From e20fa7ebae3488f0990c8ffcaf531ec327231a2a Mon Sep 17 00:00:00 2001
From: zomas <zomas@zomas.net>
Date: Tue, 1 Sep 2026 17:16:45 +0200
Subject: [PATCH] homepage-nuova: il repo contiene solo il tema/logo + backup
 homepage

Rimosso tutto cio' che non riguarda la homepage (script backup/fix/install,
tarball, note di sessione). Ora il repo tiene esclusivamente:
- gitea-theme-pack/   (theme homepage + logo/favicon + install/rollback)
- homepage-backup/    (copia homepage originale)

Gli script sono conservati in /home/zomas/backup-scritti-vps/ (fuori repo).
---
 STATO_SESSIONE_2026-09-01.md |  92 -------------
 backup_gitea.sh              |  30 -----
 comandi_backup_root.txt      |   2 -
 fix_gitea_builtin_ssh.sh     |  26 ----
 fix_gitea_ssh_listen.sh      |  18 ---
 fix_mailer_deprecation.sh    |  26 ----
 fix_warning_gitea.sh         |  12 --
 gitea-theme-pack.tar.gz      | Bin 16185 -> 0 bytes
 install_backup_gitea.sh      |  59 ---------
 install_gitea_vps.sh         | 249 -----------------------------------
 10 files changed, 514 deletions(-)
 delete mode 100644 STATO_SESSIONE_2026-09-01.md
 delete mode 100644 backup_gitea.sh
 delete mode 100644 comandi_backup_root.txt
 delete mode 100644 fix_gitea_builtin_ssh.sh
 delete mode 100644 fix_gitea_ssh_listen.sh
 delete mode 100644 fix_mailer_deprecation.sh
 delete mode 100644 fix_warning_gitea.sh
 delete mode 100644 gitea-theme-pack.tar.gz
 delete mode 100644 install_backup_gitea.sh
 delete mode 100644 install_gitea_vps.sh

diff --git a/STATO_SESSIONE_2026-09-01.md b/STATO_SESSIONE_2026-09-01.md
deleted file mode 100644
index 30237b3..0000000
--- a/STATO_SESSIONE_2026-09-01.md
+++ /dev/null
@@ -1,92 +0,0 @@
-# STATO SESSIONE — Gitea + Cloudflare (1 set 2026)
-
-File di memorizzazione del lavoro fatto, per riprendere dopo un cambio di
-ambito. Aggiornato: 2026-09-01.
-
----
-
-## 1. Obiettivo della sessione
-
-Deploy di **Gitea** sul VPS OVH (145.239.94.49, Debian 12) come `https://git.zomas.net`
-per tracciare il progetto Tacticus e aprirlo (in futuro) a contributi esterni.
-Backup automatico incluso. Tutto completato e verificato.
-
----
-
-## 2. Stato finale (TUTTO FUNZIONANTE)
-
-| Componente | Stato |
-|---|---|
-| Gitea 1.27.3 | attivo (systemd, `/etc/gitea/app.ini`), DB sqlite `/var/lib/gitea/data/gitea.db` |
-| Web | `https://git.zomas.net` → Apache → `127.0.0.1:3000` (200 esterno) |
-| SSH git | server **built-in** Gitea su `0.0.0.0:2222` (host key ed25519/rsa/ecdsa) |
-| SSH cliente | questo PC → `gitea@git.zomas.net:2222` (IP origine 145.239.94.49, chiave `~/.ssh/id_ed25519`) |
-| Repo | `zomas/tacticus` **privato**, `main`, con README + `bot/.env.example` |
-| Mailer | `smtp+starttls` → smtp.gmail.com:587, App Password, test email **ok** |
-| 2FA | attiva (richiesta globale) + `TWO_FACTOR_AUTH=enforced` |
-| Backup | `/var/backups/gitea/gitea-dump-*.zip` (gitea dump, cron giornaliero 02:30, retention 14gg) |
-| Cloudflare | proxy arancio su git/zomas.net/zomas.org, SSL Full (strict), Universal SSL, CAA a posto |
-
-### Warning Gitea: TUTTI RISOLTI
-- `https://(null)/` → colpa di `RequestHeader set Host %{HTTP_HOST}e` in Apache
-  (Host vuoto). Rimosso, basta `ProxyPreserveHost On`.
-- Deprecazioni `[mailer].MAILER_TYPE/HOST/IS_TLS_ENABLED/SKIP_VERIFY` →
-  opzioni moderne (`PROTOCOL=smtp+starttls`, `SMTP_ADDR`, `SMTP_PORT`).
-  Log: "NESSUNA deprecazione residua".
-
----
-
-## 3. Errori incontrati e soluzioni (utile se si ripete)
-
-1. **`(null)` nel warning** → `RequestHeader set Host %{HTTP_HOST}e` sovrascrive Host
-   con vuoto (variabile senza valore). Fix: riga rimossa.
-2. **Server SSH non partiva** → Gitea default `START_SSH_SERVER=false` (usa OpenSSH
-   esterno). Config: `START_SSH_SERVER=true` + `SSH_LISTEN_HOST=0.0.0.0`.
-   Con built-in, l'utente SSH è il **RUN_USER di Gitea = `gitea`** (NON `git`,
-   NON zomas): remote = `gitea@git.zomas.net:zomas/tacticus.git`.
-3. **`git@` "Permission denied"** → normale: il client SSH deve usare `gitea@`.
-   Config in `~/.ssh/config`: `Host git.zomas.net → HostName 145.239.94.49,
-   Port 2222, User gitea`.
-4. **Cloudflare non passa TCP 2222** → il record proxied serve solo 80/443;
-   per SSH si punta all'IP origine via `HostName 145.239.94.49`.
-5. **SSH rifiuto public key "invalid \r"** → il `.pub` finiva con CRLF; STRIPPARE `\r`
-   prima di POST all'API `POST /api/v1/user/keys`.
-6. **Backup "permission denied"** → `gitea dump` gira come utente `gitea`, che non
-   può scrivere in `/var/backups/gitea` (root). Fix: dump in `/tmp`, poi `mv` da root.
-7. **Sole IPv6 da questo PC** → `git.zomas.net` risolve solo IPv6 (anycast CF);
-   per curl ok, per ssh serve IP IPv4 esplicito.
-
----
-
-## 4. Credenziali / segreti (NON committare)
-
-- `/home/zomas/vps-admin/vps_ssh.env` — `VPS_*`, `TOKEN_CLOUDFLARE`, `GITEA_TOKEN`
-- `bot/.env` — chiavi API Tacticus + token bot Telegram (niente nel repo)
-- Il repo `tacticus.git` NON contiene segreti (verificato: `.env`, `vps_ssh.env`,
-  `risultati.txt`, script setup esclusi da `.gitignore`).
-
----
-
-## 5. Comandi utili
-
-```bash
-# SSH git (da questo PC)
-git -C /home/zomas/tacticus remote -v         # gitea@git.zomas.net:zomas/tacticus.git
-git -C /home/zomas/tacticus push              # aggiorna il remote
-
-# Backup manuale (da root sul VPS)
-/usr/local/sbin/backup_gitea.sh
-ls -lh /var/backups/gitea/                    # retention 14 giorni
-
-# Stato servizi
-systemctl status gitea apache2 cron           # VPS
-ss -tlnp | grep -E ':(2222|3000)\b'
-```
-
----
-
-## 6. PROSSIMI PASSI (cambio di ambito dell'utente)
-
-- (Opzionale) Download automatico dei backup VPS sul PC locale (ora solo sul VPS).
-- (Opzionale) Girare il repo `tacticus` da privato a pubblico + aprire contributi.
-- (Opzionale) `daily.py --fresh` (proposta rimasta aperta dal 31 ago, mai richiesta).
\ No newline at end of file
diff --git a/backup_gitea.sh b/backup_gitea.sh
deleted file mode 100644
index 3dfd115..0000000
--- a/backup_gitea.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/bin/bash
-# Backup automatico Gitea via `gitea dump` (db sqlite + repos + config in un unico zip).
-# Retention: 14 giorni (modificare KEEP_DAYS).
-set -euo pipefail
-
-BACKUP_DIR=/var/backups/gitea
-KEEP_DAYS=14
-STAMP=$(date +%Y%m%d-%H%M%S)
-TMP_ARC="/tmp/gitea-dump-$STAMP.zip"
-ARC="$BACKUP_DIR/gitea-dump-$STAMP.zip"
-
-mkdir -p "$BACKUP_DIR"
-
-# Esegue il dump come utente 'gitea' (stesso user del servizio).
-# Il file va in /tmp (scrivibile da gitea), poi lo spostiamo come root.
-su -s /bin/bash gitea -c \
-  "/usr/local/bin/gitea dump --config /etc/gitea/app.ini --file '$TMP_ARC' --type zip" \
-  >/tmp/gitea-dump.log 2>&1
-
-if [ ! -s "$TMP_ARC" ]; then
-  echo "ERRORE: dump non creato" >>/tmp/gitea-dump.log
-  exit 1
-fi
-
-mv "$TMP_ARC" "$ARC"
-
-# Pulisce i dump piu' vecchi di KEEP_DAYS
-find "$BACKUP_DIR" -name 'gitea-dump-*.zip' -mtime +"$KEEP_DAYS" -delete
-
-echo "OK: $ARC ($(du -h "$ARC" | cut -f1))"
\ No newline at end of file
diff --git a/comandi_backup_root.txt b/comandi_backup_root.txt
deleted file mode 100644
index f713a78..0000000
--- a/comandi_backup_root.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-# Verifica integrita' del dump (lo script e' gia' in /tmp)
-su -s /bin/bash gitea -c "python3 /tmp/check_dump.py" 2>/dev/null || su -s /bin/bash gitea -c "python3 /tmp/check_dump.py"
\ No newline at end of file
diff --git a/fix_gitea_builtin_ssh.sh b/fix_gitea_builtin_ssh.sh
deleted file mode 100644
index bff5f4d..0000000
--- a/fix_gitea_builtin_ssh.sh
+++ /dev/null
@@ -1,26 +0,0 @@
-# FIX: attiva il server SSH BUILT-IN di Gitea (default: esterno -> le chiavi finivano in authorized_keys senza nessun sshd su 2222)
-# Dal cheat sheet: START_SSH_SERVER=false di default => Gitea delega a OpenSSH esterno.
