From 1626fb062428afc20e1846022f5bdd14a474ddb4 Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Thu, 3 Sep 2026 20:31:28 +0200
Subject: [PATCH 01/20] WHY IS IT NOT WORKING

---
 src/db/interface.rs   |  2 +-
 src/ldap/handler.rs   | 21 +++++++++++++++++++++
 src/ldap/mod.rs       |  2 +-
 src/ldap/op/search.rs |  2 +-
 src/main.rs           | 10 +++-------
 5 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/src/db/interface.rs b/src/db/interface.rs
index 74ce9ee..7a6d8ad 100644
--- a/src/db/interface.rs
+++ b/src/db/interface.rs
@@ -14,7 +14,7 @@ impl<D: DatabaseInterface> DatabaseInterface for Database<D> {
     }
 }
 
-pub trait DatabaseInterface {
+pub trait DatabaseInterface: Clone + Send + Sync + 'static {
     async fn get_user(&self, user: &UserRef) -> Result<Option<User>, BoxedError>;
     async fn create_user(
         &mut self,
diff --git a/src/ldap/handler.rs b/src/ldap/handler.rs
index 32d2ac0..c8af21e 100644
--- a/src/ldap/handler.rs
+++ b/src/ldap/handler.rs
@@ -2,9 +2,30 @@ use ldap3_proto::LdapMsg;
 use ldap3_proto::proto::LdapOp;
 
 use crate::db::{Database, DatabaseInterface};
+use crate::error::GlobalError;
 use crate::ldap::{
     LdapClientState, LdapStream, LdapStreamError, op_bind, op_ext, search_by_mail_filter,
 };
+use crate::listener::Listener;
+
+pub async fn ldap_listen<D: DatabaseInterface>(listener: Listener, db: Database<D>) {
+    // If the connection is None, it's because the client aborted early
+    // so there's nothing to do about it.
+    loop {
+        match listener.accept_ldap().await {
+            Ok(Some(stream)) => {
+                let db = db.clone();
+                tokio::spawn(ldap_handler(stream, db));
+            }
+            Ok(None) => {
+                panic!("LDAP listener closed");
+            }
+            Err(e) => {
+                panic!("Failed to listen on LDAP listener");
+            }
+        }
+    }
+}
 
 #[tracing::instrument(name = "ldap", skip(stream, db), fields(session = %stream.session))]
 pub async fn ldap_handler<D: DatabaseInterface>(mut stream: LdapStream, mut db: Database<D>) {
diff --git a/src/ldap/mod.rs b/src/ldap/mod.rs
index d72d094..dc33d6c 100644
--- a/src/ldap/mod.rs
+++ b/src/ldap/mod.rs
@@ -5,7 +5,7 @@ pub use dn::{Dn, MalformedDn};
 mod filter;
 mod handler;
 mod op;
-pub use handler::ldap_handler;
+pub use handler::ldap_listen;
 pub use op::bind::{BindDn, op_bind};
 pub use op::ext::op_ext;
 pub use op::search::search_by_mail_filter;
diff --git a/src/ldap/op/search.rs b/src/ldap/op/search.rs
index 3255298..b65b160 100644
--- a/src/ldap/op/search.rs
+++ b/src/ldap/op/search.rs
@@ -153,7 +153,7 @@ fn search_entry_from_user(user: &User, req_attrs: &[String]) -> LdapSearchResult
     for attr in req_attrs {
         if let Some(attr_value) = match attr.as_str() {
             "uid" => Some(user.username.clone()),
-            "cn"|"mail" => Some(user.mail.clone()),
+            "cn" | "mail" => Some(user.mail.clone()),
             _ => {
                 tracing::warn!("Ignoring unknown attr in search query: {attr}");
                 None
diff --git a/src/main.rs b/src/main.rs
index 1bcde2c..3cd41f9 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -10,7 +10,7 @@ mod stream;
 use cli::CliArgs;
 use db::{Database, DatabaseInterface, MemoryDatabase, User};
 use error::GlobalError;
-use ldap::ldap_handler;
+use ldap::ldap_listen;
 use listener::ListenerPath;
 
 async fn create_dummy_users<D: DatabaseInterface>(db: &mut Database<D>) {
@@ -44,12 +44,8 @@ async fn main() -> Result<(), GlobalError> {
     let mut db = MemoryDatabase::new();
     create_dummy_users(&mut db).await;
 
-    // If the connection is None, it's because the client aborted early
-    // so there's nothing to do about it.
-    while let Some(stream) = listener.accept_ldap().await? {
-        let db = db.clone();
-        tokio::spawn(ldap_handler(stream, db));
-    }
+    let ldap_db = db.clone();
+    tokio::spawn(ldap_listen(listener, ldap_db));
 
     Ok(())
 }

From 452da7341386b4f011190723ef9219a9408fc5af Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Thu, 3 Sep 2026 21:50:32 +0200
Subject: [PATCH 02/20] feat: Basic HTTP listener

---
 Cargo.lock            | 265 ++++++++++++++++++++++++++++++++++++++++++
 Cargo.toml            |   6 +
 src/cli.rs            |  10 +-
 src/db/interface.rs   |   2 +-
 src/http/mod.rs       |  57 +++++++++
 src/ldap/op/search.rs |   2 +-
 src/main.rs           |  15 ++-
 7 files changed, 350 insertions(+), 7 deletions(-)
 create mode 100644 src/http/mod.rs

diff --git a/Cargo.lock b/Cargo.lock
index 696a646..929b28a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -33,6 +33,64 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -67,6 +125,24 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 name = "dn_escape"
 version = "0.1.0"
 
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+]
+
 [[package]]
 name = "futures-core"
 version = "0.3.34"
@@ -121,6 +197,92 @@ dependencies = [
  "r-efi",
 ]
 
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "bytes",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
 [[package]]
 name = "js-sys"
 version = "0.3.104"
@@ -176,6 +338,7 @@ name = "llldap"
 version = "0.1.0"
 dependencies = [
  "argh",
+ "axum",
  "camino",
  "dn_escape",
  "futures-util",
@@ -183,6 +346,7 @@ dependencies = [
  "serde",
  "tokio",
  "tokio-util",
+ "tower",
  "tracing",
  "tracing-subscriber",
  "uuid",
@@ -194,12 +358,24 @@ version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
 [[package]]
 name = "memchr"
 version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
 [[package]]
 name = "minimal-lexical"
 version = "0.2.1"
@@ -269,6 +445,12 @@ version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7011d97b484a5ebdc4b1fdb3b12d5e4bbbea56e9d22b688f2e79e04b65a7d8a6"
 
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
@@ -305,6 +487,12 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
 [[package]]
 name = "serde"
 version = "1.0.229"
@@ -335,6 +523,42 @@ dependencies = [
  "syn 3.0.4",
 ]
 
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -388,6 +612,12 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+
 [[package]]
 name = "thiserror"
 version = "2.0.20"
@@ -456,12 +686,41 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
 [[package]]
 name = "tracing"
 version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
+ "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -601,3 +860,9 @@ checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
  "windows-link",
 ]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/Cargo.toml b/Cargo.toml
index 0ea53c5..4b0be25 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,6 +5,7 @@ edition = "2024"
 
