@VJUL<%QL#VZaWn1T
z>3g48#8Q?&9PkDxY#}&5fR}Gvt5cHGp^M$#)^;UPq_7mnnAm!6hWcJM%mud^=?tN#
zj~AFAO2<Rlmyrn3ecpThG&&6KjQ3~C8k17@Di^&Dq(rBo7$RZqv<tye!IByHuGyd=
zB~CZ6x}wnhxg>EIft&sf4QmTRM|Ya>FhL`gT=Chgc-N)G)lr$t-eD6S^?rZw7_1=9
z$88oRG#u!%0dq~?rD}>ia?Nq1kARV=z2<u6VjGdoxtqV+znGcUIo<}>WI1raL@@M`
zvw?XS{PzW3H^>I7jU5l+ubG%4Yqk!MV!i<LCOH||iwhW~ueb0l7D|x~B+5E-G$QP9
zq;=j-;qE^%$BS$&kS`5C%O=a&v$dDEwtQ$LNS3U6Y4vBhSjRH#KVI%9$_==W8~%&x
zjrBTR?u~FWQ2Bw7w{&H1cy=niv5uXTcJ=RT1d$YqRbU=%a6Q^utjN{h_a)~^v{O!S
zRlgCJ-f}D;(W||HQ?s2C=UFO;lXI_fnhx3omb9N6fzhYPJ7r>?B8n9HPed9%+-H5T
z5`M2W<}bLR@z$qgd-L_maLatN6Alu;mGJ)Rug5;)xrf-}g?23efQR;_BPstpI4WJO
z+ClCJ&IasyaerTT5sIRFp~04@c5er?1<l6U`bq^tY)oOkZf!#@?m+;nOgycK2hH0K
zRt!J;i9h;U|H%k=7Z7Zkt7|4bb@8N`$r9EA<W<ad7`lU5;A-{iI{O}`Ke=`GaMjNt
zIw||3tvwsx@wwkoW<NIeUGxQh6h1I|;a9qcS8_tl18XK$(pF`1>?mkEmt0M9%4zk%
zLZCy!w?bz;Ba4MEDa%1u0z93&WzU!!DS`^j9vS$yu9zwK-*|K75GiA?X`C$db^SFt
zrEGeeBZDKYQg@s@QLY)Z=rW+Uu5skO^Fi&^a0PGI=A_jUFn1QkmrEFYXRRMnT-7l&
zU_t8Y$n(#`(>_6M1Q=Db27-nEnuTTv1%b@ppD7NT{*Gb<RWgJUNh+o6*rn*%OT;M4
zyw>Z)X^3nuaC|@rUTK?R6&K3R9+qH(!tY`Ij|2ClH-QR&)i2|2?3a5>H;UN<OKJ^g
zRou^GQSm6(Og?3}b9wjyZtTh}1l`_!x4Q$IkQBnjxT$f9R>B^TGBK(u@R(7zJmV#C
z3d;~d2VU|HIxt}8=4`G7A22N!;zO;%%5?!Jz>dT(T||<n3szF!R<*oUT+w8HNgaVE
zh&hlJ*NNFLoBxS$SJkDVj<g~Q1*iX#6Gwv$(~*lfm5L)Wk2yg*)r5dqikC)0v28Ta
z1Q-G)A3xr*FD21fN{ze<Ef2#heW2FgGvX9bq#R{+@f9#yh1GgsJO0pnSRa_?sWqJ#
zFOS(|)?WWSS5Hc=XuDkRVn=&txEyUqUPc$SepwO$^L)rWIx9Uo-@o=YT(_O4TU1r|
z3uH&h7c)Y=zQ^+KcyL~cliri0$QEEF-sp+x45=1%<awQ}a%5QT3da9O;!A7FCxTut
z?||k*n`@Yl(oTu^DTgB;Rpjr4@nLBN(^V=mPFjp3{0PJ;X~WDmlzt%vw<b}=qx<iy
zXdM@cC#~f_+@~J#Fo-nNos(6HYC!(iv=Aq;FBtC|d0;}U?bThH+iDPf(|QQ~j3y4S
zvjN!Yld@#g8S~3)|BsHB-xr>Z22(6wVZ>yR!<OKHojyaS9;b^Ko&d;hY@D1yESk~|
ziz=LcRP%+dWzXN)rT`hvh4&iO%F6oZlQ;DNq@Nv6m9(PU;xa@7kYqg3lPj}UMRp%;
z0v}*Ib(m)rABx~v2i{hPLdjkys0?pESh??wtOcIcSW2cOPsZ9mX;7_!S|iA(h@ZV$
zx1JY0?)R>cHp=lceEnm6ylrXP*l7gd4P|>(<i;juzjrP!$u-*Os%v$8V+;NC&|_l8
zQz=!&xMGXsZuouKE-1pylQMONSe(!V>>qPlO>+PG#}5@@T*p18kXn%(A6wcLUdBWL
zxVT)z!+J6z1jX%luHzfYgUghP?Vn6FdmU?@SNARN9YVFyD?7=nNt$qRKQXCCvnlw%
zolJ|67@5)twl~(xG7hX|g}Ra>M-^8<IauG*aIa<?u`krHGYEi?Pqg<hFU1JciZPBM
zw5`Zdjrh2Ai7J(~vC9^G;1C;I$3SJ0BD6|bk6)@zh}jEg{agn`5kd?>24ccq*^c{;
zh?Ntlo<SOB%{nLFsAZuRMs%-JRgREf%;khc%hde-BBT`y?;lkBQdA4eu7}#`_0spU
zBj5VYr|xU9-`)t0v*1-<|GnG&gTSh=Mt<oLR9N8G!o+5jWcHg4?3?Yl)z6&}`qiEV
zawFcqB^1~@Mm<>~)yQPHN$p@4u0L&8Z;|QD6{@csAwUa<Zd|(ZIHb*q=d4RZi>N{t