-
-# 1) Backup
-cp /etc/gitea/app.ini /etc/gitea/app.ini.bak.$(date +%Y%m%d%H%M%S)
-
-# 2) Imposta START_SSH_SERVER = true nella sezione [server]
-sed -i 's/^DISABLE_SSH = false/DISABLE_SSH = false\nSTART_SSH_SERVER = true/' /etc/gitea/app.ini
-
-# controllo: se non ci fosse la riga DISABLE_SSH esatta, aggiunge comunque
-grep -q '^START_SSH_SERVER = true' /etc/gitea/app.ini || sed -i '/^\[server\]/a START_SSH_SERVER = true' /etc/gitea/app.ini
-
-# 3) Mostra la sezione [server]
-sed -n '/^\[server\]/,/^\[/p' /etc/gitea/app.ini
-
-# 4) Riavvio
-systemctl restart gitea
-sleep 6
-
-# 5) Verifica: 2222 deve essere in ascolto E devono essere generate le host key
-echo "--- listener ---"
-ss -tlnp | grep -E ':(2222|3000)\b'
-echo "--- host key ---"
-ls -la /var/lib/gitea/data/ssh/ 2>/dev/null || echo "ATTENZIONE: nessuna host key creata"
-echo "--- log avvio ssh ---"
-journalctl -u gitea --since "-1 min" --no-pager | grep -iE 'ssh|listen' | tail -8
\ No newline at end of file
diff --git a/fix_gitea_ssh_listen.sh b/fix_gitea_ssh_listen.sh
deleted file mode 100644
index b0dee20..0000000
--- a/fix_gitea_ssh_listen.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-# Fix SSH di Gitea: forza il listener built-in su tutte le interfacce
-# (di default Gitea deriva SSH_LISTEN_HOST da SSH_DOMAIN = IP Cloudflare -> bind fallisce)
-
-# 1) Backup
-cp /etc/gitea/app.ini /etc/gitea/app.ini.bak.$(date +%Y%m%d%H%M%S)
-
-# 2) Aggiunge SSH_LISTEN_HOST = 0.0.0.0 dopo SSH_PORT nella sezione [server]
-sed -i 's/^SSH_PORT = 2222/SSH_PORT = 2222\nSSH_LISTEN_HOST = 0.0.0.0/' /etc/gitea/app.ini
-
-# 3) Riavvio
-systemctl restart gitea
-sleep 5
-
-# 4) Verifica: il listener ora deve esserci
-ss -tlnp | grep -E ':(2222)\b' && echo "OK: 2222 in ascolto" || echo "ERRORE: 2222 assente"
-
-# 5) Verifica log avvio (liste meno, mostra le righe rilevanti)
-journalctl -u gitea --since "-1 min" --no-pager | grep -iE 'ssh|listen|bind|error|warn' | tail -10
\ No newline at end of file
diff --git a/fix_mailer_deprecation.sh b/fix_mailer_deprecation.sh
deleted file mode 100644
index 022052d..0000000
--- a/fix_mailer_deprecation.sh
+++ /dev/null
@@ -1,26 +0,0 @@
-# Correzione deprecazioni residue in [mailer] (Gitea moderno)
-# Sostituisce: HOST, IS_TLS_ENABLED, SKIP_VERIFY -> SMTP_ADDR+SMTP_PORT, PROTOCOL, FORCE_TRUST_SERVER_CERT
-
-# 1) Backup e riscrittura della sezione [mailer] con opzioni moderne
-cp /etc/gitea/app.ini /etc/gitea/app.ini.bak.$(date +%Y%m%d%H%M%S)
-
-# 2) Sostituisce le righe obsolete (lasciando PASSWD, FROM, USER, ENABLED intatti)
-sed -i \
-  -e 's|^HOST = .*|SMTP_ADDR = smtp.gmail.com\nSMTP_PORT = 587|' \
-  -e 's|^IS_TLS_ENABLED = .*||' \
-  -e 's|^SKIP_VERIFY = .*||' \
-  /etc/gitea/app.ini
-
-# 3) Garantisce PROTOCOL corretto per il 587 (starttls esplicito)
-sed -i 's|^PROTOCOL = smtp$|PROTOCOL = smtp+starttls|' /etc/gitea/app.ini
-
-# 4) Controlla il risultato (senza esporre PASSWD)
-awk '/^\[mailer\]/{p=1} p{print} /^\[/ && !/\[mailer\]/{p=0}' /etc/gitea/app.ini | sed 's/^PASSWD.*/PASSWD = ***/'
-
-# 5) Riavvia Gitea
-systemctl restart gitea
-sleep 3
-systemctl status gitea --no-pager | head -6
-
-# 6) Verifica che NON compaiano piu deprecazioni mailer all'avvio
-journalctl -u gitea --since "-1 min" --no-pager | grep -i deprecat || echo "NESSUNA deprecazione residua"
\ No newline at end of file
diff --git a/fix_warning_gitea.sh b/fix_warning_gitea.sh
deleted file mode 100644
index 428ce1c..0000000
--- a/fix_warning_gitea.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-# Correzione warning Gitea/Cloudflare
-# 1) Rimuove "RequestHeader set Host" (causa Host=null nel warning giallo)
-sed -i '/RequestHeader set Host/d' /etc/apache2/sites-available/git.zomas.net-ssl.conf
-apache2ctl configtest && systemctl reload apache2
-
-# 2) Corregge opzione deprecata MAILER_TYPE -> PROTOCOL
-sed -i 's/^MAILER_TYPE = smtp/PROTOCOL = smtp/' /etc/gitea/app.ini
-grep -nE '^MAILER_TYPE|^PROTOCOL' /etc/gitea/app.ini
-systemctl restart gitea
-
-# 3) Legge le altre deprecazioni dai log (per completare)
-journalctl -u gitea --no-pager | grep -i -E "deprecat|\[config\]" | tail -30
\ No newline at end of file
diff --git a/gitea-theme-pack.tar.gz b/gitea-theme-pack.tar.gz
deleted file mode 100644
index 7a9c91f4bf8b3ceb035ae77323ef60c284ff082c..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 16185
zcmV-9KgPfxiwFP!000001MFN|bK6LE_UqtR^g#9+ka*W^mpgPyBWo;GY|ACdQ#<jv
zNDyd}9fJS{0CllesXXNer1AsuIH}4@-trv3=SS=>$#=RN7m}bP&v?C?T5~)E(U)^h
zpL6=$8qipz+^MG%KIQeuao;r`eELrdpWWSUy0&+>Tjgu^dC=bOY;AAvY_{6%2d(yI
zXLIub+x|1qvh<lHsS`8y;C(oCl3T{z)&KwWGhUScm<K#|Qr<^f>NKLOUyp+XytA{l
zLjLW|lKeZn_}yyn;MW7z`t_*q{``&0f9>n$EQy;#5j1&l&Z4Vy5(b;b8haj&!{*32