 [dependencies]
 argh = "0.1.19"
+axum = { version = "0.8.9", optional = true }
 camino = "1.2.5"
 dn_escape = { path = "vendor/dn_escape" }
 futures-util = { version = "0.3.34", features = ["sink"] }
@@ -12,6 +13,7 @@ ldap3_proto = "0.8.1"
 serde = { version = "1.0.229", features = ["derive"] }
 tokio = { version = "1.53.1", features = ["macros", "net", "rt", "time", "sync"] }
 tokio-util = { version = "0.7.19", features = ["codec"] }
+tower = "0.5.3"
 tracing = "0.1.44"
 tracing-subscriber = "0.3.23"
 uuid = { version = "1.26.0", features = ["v4"] }
@@ -22,3 +24,7 @@ complexity = "deny"
 pedantic = "deny"
 perf = "deny"
 style = "deny"
+
+[features]
+default = [ "http" ]
+http = ["dep:axum"]
diff --git a/src/cli.rs b/src/cli.rs
index f93abe3..6867704 100644
--- a/src/cli.rs
+++ b/src/cli.rs
@@ -3,7 +3,11 @@ use argh::FromArgs;
 /// Run the llldap server
 #[derive(FromArgs)]
 pub struct CliArgs {
-    /// address or socket to listen on
-    #[argh(positional, default = "String::from(\"127.0.0.1:3389\")")]
-    pub listen: String,
+    /// address or socket to listen on for LDAP connections
+    #[argh(option, default = "String::from(\"127.0.0.1:3389\")")]
+    pub listen_ldap: String,
+
+    /// address or socket to listen on for HTTP connections
+    #[argh(option, default = "String::from(\"127.0.0.1:3390\")")]
+    pub listen_http: String,
 }
diff --git a/src/db/interface.rs b/src/db/interface.rs
index 74ce9ee..7a6d8ad 100644
--- a/src/db/interface.rs
+++ b/src/db/interface.rs
@@ -14,7 +14,7 @@ impl<D: DatabaseInterface> DatabaseInterface for Database<D> {
     }
 }
 
-pub trait DatabaseInterface {
+pub trait DatabaseInterface: Clone + Send + Sync + 'static {
     async fn get_user(&self, user: &UserRef) -> Result<Option<User>, BoxedError>;
     async fn create_user(
         &mut self,
diff --git a/src/http/mod.rs b/src/http/mod.rs
new file mode 100644
index 0000000..cba0164
--- /dev/null
+++ b/src/http/mod.rs
@@ -0,0 +1,57 @@
+use axum::Router;
+use axum::routing::get;
+use axum::serve::Listener as AxumListener;
+
+use crate::db::{Database, DatabaseInterface};
+use crate::listener::{Listener, ListenerKind};
+use crate::stream::{AbstractSocketAddr, AbstractStreamKind};
+
+impl AxumListener for Listener {
+    type Io = AbstractStreamKind;
+    type Addr = AbstractSocketAddr;
+
+    async fn accept(&mut self) -> (Self::Io, Self::Addr) {
+        loop {
+            let res = match &self.kind {
+                ListenerKind::Tcp(l) => l
+                    .accept()
+                    .await
+                    .map(|(stream, remote_addr)| (stream.into(), remote_addr.into())),
+                ListenerKind::Uds(l) => l
+                    .accept()
+                    .await
+                    .map(|(stream, remote_addr)| (stream.into(), remote_addr.into())),
+            };
+
+            match res {
+                Ok((stream, remote_addr)) => return (stream, remote_addr),
+                Err(e) => {
+                    // Here the error could be fatal, or could simply be that a client aborted the connected,
+                    // in which case we don't want to crash the server, simply skip this client connection.
+                    // https://doc.rust-lang.org/stable/std/net/struct.TcpListener.html#errors
+                    match e.kind() {
+                        std::io::ErrorKind::ConnectionAborted => {}
+                        _ => panic!("Unrecoverable HTTP client connection error: {e}"),
+                    }
+                }
+            }
+        }
+    }
+
+    fn local_addr(&self) -> std::io::Result<Self::Addr> {
+        match &self.kind {
+            ListenerKind::Tcp(l) => l.local_addr().map(Into::into),
+            ListenerKind::Uds(l) => l.local_addr().map(Into::into),
+        }
+    }
+}
+
+pub async fn http_listen<D: DatabaseInterface>(listener: Listener, db: Database<D>) {
+    let app = Router::new().route("/", get(handler)).with_state(db);
+
+    axum::serve(listener, app).await.unwrap();
+}
+
+pub async fn handler() -> &'static str {
+    "hello world"
+}
diff --git a/src/ldap/op/search.rs b/src/ldap/op/search.rs
index 3255298..b65b160 100644
--- a/src/ldap/op/search.rs
+++ b/src/ldap/op/search.rs
@@ -153,7 +153,7 @@ fn search_entry_from_user(user: &User, req_attrs: &[String]) -> LdapSearchResult
     for attr in req_attrs {
         if let Some(attr_value) = match attr.as_str() {
             "uid" => Some(user.username.clone()),
-            "cn"|"mail" => Some(user.mail.clone()),
+            "cn" | "mail" => Some(user.mail.clone()),
             _ => {
                 tracing::warn!("Ignoring unknown attr in search query: {attr}");
                 None
diff --git a/src/main.rs b/src/main.rs
index 1bcde2c..0edea35 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -3,10 +3,14 @@
 mod cli;
 mod db;
 mod error;
+#[cfg(feature = "http")]
+mod http;
 mod ldap;
 mod listener;
 mod stream;
 
+#[cfg(feature = "http")]
+use crate::http::http_listen;
 use cli::CliArgs;
 use db::{Database, DatabaseInterface, MemoryDatabase, User};
 use error::GlobalError;
@@ -39,14 +43,21 @@ async fn main() -> Result<(), GlobalError> {
     //     .init();
     // tracing::subscriber::set_global_default(subscriber)?;
 
-    let listener = ListenerPath::new(&cli.listen)?.listener().await?;
+    let ldap_listener = ListenerPath::new(&cli.listen_ldap)?.listener().await?;
 
     let mut db = MemoryDatabase::new();
     create_dummy_users(&mut db).await;
 
+    #[cfg(feature = "http")]
+    {
+        let http_listener = ListenerPath::new(&cli.listen_http)?.listener().await?;
+        let http_db = db.clone();
+        tokio::spawn(http_listen(http_listener, http_db));
+    }
+
     // If the connection is None, it's because the client aborted early
     // so there's nothing to do about it.
-    while let Some(stream) = listener.accept_ldap().await? {
+    while let Some(stream) = ldap_listener.accept_ldap().await? {
         let db = db.clone();
         tokio::spawn(ldap_handler(stream, db));
     }

From b37c0665d3b3620644a6a81fdfaa5f0b175c2891 Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Thu, 3 Sep 2026 21:53:31 +0200
Subject: [PATCH 03/20] minor: Remove unused warnings

---
 src/db/group.rs       | 2 ++
 src/db/memory.rs      | 1 +
 src/ldap/dn.rs        | 1 +
 src/ldap/op/search.rs | 2 +-
 4 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/db/group.rs b/src/db/group.rs
index 428d8f9..c07a891 100644
--- a/src/db/group.rs
+++ b/src/db/group.rs
@@ -1,5 +1,7 @@
 #[derive(Clone, Debug)]
 pub struct Group {
+    #[expect(unused)]
     name: String,
+    #[expect(unused)]
     domain: String,
 }
diff --git a/src/db/memory.rs b/src/db/memory.rs
index 186486c..a3cfad5 100644
--- a/src/db/memory.rs
+++ b/src/db/memory.rs
@@ -6,6 +6,7 @@ use crate::db::{Database, DatabaseInterface, Group, User, UserRef};
 #[derive(Clone, Debug, Default)]
 pub struct MemoryDatabase {
     pub users: Vec<User>,
+    #[expect(unused)]
     pub groups: Vec<Group>,
 }
 
diff --git a/src/ldap/dn.rs b/src/ldap/dn.rs
index 87922aa..0f492f8 100644
--- a/src/ldap/dn.rs
+++ b/src/ldap/dn.rs
@@ -137,6 +137,7 @@ impl Dn {
     /// Overrides the DN hostname (`dc` fields) with the provided host.
     ///
     /// When no `dc` fields are present, they are only added when `force` is true.
+    #[expect(unused)]
     pub fn set_hostname(&mut self, host: &str, force: bool) {
         let domain_components: Vec<String> =
             host.split('.').map(|x| dn_escape(x).to_string()).collect();
diff --git a/src/ldap/op/search.rs b/src/ldap/op/search.rs
index b65b160..9182fdb 100644
--- a/src/ldap/op/search.rs
+++ b/src/ldap/op/search.rs
@@ -39,7 +39,7 @@ impl LdapReturnError for InvalidSearchDn {
 }
 
 #[derive(Clone, Debug)]
-pub struct SearchDn(Dn);
+pub struct SearchDn(#[expect(unused)] Dn);
 
 impl SearchDn {
     pub fn from_dn_str(input: &str) -> Result<Self, InvalidSearchDn> {