z`E|OAHRUKc<E-}#$>`LMw%n@v_E+aQ?W*_Y8phcW?2}$>-9cJ!5<^hc+6oVg0LZX8
zx9FTa1rApX-j_LcfEa>p8*JW5o*Il&lt_l*!sYG|_bpK9&p{qP3o{es3A3H>P$QNH
z@|qQs`~u@S++ov%B3k<(Mo>MJ!H6B{hGiV87kF#<Z|RQ1k$6i54#`Lut2Ycv<{#s8
z@w)!k-Tcw%LD<)#M7d2jt!5<oFDOVeT4Xh&4`qSNV)O0|rf|tHflE$IQ!a`&rSM;F
zf}^u_#2zCDn4JRl$GZ>n{qS@ZNW7+Wg<wwP5d^K^?~D;D%<oshpER{UGw6EgiaLPi
z9D|MA=JD3qoPB7ht-CQ;2N2adi{!GCaP>1HgSWkSxS<^n(i!K|uxZ9n6}i5=S|j$o
ztXaI}1`s|>Hej8h?Nj_t__l)WQ|f%HKt2n_KSNTdnJ!GyCb-7E*Hvk-poH8+l^QGl
zQ5gvH&o18j<~koc!bhUv_}-h<Ah%r(V_v<Zy;{2JVn%b=^H|{I{F4Ab!QHsGLm)t{
zP;P!bI!&4Sm^@I(lJ`OUqC)!b5^ao~kKtwNS5Lmt*+%8vTy}KPv+D8o05(00g2YJu
zj=%zz1+9o}kIOr@&YvGt&?)O9p6drzf<5v$X&_na*nhT6sy^rO=b<O6FuPNtyKp(X
z#c8dB<i+NWTW{G8BI$TZGbmGJZbCm<cI&Ap5-)@VknZq7ksWZ~d@hFg-FHyPF%ga|
z8M7ZfBqAeNmCxR?-QJDCKJ>OJXDMzUZ>SI&gg22%G-v*NSh+=Ny!d@)Op&`n32a)<
zirudae11c*FmDNh5^w2|8-#fY!c|ftT{=Bm*%yJu{cerQ%Gj>j-~_3G^~aSVciC7Z
z5@n0TIgQ;muMVOF=P(s}L@Cdjxc+t+iI>6q-){R`b=+t3&HCsbq$pzo3UJ#tW)JRi
z*}Z;i>W9zy<;OfLBm}2n7-Fe~@+J&I*vp?f@x6;fV&!*_04ODUnJ@Zy?S&T1Hx_r*
zT)mY6VO-Rz8U`nIQ36^I58Ln}=xNY365ksu-x~5Cuy{&IB7z#+ihW$VR%9v|4{Tzr
zIwr8KAwSLl#hnHT<RCg7N^5<<dPl<NIU&<|IKbzBv;n(Ot(X&Tq>DDqWuW0=DwqM;
zdSrcXGt36G?mBwu%_a(V`a-Ssp*@nI+nQ@smbos$?=)FaoZs`7u+CWT_Vk0E9Md&&
zYSad*_ZVBx<+V*<l*#Won4cDkf4E8L>b$WyGYi@Yb;sj@MwcxGLBCtaj~TXrBo%89
zE%9-%mQUHdb)dwn;p=XeYMe)K(%`!~PoljLzbA?6kCRmaljm<+o`jYuzsWNd2yZf_
zMk$zw)vQr9P8928V;T#~Kqn5Vjc6K)uLsRsYAE+im0%`57hM+U_J~KvXg!TLBHyJ=
zROL!&jVh7O=5UtD1D$+sZ%ALczb9xRA_^Xu#9TaJPObV*J6!H%^pRx#nYo!}im5=2
z-rzRvE8oMPJ*_nmYjfkOWxODXvJECHB1f*oZ*{I`tf;T_gHeepN4BYD>GlQn_x;8-
zt*DF@?&8GHSno<KS`jY)kZ#AH-fw@_id_wA{m4{6R)f1&YVIxCfO00(+JBvX9=o8M
ziHy^qe#<wg9@Vyo0QJF1Qj%k`!}!w!Wj1Pfd*286y@f4%amC@VuhNFVb(`%p*BS{`
z<Gzje0C*J23co8y({l9JEw=|1Qt?b$PLc%bH6RiNPsn~b-a7C4ZA-mlC&yIR?PHqU
zkEiRt8^5pus*ax8_uhY%a@~2%sn{XIm8U{@7Gys3dGG;{MqrJ+7NfjcohzMSFav$w
zMvSb9IZVVj%OLvTN5h#XTC#Bmf`Eh^Q$e^f%cyL_4YRJFs;E6Y*?rQ$#n8ov)S}xO
zmb|4`t?(o943j7Yi7LkSqksKA)KxUo+zY@x4b1zT5TzvO)S&JiI=*Y0S^%LhE`Nzo
zkt=~|2vG&!p=DL3==0H)u)v*-Pib@ngm~QxZ~gVP4GJ?ux7aXM0c3H}DjMSA;{02N
z(0{r-aJ^*kwqAsC?~q1~R^gO<iwX`|3NYa!S9n&8u2`R11<K4n1%b=T>AUB>0uj|~
zZG=v?0k$KL2FQR6Do{9946qE-vN^ph$~sX6dEniC{k@)MfLU2K@QkAc8?pyJcP1@#
zC925HZYgVNrBaZTc)_t$QXaX8(SDDa>k@q;VCro{plHWxWO}mElw;x}sp{%h(O72k
zyrxRa2vn0AzSb#xJw3Z^PU-XzG*`$ayGumSNdqVbznYY&kgCVpcBtS~r~{6%#8sTo
zk&AnkjZ<;t`=7$if{E1Afaa{nB$eR~djF9c@jHwlWgDNRCEbYq6QsZ-w94!N2eaQ?