z7j77^XQU-vc6NAhw#Q!V9lbu?KYqT)dd%gqI}stXoPhg&Xfql;3mj%1n#}RhAEa^E
zAb1WtWC429&~+W=KUOoC<@(%-oxtTR5$-H@>;`)&FpUG2=g`!HDNj@CcG%b#?DYF*
z%<@a*0qcY_!Ct*w=x91o<nwwO&fG~|js&#GiBleUA@dyHci8FK!RhH98}krYV&T+)
zHu><M5(}3g-EcZ|T;T**hnPlToU$-6MsYZ0ua2HG-E=f{#=NF3Ph;o8FpgiJfkUPX
z4GX8uXg2hP+jNqIr%6*x$EE>d>h*eo8tjRujxXN7cT$I0qu6;b!ay*O`^<OJko`1s
zJnT)d8S{*zm!}7Wq19+@vHY{fhG9&r!=zZq86k7xI84L9!(8KJ?<t1Sv`(iyEq2CZ
zNYV+$p)cm98~cB#vHc(9ob4KY=_yLO%u2*muD}gzEZ|8(3P8fMjgw=hk!`grkntqt
zaX?5(7mSl5uv@KYyF5CH05pub9>-YyNd`d#3c|?|<^fxs5fE_pP*Laj+&DbUi0JH;
z!A?0i4J}RO6)W~hM=j9glXhUqbxft}#^IrDoW9!IS76#(+a)lbfC&izA&eoqFi3%u
zlq+M8LrP0Pg#l%Iaq9xru>F(c(^D<kPSvm>1UiS$F!tM!Q3sQ(c4w=`wtrh=oy}dl
zhI`z?qSF1QO<>MNh?Rne&inT>Xog`daL+J2K4LzPBMbXsSYxT(HHd_mr?WU9rdtl%
zVAc>b9Gk6UfSxpt9k1_(ei&N|lPn2uzx}55mME2%6!c}yZPnafXzr-yj%?1bNZ-`Q
z#)0a+=NgZDiM@M;h3x+U6j6uNTJ=*=0{x7IT52`|OD~N8|EK7eaw;{uahN0oSqi4q
zv8E)}&18K^Ht~}E&wnw}7CFS{qqKk7BFTWTy6m6}p=h#>T?VJdw&%xgRF93tcv1qq
zaVuawxII631>_{{U$tuTq9*(Ru-E}P&!}ai)S_7-wX(~c6x;5c$BDzzSqe+$)4zB;
zDQ~ly-k#`AW)PEN^H3tD3n9*h2lPq;ptK}Y(2zHmHO&)lYPpv^r4T*$3Q`YyO8C84
z)C{)p(IV>UYb}$5ZfGyh$e7>De$;XnXH6BeBx8GJ_R5=zkzhfY9=a_7R*dSE*(Gl(
zQSxbzzG{kBJ^7vOBUi+5zx~KbCsth3JE+D=o61L1thKt%<QT9$p4-?X^98&1FT0J-
z=!RXpSL(+eyN-2}zP4B!|6j+8Bh5LgN9M|zOE~_)%vO?|k5$B4wg_X;y<jS2y9nTf
zu`b8M0Odw=a{%vHQtAr~kT>#<5OM2LLocylWL_)MOf@i^!7CBdO8gzaG2_sL8N(0v
zGW&5wKgyH^l@rBn6P2I@JTGRxd0X5z5dR?5u||)-0e{%#)DM!LIZ4x~+iYH3Tr@5=
z8(}<db`XI#F~Wpv;1}P9mp!vZ{3h@>`eL#R;iZ$FncYq}sbhZs<gvYs_%UPOfN9B-
zZ>ZUcpMm8R+cDww%=f?ttu|XGyHc0Sj=IC84S-9^%&?9$j954tL4a~B-PfhR>6vT0
z?xw>%v-xCxSbJeui#yx=cQmXyPZk;^wN*<Q(OP2erVQM<=9bhU8+^E$zs<PBt&4hR
zJ#Wsrwa^|bXdr;@M#A@d<}CKDwfAEi6lzM=vdG7h>ddB&m?bWG@jL`yMKY<7gj<hi
zKJS_QoCl%jWw_QxqmjuVjccj1H`h`FZ_22PNJ_;<0tP^u`g?E*nyQVM`L<vdTBQ+G
zZ3V~j(QWf>eQ|1ugL=LmRRUF7Q}bR@lzU5A@Ou)N8DWKce)6A-MClC{=#$33f<Eag
z6xPzTdCH`($j989vd7<$k;uBV=`()}%*H>4BCzCG8_GdV+AJeoxlnew9|dDe*;tvC
z^}cib<W569r5>46H3EKNnJ3S_-7{-U1Cj%A2Pdfi*&k!zvj}d4%qZ+uW=k@k9c%Nz
z8KRn0xD;<o-}=)$anF}1YbkQ_q_9C>R`QeGh{IXnaj#E;M#|-LE4OxUH1+zT1E7k#
zw{nHB1U+18N`9T~ZH05J7yr?`8|TvsiV2wN9fdJ6Z4m%-Fy;~#*x4z$#1zv7LbALM
z<hJd+d+aqxQLHzXAe^8;Xky;#CCsG|#bO%K44F<eafpAJb~I!QMk5JNM9MX#TC!55
zHV!F+=dhWHJK;#1hDhaIM-D;TyL-xTTEP~Yp7l0hpGA~lVcJb&*>f)cYOZO?w`H?7
zmS^QnZx@BU8m(AHEAB=smeGm=ZO(~Cp|x+yW?IhGwod-et$E(lu3p7Fz{097K`hMg
z$AQ$gP_1rQz|-b3Z(jtaqQD7M>pq(aQ;=qtzqA5N2!#e0ic_V-a<E1%M#@|k`)lYV
z)wB>Oou93wBLlF66O)S(+O*4oFo0zBBo=ed@?(m&@>Ay>@2kp|r7c02G^o`Rabg|6
zKC3Z)DIl!yUGFTOY3m-ss~~x}M*mHd>UIr^L2JysFzv=gOk@>d{mzzMF-sTv?lp12
z7j-%<yOAJKohJcZX61OmnIE3vUOA)v+g9f6<f7-NFV-eYaH5zhET)R}EZ2zy^rowm
z0?NE?rnt>$u_>pbDwYqhlny~<`u)I}@_wK7dd%$i5iSP(zS-3_uOuvEss0bo0%U$)
zcJyUOBbofF8uK0JKiloy9bNz5?sVv!01fS}FZKV=@mc#?*8Z{8C&n5(Qo?uG1RgVj
zfnn3o<8eU6zU(X@;&BoNx=hXKRviyerT*z2J2*Xf_WJ1LfbAc@IAABo$7k&H^>g<9
zt5asFa4MO3p-rP-Cy2Vp%1l_b))`PzR_C*jMIz!ONBD-Z|N8Xo_(lKe(MivIcwO9e
z>&<f~MnX4iN+3;DcSlBkda|#FTdv3O4WmTc13z1)ZL;6|hD8^ittVjo+1`s+G}@!}
zZ9Mwn(e#m5e{}fh#iLW(G``*2|NGakmI=6NHip<hv#9>?T7sZr0QTY=LMc2}p8?m`
z*pJ9s-~OIrlK}gXyOWTa2PY@TCkI{T@pHj=!pAcabN17WgCdr=v4~O?#Kd8k5+4;0
zsc-_jnzFVr5*pdptWJy6i(ZY&rDG5hbrQy78Qeb3COuZ?G;w$?&mlB^#C*k^Ar-aJ
z`*%x3C@j6+6L#hRFzA+SWng-jJuKKIk3ZTr`&RNymIXPZ<TRZ@x8}4=or3TL4g}r8
zINW>Me|2*3eJ=>rn(HLX0(3Lw)5wSLk|ybKBgGvU!T$Kiim}V*G9{Mfn67w&+vz*3
zg4H8HD71jqPf>A19IC*~mN5LDd12<<mkD|pl_`)Gy9#Zytj7`bSPyn1R(F;m&QFc9
z(S@|M91_Qe)UhwC#zVeva$&#?j@->CPk*V8eHP^g1A#z{d!%7C7N|7Ja}=JKLwiVR
z)~Eu#A4Y=e!-55~5c>c@7&l65uM)6%moN=CDt1G)V%(`Z^DvfhG|lxpsA!s{ZSftJ
zh0Tn$rlM;ae!}YhJ!q&HSA_?x+_c#%9#0_<0X#9HwNxO>f+EJDO9x0y8c2M{j<PDV
zREkA5+Xg7T2w43@-FMYsb8hPvtI09ZF(_;}p(@QI^FSmGZFZVcK27cdq{N}`leHvc
zdv?(O?&$eJZ*Faka$rJmxoKSI8mHX_@@FUQJ(Skg%sZ78?n7^S3)@unPbj^VMydBO
z+u){g!=8|kb8^ayRHSD#XM2S9``iR9bjxNZ!Z|+|Aq<}Ki$-!q^>;VLsyPK4sbZ{=
z_?$;<ho)`Y?0X)Ikw9L$h&JKzxxiL}t`v|&Qg_@`oNJ+#CS`DPe{CI}oxP&tSZ)J^
zJBxi*N7h>pSrhK28O(e%TriWdvL=-RYdR@>bWK&`K0&$pF)$h3CEaGT-Pvul@Lzk?
z+#kVq*j+^*LoiGD{g7%X(#v=viD2D_*c3G?uSnYA`_5qshH-d-)!Sy(@+esUi1lRY
z#YZnDpQu-oB9hO%Tt?V;duM0I4M-lO6Kxql$fhCVM&xO5+a!(sH1;=6Ct{RtoXE{E
zyo!L0mJGk@I`kw1oxNvkZ)7;I(HQ)23@0c8J)92Nq>T-c7NZquVm2IE+LYDf5xc{%
zush6W25p5BX9MQE_&ImoiQv+JBYfb6>$d0oifR0XgWoTo<>$XLEB6T#z&rB4t<9Zw
zp8w&C^1t29FZthR`ON2kCt`}wOWKw^1DwnE940$6-;(*b8cRdOqV!aiLl5%MV-e)L
za=XMVIgZZZ+;=v^F!_{N7Vq<0<Hlc=S+3CMPn24IMD+4`bHT!6o@7oV)It#f!U_3|
zl9nEMWm=FeBbwzD?KvNh1stxP?};p3*ODqsygip4n-!VbXg<g)tv(57vC9{_J5LIy
zo;lxg+Mz-um8wGI8C__5SdI~EOa+C#hu1}P*sZH))xw)vN!fZ2i}<jVoT#0Fl`F4C
zE*k#OG04k~?h(FgZ+us_vXCZZXyEy$Aw}6%;kY>~CT3x_T}b<5Hkf=`O)<teIRJep
z2Tya6nMIIHk279T()E^#CXi-;-s?i--TF<@=gnuyOM1Sbn|IL17DD+#n@V|Vb>3gf
zrSHlnjdBKk7vQ^vPSA3GsuF@sp%wA-47$A#v5NEx6<V=`<z%sOSMuC66~Sr~Y!#az
zHwAD8JgW*7)tjk0E1iWY&-X_;Pl~6sl)I`htNSbas%=FDs#5KsYR1Z}FPixx4b?{5
zE~VHo#46*vN8((G@gDi%&VBMj_Rw0HAljcK^J7-0MbEFnhi86&tF_hB6+UI7Li?lg
z!zzaSvh3;}nH8DIzjVO$SN2(o|4$C~p1wF}OubKs<M#JITDx2At?c~|ME-RCv$egs