From 5683174746cccf22ee19456bbbf83748c2bf212e Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Thu, 3 Sep 2026 23:21:08 +0200
Subject: [PATCH 04/20] Workaround

---
 src/db/interface.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/db/interface.rs b/src/db/interface.rs
index 7a6d8ad..f8ca052 100644
--- a/src/db/interface.rs
+++ b/src/db/interface.rs
@@ -15,7 +15,7 @@ impl<D: DatabaseInterface> DatabaseInterface for Database<D> {
 }
 
 pub trait DatabaseInterface: Clone + Send + Sync + 'static {
-    async fn get_user(&self, user: &UserRef) -> Result<Option<User>, BoxedError>;
+    fn get_user(&self, user: &UserRef) -> impl std::future::Future<Output = Result<Option<User>, BoxedError>> + Send;
     async fn create_user(
         &mut self,
         user: User,

From 8c29f1d31fd0718dc8a5895750d34f76e8a67538 Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Fri, 4 Sep 2026 17:33:37 +0200
Subject: [PATCH 05/20] feat: Implement basic (dummy) admin auth

---
 Cargo.lock              | 363 ++++++++++++++++++++++++++++++++++++++++
 Cargo.toml              |   6 +-
 assets/css/main.css     |  81 +++++++++
 assets/img/logo.png     | Bin 0 -> 41039 bytes
 assets/img/password.svg |   1 +
 assets/img/user.svg     |   1 +
 src/http/login.rs       |  52 ++++++
 src/http/logout.rs      |  23 +++
 src/http/mod.rs         |  58 ++++++-
 src/http/session.rs     |  75 +++++++++
 templates/base.html     |  11 ++
 templates/home.html     |  11 ++
 templates/login.html    |  29 ++++
 13 files changed, 706 insertions(+), 5 deletions(-)
 create mode 100644 assets/css/main.css
 create mode 100644 assets/img/logo.png
 create mode 100644 assets/img/password.svg
 create mode 100644 assets/img/user.svg
 create mode 100644 src/http/login.rs
 create mode 100644 src/http/logout.rs
 create mode 100644 src/http/session.rs
 create mode 100644 templates/base.html
 create mode 100644 templates/home.html
 create mode 100644 templates/login.html

diff --git a/Cargo.lock b/Cargo.lock
index 929b28a..45bb96d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
 [[package]]
 name = "argh"
 version = "0.1.19"
@@ -91,12 +97,43 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "axum-extra"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be44683b41ccb9ab2d23a5230015c9c3c55be97a25e4428366de8873103f7970"
+dependencies = [
+ "axum",
+ "axum-core",
+ "bytes",
+ "cookie",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "base64"
 version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -115,16 +152,112 @@ version = "1.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb1307f12aa967b5a58416e87b3653360e0fd614a016b6e970db08fecbb1b80d"
 
+[[package]]
+name = "cc"
+version = "1.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "005ec2760ca554fae18df7a11195552ec576cd665632a881bc011d5bb2fd4d80"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
+[[package]]
+name = "cookie"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a373e3602691c3cdea496d2f0ee5935151e6168fe87739483c463db1b2f2f87"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+]
+
+[[package]]
+name = "display_full_error"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc7c47e9a2fd28a8edd1446f10dabe8ac5d26bb77ed2b1077bfcd8308904e8c6"
+
 [[package]]
 name = "dn_escape"
 version = "0.1.0"
 
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e0f1c7c3a72c66fd80abe965175f7523475c0489a87d3ff9d6e8c87d87a9d2d"
+
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+ "zlib-rs",
+]
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -197,6 +330,12 @@ dependencies = [
  "r-efi",
 ]
 
+[[package]]
+name = "glob"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
+
 [[package]]
 name = "http"
 version = "1.5.0"
@@ -242,6 +381,15 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "hyper"
 version = "1.11.1"
@@ -283,6 +431,16 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom",
+ "libc",
+]
+
 [[package]]
 name = "js-sys"
 version = "0.3.104"
@@ -339,11 +497,15 @@ version = "0.1.0"
 dependencies = [
  "argh",
  "axum",
+ "axum-extra",
  "camino",
  "dn_escape",
  "futures-util",
+ "http",
  "ldap3_proto",
+ "minijinja",
  "serde",
+ "static-serve",
  "tokio",
  "tokio-util",
  "tower",
@@ -370,18 +532,54 @@ version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
+[[package]]
+name = "memo-map"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5449c8c750f1a07ea702bbd212bd999fceece9b3d1508b17023b3e174583124b"
+
 [[package]]
 name = "mime"
 version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
+name = "minijinja"
+version = "2.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86886cf6dbf4e614b19c9a1eec9775f021869d7eadde0fc73921a81b90c9b4c9"
+dependencies = [
+ "memo-map",
+ "serde",
+]
+
 [[package]]
 name = "minimal-lexical"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
 [[package]]
 name = "mio"
 version = "1.2.2"
@@ -412,6 +610,12 @@ dependencies = [
  "windows-sys",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -457,6 +661,18 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
@@ -481,6 +697,18 @@ version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
+[[package]]
+name = "range-requests"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e30cea6780132baa8257e81ab3f6e11526a9271e9032963eab8d830972e68b6"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "http",
+ "thiserror",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.23"
@@ -559,6 +787,17 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -568,6 +807,18 @@ dependencies = [
  "lazy_static",
 ]
 
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -590,6 +841,36 @@ dependencies = [
  "windows-sys",
 ]
 
+[[package]]
+name = "static-serve"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49c7a4b3dbe44375f7e30895c04d3ca4fde020eb7336c0f6a71ed495c5302e1a"
+dependencies = [
+ "axum",
+ "bytes",
+ "range-requests",
+ "static-serve-macro",
+]
+
+[[package]]
+name = "static-serve-macro"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cb887d817cf39e80fd7fdd21c4f138c8277d7dc2623fee4d07e141f4ce32a0a"
+dependencies = [
+ "display_full_error",
+ "flate2",
+ "glob",
+ "mime_guess",
+ "proc-macro2",
+ "quote",
+ "sha2",
+ "syn 3.0.4",
+ "thiserror",
+ "zstd",
+]
+
 [[package]]
 name = "syn"
 version = "2.0.119"
@@ -647,6 +928,36 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
 [[package]]
 name = "tokio"
 version = "1.53.1"
@@ -772,6 +1083,18 @@ dependencies = [
  "tracing-log",
 ]
 
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
@@ -795,6 +1118,12 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
 [[package]]
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
@@ -861,8 +1190,42 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "zlib-rs"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12"
+
 [[package]]
 name = "zmij"
 version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
+[[package]]
+name = "zstd"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "7.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
+dependencies = [
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.16+zstd.1.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
diff --git a/Cargo.toml b/Cargo.toml
index 4b0be25..9ce4c55 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -6,11 +6,15 @@ edition = "2024"
 [dependencies]
 argh = "0.1.19"
 axum = { version = "0.8.9", optional = true }
+axum-extra = { version = "0.12.6", features = ["cookie"], optional = true }
 camino = "1.2.5"
 dn_escape = { path = "vendor/dn_escape" }
 futures-util = { version = "0.3.34", features = ["sink"] }
+http = { version = "1.5.0", optional = true }
 ldap3_proto = "0.8.1"
+minijinja = { version = "2.24.0", optional = true }
 serde = { version = "1.0.229", features = ["derive"] }
+static-serve = { version = "0.6.3", optional = true }
 tokio = { version = "1.53.1", features = ["macros", "net", "rt", "time", "sync"] }
 tokio-util = { version = "0.7.19", features = ["codec"] }
 tower = "0.5.3"
@@ -27,4 +31,4 @@ style = "deny"
 