z3x%}y5;fMDfgL8a^;@`lQACUdiD)H!3ux%Ne&^g7&NG3TD<FuCtP{`A*DL6k5V}&p
z<;!_BFw}Q)=Q=5ceU|W7(r^H!BdIt0uWiSdV1;_6qXP^w|JgI9WmRpiS6}>NTFawc
z{VD1av-9KNJ3>#my-gdyPz$6T2n@o_Re%UZ-qdXQUXf%6@_K&4LzsJtl;*^3ostx=
z`b4tm0pm0c9d$EGmliWK-A$^uW%?5HLMSb7TJf(>?UR7ZuY`)Q>XIR=EgXn>FGkvg
zhdU!o`h5kcX`{4|8&N%{SGb)6<kV0ryWO?w35W_<J-w-0G#zx^3m(pb^>xegemD5m
z?$gNYasuAJKutq;qsAsD#Ymu|uq%n*MB5|7#k;oR^Y&;^e-L41$JrE0?RmGTUUcR!
zKoi&9=SEEgCuj3MW)(3y^V55oi~mZ<F@d<@@#KajqZJe3<w-wp^Zdf7bY|pOH6tT4
zQ?*f(;qmAj@&-kRj4|C{b%Dq8BygRWoIb4a;dS|0sFxtd_YW_^hh}%>F(xeym8Q#;
zSE~jcuY}d1<Qr#QGEm8Ky#|hCszc-G#IqpnJ|JJqrp*JksPHx7op<4x@cWVnR%DGl
zt9*5Rk;!2tl&v~-8Qi{#cF76%@{R3LR7N!+k!st9s^Wye>-7-eG{O;K2)GqJDoq9I
z3Lc$u#|V4*@;KcQJ}acJGXqircWfN%|F!o;@FWxJM@%AP?CzpzBdUIy?=Q6N8aeYE
zz-PfWU{AEYgZU4>FNA0;HZDCWiQqIl>%2IzdEzx+R?4IX+d$;yZ$VJp(W#D0zts+a
zQc^c3MTkfZTr&99C$njN+U0Ot1u#dIqYm|GeJ3>k#N7OE0;a5bBGWEg#&7@+OxH{W
zlhJ&QAc<~#D&+Il7@;f|(yVYHVZ_)MBBf}iH4^MS4G`j12&w?`u@m`yXAziFmRvas
z<3)rLldJym)No@Os=5dK)O_6+%PvWs9dY@${^f-(v&B!4i>ts3A;O+#1Q%DF|3230
z7{&7EkTI_uJ!jY-#5IE=bAa!?Jg`Qm*q|qBXnvfi$Bq=0y#g1ykI0If6}*}TtwAY{
z68<4o+t!)kVw`a5FXk`)mzGo36w;-}!P<8SC3_BwsiyEEUVjIqE`UQ*M;@Ir{Xmn=
z(qonxdcFzPdS}<o{KAyM{&V&>Ut1ik0sRHUsPAm4v7$h*o{=z$U5e+3=~MT_AaYU6
zCGkoJPBEa`$9ly7SjC~x(^DO){Y~^Uu#$#TmVx%0TlX21vcBiX`?44Lo^bYx2|t$N
z$!?NrQ9-%>aRP+;w6I+uC_hy2$GeWJMV*QN`!c~emR)kCtkY`&apbL`6jdQ`JJPB7
z7hLP#9oVu$c56nyM*yn7Cm!u0XM9JoOxh7Kq#*lx0#KoPgdHdH`n#3V?$6YX7TS@b
zp8#fjQ}g|Bi`@J0tFhy!25SLU^f6p!$eoID_TOEUbQJ&UwDw8V0V2gQtjYU0b-wR?
z#i`Zy?XhVB*0}?Z0)?52f<t{6as6Uml=zotuL`0^55Q~Nz9n|QzN1);w|wCReYETC
z*S9fHQq~l-D3v)c$uP{Uzl-lHj;&PVD8GDSw`*`~h(qc7YQCy3vFuH`l^6h6E&W=A
zP$Q|b17lXWxvrJ^_iIXB%dY9ilj(H3v9X?zAYs${3mYN-xsF#avhktreWA=-acu>U
zgsWLIl%4C^pSm<_L0mg-G$P>E-|A0r+aa{}0Ne<R=dQ!fqu8qD(UI2lHEya4Qan5{
zHvEG#VuJG$lR;;WfN22b4TLUl$v92CvFO+D!6gg6#g$r}U^v13y`R%S^icf{TzTR@
zsQ=^0SCfHG?t;AB1>jHLtjg?3h%j2ebGe_diO<i1y<RNoO=><ZPTkGuOhUltTNU)=
z-HN8ZZJ#F$vPPSb<GQxs|E|F{HGhIeZmjpAnv+nI0I3!##&BhB@VP-{-sVxr{l)Ck
zL5*PZuW~I$e#JcZ=qg0z^M?M{@gJ}sgEn~15}n)UT>e+tuSdH&aFXt~>9w?ud{VsR
z&qmtyvCsBh+Wzl%fzhthuhM*;f}?Jawmrv9#)>zX=?jb3=?(c*|M4qr8!RM9rhGtd
z%zm8Vd=+RU8S}HW5O4mto!ToIkcTKWpLEa-xwBhoxptJu@GsR!S2jYhZ{?HDjy9k=
zqCV(OBbF_Y3@B{qdaX`sVLijSzq)FAmif=RfRX?r?5xdn7JhdGq){5O8xQ`}F$gSr
zRRJtV|4GnHwYPDr3|(ozk1e^>U8aWnRCR#zhW!Y!^AB**yWZl@l!NNq)tGzvKC*6z
z?pK!r-f;%v5)rlWFNW_8zqc_%QK<tJ7)2hqes4w{5D*i>?CVd|^ZmsZk3uUrk;~$v
zVuSCBPxL5S`4xLNCQbsfS7BMwX#a`V&M8a#{nUGdGPMjyRqHn%>y04tp)}~t_bV9s
zsK7;dEqJEphYQ+6c{T&vQAr=2mcMS;g-=YFz6Nf4*LcJji=SpW=1OeKqcb#o2jkgj
zKsvh%1}2aOjGD@wZnP_Z&>aSLQJ*d7)i99YRTcoPMyNfkfL;nL6|W_FPUH?L{^i-*
z59>{q^>o&d>;QwZiJcBf<d@^E48w(>%)b|_j4J`71czAUVWiJ2T0&s|{i^?5HOnDW
zpAP4uZeU0;cKuA1tk2gQ8Hw&|55js$(?rkCIgtlwbf3`ntQ+1w(4QT4xLG7jY;=(R
z1bi>^=^yls_QCf(MwO{_DUDqLhr5&-2e(%NEH9+J9AqA$3nE4eDkAjuTZTDaa{1?Q
zAKt#~i(~nxrP)Ewt&h*&qjyEB{<8Oi{!~LL@gM190NjgQ2By6!@jnl1PvXp-zqP;}
z)VWjuWv`xK5peWA=t}YpORvkg$g^LixKjvhhZY%%^^Bbd0_^EuD}QRfj@j?DaYb0k
zPdv8;MWfl69^czX?DDm5z~++goU-(TW`<!+2VA^fJTQ?x_Y2C$^XciAfVO_>)<Bam
zYlJ`AH)D$Q22iHkkr4}{{2fpgguhtRb-JGz_o6>1F%bNPUJD3?z=n^*!!M3t)E_nj
z0KVnef`vTkOCO%&*4i}lvYtZ<qV-a$7GJ{0v*CylR+dbmbtjQlGnxqDLZnTC%gTAG
zm`@lNbR7(AK0>Gn6!IiXv*xgS<mtA^;$84)S?_#*^%B&tgEYD+M8o8-5mKX=WHCRC