z^CkZO9G^8E0!j^Fqyg+t|NL)kZf_aJ;mYG6Ss$6t5oGb6`H!>5;`Ql}v9`wcLwJT@
zmWGBg7z_;kY6QGYRb^u7vsOw<W<xUi6c~8|F>-*^1Ynk3SYEy<gOM~_fpb2D=r`De
z$MW&H6|<vYT-jMRV>xJQ0XLmtR>5J`>G#j7p_dMj3jkSaHFC7yv0lAgF~8~r*{D8A
ztKel8AIDPQh_LcpLuMB;ze;94<yXdvBx)IGyfWEXiNv^r(gL_neqO&k+CR=?eO7YO
zRAEbmJeh((m)>Ms1s6%G9Lmb?4#|X4oxqO~h$2Y}BZ^BMDpZos<@ENCE%n%V?o_Cz
zC7*i_JOS~_9;)pjU^qumOAo!z@3Dl_UI7Inu-S*7kvdZZFLiVNAvDTmJbKkAML6Pz
zxYAi1;$_aZj1hOzSuA5RuYoj}j`t9)?Vp~4Uvkt2LoO?vq40%FEm9#%j(H;g(@cP5
z15%7QJ-qK=x5`nD3hQJ#;!cDUhs^{rMTnh!<f|<OvMK2(b8RXD{iLe(zyEDB)Agai
z0A_Z<3V#yL<f~l~Rz_zLfuWysRd2e~mS1!!o<&vfhshU!#_~M^B(IJSm2(Uaaa8Qk
z6LjifFUpbgm#1!fypLXt`P0Art9~!0VLZ)ji>46K6lqEbzFM(>%@Umb)9&^onWz<S
zXGQc#?uY+CJU1SLg8?{fIN&ijn8>qCSgnxOZDm$e*&<s8)HFx#4$>cDPpp~QF!r-|
zCNMjf2<e$*1s$Hz!buMFWDl^>Sm*$DA$8cw3ZHNYIT0y6rRR&ONL9iGIqLK|t2gLm
z7g5(lkkYQNJFYrGqT0jyI#nNFgyai#QhgoY7{{|H3fVyJ>Vch^kgf{C^!f3ivY;}M
zCjuXSHfW=t%QFG_lHOx|K6QF}$OaxC_T{cYNE!qjF>V+P8tnPw!k(QwnHFRFxkA<~
zq|UO5BPl19RZD}{qT{d+|IXCel?pNOLz7J^gq|_&VXH)oQB8-eps2;cg*8jTRdXOM
zU=%}*)hQVG$YXAlN)}#D9fY(8;|@}Eg+<nSG)=aIR5pfH%TZ$+?5P4;!_LghN75#Y
zNx+HA<x4tYS9)Yw26R1Exq`(|(J*9zZNYqJW?7k5N3G(P=SeDo<Q825k+nrxSX^`}
zRCywuiG<_w%ogX%9Lz%<(7u2G1E5v5n5=l$sI!44dZ3Q>=zwx~-^UUJrRUZ9oIen<
zKB%b^UtK<`Wv8V~LX>$VK`G^pm?3uoXQfrM!R<xH0X^TTvQZs&F`gf)$#-XE^w6Ls
zXDl92-X@E_nT$4a4=7hrD;+!0CN9b{6qGDgZHiJ-xh`0nCkrZWQ36dbo66TeNgRXf
z&}D!%3|0gn2qDQ(l07?zJ_NLJu?Cn(QIngDHa!R)fd{1OGji)wS*NC6MRLP7jLil+
zo#m%)P}^9n$TI<LDqkO7UoU5z>+4i_u_o}lF#CS!c=n1URNLS@P%?~D*@>N@<diFP
zEwc!@5&Z?5^tSD_xM3DGq4d;Ol`cHatBb}xtBbd&1mi}gsSS1{T{#(wRH*$}3M?T%
zS<(FPbBQ0izFNHxtFnvgkxN1L%IZuO_o>6ql7&;wcNV~d>L&$s2%v%xS;l|0Pj+J<
z$!SX6YMw_)-SH4EH8V(c#k2grpPi=kJFU)6>vyeo9a%Hd=EfwQ`U9m`FRAE;{jGS~
zZgh4V(Cs{b^C<S9-9Vv3*j48-Y*4|V0a=OXTqZP}h463k)&7K@iL=O3)ra)f{se|<
zkRUwpy*kzidr~8CK1a|ODT6dXNFLNhKs_;!Lb_5pN!|lJPY1THB!ZE$yr^HXum&Dv
zI}EX@XfVHw{4hp5FH&F5Ccu3KnCR9WwsM1+Hc2~`pFlIjm&GG*b6onHEDbHyfAmK9
zlsNAH_g}W#?e?y$|7^Fv{QZ~D@mVGR!Xo^793Lb9&aV3VFI&4`<o`K7cgsKb2)`J|
z9e@9))oJY%fB$D^=K&hF+O043-_P;6zRn~~4^Ae$IpL0Hvc}Dg@lBFm`TU9TRpb4%
zF6&U&##dj-_k|GQbt%lH@QnW+t%w@qksn@k*+h7V`lu~(JgR+l*=A!KK{MQ}ylml%
zx>J6c))6s|1NGN4c#PJY|6}i3;GxX^KBC4wg(UG9_cCKHX3V&YNFuANN{lhX)M&=c
zxcx;+VM{8y*ixI&w!0<WZxmg~rMpULRW21<OHoMbJ?EKmP3^Y3Z~xExd3*3&&+|LK
z+xb1``JU(e^w(x>9mrzCWGApzCJG#jtPw2MW)KsMK=3jP-pS!vbW)@>LV)|Q?-Yzq
zva|+A@(|)-aB;m*k13S^Ss|lqh6o`Mj1Ynm=#d5oG6v;Of!S_|G|*QSfzFN)yjj4>
z>r{e~nfY*3DJVS>RYH|UF+zy_WCx^S`6OAfaA;B+9NN1UTEq7N)?n4(P_zx|C6plm
zT|(<#-9oSqAxadCP74N?NCbWqJQmLZ9&iG@ih_Eqkstw&j}wM4f_Rap1aO%jg^(=4
z3S}G4VX^{$BoZBRO`@2Y4Q2)jA)>6Xfr)T%{uwYQml4W0B?(~G2}(qyIq(2zbyPaE
zSfqp%8UZyH1SWBP?BR(v10;iq2ncwpL?$sFh65^NqOOG_;0Yx3(m;;*crNf_iGreV
z5=B_{66q(6>Wd^fJwO1!1Esgd!MssXZ->>3q5%awjnZE?Q^XLWmBNo&xeRcf&1H!-
z4Ys&Q0fTRiz%@J-3=jGRTLR(`haHXUbM&E20ws<Q=imb&T(eBv7JFM50dFO4VU`1B
z>D4k-tYw%N3g}KeWf<N=k;o{iL4q9%hw6<wRBxnVoUKpfU;!rxl@Dxjy|D$RUI-6e
zCWJwQ52`VR_u|+bkvRm2L0zV(zCi<F3sC<OtEZQEznl_B|A=Xn=Z^%W551p=CyVt&
z9;~hb(E`HbrZ{n~2wWg93I_usOJI%|unF+TtY4LY9%v;X{&0c@-6do(A-pVzmbCo-
zDb{$RSh|6+56+QA&%sb2iE8LR2!5exoDd=`5Sh&p$c?y}4mkahDy&0bFh&*9M@B*s
zn!?u<N9IRKr0AuGYL+ml-49@zKr{PT;cy=UX@mS-JjQ_Qb$e7o9Oz+$3I{m!XMDXk
zW|8_V)7$d;&wOO%!R`rc2HHm`+BPK@P^(xYFtfo>V~g{D^ha<anG(bb2F4br5&=8n
zWFf;SAcQ<90*m7mnKE23Aq?-c{J{i<+y>m2G<*!AP=*E}l9;$-C<{E05K}SYCG2%a
zChXmTFwYPyHAAZ$)Nqi$<orYi{4ujZVqs0T7LvY!Z4f5{!bvPUESzMDMc~*Hj>`yS
zaqX}%F&s96cNfkAUcd^9jg5(6ilXo{(6@X1YypDpd%MTNi*QcSFopWx?8T*)0ZLc|
z9Y?amqBx1fk5C8(3;HW4Q<4IbM*=)8Zwu2&3_g!ONwJ7fz=Z5NLD*-Gfa?wP$BBxK
z9W;Ur^BIcJQhdG_Ba{`}pLqj3QTtPDzyq|l5TgBn!nPLR7@p?$vH+h^Xi0f@E+Ptt
zgI*9jgP=qou8K~I;PRMoxQoGNbAsT&9SaX{auehC92inzcZdh$4X_+gJ{&t_AtK<>
z95K2Nf|N)++9iV6AJ1Hprx6i@;S44dm|q0R+FI~YE(fa+K77Qi4z(#fCvVH>EgKHu
zRt|9KXhi&+0(t?;l&Ec1cp%U&(5sjhqy`7iu@ZC%Cq{#?pqmsMYrHH_$hY~d%ZTf?
zVAy}mL|+L0EE^I)$pY2jCwS_^vOde!AZThRYrU@h_jDC5WC<+Lap6yJD1p~L%bx@(
z`@f~MWn%xbwE)ftn|1GYuy6KuTd>3Ut>l`R%OTeQqgeY-I3S4x8?3lG*pkWib9-AM
z9G?Y&12ku{_#)rl8%2gCvsAgP2>3G9hxiIOLY_d#>K*dMBa+6><OOk<=%)mse3;o1
zfmuW$Rvg5E2saPk+Y)=(_=lnm#At^Ta28Cy3cu(CJ_$dj9w?v_I_eAEl_x@H6SDe4
z2|CgYy5(?;9Y!18;D97fvdR>&B*OyYL*Qnd2o5@T>ED*KADJHBjOdIhIGhU=&jltJ
zDCiXQMwZYVe(ebne-y7r#g)WWu@r1>I0(h?vvFQ9{7ORd%@Z7Ll8oAk&5Q7YflmZ;
zc!Gc5pb$bIPQ;mf)-uV*^aDk6<_SfDaE|1g2N8?8j0b}Xun6E>gnBk7kR<>PDxS)V
z1OkVL30?bgID%dsa02+@i0Hy@=%&nYIHJx$0)dMMe=MM6E7^PmG_ZNVnFL~};lGW7
z{Qq4(h5tzg!v2*yz8wFj5=h_h-><U#iTx!5q5rIoFSoxHnfz`1=c_D#&HnH`=<nC@
zMfRtVApTDzSbnqr*I53#{Re#R{DpP=$@l+6GKJDV{zHWJCy~DW|A()${H?^mR7>#N
zhkn4_Uho6#+bjH&q`zM$!LP!A6ssgWg^K1?74JxdqR{X(TEAS9Lzu0XXo)A#hDp_{
z@CC_sJrN4tii(g)cme@&LP%6R$x^Zwr@999f&I^1@4tP4Cql#12M{B}{|6ynOA1rq
z{->`GxP5^{kUr%Q@kA1;9U=u!?pF^PKM?XFgG1Vo1hNCEkm-0T?H^O==Y>qbQ~Rla
z^H$V;G9)~eK9q_$aqYL)jE|QukN^B-|8o2%5iCg`#eYlUxA^}xmhZj2+>{lxVbf4{
zpXTBNwvO-*GZL(S;e^#nNsVZ7cX65>mHA>}lh18}R!?*1$hw-{$Yt#A{pX)Oi+_F?