 [features]
 default = [ "http" ]
-http = ["dep:axum"]
+http = ["dep:axum", "dep:axum-extra", "dep:http", "dep:minijinja", "dep:static-serve"]
diff --git a/assets/css/main.css b/assets/css/main.css
new file mode 100644
index 0000000..5660244
--- /dev/null
+++ b/assets/css/main.css
@@ -0,0 +1,81 @@
+body {
+	margin: 0;
+}
+
+#logo {
+	display: block;
+	max-height: 5rem;
+	max-width: 5rem;
+	height: auto;
+	width: auto;
+	margin: 0 auto;
+}
+
+#center {
+	width: 100vw;
+	height: 100vh;
+	display: flex;
+	justify-content: center;
+	align-items: space-around;
+	flex-direction: column;
+	max-width: 250px;
+	margin: auto;
+}
+
+#login-form {
+	max-width: 200px;
+	margin: 0 auto;
+}
+
+#login-line {
+	margin-top: 1rem;
+	display: flex;
+	justify-content: center;
+	font-size: 2rem;
+	text-align: center;
+	height: 2.5rem;
+	gap: 0.5rem;
+}
+
+#login-line > img {
+	width: 1.75rem;
+	height: auto;
+}
+
+#login-line > input {
+	border-color: rgba(31, 41, 55, 0.2);
+	border-radius: 8px;
+	padding: 0.5rem 1rem;
+}
+
+#submit-login {
+	width: 100%;
+	background-color: rgb(87, 13, 248);
+	cursor: pointer;
+	box-sizing: border-box;
+	border: none;
+	color: rgb(240, 240, 240);
+	font-weight: bolder;
+	text-transform: uppercase;
+	margin: auto;
+}
+
+.banner {
+	margin: 1rem auto;
+	width: 100%;
+	border-radius: 5px;
+}
+
+.banner > p {
+	text-align: center;
+}
+
+.is-success {
+	background-color: #28cb28;
+	color: #efefef;
+}
+
+.is-error {
+	background-color: #d42929;
+	color: #efefef;
+}
diff --git a/assets/img/logo.png b/assets/img/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..9278cb6baefbac616a6536bb2b4a812f5d737fa4
GIT binary patch
literal 41039
zcmXtfbzIY5)IT+(y95;J2I&^1WONA9-E4G<#1K(Z7%3?*L3-3^7)T0|k|PENIY43{
z`P=t-p5GtaUa#%5bI-l^oO{lFpZ7^HGI&l&#!7~Vherw2)-b`tBe3}IMM8}GrpGOJ
z1@}Sfr)?RChes6m-wXdMCVdz8<^3Q{iy%{9x1dnR09U-w&`>c?AMZeCM?Y6F-vIag
z17%h`yhnIIjb|^y3ib;_+xB1lLma;QgAbFVrDf2h>JB9$N)LGY^l4@l*K2~rMf5!~
z3lAZEBc#}(2Z0Ifd@Uk<O@lUV%^<u-)m(Nza8W5^)J0!XYOklx#xDfgvSvA|x7KAA
zL%Kp-;}D^S_2v0a48nWOYC#dk@%UbX23NW^58a!w^B8AP@8i>Zz*#(gykbI{Ljj8j
z)Dvl??QWzGvInWRnkoO^g9#d?_rfUUS>+e8NqEq5;;4Hdx$kg7epjWJ1h>Rpy<@R_
zxMy%OPsyb4BJfc<%PUw)1i#KD!Q(kU^7+u1cMw$q=iPLf{}Z+qMz}bHU4PU@Ucrh8
zw2M7_Eco*ObQ-)*crAEB;1to1`(qQbAQ+haKMHV7|5OGfx7-~2k(-;;{qJZz-=sK>
zz`4pvkN;OL*Yy2*0*>6O-;Vz$ETMFq1eD8A^S{$g@LJ*#wD`ZD<|JhY9eDp&&Wo`?
zV4u!^)8tD3!o&{{{y#OHOeoC%XQ2`_2K8ny(`<U~*~s;;e;{V^46L~qW2=<uu9Hnj
zCFs8vg>2!SxDtIFJ#qUyrk=p}5Bmwe8vlVZ6@eJou=&eth6^&d2J@d+cozV_mjepr
z_j*WP=NSpt3HTE5<45E3X{34U$P)LMZ+2l~qF;)P(dZJq%aZqft_Jw!)9}zz0xA2C
z;>hG}fQUxhg88S#Za4HRv>dXGaTHGE7nX3+L!xY)PSM>j8yC@H`-HN~yjCE^)fN4Y
zcY;m7_zToCMg~F|Gst3l@0Ci%Z%&5_1HQdD6v$rsHwSOGjZ;mI7Hc&<kG}2k57gKQ
z*G{A;)zTa`95D2cX=C%lke*q+**hB|c41Fvv^z4EcI#5WkH}B<$PD#CD{o5#C``Cc
zB#U1@rhru?`n>ChvW-A%Uuut<)+e_3K!<Xa&sb5^FNE}{plkNWKgPhSFG~cN@rQM-
z=q^N#Nc)pEn!l#rr(Ss)R(aWki4ZQ}0QzPspIM>K%>;F4)0<z7nu@pHIDPJyW&lcM
zDhF#sauICd-|>5D^(TG5Mk>d-eHX_&#|vF7dgRG2BV=JVllu9QtgGwC%%;O=<XgaS
z`<vH*J@vP|yIhD#Xb^2*RipT0(}A5K{Nl7A=_77b{R<TcW-msR_d76b&oXw3;X&-%
z-6v>sv?6L1ZqcnfAXdC!_$%^dXDUXCWIY0p=R5v5L6^hTzhxp_J>U{NuTlK!jmFDh
zJXAeF&R_v|cI+I3Yb7e63()1B8ELp!WZ_p}zTip;RKnw5^!f312D^tWf!=ESwH#=4
zS@hnI>5c*OV8{ztoK--o<OSJa{ZiwFCuIqeDH>(J$7@{7tiI9Br7_gZOaK07uOv7U
z>GEyuQMg!Ycp$c0szLez+&Jm08-5hE4QC~rzaiN9N)XjabNzQgqv(JT$r0ntTgwn$
z7xiiSn`VwjCO~*vD$^{Jc*oKj`)?^U(XuAV&aK2r#HUq!QB>jT5A<}Dz!_u!A7^k3
zMl%7Q1M}L^3bupT6e5LIf`=cJS9OpwP=hpS!(Z)rPc1bC%LArERiOz3kG~07ym9Fh
z(p|p^p@5pNQi}OB+_3<gQV^yyrAR|mK_IKz_^b*P;dQc7heiq_EznnS6e$*Znj_E%