z3c>ma!;D3rvQb`k(pH2EdBUd^uejX=yub-Q#}Fv>m5WS-Ixj&4aD0Txi%+1o!W`||
z9(;Fc%#NgZmid(w=GHdSP4d_fu%wL%usEZW8Zr?7t#W+64%W5PH;%v@Y=hdf3+;W;
z8z1fi+J?VYbL0rR9Z>jfKQ2j>Gr&3}#BEaE17}+^jdoq4w48AgKlRTJcyzBfRTz*z
z`3`#Xz6IXV{mfn$MQd#JGQyq-FqCO31XUDn4S?LdZVaz3f5~L7(>_NCEd*A#fRp(Z
zo?mJgEzHL*>#!Rk{oo1Ug~PmF1Rxc|_`=eC2B*~wJrmUkf#pRll{>}5%sQ~|SeUC{
z2&v>7$4264xGf-k(p)Yt)WUcy6PgGBsw%3M2fw_C$v{d4U=<mfi&{u^Isi)D4IZ37
zH!RaUJ-)g3`%SD@f3FTG;=YUGT1xBZ(ft!F(k9ObI*~b@QSs@MIYgUhlQJ3rLzt4>
z-8g06;%cl17L@(ZmPKc(u>VU4UX+&`dNBRWlyXC`B|)t>_=-13A9`g694>luOJJsB
zJ*Xyn+7Whtxy_H9nOitFgBmcEU(L=OtZ4}}yw|=o`^&Dli4|w>8?C+QwYt0M{FF>-
zLr}y_Dfd4t^QO;0imBM}Z;Rv2_`~(LIcA?-U|*7GzWQC1P)%P>rDU>z7bp&G4cObC
z|L{nP1{U{g-d_E`lld20G+%V))c=$BHM3uoUkD5&ufJl?9@Mm4tlUuY@l<W}vc4yC
z3oj|$PEF;1ZM^E-|D3w|@<no>7T41XHoH7`iCXb#dTBSUc|ROn+32nJdc(}+JlpQ_
zy-imR|GweiWb5eb*R-@(zZLnjadDEipDUvisJ7e1_3VLO%SC(HeujJ3Om-Ai7bssy
zj^Oowz4cnT&)lz)y#GoU9KY}?LAK7o_`a63_nIAxE(FQ_exH8v@{FDykR#`^6o1HX
zxwzWkXZ^kosT32SSeE{b=IIZjEq(q?Z#QI*1a&xOz5FO!Dp-@%_;e?)g|O<0C{Q45
zkeSDBz&dUDwufdVj@N>LLQ;u+Y6q7;t+e`3FTY!1IZ$KJ>qNe9P5#w~J{_sv!K>Th
z0@7G(z@C0+`Oyt6)zadNt-($9ugWu;^$#rn$60swKf6qWmx~cl?<=Vp&G!#&w?8cO
zsBTWDT?eS;eC476`}xD$J#X-JFZA8P-JWca1a9)PJX^uGPnN&C@%zW}n8ukJp!7a<
zdNpH@qr}?o8`};<f0WqQx7Z+#c^@#FEeY*f`_G$k@9Ja!ez5)Pyq+NWMQ`4L_a8;)
zv^|xWrEmQi<nsQ*GBGVaVLfsZjW=&Fvp+DH(=fRpk-_|dT1*c&vxTgCg1*kd5FSQp
z1(51j#|_x+U3@^Ha0OUh^eZg`iDt?7&-|!)1k`f$>TR~X(dXBZ2vjj;Rap$@2c@Jr
zKu0e9$Kri?y5M7=3eByj9)A5Val`_oeCZ_{$q!ke45`H!`Y3(F`45$#>S{_5=Sl(g
z`a|y;%9B|^dZs>@Wyl+RLHz$_TMGfu(KiB5@@-Fuf>;9z4uqd>NV)Ov!SNE1Gdx}W
KT-G@yGywp6gf^o9

literal 0
HcmV?d00001

diff --git a/roles/forgejo/files/custom/public/assets/img/logo.svg b/roles/forgejo/files/custom/public/assets/img/logo.svg
new file mode 100644
index 0000000..30ae832
--- /dev/null
+++ b/roles/forgejo/files/custom/public/assets/img/logo.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 72 72" width="32" height="32"><path fill="#FCEA2B" d="M43.278 20.52c.275-.645 1.445-3.289 1.915-3.859 2.592-3.144 7.54-3.344 7.54-3.344s.742 4.896-1.848 8.039c-.7.85-1.573 1.484-2.474 1.957l-1.864.85c.816-.435 3.59-1.634 4.574-1.757 4.043-.504 7.777 2.748 7.777 2.748s-2.823 4.068-6.864 4.574c-1.504.187-2.966-.145-4.208-.637l-1.513-.562c1.072.4 3.645 1.562 4.525 2.46 2.852 2.91 2.528 7.852 2.528 7.852s-4.947.219-7.798-2.689c-.63-.642-1.885-3.776-2.243-4.541l.767 2.397c.238.713.392 1.474.407 2.268.074 4.074-3.555 7.443-3.555 7.443s-3.747-3.238-3.822-7.31c-.015-.833 1.347-4.705 1.347-4.705l-1.14 2.622c-1.772 2.489-4.516 4.144-7.555 4.449-.925.093-1.544.066-1.544.066s-.323-4.942 2.529-7.852c.828-.846 1.834-1.427 2.844-1.826l1.71-.71c-.003 0-4.314 1.454-5.75 1.275-4.04-.506-6.865-4.574-6.865-4.574s3.734-3.252 7.778-2.748c.837.105 3.842 1.578 4.56 1.92l-2.21-1.211c-.77-.449-1.507-1.023-2.114-1.76-2.59-3.142-1.849-8.038-1.849-8.038s4.948.2 7.54 3.344c.502.608 1.854 3.216 2.136 3.907l-.91-1.94a7.721 7.721 0 0 1-.507-2.55c-.074-4.073 3.555-7.442 3.555-7.442s3.747 3.236 3.822 7.31a7.713 7.713 0 0 1-.411 2.559"/><circle cx="40.792" cy="26.177" r="5" fill="#F1B31C"/><path fill="#5C9E31" d="M23.365 38.967c2.344 2.868 1.647 7.316 1.647 7.316s-4.498-.203-6.842-3.072-1.647-7.317-1.647-7.317 