zvx+-&cU>a3MlN!EB+GwMSjh=uY~tGyf$5f>=|^*46xxv^pLpHPyk+5kt6{m6nNNeI
z(r;r&P2VUtGXB#0qW7x!nxA6>=m%GJjClHX6z)l=zpr&(rCZbLtiYg6L3PGb_wtUV
zWNO`%Q5rXKV~4&YyD_7x5bx)5RxV#D{<R!W%~n;*%rJSf0^tPSty*y$-T)`v$`fAo
z!(>Sr$koODah%5{Yt@-=-@a+9)K=+yO2xS1Iq^4Sf_#h4Wz?+Sd*b3nn<bt<>$Em|
z?rODOkDKNzr6_frj@8kqbsw|g_;24w&fD=}0<t6QvQB=%bM^Y3ww_Ss1Jeo*DV_Ax
zw&4WF9K>YY4^M0PndBU;SP<K!o_$u?-7TIa^}O=>cl_0bk2>Xp%6=&|c({;LzAG<f
zFZ=1(5A7}w{N``&=*jJ*%Wk|>HE;X!6>H>U_0vj2xK7urrzpORcK4JWvp~kS(>48E
zgz@q^^Q-<@Q#%juGm$YWayc8>`7rph>SjIrXeFwA-n6yecX*K_a!(W$wpex*lhSv%
z23tL=KfR>gCGeqCfsXgX#C^8;+shJ~@m(hpMB`3&C+PcY|CS#7-CeJ-i~TmXsQAb{
z=yFd#w|I=+E3IP_k7Aa#39zOn#aUWurTdz^^|YcD2wjsi!+ID2u~%&rHe&-iMazG*
zcMbn(fjUMm<H3<1-><LhOfN+q%1k&?XL?;%o~^h@?quP%2WPJZ3QO!1a<Bn8ru4@f
z!txg4$L07T%_Ciu^Q2D1)%2`rpZ)5*Uj6eqXC`n@HLSFh*|W^C3KQg0rKp&ui2V+E
zYJh0K;_IEur2Qy+@0>1LdUemV>zBJQ)8rn7>R9Bvt++=rn0=$-18uqiO7{TgrD0LW
z(a!k{!8sY<*{9oA#2-~mmeVrY6Yr<Jj(j=y&@Z|#t1^6K^VemEU0mWC+WySU@pvWX
zloNea{`+{E(;Yp>DN7e*h9_T?-tTPK$_b0$q`byVmA_+<6S#5ryNP4FQgCk`VFVL)
zU`CaD=1s&Y?a;Y4sr#jw^VzZPKiEY6)bT=awnthua?d*1tp&UlMOPf6eHMG&(Z>qb
zCazJv7V>Jpvy1GzcIoAn80D?oXX_T(KPIeClRECX)y2=|CcdYYqONN$OjE8fQ;}-@
zL+;_EUsvrcJv!&kiFwtei_!6x9={tp?ef*m&eD*tF{;;yP|jR*sAAM4soHHCa$}|5
zY8Z5`sPkY;y}PY6)z6YOUTQ*H-FdT_(u7s}v~Rhuij&3UEJ<<kX&!l3vr*A>i!8DU
zw<X(5F!6&_(iroGHLOEBU}SKg>gAF*C1BNmF*to&{@0hk{`?<qw&`E1<4>Od;I-d!
z$n&3UW%X_T_g7hldHx@Te;66CK74Q!OG-+SEP4L#d>Wzdrk(ik-jPV;w^Yo?6ep~2
zK-rY7N*RW$)DXu-MZ5ft7#gi2W+;`&W+lJyYuQz}vuSBY&yDOmtMi(ho2TOnuN}0W
zbu%O<x;@Tsj@_Is3l5B&a<g+?%Q(mLYXqb9Hz#1SbX+iv$Q092YOm&PaOi&U2IHvg
zD0e{lWy0FR1OCR({3e#(tvOazyCAo*V!JMvr{3fl_j5yWq^kAfgtZmXsW(E^?!TAa
zoPBKNT)OszmK7qCwTkqsy!8ueJ-k)?=xMd89S0T$&P!EXcuUc(Ibm~lZG4)JJM+yh
zoCmioEX>0&x_g#hj?U|mugcUq;tG~7R%;V1dNAgaa(UL>UrpRne5cMRC%*BOZ93>g
zpZ%Y8m%khFq_T@KBehz|JN0~_Tw}6c<{74=8aX|Hxx>KVn)8es!ov&Rxvw=Y&AsAT
zueMpAu3PZ?^-j;Ex4(K`(}@rmuJ0P(gE2EK&GqDr)mm8=_MtFUVUm(c)dw5rt=S{Z
zpS{hpC~fpKOSoM*uGuv;=E(8Yqr+MQG_uO2{TwVCPZqe_o@tz!dPdLB=El{c-2^Y&
z@|6mjdxhOu25#KMCyK|A(w$P7Ay0qjS*}YpqQ^goYuH*}Ub64HBE_V%a#6C^(OV8x
zOXO|Kz8j(0*7;aiws^-6U4js`wq|z|ZFMuXt~5|Oh3*~Ad)bh&*fd@9MZ0pa|EBq#
zDzo!xx!St)hU6=zZ>NMeW=uMzxxQU_o?W^0zPDMEN;?xTS1MkyD6QHPjZ1BJeYs(N
zPh;+_ryKlt__w`luGxFzpa*?PQQ9g!Cx77#?VEMa&ayQo9k%ewwYR(9YB<wh^LFF5
zA8n*{XzG6)OZE|@@Iua3@zZqDJ=Rpxj-SBGUf(LacU<kRLQ})(&y(sK9OXRH$6MH3
zY%tw(>80JTUNnPUx^k`WPNf?0bi-w;SI|yk%Dhr()JK!(#z!k@ht3@1AAMhn`OkVo
zx0w1%<cS`E4w*)yHmd1L8<k!>oT_OOnG|)Rs3_pr+~SI#y41T~Gfd)Z1F(h$^pZ2!
z3z~}m;XSot2F<H_|3Ph<!18$8B$?eE$x+s_#_7Ol>n<21&n#%9Fmp__?`Z@E<lJ<a
zeZ|J^?Hdz^9|M;-ZPl4~W{=43ic#r-nO#R|x5vtV&=?&eu%s?_xZ07oqRVgL>LR|t
zQAgK4-C*1JpH64b`YqR8Q7!hu?Vyo<a{hX&Q(hXE9(X9o2s{05fu)b8!)jLJl5L$&
zuAgT$?mayIr%2a5H?O~~G<EXjG_5yrpHm$v$~{}O+}BC2VyxN0i_U_5JHpscw=1MX
z)HP~oEQ*V>E<UDXnJxGFm_|n&ZA<-=mg(%wduluH9l}>8)A{>;*_X_8cu*GRd?n?`
z@9yhd)$h)=r?ngSrFJf<LM)x-<~W!?uRPSlE#DBaNyqBFH@SXYc&KZNo5Ov1*5em3
zEOJBSxVzh)+v)qK%*m{MX16G|n~>Zj{Jkv9PoG+KWxk1_B5w@)MN*O<eRE~C7um=A
z)rI?sGl`mwC*L3BlCR!SBG&e_o@#X^licUB3IjY+SFkUYoVvzI9P>k5wW8`|LC|*M
zbn>f>O-bty$f{l58DKc0vZA;;-|29W#d+5#t*!O<&v6oQ54s;8-Jh~7d;FTq?HA0A
z8!x9Q2Tn+^sXEURWCn9H0uEkiB^W2!QbQ7*-sq-xF@jp^v{YE%k0uKib<fhCuyFi@
z#IUitGgPn_<8>USG3#ZR7gS<$9uxJh{wyEl=`&lUB+>1S&bCCim2G1JGjv>%r_%9U
z26w)juC5$t;i?}VFOR;izTf<KT0NF|LF3K&gu9^7S)C67o@OKN2S*kA2=e#R*d6kd
zx2$2U!Q9xKK*@CpnWx!SR=mAVZUTA|#K+`Roq|WE6Sb4d&qoPTVoMZNcv|P42l(p4
zs5yn6Ji6RzHE8559~!-LH-{+ApJ6;IX;SSymZ<3b;VG-VRj{i;sLkT?Lf6I|DOgM$
znLaS;O6~`xf(~2}R&99sN`!sg_S8w|981Bt?=ruojk4w`i00geiFUa;-LwDbj-Nlb
z_fAMZ?^=|>8%$lwiHaSx0JHJh&KmjqN6Ui%|C0ZVaLCCqNu}*@wu@*(NStdL5bF?j
z)Z}$cZk4+Fri3lI>LGX4Ve#V)0j#i+=XMLN@-)-x$4vI9Zdc!DmcL+b9@+Le(}G&G
zR0W&0PiGsoVp7Fx2Q6LAO{K2I+hvSLZ3=KyNlY5YZt-B&=d28s`vGWeJiR36aah7*
z#&*@4)zvI4wWt9ZlTxPt@N8#Ei;^ny<oC)aXQ;eotX6e6UDLQS=Es9((+fJfJQLlB
zwKgfrCmrfvJmIxFr_Ufy=a(#el69foc|-?0-q{yhyjDj^^+-X?BYkRs1)bD$a;ihs
zWlQF@u*vKqp6{vG-^T@Q<Rs29FAvk7Z0qQdQ_y2pqZD&Ux~43QvGlm!i6%Gg+AHx1
zhxas;l6pd>l%+5ut~k<a7Cv132d#U}&F9_IX2y<Kda--16))h$ww1-Vt@i&<duIX<
z_4fDik&-3KUf~-1Od?D6ELk#k5wZ-)zQi;}NJOY8vW0AA3nkTLnURpa$r6QRoor1m
zE|MsEX2ue?y6N7Y`~08Re?G4lUYv8jXZfAqIp_QPneW?g+NCCb_PsU8*Y+U_D1Udy
zZvg%T&WgLv_P-Z$vcV+HWXg3KuVi_Ssq5P-@z(V%IxOm>bHa}_N;}tF)?)-K_TUcG
z<s@>(XmP}hYD7t0k?lKRAZBx&LtGV=x|wakVkY&<lNwL#g>)8}8%1eDWb2h+D}TC<
zZ2<h9&Hwh{D`q|$waoCw#6!{4kHW3uT*k%_UN8LX4MxRz7WVS{-0h4>bfyh5@|hT|
zlc~LJ<!>VNPD;=3UYeJW*g}oBxw%YsGAH0BOZ$=FL5Zqf!KeWb>{$1Ec7N@C2<>>Q
zsE#XgPmfa!+HI-uHnGjk+pmz|<ztsAum@`DGsD|g>M#-IJbxtsi{!oqrX1A0H_^u5
z#ArV(XFseN!+kdu@%9=v1vseWuLx*p@a(2CkBZlmvr=e$q~Gc*O(`B}Y7DsSo>P9}
zJx0?;#r^!d>hbmg+l9ERtj!3P=J%ZW%J1q542|QeCAMJmF#O3q^iCg6&e|-Pzr8@`
ztK1x#u<&^EA>~u>V|)j?dAAzd?voDkcXgk}DD360d%zmP(z%`8x$J###$aR}#U|~D
zU~#z&Zt=`n#XSFs7Qf+vL7bMj7qr?wIMe_R*x9#3MmHi;-p-m~0pdO_K`j<NFzGTa
z)qiH@MC~!7UULzdxSPncJVr9lVCi`_GOugR5_!ki@->C+IqL7{9HUSc78FW;8v%&*
zi!N}N?&faQjTo%Z^!C<>sLi>4ZQph71(n-QWH^zRr{JJkiYW|PKc=?+A^XXUy)l^!