zqZxdtR^SqrP`_D2#<)CPo2f?QJ~Rm~6ImgU#cK(#QaPkhdwk^~LSZB6ip?QlBVfim
z$ts9=g607-Yg@JbVli&G$-@wm?D=u|a||5<u=fr!n_UOOcVRCxKk`B64<5`|F+82=
zKq7bzeNEIXLC~bf+?H^m0W4c{onwo%Uqm^{1MwYgHT}{+fqEOttqkM?DAjmV_FMvn
zAM8tAqjufF&jB#V4l02Sa!<~IO_&_RXIOd2(!22v0R@KITjF02dB2;LSfua>Ps77U
zXXP+*AJj7#YWO_s3rCK*(Y>OnA0eMeFckav<EwqIx&J<N;E2r!Q3LfmCVZW*UOC7(
z+}mXAVRy1c&+AndN*&wi^S2K}W3vRFVp0Fx)%tb~qMoZ7X!rl~<BgS}0iMt%qJ2yQ
z-am+`=8<WnFutGni!1rr!f*JEs@hHr-(w{|9={ft>mHLE56G}FlHiC|?X~$*={wEb
z_)kC9iUo_hA2O$B#vSwUN*Tu$<5|Cyo>xOILEUOSx`rNk`k(_onTq!v$34z7*X)dl
z<+GH{E6sfNu5t19!O=;gOJ!^pgso}6L(9q+)SEZxE{b137v8}+cwzu7PE>wL4@|VQ
zdZR(k6Un~VwCOlZ!2d$ot=2`ns)CMTM93m-3Rt$a`gSyy@k2d*>{@=mQOK$av}e(w
zb>j`9m0;e{!gWtO88DF%Wd0%VAm8IHFj4m~y>4lQ9a!K#G6c1nQ{3n6A*(U|n>%J&
zH|bU8F{6$U)Uo7ssWp}5Z|lw*u!+-Zkdtl~sKDrws4RtWM``Z)BUhnOnP(Ndp(YP-
z;o#l)s}{Y!ul0Na_u1&xXzB#~CLp|;-V9JTPH9h{K~rQssl>Nl{97}0K_u_@HAq-X
zhKR*nk=%XDn+igb!p=jl^HU+05l00z(7ZTn0a(5dD^BA2AeHa*E@_ZO?QY<T7cA`g
zBjV|d9@H&^p=rU1HqRs6qg0RE*nFb=8o|410&5=AMY@CPeXdwg?x@==j10s#Bl?3V
zujh^qPi+pEl#{vaFY&W~HdELfaP%bB07(!>RNs}0vW)pIl+jF_=hC-p4Jv*vFbSvh
zQ#{%gc-KQ*K)z2hu5|%jr#Eh{gw)eyCW^}}f-kx-^|bSkLt4-Nk;rt^WjB|??(>4h
zc07P`+OHr-UoVx9ps<CeUJfqL%8^EWV7-8pKCGrRbN=<?3yq|kdc3{mTa>mE_%73-
za<mMj@P;ov2k(dp{;d490XCqZTlp>-t-?|)rDa%e{F(X%a8`Sn!=h$j$C(!+UimE+
zlp+}B7Ey{(MXj;tW~6}|WJ}(TYc2J<H*}|CR2QSBv6V<DG6!<^LUi`=AFf<qwtO&&
z!<7%Jn5Sz_nIXKxEXEsBqBYq`C`_|f6)(kib!CSHLnqRkpSmo?YX`%>Wz0X4;95%h
z^W2IZ5jsySa?ax5G;v!hHloGl`O0CiKs^d{)z~EgvZr9r4%Buoey;gNukYK69y8uO
zqdG5)^iq3;`{1{#PawzEFM_3r^^wfCW1wQEtCjur!vKhD;!-{7eb)7RYsmsuKbt7=
zLB-FEHt#+h@!e0VBq4jD1kxTcSmBISHk%$mU)XWBlUx-m#OwrMRSB;f=N=)732#3J
zjtnnnR(rnAonG+dIvS4sS<t_oxUCFbzM=G?$P%!y{Dk5qO46%H=6<nu@I@;frV`_<
zTNDL@ar_zF2+9}y#!~RWzp4cEwZzI;KbWn@^NL38^}M)e_RM4YBPF2H^CEsrM>?~#
zgR)W2GwXnMjB@L|pWXP9Tx6dF>vK1vCEl&HyXBtV5etN`<LTxKSF_3<P%$dZO=rZO
z^sj_j1MQ$By_UwzB&i@`Hk;i^2;GUS&x5((FGeA;LvhJjxjv1!p%=8R#5R>5I9_?;
zVvNnJg$2>c$3)j$0g552DlBYgDq|(Z^U4yE_0Z@-dm%|}Y{2Dhm-;eom7w-AOItoo
z*ArF@tM+lKc=MV*jBIZ}40*|zEX8}J?S+aH@-%c<NOZZNgWGF5n<ZkJAey96x4CnZ
zFS#;<JUUQE#Iev8#-p(Bn-mf<el@W2Zivk2vYbXMV@{@KE=zh%#lEw`I}u~QFT4=y
zKl{<8a3jj6Gn-H`;#&g&;=ExI=pRw}0}yh&Y#(QF)`OoxOoc)ghxk!O=(c+#iAdr&
zmaIF%hamrnW+Gt|M;=i_53mvM70~MQri5@G)*3<0OEgl<=3gba8lM7^$jBO$e@jyw
z{P^$YoE_oqa|un?sQ#OWZy0_RX%B2<7eor{SP38g8b9$5N>X^}@$!pensha+EXLZi
z&{km}2zd+mu$uZwH+euGFzmsD)1-P<G3|O7>4czei7diIyEI585xhglhbGB-OW))=
zm5;t8J!n}VV^?B4Iw@}_d*^(`iDJXg$NQjF;57mc>xN}<Pt4LH>>IkNHy$c=mpby(
z&eY`)xizXNmB79lG>6O`@Kn}xDt>?o@Y4BvFm7GG1aiBLxv!sPkWLOOi-~euw5CaC
z!3s$rm-b~hzgh|<L!H*xlhO})JF31buxVD1ncF4uAt8u!R>4P8*f3NCq3XCoGzHv_
z_8CvD{@$Z2?-)b6hiM#~M3c4THcOjbu8k+GDVQdb`TWJDcy&!3!?YK&rc#Osj)`wh
zHM&=C?cSX*!Lu-hpmom(6WQBd@LfDwvW;`=x}7u|RRzRl0bEq>lCQeeV!}!8FRbS@
zgUrJ&-avauS4ctAPS*(oXNo}@e_GlfUNHV{`dh&#P+EN7HT5ipoYXR(+YxQZyX8ZK
zTiNgywW4y1PnWmJMbGd!>&i)Lg${2CEM~Eq2uk11OffzIx914?-ciqUTqJH0LHXTB
zbI?|>uA%%Y%H7!dQ7z`#oJ6iYMo#b5!Nu89w|jBRHsO7_-r2dWjQTG!FI5ng3Epdh
zHy0lj`>`i+%Q4}4hVY&hJptuwmLt=|EPMIEkn!dC&uOPmfW7?9ca}Y|obGrASwTH8
zaouH&nF;6w{siIiX0ur9D!tE->Fv`JdGCpyUJ60UaF^k0g{`#G2OV;wOQ8>s=F)fd
zTqX60dY*-O-%mNquhGy;z(jz3wJma<a~a6+Z-{Qi$9GclFFql*h`YW5>#T9L6<Md;
zi65^cI&6QdeE82ioBur8JbhM3!cOP7GNYX*CJYWz?aMVfBcFT~7og})FibCU86KER
z)4DnvRQ33mStYn44%w}6r8OoN#s&<e*>u$U>8|cmI6cD9z5a(?Qt1d{-pHUi6VX(Y
z{F_IV$FuoSZ|cZOd=h;gDC8?R43xnZw0!#k111q$@8XJ4U-9VlkeKa~eZnCmucdUF
zVKO7kR5K9caCKj8-*}GQ@d``w6Olqt%ze%D5D3`<=UfzG__9_7|HlF^U6ek$g{#(u
z>#We6Z0%oh`1wCmnBeZ^{T>S#zE2Arb5X$@+_U4m*!AUddC|kQQ(j|h^tsktvUTH}
zq(N=VOaaTF2e?*MLpaW^#xv8_=+v&@O(G;fcJD5R>IP$G48M7D(IM{iMzre^^WR%s
z^6wSDg2QHcY{hqkfEBum+A~#OqceDGb>8dVN|pQzFm21aX0=vPuTZ@Vud4`&?LT=X