4.498.206 6.842 3.073zM36.653 52.501c2.858-2.334 7.289-1.64 7.289-1.64s-.203 4.48-3.06 6.815c-2.858 2.335-7.29 1.64-7.29 1.64s.206-4.48 3.061-6.815z"/><g fill="none" stroke="#000" stroke-linecap="round" stroke-linejoin="round" stroke-width="2"><circle cx="40.792" cy="26.177" r="5"/><path d="M23.859 38.563c2.79 3.414 1.96 8.708 1.96 8.708s-5.353-.242-8.143-3.657-1.96-8.707-1.96-8.707 5.353.245 8.143 3.656zM43.278 20.52c.275-.645 1.445-3.289 1.915-3.859 2.592-3.144 7.54-3.344 7.54-3.344s.742 4.896-1.848 8.039c-.7.85-1.573 1.484-2.474 1.957l-1.864.85c.816-.435 3.59-1.634 4.574-1.757 4.043-.504 7.777 2.748 7.777 2.748s-2.823 4.068-6.864 4.574c-1.504.187-2.966-.145-4.208-.637l-1.513-.562c1.072.4 3.645 1.562 4.525 2.46 2.852 2.91 2.528 7.852 2.528 7.852s-4.947.219-7.798-2.689c-.63-.642-1.885-3.776-2.243-4.541l.767 2.397c.238.713.392 1.474.407 2.268.074 4.074-3.555 7.443-3.555 7.443s-3.747-3.238-3.822-7.31c-.015-.833 1.347-4.705 1.347-4.705l-1.14 2.622c-1.772 2.489-4.516 4.144-7.555 4.449-.925.093-1.544.066-1.544.066s-.323-4.942 2.529-7.852c.828-.846 1.834-1.427 2.844-1.826l1.71-.71c-.003 0-4.314 1.454-5.75 1.275-4.04-.506-6.865-4.574-6.865-4.574s3.734-3.252 7.778-2.748c.837.105 3.842 1.578 4.56 1.92l-2.21-1.211c-.77-.449-1.507-1.023-2.114-1.76-2.59-3.142-1.849-8.038-1.849-8.038s4.948.2 7.54 3.344c.502.608 1.854 3.216 2.136 3.907l-.91-1.94a7.721 7.721 0 0 1-.507-2.55c-.074-4.073 3.555-7.442 3.555-7.442s3.747 3.236 3.822 7.31a7.713 7.713 0 0 1-.411 2.559M36.242 51.997c3.414-2.79 8.708-1.96 8.708-1.96s-.243 5.353-3.657 8.143c-3.414 2.79-8.708 1.96-8.708 1.96s.245-5.353 3.657-8.143z"/><path d="M34.366 41.03c-3.438 3.547-7.676 10.245-5.829 20.734"/></g></svg>
\ No newline at end of file
diff --git a/roles/forgejo/files/custom/templates/custom/extra_links.tmpl b/roles/forgejo/files/custom/templates/custom/extra_links.tmpl
new file mode 100644
index 0000000..10c0d19
--- /dev/null
+++ b/roles/forgejo/files/custom/templates/custom/extra_links.tmpl
@@ -0,0 +1 @@
+<a class="item" href="https://nilsnh.no/" target="_blank">nilsnh.no</a>
diff --git a/roles/forgejo/files/custom/templates/home.tmpl b/roles/forgejo/files/custom/templates/home.tmpl
new file mode 100644
index 0000000..b15cbdd
--- /dev/null
+++ b/roles/forgejo/files/custom/templates/home.tmpl
@@ -0,0 +1,14 @@
+{{template "base/head" .}}
+<div role="main" aria-label="{{if .IsSigned}}{{ctx.Locale.Tr "dashboard"}}{{else}}{{ctx.Locale.Tr "home"}}{{end}}" class="gt-pt-4">
+	<div class="ui text container">
+		<h1>{{AppName}}</h1>
+
+		<p>Welcome to this humble abode, nestled somewhere on the web's outer rim.</p>
+
+		<p>Here's where you can <a href="/explore">explore projects on this server</a>.</p>
+
+		<p>Have a good one! ☕</p>
+
+	</div>
+</div>
+{{template "base/footer" .}}
diff --git a/roles/forgejo/files/forgejo.service b/roles/forgejo/files/forgejo.service
new file mode 100644
index 0000000..d7c5ce6
--- /dev/null
+++ b/roles/forgejo/files/forgejo.service
@@ -0,0 +1,20 @@
+# File adapted from here:
+# https://codeberg.org/forgejo/forgejo/src/branch/forgejo/contrib/systemd/forgejo.service
+
+[Unit]
+Description=Forgejo (Beyond coding. We forge.)