zDl-L?2P0~5?5uiOV8OA=zu)RR3>&ez7<Xo&QFBW!q`Zj>-4JjHegm7yT>hk`*H;Rl
z6|E=W*f(aqPlkoPK9E^aIfe)KNNV&|bkNqM+AK=Fh*Encb2>o0l-grV%S+Vf-Z)SY
zd1WNT?^y;rjkxUe{&_f1!JW@r=9MpJ>GKx5obp%i8n*QM``kS#^R7YZpv*nwqz`%!
z;*?j!(W8Pt^7uf7j)!6B#fxOd&Wq~PrC1um8~VVqL+-=&*ImxebMi+X3QHn0d_vDS
zA^v0#^b$W}!wo5-E(Q?^wo)SaW1G1u-Gl7yN%1_xuj66^g@^QUZ824~X)lTfFNPM+
zq_Lw<Ph+en0w53J)yaK{k{p{bT#iZ_baRh)AA)hISH3B_2)BKY8G@mu$_!=9E-KP#
z$e6J?UajhI%TyQw1~Os<dLaSJ%ihunw*E8Ob8WuT(aCN12xsj7WKVkI{@=>~!Tx+5
zKmYzuR6<IE<p2E}BEA13z5gS<|NHONPp<zz|MCy;<M@waBBEcd{}QC<fB%ZU@%*ow
z@I`$8$7a?X2msJQR-XUOoo1@pUE7yjCkL1~@5dMzyi>_kO^I?dy|VG$es<=Ayi~zz
zYLbUVKc4HFJkX3z68E6>ScDWi)oy#<2Ayd$X`7hfoZHic;M4m&<qw6*lTmU7?@(U%
zEiwT2hdf!5MX!;|{#Nd}rs}u0+WBq?<-aLqsF<cSJb=p2^f!W<+K!cn3d*_AD(Qo$
zM{ep4n`Wk#ai#`8)<&JZAoduPoFaS8q4V^x<<6<x>$acYGq;q|sA0QbJUMWp{Xy7}
zq0If;xwiVeOd%eI0@H}Y&An{`skf+TUA0)`6VC=*6D{-<JA~afYMYuriq_zm%1x-Q
zD7vYd0h4j2b}(~^Z2GvFqNsiMiL=MnWR0FFRi7;7@P@hAw?$Pl=YTCbPcKH4dVh{o
z0N&ff#--5dwRraRNE!+oWDYNgWY$A%-Pit@LSTDG0!-%ZmdBZla?hTz1hF7DRrVwy
zd5jM0vgeZBfH^&anIDpk3d%&1wK0v47g(XE;GZ1tAS<&_EX`<`N)k;$WFU={4CDD@
zW74Ozm6VjO!e{}P=(0TabpJ8TB8B8(8gFuCk1l-u=A^n1s2_T-@NEs1RI3c5o3}@(
zOOaCWLk_g<9cg&_`;KxOW;z&83M1B_GvGsTQo`+<_=HdXV^?MQv4D@QrmSw>F(EFJ
zA(c7}h6No_VXR5`s<c?Le5=~oYN*wo*3I_a*$OE2LbeZo&XY7|bhC}gQe)UcB~_->
zf{6@cRjDL<Z_tzo<4M{p9PQ2Ib~)X2sAu~tivhC55RA{FP<VWNQy47QRS8uYF7%du
ztRZk7qbMsjy<pzsIPKYwot_!zcY^G(tgj>+%DVkYB3ZAc>HP~UL2XmBv8*%iv@NSS
z%b+sDX@+fOwSp-y9yX3VO={lmJA9@sO`aWH{L!X83fOiARGUQGKsJ)$=IdODNY%7E
zS`~AZ!3~j-p~g^Gsqv(}tB3zF6IJ}3>j$EuCZ6Rc(xrhc3{!Rq8lL3?noTUuJ6jvw
z8-A4nGvytW^Ok+!vE`3_M<b^1<{&~s*m~Z;j9LR>RzeSB#?F|es?l{7UWRqf<7~X9
zvRZR@>>ZgaK434L5-(7eb&{_uB!B*vD|7#w$yb6OK_{l3cbqmp0yO|(TM^_4fo`3x
z>CiV8IuA@D;xE@E!(7^$f9qr&s@P>GWN)8`mefHzGBy>t`lWcj^E4J{oPvK?c-1E<
z5<gTE<o#S&6YEx1AYk5CCOiNBaKWjUEc=Xcm(4LPw3}vosEcB)%$R5a!sE9`6#d1F
z3*+E-=I2x%BHx{PgRW_~e8;GKzoTG=hIA4V+HGE^cGJwdSI+do{ELd_*#Ql?jNp&9
zLC^f8s`^B%7LThJU3tHocQ>Q3SBl%{9<AmJscx|jwPtNThQc3$AAs3Ts!TJItA%pm
z&asT2-_oh@%CJt|7nJ1EyKuu^tu(hHi^f=*4GB$meErhf?ATjNRO=AScnt07#osEz
zt-$8>)u0~p_^E}IbNvkYd9Lxj`2($8v5is}blWs9W$Tn2*v!{G6OHuKZh3L?UMAvs
zpa$z@SgepG^2!L4^}L&O>lUu=nLbTSQ4-QAdr#{SL(|APD!bcsX<G3PSl+kW=}TM>
zN<QCy&TlAmf>OlqO~LPR`Q+Iy-t?0XPTn%d?9<FlqV2rMiEOUACYDiJctp?w+}WG%
znr5h3qVcFTmni~C57fmSp*D#Xj1`hStqIAd_pJ1r^u3SBaGi|y1GH@p2WM-dT-5Bk
z)H;u6=O7+nG7Wjy?RdsOdwV$KTXX62DHmezz)KDFWrcEf<U5woN3#lnN1!N|vrIAJ
zIAdt944az^4vOM_H<9UTgtt&Oxu<(%OKUhXDweyo(MJ~zWQ>T^pX9fQLOjGEcyth~
z8tAS?1L1_=4A)HNo{>s)>NGb#k*Au!%s}{J@WYZI+#yRn5LiICd*riy2|dRLh|COC
z9fHS)ifc$U<YR+K4+V%#)V4egF<lAHR=`q*Qi);{+*HFB9-RkEamB;6rIk0+(?{SA
zWws;|e@TM{Q@*x9H81XW6)1j?!h7o3OJgxCCB5oZSdg~V@oU0Wu^!=uSOp1J0jkNy
za|1;NMwRpoa?ZgvavBybo|by%IBn^o7~Uf+wLOJbof#q`_uNp%|DjsK?3E^SCA|T2
zGG*PU6oYJj{y?cfcfVv&j4B1~i7YQHWiA6##Eyd?cCK?rS;wD$hCL3h4!jh?c$Z45
zdJ7}BcJ@dJV^M4{r82%X!Ikvflp#E-JE+w!0*ymH#y=J!%hzYHLRi+98=xKM+5wEq
zru6ZB@~N8LeB1_p-n<Lqk^uXL1*SEb2?J1>!XJn0x$Z-qPVQ)1?pV0AZ&l^_PgO7U
zJ<4ZT87P9G>RYgkq-n*Pg*nb{BfU=|UUHv3ajBP1Db__(eZ%x?BkBAj3{J!2A9`eL
zpeXtvbMjzE`@2Ktn*ipT%BrhYAHq6NFy-KcnbKpMq#4|7X;^h3FHuKD$e4K9xr~%U
zU>*Jr<{I7UX(^jyDb*oHFn;#C1CSh4i9b0LAA6VPYigk}-Ww2U<y!%U*q6r9&t7(o
z<m2-a(vBx}YRKbL@!dFHhlW+1KQY9rEpt3{R~4db1eLNGKSmb`jZjrZVejA*-CYGW
zWcC-u5C-*db+8SF9$avfts<C5mFX}x0bVU3?nV22?3_gj85wW4r=~hw>;x!jdvyq#
zn6`|vMGH9DO$k7?Rb&X_s|=B<h=Hke;S23kXr-m(#RB^0?`q2+CDSt5`VXVH!Rk1O
z`19EYyXmWLN=j7fkZs<~`4CLcF-%l&E;sH}uT=?IAU}H+kDBfC052>BP5#l|4<W5a
zSJRQ6KDts$fiQpwDy5j}qWS)M3J`rhNE`iD)Kjs+SWGP(re-*<rD?LuUl^1WhahL7
z+Nv+xnplaPc^gHm&(99n#&mU@FY6NC)R+lB+YNn`n10EJ4|4}!cDOd?Fu5I5pEP=!
z6f3;jGB#4jri4s0gd7BI3q35UbRVXqfr|q}b7G^%k}W#{{j`0IuqTZ}o*%ru&`EFo
zK1O$V<$cPI@=rrIU9PEa8MvET5q@*xK3e#rxc8)|1;M_qGyrABJp||%<cErUI$}`d
zHiV-XWE#Kz89FiJC6#sQ`c7M4pV7vm)Eqrj>}@$M&0<wt0Yi|h57i;*fYzFNy}sDk
zF;{6MSs>L`zye>^!@>f(Vo<7=|0jES|GnTYxxgnBn?daQma+g;Aq02ku<?GNb|-)w
zduCtq{^#YFT0<at$RSe^vQ0WDCbrgaq5P_yH6Bgd`||6y_nAeGsrVtU?I?f&U^V9u
z0FfdkoQ1W@e!v?l3&|T5WdSX;g@@i7h2Qi#X+YRBB(H})L>2e?J7`==;fH%xeVTDB
zH>|c__>}et%9HELJ(7f-n}zSSlA}_Mgn><Zk+W#f0L`d~LUXksX8OWtN<9mC3+2{4
zh*#%L@7SiDN$DKYhAPe1ylu&;-6S}Aj(!w0l~A2GD;!ft%*&46C2W3eaZ?{Bes_~q
zfYsX2IKdW$*a~8ls`Y3rdZESh7n`cPF}~0@gX;5k_l0)f+hcy2sjN8eX7WUzh>x>L
zQv5zdo8UEA^KWRM;NgB;Vub2bpT%o8*>;?)w43wx>Ip>@JDBuNpD~dzn82R_ns0F&
z;BdcXm#bQtRaiYd)Vr{2jvIm!(Cb#*k$6={EqzG(b6j2H^E<dZjk|h|x&-rDm}#A`
z93MN?2`^#PRTcwCBQ%|8a*d<`J3B!zo&)0cx8wYe_gi>D3t?BTWBdyqrx}JBbI~@J
zrz6Rj(dW%CY55wPDdy5Pcx8X~PktcppTF>%{PZlEE7#E|3sFf{QO{pDJ0xb4@2ta?