z$@tfFt6hknv9>Jzfm|t@MA-|zTo@ydt%ml^YN1i&Yn^gV3kVh7!^~6Mdggrem2Twv
z%toV%^20f@^VijQ-^E+Wf8FrqO2@3wZYSlbtI^#IhN4S>PHetRi;M2yzV2S~IoFD=
zN7VHzfU|x)OrLjEmqc$pe~Kqu6PHSws#WGzLn?T0bY`-adh@YY*M<(JC{4+0Hp2?C
z`BjB0+3aSmYJAD_HTOU&LFi4^7C(pS>GMak2PezS&A**YJ)&;t)n?Jb%ksgj=p>}A
zWx3{O7oV@1q)YJ<Ntt50)GlmLdvDi&vN~@;c}?PO>^7wlxQ$fOSegu?@iTQJ-LY<T
z`O*ymdrX$96a>c1fpS!$HF&;r?SRx2@-)c`B;`t)^{VOUg8cySDoi;;;z6zfV@=nO
zpcs1Ilx3l(Gs$tUxSM_@8^g>;q!g~)cvSJC<o9TuYPEh&$Nr=^^HOBKV8XOgvN(yM
z*@4C4;kREFqg2LZ^)z)(oblZ8u^^ck*c=2LNY!3uTS7MVf%?j4`fw=~GnH`W=ZUV`
z=dChHikKZ)dCS4=LdHZH6-{(O0B^wDnF)S?QPb>d41$Ku;;Ul_ArWK`@05=i9WXV|
zLhLuF5dLu&<z3DP#Mw>Xk5Y~XyP5{uKM<N4h979Naej$v_OByYo87$LA)%~(&h``F
zP!-##r!SB`HM&f-zJ_NmBpJGtGKD%yCv$xW?!0fI@W);7?@|TVfZ^}an|}o-3y(5c
zN0p+RNCKh}zhrU+H?8XIOv*om{LAyTF_~bCVchL;7q&~v61wzJrQUzmx4v(;Mk2#1
z$Ja(B&ZE3l#M|84o@&J8q3*D(eKM)Bx8>g2$_8nP9~E!_sEselAWezHr`Y0hmQ5kG
zke$7rB85HWy00=j+rRwdxKe9V^YID{zk~;q^fAa+BE#3coH<i{B<AlYA3Jbbv>Sl^
zZ|zZOuEivBhd+@v>AvOnNtWV$HPWIlWNGE8a=Q=2r{I%OM&uud38OjN%qzwwKB{yU
zuY36)NU3kV5DBydc>j67*JcI$$aHXgwg!816-wu)wtwi%yih6x@b>Ut(S6YiZjQ1G
z4vZkWQ2x}hz}v6rJH4?S6m;CC_kLZg!^3&m;yt5hZL`YL#|smAg;Lyo^-<CI;j*Fv
z!|ceUbe~`Lp*!W5B%E%Ku*`wmDXnR)kB{ApL^Jq@wv+{+<JLKu6$xbK^%iigj_8PG
zC-pP3Y*KM!e!Rf>n}3(!vcPH`GZZ;e&U53z?wsgVN?7?<nceMQoB(g8W7{B%&rgVq
zj>yOkczimQE{F}#5*T~fJ{PutZ_gDmMQh^Hi?57}d!$GL+n&CMl}8<^h*hGR#TfA)
zMYK;)+{ongU;1R`?&l$93vCsmvIEBOc*K^+i0%tjP~1@l7cnH7p!Z%Xo<Z4i&M<Ik
z@#IJM!}R$u$JpW8#1@<u{$Jy)-lLssH#ada0vw0vSmj^-Bb0zlIaPe2phmD9dT9M?
z;I!x!^Yy>Qx9wRf=g&+H>)s453}Acpv#@MPJe$M^S@mQ#%whHYaa0}52H00+-p6{m
zx(jUO?7QSR=>)62Hn1P8n+vLy1vN~F6Xt*LTT71X>7`ffN|mFRyz#P6BJoz@-mpA(
zdwU-Foc}|<8d7t6d{g4#h1$EM)4{}O7Oc1P0l+FbSWI+<l!#Y&5*lo(FK6Gn65rDE
zmoE0Dcr7|GnP2*Ss-U+C{M(piORP-uSph07?N@_JExnB5Dj(f4Y~1AB{a`NTda?SY
zXUPD8{Y0Jm$MxU!r!$eOe>!~hws|ejRMw|Qe`?VLnWHo5oNvf4G&GaugdEzpv9q#U
ztIdO9)eP+JhXoQtvsxf47~9`;61mMxR2C8{6FKAwDGq*gm6UwMbpP4JWKO2Ipv7N?
znv&YBmH0SVN}0epo{xJ(-lwTETce;~d)&vikrB-76%WoA(oAgf-8ql*%y+0>FO=^`
ze`{>OG(BJD^yF3pte9CP|5Yp@{YA~LnENso=1V8pRW9g%$%d2z-<5t>XytAr)!H=f
zSLdlWxt@|Ir?p8b`}+Xx_l|GQ_W8^y(r!tXZ}SB`$<D-j(~ZeMI4%_*ip%ZbB`cCl
zI0|UU!3>v@W~a|RAM<{!!rHVP)!-G5$5X2%kTfH<N5e4tkyN5kivFPXWA3$*@(U^7
zw(Fmemn0kb;sy;WKWVGfbgi--DwCHYz;qj};B}#BloPjSIC_g{!BMXcFQmy9mV1ii
z_N3LSUy@7zMAUL^r@I{E)IwcP7}6RU=r0&S2$Z6&Vtt(gePES1lMs&;BcCT>-As&Y
z1Z>eaUOeP};ja2|s#Pq{P0yn*P@S#Vovx(d>mu|7Qy_)S0w+ra<6HWc{>dfo*pjWm
zq~xHVED>A?_vt;EVOs;o9W!z4G=f}3Ev9XxGg}=7SL}EgRJwAH2!bB>nH}Fp``YH-
z^~UWksnBnKSMvGl&RzdKEOt)B3XF(aia86M|C=g1^s#bK<{vdDsz+QjIc_RZXmc<L
z^q_FXq|d9LxQ6r^VnpNv6Tc`V@?O|{Fp;qp;;}{kIHK>YSQ~ycZhmqZG6oI{uUPo<
zby7j*S)~oc=nl-=2<4C&ZPFhNuCeJO_(Lc=axm<3?Pu2Bt#dXi!3~z1j_~=au$_uJ
z5_GugQ1#7_bEqyj>qMmZmxKL9nX0dvw5)o+93YJmsRjq60PjT2qNJ&ZZtb8x_b-0?
znpQOnrGVjo(O|oG(WZfVgsZsN<=b^w6D~@|^q87+?TA0_;2yUnc1HGiKI5!}WR=Y4
zu>aCVt#5tw87f9Ja2|8tAusl)$kHb3saY4Je<NX%4{pMNWahuf6)68v=a+ew5YeuQ
z`3Q!qc(ok49EXm9<&S*3f`EMlPjp5eDW=c6YR{O1uEa~2?8MtCD>z-WduYPJYg}C#
z-K__cE3gy?g-PpHO7hgeu(e3b^R1e&?;Sf-?4EnuzhDmCSFyL{gLx@d@v)z5ZaQK)
zDvIZCeiDHU3Yr%LTghWS%tfwxTm5V#Gq1DGI2vjd>jOs_rl=acfv;-(dQwJv(0NW<
z<EOb?7~H5b8q=$x-*C`GCvs6%yKvJCPo~Rk?lSjqpSw{IwyIWKfpCK#6c#YlgxW6}
zGFY_Q(~LKNoA}6Nk@QLA#lN4;QZhZ9^sm?+E^d<JkV?Lz_Kx~U%DqnT=-I2BSim^>
zK9!Bu?T4`Cs`dCrSMQY1BK~)g>}_S_dx5lsmvl1ydG;$#wFj=5EJ6-os|CfqFI29p
zY@9K770n0KsM^}HjEq>BW6ho#^yTXFus125{auj05!q|w)rIc(;MKZcR+ML(1sOD*
zp-jL^um1T!uxr>bn5Ft|cM8kOnOcrujnQ8u@%e4;EmLIF<En(th@+Sf^Z@(6&ejHZ
zcQng3B)$!43=Rq~fot_l3Dc|Yl^24!{Ma8y5cc4G(6~$n_6hZX^#wAZnN@B+-P^JS
zIR|Z&959C(V^trbx7Y)1@2kQNRr^tye*%7Xggvc?%jI0g3W$2{F0jno${5?2d%PG<