+After=syslog.target
+After=network.target
+
+[Service]
+RestartSec=2s
+Type=simple
+User=git
+Group=git
+WorkingDirectory=/var/lib/forgejo/
+ExecStart=/usr/local/bin/forgejo web --config /etc/forgejo/app.ini
+Restart=always
+Environment=USER=git HOME=/home/git GITEA_WORK_DIR=/var/lib/forgejo
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/forgejo/files/forgejo.sh b/roles/forgejo/files/forgejo.sh
new file mode 100644
index 0000000..0615c8c
--- /dev/null
+++ b/roles/forgejo/files/forgejo.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+# Sourced from: https://forgejo.org/docs/latest/admin/installation-binary/#general-hints-for-using-forgejo
+sudo -u git forgejo -w /var/lib/forgejo -c /etc/forgejo/app.ini "$@"
diff --git a/roles/forgejo/handlers/main.yml b/roles/forgejo/handlers/main.yml
new file mode 100644
index 0000000..754956c
--- /dev/null
+++ b/roles/forgejo/handlers/main.yml
@@ -0,0 +1,7 @@
+- name: restart forgejo
+  become: true
+  systemd:
+    name: forgejo
+    state: restarted
+    enabled: yes
+    masked: no
\ No newline at end of file
diff --git a/roles/forgejo/tasks/load-backups.yml b/roles/forgejo/tasks/load-backups.yml
new file mode 100644
index 0000000..2a4a9f9
--- /dev/null
+++ b/roles/forgejo/tasks/load-backups.yml
@@ -0,0 +1,19 @@
+- name: load forgejo data folder
+  become: true
+  ansible.builtin.copy:
+    src: "{{ forgejo_load_backup }}/data"
+    remote_src: true
+    dest: /var/lib/forgejo
+    owner: git
+    group: git
+    mode: u=rwx,g=rx,o=x
+
+- name: load forgejo repositories
+  become: true
+  ansible.builtin.copy:
+    src: "{{ forgejo_load_backup }}/repos/"
+    remote_src: true
+    dest: /var/lib/forgejo/data/forgejo-repositories
+    owner: git
+    group: git
+    mode: u=rwx,g=rx,o=x
\ No newline at end of file
diff --git a/roles/forgejo/tasks/main.yml b/roles/forgejo/tasks/main.yml
new file mode 100644
index 0000000..b741824
--- /dev/null
+++ b/roles/forgejo/tasks/main.yml
@@ -0,0 +1,105 @@
+- name: ensure required packages for forgejo is present 
+  ansible.builtin.apt:
+    pkg: 
+      - git
+      - rsync
+    state: present
+    # using generous time because unattended upgrades will keep packages updated.
+    cache_valid_time: 604800 
+
+- name: check if Forgejo is installed
+  shell: /usr/local/bin/forgejo --version | awk '{print $3}' | sed 's/\+/-/g'
+  register: forgejo_found_version
+  changed_when: false
+
+- name: download forgejo (arm)
+  get_url:
+    url: "https://codeberg.org/forgejo/forgejo/releases/download/v{{ forgejo_version }}/forgejo-{{ forgejo_version }}-linux-arm64"
+    dest: /usr/local/bin/forgejo
+    checksum: "{{ forgejo_checksum_arm64 }}"
+  when: 
+    - ansible_architecture == 'aarch64'
+    - forgejo_version != forgejo_found_version.stdout
+  notify: restart forgejo
+
+- name: download forgejo (x86_64)
+  get_url:
+    url: "https://codeberg.org/forgejo/forgejo/releases/download/v{{ forgejo_version }}/forgejo-{{ forgejo_version }}-linux-amd64"
+    dest: /usr/local/bin/forgejo
+    checksum: "{{ forgejo_checksum_amd64 }}"
+  when: 
+    - ansible_architecture == 'x86_64'
+    - forgejo_version != forgejo_found_version.stdout
+  notify: restart forgejo
+
+- name: set correct rights on forgejo executable
+  file:
+    path: /usr/local/bin/forgejo
+    mode: '0755'
+
+- name: create a git user responsible for forgejo
+  user:
+    comment: "user responsible for forgejo"
+    system: yes
+    password: "!"