z(9C{xp+8-WYW5Fw>h?jO*&yDQL`IfBt{<Zq=`#pLxSSq+T@AD_^I&`cHE1zVX2I{r
zI_}VjBPGv5v_?;cnS{;i7D4t?J6ws<i7*xtw`rA_HB5{Oi(|M1(_$R5b2;rIx6K`X
z&-vP}X(K)T(hmHIB{`Jk2CT>ypX9sEz37Zi{H|$ew(p)N)VYq}`&7k_hb3=R7H<ig
z>KGo1XuAV78mJGwY^&>UH(F8T8c@Y)k_f-gXK{O8cW^4}tWCxIfPBC$)u-(Tsqk~a
zgc;j<pCaJNHR(aQQ+dOSJi7oA=j>cqkrEsjT9qWBz3H~KFWR5HG@CJdsJ$QlDJS3<
z8D+6|SGcRr1$f=FxadnD;_*JNxJ+uuq>@pcz3?I#O>w_|0TVqozz7Gj_&EQVMoujC
zfQ9eOLYk6DR;5OLJHl}nMKP13sJM;u=(6iVz1a}dUCFVl6R`dIE6*`KDCafZTj80m
z0T+U`c6B>HJ8n;C$4<tkd%DA5Xfw^FxYzP0D2j%cja;tW)&ArF-{_o%B2q%9W*>Q%
zWsLV4$Ae)eS-r)eR1f&HqKHKbv!)ER-NS3)Qe3({w`sncdx`tj53FI8=-e2ek{k!-
z(71Fr<;Hi}Q*$g!e|(kaFo9zfQX8vI#Pvm?Yso*+9K!yN_nDryi-++&WvJ%uc#YAu
z+r)3fL})3|<vMR`dM@dYQB<j*DS`~tZ6?7)X{?XR-HLsp_GjNN3j5h~rVUJ4kfcCx
zJpYp)ivJhstLHzzko&%(zyAD}sHmuz_{!(M#KpwLh@bx?#Q!5b|M}n7dj8*97RU)}
zH*1GwI>btlasq7OO90^Sh6(;@VBa#b5C3DC+P9&g;(y7h|E{eK#uoo>`St7wV*Ke9
z9x?a-8L)oi6ha+6RYEpjQCXqoR^w~5vGyQXC!}#NMKoVdJF_xcV4y5eP7a^22fWO0
zBQh3wMS$ji&I;w0TOtvP5lYy3Slj%|>_Z-)&_C2_@ZdGHEgg4TYhvgFe6NWEwI)sF
zFBtd#xGl@$yGnK;UQZAqk`oX}L|+poiY+0qf*_wM-w8fjAwCG74xb?r3BQ)dxOVpW
ztp=y(^(7j?&w>>)9oG_@Zh0E6$Iz|6POCtN)riUhE5!team<&<jMhNV^2Kv<TT|w^
zH4)Wft+;drSFa%vI!8^oyF|f2<&6g7Uk&k$FS(XGxq{oX`!TQ&2qiGczRvptG~a4%
zONhU9tiJWsLVVBM;XoK+7`_#g{HuE8fVS?`OH0i+JHZQE-;(cEzHjX!0^<gAuV!CC
z1^&tE`ogd;`M*s1<twvHLtjUBUQ>byJOtwV;YN(Z?doAiz23}HxDo5W1VHWux;d?Y
zAc^(C?S#44%o8y%P=&}>u(fjnx)B+L1kM8WkBN^Pz$x0mzT6Cdp9Hzi$~RDpdo}`N
z{1YCO$do`h$r6%WJ%B>48*0fna(=5e;=qcp0Ug@7!{Nl}KOiSpLgbqz63i0i(7_45
z46RvawJcEw3H|;d6mea@R%=@(WDu%bQ<4ZeB{Xb5co~04h`U4J1FRqofW&oi#pGHD
ztUNDqq2peY`~?Op|J9wkl;aBwR{jeI6`$@0RQMCs@@p*Z>Pchy79rww*B0^nCHuo_
z*H<AKYj=pBCit%3Gq}IAntq?-`%@&}f0O0AZn^j#&ld>XDA9K*=LVR*U){DpMfF|2
z3k|->-PkbIclomYdY136q51w@p6>>UzQ3C3yS%6U9gOc!f_#4|%6GZpD|f-)1Nwfs
zLDnyR|02})o0a_l>-!h0^B1r$VN}+jeK)jweY3V-v#>8YKr6n}l5-~i#o1gluhzK+
z)XRsg_1nR(@{E=#ID$kE$>)dg;=fBP-ax0nm|kHcFRh(lsCtBdSppMJN524m{ExB5
z8*jxbwDf12uv+k2^%Ew*H^|CB5OI{jB*HRDB#}fCNhFa(5=kVHL=s6Pkwg+nB#}fC
XNhFa(5=kWef7ky2_jGVJ0LTCUArl+R

diff --git a/install_backup_gitea.sh b/install_backup_gitea.sh
deleted file mode 100644
index 7fa4322..0000000
--- a/install_backup_gitea.sh
+++ /dev/null
@@ -1,59 +0,0 @@
-# ============================================================
-# INSTALLAZIONE BACKUP AUTOMATICO GITEA  (da eseguire da ROOT)
-# Incolla tutto questo blocco nel terminale root del VPS.
-# ============================================================
-
-# 1) Crea la directory backup
-mkdir -p /var/backups/gitea
-
-# 2) Scrivi lo script di backup in /usr/local/sbin (autosufficiente)
-cat > /usr/local/sbin/backup_gitea.sh <<'EOF'
-#!/bin/bash
-# Backup automatico Gitea via `gitea dump` (db sqlite + repos + config in un unico zip).
-# Retention: 14 giorni (modificare KEEP_DAYS).
-set -euo pipefail
-
-BACKUP_DIR=/var/backups/gitea
-KEEP_DAYS=14
-STAMP=$(date +%Y%m%d-%H%M%S)
-ARC="$BACKUP_DIR/gitea-dump-$STAMP.zip"
-
-mkdir -p "$BACKUP_DIR"
-
-# Esegue il dump come utente 'gitea' (stesso user del servizio)
-su -s /bin/bash gitea -c \
-  "/usr/local/bin/gitea dump --config /etc/gitea/app.ini --file '$ARC' --type zip" \
-  >/tmp/gitea-dump.log 2>&1
-
-if [ ! -s "$ARC" ]; then
-  echo "ERRORE: dump non creato" >>/tmp/gitea-dump.log
-  exit 1
-fi
-
-# Pulisce i dump piu' vecchi di KEEP_DAYS
-find "$BACKUP_DIR" -name 'gitea-dump-*.zip' -mtime +"$KEEP_DAYS" -delete
-
-echo "OK: $ARC ($(du -h "$ARC" | cut -f1))"
-EOF
-chmod 0755 /usr/local/sbin/backup_gitea.sh
-
-# 3) TEST: esegui un backup manuale adesso
-/usr/local/sbin/backup_gitea.sh
-ls -lh /var/backups/gitea/
-
-# 4) Installa il cron giornaliero alle 02:30 via /etc/cron.d
-cat > /etc/cron.d/gitea-backup <<'CRON'
-# Backup giornaliero Gitea alle 02:30, stdout/stderr su log
-30 2 * * * root /usr/local/sbin/backup_gitea.sh >>/tmp/gitea-dump.log 2>&1
-CRON
-chmod 0644 /etc/cron.d/gitea-backup
-
-# 5) Verifica
-echo "--- cron installato ---"
-ls -l /etc/cron.d/gitea-backup
-echo "--- contenuto ---"
-cat /etc/cron.d/gitea-backup
-echo "--- sistema crontab attivo? ---"
-systemctl is-active cron 2>/dev/null || service cron status 2>/dev/null | head -2 || echo "cron non attivo (verificare)"
-echo "--- ultimo backup (zona) ---"
-ls -lh /var/backups/gitea/
\ No newline at end of file
diff --git a/install_gitea_vps.sh b/install_gitea_vps.sh
deleted file mode 100644
index edd7d8d..0000000
--- a/install_gitea_vps.sh
+++ /dev/null
@@ -1,249 +0,0 @@
-# Installazione Gitea su VPS OVH — copia/incolla (root/sudo)
-# Obbiettivo: git.zomas.net  (Gitea dietro Apache; non tocca zomas.net / zomas.org)
-# VPS: Debian 12, 4 vCPU, 7.6GB RAM
-# Chi esegue: TU (root o sudo). Esegui i blocchi in ordine.