z&t1hhcq9{C;3zWITHKgAn$v|RORzux{ba!ZBD(IY{S1BBSwt&;TggGH{G1w60XhL~
zb{Gg}O;9h{T_yGTE!3Vh#nR!PCjACRNaC9P#H>l48_G}<cKzOH01g}{W(QvUwd<k6
z2le_~;i*+7bIrxkmz8w@v^AWCV&5L$?tlKmA5{&uHxM|w4p#fQVUbLDkR22QJJ%?v
z@L%l7JnG+1jK3ByX<4{P97-~ncm4TLO$M90a5rRNaF8Gl7T<K}TuDUdd9w-=EV%oQ
z1kQ2BVD5o^i9l)|+?m=uYv1?da!RXtL`_>CYr<95u*Pv6G5omuF>ya3)&Q7-n@m5}
zmsDqd?*Wy}55kM-)VI3?P^Ro4{G(6@$a~XOb@<Tjr;KONSVmeDJvbV$m@)-xdf>y`
z%#b)Z#dfR$4XN6rR0w1f(+XhYqYJMgSb4FfYuveb`!Z)Go&zv3hI>zzH!OqS2=|X2
zd)$y(`{TpAB0e$0U^`Nw=m&Ag8;dTjFeXv&t44!+x@6|eejcpdk4uivek#1{p(-G&
zagMN56MUyX>U+H+7)a2|)kc|<BtMDEZAEdT0xxEAINQhQZYHL5rz3-hOc1)*PrKQu
zqoQ%Jye)2{)XUj#KL6UeLPd4xggZ@XhN73^#0c&!*8Or-6|}JJ#|9#Log?ra!qrl$
zB1!m0Y)NHY|1@`h#^^Q%g0A!&Nc+FfRVv7T$RhFiTCAHVx~W{|bXAN{1t`B5zE&A|
zzRUE;m|WfGD;rO(32up5{>a*}%ZqNlkfMtc_RT*1`~E~ap|QcjY|u~h*^C-=g0qc~
zIaz-04U!lkhq$rGBIE~D6NA=4S1%FNi0)pDGuYnqs>L`p`YV>2#2lV0L1{{#*?rHO
zs;1Clvq0<4;za_?jJJ^bb-j-zT}z{gU+^E<f=(aDM29PXlr;^R<T|~7)gWYyw@}2h
z2sb#S#{?eVPIyQliyL*1C=|Vkm`sxBdn#xFeS*W6fc(IYXEW;1gY=-curgk-sAqh~
zZ+1$Qp_>F{F%N@a%72?29PG-L{prv)Zs{gM(vJ~tw|dOO3c-1Fn>BSir8sXJ<vG4x
ziu_!5T+34T%lUGm$TA1l17s(u`G^E<g(4w~^=BOTPOR1kZHB_eNV@Z=_+8Fx@m{mA
z=x#IgD)r^uhy$Ph_{}FAi%BB!tzYMFE=d?9L$*Luq0)f^;dBbxdA2j0aj(R!CGozw
zl!Dy|Q#sp)%<HXlxfY|wuzkqk_ue0i8RhdHTIGvPvjB8w?ltBN_Y!g>%Fn6C5$xof
zVW`*>dd%TGDd|DVew1*&!H0THG_ewgInADW{}df9R4NBa`obG>i7!|;MExRwI~!}f
zJo@}QN^u--yWg{+KW<ZJ6V#1M?*94TL4}&eheO!J05<9El&UoTMLx4lOd`Npo#i*^
z^d-s77hhK)TN(xKl9%Rv(9<VshR8y}bA>GegN)|TtN^nV%sa5J-WUEe?SaZafLlBp
zA<u^QCp<ACPtVQKM*VDIT+>uPV<I91%fxUduD=3O|C@?}yU&*cR4N^SR_}~LHni0O
z)I`MiGHvCNA$lJsJGXUlvpyx_*wexJF{7Vfxuaa3;4W~mD`B3<=le>$lxBhZqtO+}
zFuffWQ>|rzhObnnacB~(Wsj+x<ZC14Fx>)JzF9U@d-p7CsK^A~_y{`-Ng^5aaQ-U*
zufzm{hm$QIX7#*)$JkG`2gnqBjpz$i9S64&`J<-vbp6=Ycs)<vpHNUh%c0HWoUUQ+
zCIx1ticExJqbu<e)%Gv7m{;RD2qzBza(!0$?0_Fgv#T`Zq<kdhkWe#j3_dN4<@F?V
z7*2dwNOobHAw`kr7;x|Za{=B-)lhy{%&b4Qj-xi|8L{Q!j@Y)<@TmT=_$yIkQmTu_
z-EiO}coa;M(fK062^>G|O=hkq2FONqzr(!TWhy^p5J4jehHW%QSg+;bOh?giMS9_{
z;~Xrv?>EMN)}@Uq@akQnJJg!Vj<cvP^4s8fRa9~t8Hy{|IDe6hZ>MDD_DP>9X=zsx
zW}Xs0&5LFHs(2^va1T`se=xhb^dDl{^pZ<c)1_}AoYHum2+`CXk12K^R1t5DB<ZUS
z2~QG4)alIoOb_P9ckBq}<iXl`3-Jr|8m)LcCZERyN-kK8H(z{%-)Q6{W=2t5bi%xO
zYMK0ts<xl&zA%nofg~+HDe-YEhnWKQaxCG2rd1@q`Aw5ZEaFan)8HyxjnB?*y_b<E
zvYGIom$OCsObX=PUbcH$x^$|M-r;QU7?dS!2tU-lt|9mB1L3kHpRZ;lyy6Dg%|-*^
zik}xmEX@2B;Cg?klEXPN%W-3<#5rtT@kWM*`5OQOwJ*D1zOHYTsMDKsV6{Bo7dE=e
z(qE!}aiRFP3PD%A$Ez`>w5)XJB8W-8=JfZ4;M`mSpsBm)qX{1AB?F#3<SEg@qAD-g
z9(Ocum!kZ>)O=lqQgJ*a5%)yw|HH}wU+Q!`ow4V|<hL~C@s-+q-H`!QoBDp8MN%P`
z5r=h8i@vn=V}jMD$9nPWTja4~XklbBqSA@bVDh8yu<TH~w0l8!6}0t$(t<?3;;Z+q
z8&Ug#IOp)Q;ClC@NohGh$HDd1=Fg%-A+#ka+L-lx*&h2n+C;M<yL{56%WL8=#9+fD
zy;JN~!u3+G-EotM`E1Lj12BA;@HxIzsPVji;flD~z4j0IvIMf+U5vjQSV{`|38Avp
z9=BZ`dYFrSj&Dl~^dI9i;WugOhz-8DJkA6X7r@y8(R{6Swni!59*x)PjevNd)l7}P
zXNl_-L2M{zi0{`*(!CQ+wRVWI+t{ygjhTnEoephdTXTa5ssm)sE)z^Ze}t=m`NH~-
z+Wsl=c=b1>$`pUT7t#iX=+MN>RF>lT*dj8qLs@7D@dUR8oG!s`Lj~CrHv_Q7)3!32
zDT0dSoJt<4qBVi_zz*G+`lb-8mae$V!nJtkggseM&JO9^w@D~NnNxVZpoMGk{Yf(+
zO=geSSeXI4IJeJ*X%$O#W-fR@Q~bRx_G6F|!5JCCzATvO_xlQSQC%SG=WW-&=Fjnm
z=`R)d=(<PlK}>m6o_P!g%a?S0k9hY$N@W9p(TxkS`k=GiStl!fV25z*1Zj*I)F^)Z
zw7^gUDFKo(A?u($D}DbAfA6E7&HMliSx{O$a*zJ`W|!^^+CroFCJhg&eM*RteqKZ_
z&(c;h(es&VDSnJ*mwhOR4e^zqq(s7O2IuHycJa<L(g1Sw7pe~AdO?$~KYB!24hDM*
z$p{z<qi_2R10~=;ory&T$Dv0woYE{4jsAQ>$U1*S9nm;A=9%6*B4<2T-N#v-h)PB7
zpgCO6NZWw3Yua9IM0(u$6^<^lb#?Etg!|nA639J=fi}zdQF8Kuq$l=1<8^9;rb{!m
zL4Uv$(pj8j(JP9gmUxJ}-$wWRRMfHqvXt?!vyKXs3e!{;6Tb=<^x~%8m}pWj7-!5_
z6A@zu5_gXfM&&Qry+hC51ttZmidSM3pCO7L30Q`MfFrx|3c_`vFxVBT%9)kxTXs~P