+    shell: /bin/bash
+    state: present
+    name: git
+    create_home: yes
+
+- name: create data folders required by forgejo
+  file:
+    path: '{{ item }}'
+    state: directory
+    owner: git
+    group: git
+    mode: '0750'
+  loop:
+    - /var/lib/forgejo
+
+- name: create configuration folder required by forgejo
+  file:
+    path: '{{ item }}'
+    state: directory
+    mode: '0770'
+    owner: root
+    group: git
+  loop:
+    - /etc/forgejo
+
+- name: Load Forgejo backup
+  ansible.builtin.import_tasks: load-backups.yml
+  when: forgejo_load_backup is defined
+
+- name: upload forgejo configuration
+  notify: restart forgejo
+  template:
+    src: app.ini.j2
+    dest: /etc/forgejo/app.ini
+    mode: '0400'
+    owner: git
+    group: git
+
+- name: upload custom adjustments
+  notify: restart forgejo
+  ansible.posix.synchronize:
+    recursive: true
+    src: custom
+    dest: /var/lib/forgejo
+    rsync_opts:
+      - --chown=git:git
+      - --chmod=755
+
+- name: upload systemd unit file
+  notify: restart forgejo
+  copy:
+    src: forgejo.service
+    dest: /etc/systemd/system/forgejo.service
+
+- name: upload forgejo.sh helper script
+  ansible.builtin.copy:
+    src: forgejo.sh
+    dest: /usr/local/bin/forgejo.sh
+    mode: '0755'
+    owner: root
+    group: root
\ No newline at end of file
diff --git a/roles/forgejo/templates/app.ini.j2 b/roles/forgejo/templates/app.ini.j2
new file mode 100644
index 0000000..3381e67
--- /dev/null
+++ b/roles/forgejo/templates/app.ini.j2
@@ -0,0 +1,79 @@
+APP_NAME = code.on.nilsnh.no
+RUN_USER = git
+WORK_PATH = /var/lib/forgejo
+RUN_MODE = prod
+
+[database]
+DB_TYPE = sqlite3
+HOST = 127.0.0.1:3306
+NAME = forgejo
+USER = forgejo
+PASSWD = 
+SCHEMA = 
+SSL_MODE = disable
+PATH = /var/lib/forgejo/data/forgejo.db
+LOG_SQL = false
+
+[repository]
+ROOT = /var/lib/forgejo/data/forgejo-repositories
+
+[server]
+SSH_DOMAIN = {{ forgejo_domain }}
+DOMAIN = {{ forgejo_domain }}
+HTTP_PORT = 3000
+ROOT_URL = https://{{ forgejo_domain }}/
+APP_DATA_PATH = /var/lib/forgejo/data
+DISABLE_SSH = false
+SSH_PORT = 22
+LFS_START_SERVER = true
+LFS_JWT_SECRET = {{ vault_forgejo_lfs_secret }}
+OFFLINE_MODE = false
+
+[lfs]
+PATH = /var/lib/forgejo/data/lfs
+
+[mailer]
+ENABLED = true
+PROTOCOL = sendmail
+FROM = {{ forgejo_from }}
+
+[service]
+REGISTER_EMAIL_CONFIRM = false
+ENABLE_NOTIFY_MAIL = false
+DISABLE_REGISTRATION = true
+ALLOW_ONLY_EXTERNAL_REGISTRATION = false
+ENABLE_CAPTCHA = false
+REQUIRE_SIGNIN_VIEW = false
+DEFAULT_KEEP_EMAIL_PRIVATE = false
+DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+DEFAULT_ENABLE_TIMETRACKING = true
+NO_REPLY_ADDRESS = {{ machine_from_email }}
+
+[openid]
+ENABLE_OPENID_SIGNIN = false
+ENABLE_OPENID_SIGNUP = false
+
+[cron.update_checker]
+ENABLED = false
+
+[session]
+PROVIDER = file
+
+[log]
+MODE = console
+LEVEL = info
+ROOT_PATH = /var/lib/forgejo/log
+
+[repository.pull-request]
+DEFAULT_MERGE_STYLE = merge
+
+[repository.signing]
+DEFAULT_TRUST_MODEL = committer
+
+[security]
+INSTALL_LOCK = true
+INTERNAL_TOKEN = {{ vault_forgejo_internal_token }}
+PASSWORD_HASH_ALGO = pbkdf2_hi
+
+[oauth2]
+JWT_SECRET = {{ vault_forgejo_jwt_secret }}
diff --git a/roles/forgejo/vars/main.yml b/roles/forgejo/vars/main.yml
new file mode 100644
index 0000000..92f536f
--- /dev/null
+++ b/roles/forgejo/vars/main.yml
@@ -0,0 +1,4 @@
+
+forgejo_version: "1.21.3-0"
+forgejo_checksum_arm64: sha256:00375a2fb8bf3975371c7e99dc8986d35997c43e01cf3ddaf97dad86bf063277
+forgejo_checksum_amd64: sha256:8c8f34e889f968b4f9357701ceee7daab5b47ea605793325da8e3e740457b45a
diff --git a/roles/postgres/tasks/main.yml b/roles/postgres/tasks/main.yml
new file mode 100644
index 0000000..aa1343d
--- /dev/null
+++ b/roles/postgres/tasks/main.yml
@@ -0,0 +1,22 @@
+- name: install postgres
+  package:
+    name:
+      - postgresql
+      - python-psycopg2
+      # needed because we need to become the unprivileged postgres user.