-
-#
-# ⚠️ PREREQUISITO DNS: prima del Passo 5 deve risolvere pubblicamente:
-#     dig +short git.zomas.net   ->  deve tornare 145.239.94.49
-#     (finché dà NXDOMAIN, SALTA il Passo 5 e resta solo in HTTP)
-#
-
-###############################################################################
-# PASSO 1 — Installa Gitea (binario ufficiale + utente dedicato + sqlite)
-###############################################################################
-
-apt-get update && apt-get upgrade -y
-apt-get install -y git sqlite3 curl wget
-
-# utente di sistema dedicato (senza login)
-adduser --system --group --disabled-password --home /var/lib/gitea gitea
-mkdir -p /etc/gitea /var/lib/gitea/custom /var/lib/gitea/data /var/lib/gitea/log
-chown -R root:gitea /etc/gitea
-chown -R gitea:gitea /var/lib/gitea/
-chmod -R g+rws /var/lib/gitea/
-chmod -R g+rw /var/lib/gitea/
-
-# ultima versione stabile
-VERSION=$(curl -sL https://dl.gitea.com/gitea/version.json | python3 -c "import sys,json;print(json.load(sys.stdin)['latest']['version'])" 2>/dev/null || echo "1.22.0")
-echo "Installazione Gitea $VERSION"
-curl -sL -o /tmp/gitea "https://dl.gitea.com/gitea/$VERSION/gitea-$VERSION-linux-amd64"
-
-# sposta e rendi eseguibile
-install -o root -g root -m 755 /tmp/gitea /usr/local/bin/gitea
-/usr/local/bin/gitea --version
-
-###############################################################################
-# PASSO 2 — Configurazione Gitea (app.ini)
-###############################################################################
-
-cat > /etc/gitea/app.ini <<'EOF'
-RUN_USER = gitea
-RUN_MODE = prod
-
-[server]
-; porta INTERNA: Apache farà da proxy verso questa
-HTTP_PORT = 3000
-HTTP_ADDR = 127.0.0.1
-ROOT_URL  = https://git.zomas.net/
-DOMAIN    = git.zomas.net
-DISABLE_SSH = false
-SSH_PORT = 2222
-LFS_START_SERVER = true
-
-[database]
-DB_TYPE  = sqlite3
-PATH     = /var/lib/gitea/data/gitea.db
-
-[repository]
-ROOT = /var/lib/gitea/data/gitea-repositories
-
-[service]
-DISABLE_REGISTRATION = false   ; metti true quando vuoi bloccare le iscrizioni esterne
-EOF
-
-chown -R gitea:gitea /etc/gitea
-
-###############################################################################
-# PASSO 3 — Servizio systemd
-###############################################################################
-
-tee /etc/systemd/system/gitea.service >/dev/null <<'EOF'
-[Unit]
-Description=Gitea (Git with a cup of tea)
-After=syslog.target
-After=network.target
-
-[Service]
-RestartSec=2s
-Type=simple
-User=gitea
-Group=gitea
-WorkingDirectory=/var/lib/gitea/
-ExecStart=/usr/local/bin/gitea web --config /etc/gitea/app.ini
-Restart=always
-Environment=USER=gitea HOME=/var/lib/gitea GITEA_WORK_DIR=/var/lib/gitea
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-systemctl daemon-reload
-systemctl enable gitea
-systemctl start gitea
-systemctl status gitea --no-pager | head -15
-
-# verifica locale (deve rispondere HTTP)
-curl -sI http://127.0.0.1:3000 | head -3
-
-###############################################################################
-# PASSO 4 — Virtualhost Apache (reverse proxy verso Gitea)
-###############################################################################
-
-# abilita i moduli necessario (i siti zomas.net/zomas.org NON vengono toccati)
-a2enmod proxy_http proxy ssl
-systemctl reload apache2
-
-# virtualhost HTTP (redirect -> https)
-cat > /etc/apache2/sites-available/git.zomas.net.conf <<'EOF'
-<VirtualHost *:80>
-    ServerName git.zomas.net
-    Redirect permanent / https://git.zomas.net/
-</VirtualHost>
-EOF
-
-# virtualhost HTTPS (proxy verso Gitea su 127.0.0.1:3000) — certbot poi aggiunge il SSL
-cat > /etc/apache2/sites-available/git.zomas.net-ssl.conf <<'EOF'
-<VirtualHost *:443>
-    ServerName git.zomas.net
-    CustomLog /var/log/apache2/git.zomas.net-access.log combined
-    ErrorLog  /var/log/apache2/git.zomas.net-error.log
-
-    ProxyPreserveHost On
-    RequestHeader set Host %{HTTP_HOST}e
-    ProxyRequests Off
-    ProxyPass / http://127.0.0.1:3000/
-    ProxyPassReverse / http://127.0.0.1:3000/
-</VirtualHost>
-EOF
-
-# abilita i virtualhost (mantenendo net/org intatti)
-a2ensite git.zomas.net.conf
-a2ensite git.zomas.net-ssl.conf
-systemctl reload apache2
-
-# verifica: il vhost :80 deve rispondere
-curl -sI http://127.0.0.1:80 -H "Host: git.zomas.net" | head -3
-
-###############################################################################
-# PASSO 5 — Certificato HTTPS con Let's Encrypt
-# ⚠️ FAI SOLO QUANDO git.zomas.net risolve pubblicamente (dig +short = 145.239.94.49)
-###############################################################################
-
-# richiedi il certificato per git.zomas.net (usa il vhost :80 come challenge)
-certbot --apache -d git.zomas.net
-# quando ti chiede il redirect HTTP->HTTPS scegli: 2
-
-systemctl reload apache2
-
-# verifica finale HTTPS
-curl -sI https://git.zomas.net | head -3
-
-###############################################################################
-# PRIMO ACCESSO (dopo il Passo 3, già funziona in HTTP)
-###############################################################################
-# Apri nel browser:  https://git.zomas.net   (o http:// se non hai ancora il passo 5)
-# Al primo avvio Gitea mostra la pagina di installazione:
-#   - DB:  SQLite3
-#   - Path DB: /var/lib/gitea/data/gitea.db
-#   - URL:  https://git.zomas.net/
-#   - Crea l'account amministratore (utente final, nome, email, password)
-# Si può rilanciare la procedura con:  su gitea -s /bin/bash -c "cd /var/lib/gitea && /usr/local/bin/gitea admin create-user --username admin --password 'ScegliPasswordSicura' --email you@example.com --admin"
-#   (poi applica via web)
-#
-# Nota SSH: Gitea usa la porta 2222 per git over SSH (oltre alla web). Da client:
-#   git clone ssh://git@git.zomas.net:2222/<utente>/<repo>.git
-
-###############################################################################
-# PASSO 6 — Certificati Let's Encrypt per origine (plugin dns-cloudflare)
-# ⚠️ da eseguire come ROOT sul VPS. Il token CF è già in /tmp/cloudflare_tmp.ini
-# Genera i cert con challenge DNS: funziona anche con i record messi "proxied".
-# NON tocca i vhost esistenti di zomas.net / zomas.org (stesso --cert-name).
-###############################################################################
-
-set -ea
-mkdir -p /root/.config/letsencrypt
-[ -f /tmp/cloudflare_tmp.ini ] && { cp /tmp/cloudflare_tmp.ini /root/.config/letsencrypt/cloudflare.ini; chmod 600 /root/.config/letsencrypt/cloudflare.ini; } || { echo "Manca /tmp/cloudflare_tmp.ini"; exit 1; }
-
-echo "=== 1/3 zomas.net + www ==="
-certbot certonly --dns-cloudflare \
-  --dns-cloudflare-credentials /root/.config/letsencrypt/cloudflare.ini \
-  --dns-cloudflare-propagation-seconds 60 \
-  -d zomas.net -d www.zomas.net \
-  --cert-name zomas.net --non-interactive --agree-tos -m zomas@zomas.net --force-renewal
-
-echo "=== 2/3 zomas.org + www ==="
-certbot certonly --dns-cloudflare \
-  --dns-cloudflare-credentials /root/.config/letsencrypt/cloudflare.ini \
-  --dns-cloudflare-propagation-seconds 60 \
-  -d zomas.org -d www.zomas.org \
-  --cert-name zomas.org --non-interactive --agree-tos -m zomas@zomas.org --force-renewal
-
-echo "=== 3/3 git.zomas.net ==="
-certbot certonly --dns-cloudflare \
-  --dns-cloudflare-credentials /root/.config/letsencrypt/cloudflare.ini \
-  --dns-cloudflare-propagation-seconds 60 \
-  -d git.zomas.net \
-  --cert-name git.zomas.net --non-interactive --agree-tos -m zomas@zomas.net
-
-echo "=== file generati in /etc/letsencrypt/live ==="
-ls -la /etc/letsencrypt/live/
-echo "=== certificati git ==="
-ls -la /etc/letsencrypt/live/git.zomas.net/
-
-###############################################################################
-# PASSO 7 — (dopo aver generato i cert) Completare il vhost SSL di git
-# e riabilitarlo. Il certificato git ora esiste in live/git.zomas.net.
-# ⚠️ Leggi il contenuto di git.zomas.net-ssl.conf e COMPLETA il blocco
-#    aggiungendo: SSLEngine on + SSLCertificateFile/Key con i path git.
-#    Esempio (sostituisci tutto il contenuto del file):
-###############################################################################
-
-cat > /etc/apache2/sites-available/git.zomas.net-ssl.conf <<'EOF'
-<VirtualHost *:443>
-    ServerName git.zomas.net
-    CustomLog /var/log/apache2/git.zomas.net-access.log combined
-    ErrorLog  /var/log/apache2/git.zomas.net-error.log
-
-    SSLEngine on
-    Include /etc/letsencrypt/options-ssl-apache.conf
-    SSLCertificateFile /etc/letsencrypt/live/git.zomas.net/fullchain.pem
-    SSLCertificateKeyFile /etc/letsencrypt/live/git.zomas.net/privkey.pem
-
-    ProxyPreserveHost On
-    RequestHeader set Host %{HTTP_HOST}e
-    ProxyRequests Off
-    ProxyPass / http://127.0.0.1:3000/
-    ProxyPassReverse / http://127.0.0.1:3000/
-</VirtualHost>
-EOF
-
-# riabilita il vhost SSL di git (dopo aver verificato che i cert esistono)
-a2ensite git.zomas.net-ssl.conf
-apache2ctl configtest
-systemctl reload apache2
-
-# verifica certificato da linea di comando
-curl -sk -o /dev/null -w "https git (via IP/SNI) HTTP %{http_code}\n" https://127.0.0.1 -H "Host: git.zomas.net" --resolve git.zomas.net:443:127.0.0.1
-
-###############################################################################
-# PASSO 8 — Pannello Cloudflare: attiva il proxy (arancio) SOLO sui record web
-# ⚠️ NON toccare: MX, mail.*, sole, calendar, docs, _dmarc, SPF, SRV
-# Metti "Proxy (arancio)" su:
-#   - git.zomas.net   (già arancio)
-#   - zomas.net       (A)
-#   - www.zomas.net   (CNAME)
-#   - zomas.org       (A)
-#   - www.zomas.org   (CNAME)
-# Poi in SSL/TLS -> Overview seleziona:  "Full (strict)"
-###############################################################################