+      - acl
+    state: latest
+
+- name: create gitea database
+  postgresql_db:
+    name: giteadb
+  become: yes
+  become_user: postgres
+
+- name: create gitea postgres user
+  postgresql_user:
+    db: giteadb
+    name: gitea
+    password: "{{ gitea_postgres_pw }}"
+  become: yes
+  become_user: postgres
diff --git a/roles/sendmail/tasks/main.yml b/roles/sendmail/tasks/main.yml
new file mode 100644
index 0000000..c741766
--- /dev/null
+++ b/roles/sendmail/tasks/main.yml
@@ -0,0 +1,21 @@
+- name: install sendmail (ssmtp)
+  ansible.builtin.package:
+    name:
+      - ssmtp
+    state: present
+
+- name: configure ssmtp
+  ansible.builtin.template:
+    src: ssmtp.conf.j2
+    dest: /etc/ssmtp/ssmtp.conf
+    mode: '0640'
+    owner: root
+    group: mail
+  
+- name: configure ssmtp revaliases
+  ansible.builtin.blockinfile:
+    path: /etc/ssmtp/revaliases
+    block: |
+      jake:{{ machine_from_email }}
+      root:{{ machine_from_email }}
+      git:{{ machine_from_email }}
\ No newline at end of file
diff --git a/roles/sendmail/templates/ssmtp.conf.j2 b/roles/sendmail/templates/ssmtp.conf.j2
new file mode 100644
index 0000000..717eb93
--- /dev/null
+++ b/roles/sendmail/templates/ssmtp.conf.j2
@@ -0,0 +1,25 @@
+#
+# Config file for sSMTP sendmail
+#
+# The person who gets all mail for userids < 1000
+# Make this empty to disable rewriting.
+root={{ machine_notifications_receiver }}
+
+# The place where the mail goes. The actual machine name is required no 
+# MX records are consulted. Commonly mailhosts are named mail.domain.com
+mailhub=box.nilsnh.no:465
+
+# Where will the mail seem to come from?
+rewriteDomain=nilsnh.no
+
+# The full hostname
+hostname=jake.box.nilsnh.no
+
+AuthUser={{ mta_user }}
+AuthPass={{ mta_user_pw }}
+UseTLS=YES
+
+# Are users allowed to set their own From: address?
+# YES - Allow the user to specify their own From: address
+# NO - Use the system generated From: address
+FromLineOverride=YES
diff --git a/scripts/build.sh b/scripts/build.sh
new file mode 100755
index 0000000..613c6f4
--- /dev/null
+++ b/scripts/build.sh
@@ -0,0 +1,19 @@
+#!/bin/env bash
+
+# Source: https://stackoverflow.com/a/4774063
+PROJECT_ROOT="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )/.."
+
+RESTIC_VERSION=tags/v0.16.2
+
+# Checkout correct version
+(cd "$PROJECT_ROOT/vendor/restic" && git checkout $RESTIC_VERSION)
+
+echo "Building restic binary for local usage ..."
+(cd "$PROJECT_ROOT/vendor/restic" && go run build.go)
+
+echo "Building restic binary for ARM architecture ..."
+(cd "$PROJECT_ROOT/vendor/restic" && \
+    go run build.go --goos linux --goarch arm \
+    --output "$PROJECT_ROOT/roles/backup/files/restic-arm64")
+
+echo "Done with work"
\ No newline at end of file
diff --git a/scripts/restic.sh b/scripts/restic.sh
new file mode 100755
index 0000000..424e425
--- /dev/null
+++ b/scripts/restic.sh
@@ -0,0 +1,12 @@
+#!/bin/env bash
+
+# Source: https://stackoverflow.com/a/4774063
+PROJECT_ROOT="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )/.."
+
+VAULT=$(ansible-vault decrypt "$PROJECT_ROOT/group_vars/all/vault.yml" --output=-)
+REPO=$(echo "$VAULT" | grep restic_url | awk '{print $2}')
+REPO_PW=$(echo "$VAULT" | grep restic_pw | awk '{print $2}')
+
+# Helper script for calling Restic using correct repo and password.
+
+RESTIC_REPOSITORY=$REPO RESTIC_PASSWORD=$REPO_PW "$PROJECT_ROOT/vendor/restic/restic" "$@"
diff --git a/scripts/restore-latest-backup.sh b/scripts/restore-latest-backup.sh
new file mode 100755
index 0000000..17209b9
--- /dev/null
+++ b/scripts/restore-latest-backup.sh
@@ -0,0 +1,12 @@
+#!/bin/env bash
+
+# Source: https://stackoverflow.com/a/4774063
+PROJECT_ROOT="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )/.."
+
+rm -rf "$PROJECT_ROOT/backup-restore"
+
+"$PROJECT_ROOT/scripts/restic.sh" restore latest --target "$PROJECT_ROOT/backup-restore"
+
+(cd "$PROJECT_ROOT/backup-restore/tmp" && unzip forgejo.zip -d ../forgejo)
+
+rm -rf "$PROJECT_ROOT/backup-restore/tmp"
\ No newline at end of file
diff --git a/scripts/verify-download.sh b/scripts/verify-download.sh
new file mode 100755
index 0000000..0cd244e
--- /dev/null
+++ b/scripts/verify-download.sh
@@ -0,0 +1,32 @@
+#!/bin/env bash
+
+set -e
+
+# Helper script to download binaries and check signatures and checksums.
+# It assumes a very rigid file structure
+
+# Example
+# URL="https://codeberg.org/forgejo/forgejo/releases/download/v1.20.6-1/forgejo-1.20.6-1-linux-amd64"
+URL=$1
+
+if [ -z "$1" ] 
+    then
+        echo "No argument supplied. Please provide a download URL."
+        exit 1
+fi
+
+FILENAME=$(echo $URL | grep --only-matching --extended-regexp "([^\/]+$)")
+
+DIR="/tmp/verify-binaries"
+
+mkdir -p $DIR
+
+wget -nv --timestamping --directory-prefix $DIR $URL
+wget -nv --timestamping --directory-prefix $DIR "$URL.asc"
+wget -nv --timestamping --directory-prefix $DIR "$URL.sha256"
+
+(cd $DIR && gpg --verify "$FILENAME.asc" $FILENAME)
+
+(cd $DIR && cat "$FILENAME.sha256")
+
+(cd $DIR && sha256sum --check "$FILENAME.sha256")
\ No newline at end of file