zUP9l~nPVhl^Og>fhZyoP#x#HG=Op%R9O$diO8gx$;vQ4;P5Zt=tHKc{`q6R5XQqs1
z^LHoI{~d^yP=N5yVx$+MzBu3=#vSad?g3I_ouy+ak$jzx{x;?u54ygAsF3{mX>Q|m
zbq$r|z0BQzckE>HcS^%anh76UV@;BaOR1RTTYf#RC(K`bGL3cl_#0v0*ezZgv4E?)
z9|!^yP1F-UJAl2f-ZBlprVo>JzhiafLqu|HU|>3Scp+6`;~E@~JWbW^$7}r{)Zyts
zt|D7w%pku>eOiCUv|1IM*YdUe9Brg*g%zOud{J@;mb*|SK;d1@@}Gh-gSp=)bby2s
zht-AMp*O8#1i#u>vW0|WFx+1zhHr?E6i^>tNZXYfrZqp|#FmCEJm;F`jiMIuzIu#W
zSngTEzD4vBi0DQY&nm=x@8on*$_!$=?MC~nPAs*)hnWM~lW=^Jcslhy#rhOyUz}G9
zJ*;9}C!qS&l)oK~973S}>HTL&{G|A`z;+!9vMqf3W|h*<-%7++hT^jM%Klce#0Kl+
z`+ThcsapAMTL)tG0pliq1<J4VjfM8O_7xVKC;-*kwUwO5Ri%cg1RAQ>#m7+xoiU$5
z_CFHX6K=V6l~fC-ScTGA7<zEPD#~NA=iY_c1gG#zVUre$K(;@wja!0grcmZ>s<~#n
zJsE(v!}}5k(bb^_=RmBPnM8NZ*-o~Iu*7uaw`+%>-xxmAx(Pz3<}PiXyu{JNGsS|g
zY-@6tRmnU9JN?0b%Ome?x(09E$x<_(TLP-Zl8h!TOTW?m)Ur35c}M=RQ*)xHD}D@<
z_L5mRT_72zN!q~t-?Uk|PG_uP$cAv8uMyi*O4Gc@PNU_#&E10iZVFdL4L3Ue=~}K1
z4B2+v*-1z5&3y%-A^68a*LKF~%D5|=fuzibSXekDkn}A*eZn&rDz)jU^A>rr$qwgN
zKjr>Kp$7|YRH4$|Yj{v|f{^bDzrIPvnrSyWX!2!OhR~y>frnlJ!k$7v6v6Z6+`H36
zmz}rbfu(&e-GE8X-si4d5+tul<gI5S0#ipL{BK(^=KjEz48U=5R^W&QS_pWO+-y1{
zg!KG1Y*A=w*FRcO?NOjH*rkhKm8K7I=Xrp?l5+$0agaN9uE!ID+nOo8fjRK%aC=&*
zkte(EX7i?dkc`n<rAEHeaRtsKBNqZEy5*`|=8pLtPz5(h_#bpHW&A9$tviqhkQVFY
z8xFMZgKrChI8Mh$9FAWxdbldbcJxMeSQ>8cnXsmB0)O>^FB1O)tfcaHf<_8R`^(?c
zloC~KI=@H%#HW~_XID#tiurd4)Hr9Rb5qg8<AH$G0SH0~JSR2qDN|)zCR{0m_O{^K
zgxpo$3&y16I=ak~nINk3SNm-GeM?UB1I(QtAKjb&B4`iZBTvCtUGRs3pZaj(bGmiB
zDiRHj3C3ToiQYLyrpm-`ar&VkhvuBxL%~Qp##A|tIUR@6$@FFlzt^h)Jam*>3($uI
zK4rmftKkTa?O466bVkF~Sge=*@4rO2YGu{XUL1~Vqc{BQ06|TRt$UiCACsb0O}D~1
zs-KIq9t9HoDzoMWZJx`Il`&kd;e1Bl155W7pA@6%ZVcb4uj1GEbk6#h!xnIclhG=j
z<wCpsgkg~`tZrZ@BZeMgxER$#7OwS)R;)tfBwbpjFXeAZhbxfh^8F2X-ME#;byV?{
zi2An5a@}(mx+AvOfU~f<#$Y5;Krz_Z@*^>-f`FWGAv4WUsY<Gkk2s?$N(B2knAnIb
zU0~u6@@9{z)D)x&z6y-<;f=<#^YQ;?9cMx@w!AhPQvGvGQsCKv%Ja{ztRPkKo!1U?
zbQN+KC;sY%7*0>ksuV#z9^#L{IK8itR%eg*c|q%>`vRUX)dKg<VuDF!>TiJpx<LTH
zatw3FBa_*p!dl#>>C%@`neVRWY%B15C%~oQ&40CdUO~>l_7<%)4e%S*4Y{AN4p%{7
zy`W+@pKqqlfkf;NrO#VpdZl~p<RZ9-5;TgBnEZ@a)hI~1v9I_3lc?VJN~%9MK|`7c
zO!&IaM}aQkiIbCRJK!qQ&NS%NL6jFXcFvo*lVhiyt<99@J8(Pcqc%^Kb26-bm&xhr
zcFUvl|CU_>7oMnhAQ5f+tbO7!r;l)tXd*X)$<wue0LR@XF?6O%qEaCy7nkh7b)Fx-
zy3%i6LMme1-+{$xYc`4FB^%v%UstRXjuVXIkADQ8;7f&=?GAW=gm=UdleN}qPbwBf
z)KuIPgmfuzM;DX$biTF~kv!2w&}t)vfFX@l^@^6ZXEaOLB38<bLd^4_TJT?L{3M!P
zCQ-_9`@xF@guKDbCc?f7C&|sIs9oh;A>Rc@P*p7Xontt24{{UpK>IwZm4$jm`wMvx
zub=HeDkYvvt@bUUjneg@B{?iBMkeM1p>W!_fC0BC^cAuwm>e3$-0jx4t59#!=)ikf
zB(jLTi>b$R_F{6U2_uldccJ7LZZ7^M1f+VeARnxqhi{Q&Boe@W1X+&T^9{*36-J%^
z5Y;Z8@fPcEJk9Ic5q&b<tDSfMLJRTzMU(u^#7|^#j45c{3YYtiF!TmO0-LH<#_+81
zi}~B>t6i+n?r~mQ2?IzAxRVR5tnnDAR4+kWo0WTq4XKX2<@qhdR8Nz)SO<7Lf_>6m
zYNMY(*t)ouZ{!yOMz_WxuQax5xOb$2$)_uL$j#O7GXSb7R4PQN6`|$n&GaQ4i;i(M
zjT&dlMEjH?X)+DnD_B^^+bS|t2FTv+N*8$rv5krFW~%0p=L#I-tNLtT)IOaiZ9Zej
zW6Qf^54FoVeT}dc-FXa5GE?!z1ul^tJ|KnhA3F;`8~Fv}Xg7UQHR)d+avU!@1pbO1
zegnnW6C}|;xss7d`Y|?6{kqnNlg@Y6``H1;kVjN}hZX%0ZH@FocEwq&EH#47)L2Gs
zp*}b!tJw)Zxp}FvHY;IQ{Xk_kAxE`Efd<;i0gS3fJ?Sj2G1DBav2sV*QC<-Fd9F&H
z39P3}Td%5}-hZ>nC8GD|yF76l<mlKo(=|qz=SIzBSYlTnx0g8B&6#xPT53U5mmnrT
zCKyzYLzg<<dXgc;TW(0v8A#FKv03MF;@6!xHCyP+8Zx9+IKy3Ap@9i${<qX>5<h2f
zi|QobGFS*)W^emwlrLZ`Zb*}7U+-}R#mNyuh;yyfqiBSt_!Ixi08i#cH8|2mEbc?g
zd0nKU8)G--KYz`Exb(3WGW=TOZQL)-z!es=U6J<<wJYq$vG(AK!>8nu3me6dx1<1>
z^(sr4or4y-6StYq|GQwCu0=w=>!hmE2?qxpe_~+Or%sHAy80C0>Dji55Kd4cnN1`{
z0$gNTsM3O1kCYtR^EAB_m4J!^So&ac6Jnq#z0;Egygz&bDZY61gv<nY%{MwZ10O4X
zg$KSA(){ki$rrI8I_#JC!lOAM(UOY`N_5StU5PrAcqq?)QH1#$Og_7}*kd~L4JilV
zz?+>DF){s^3fHo)w@wQg=}^Nl1v+crYANi~pm~AO1gVGzp9h|2(*!BQBS$$6(wp-!
z>o57uYOiDFB}{YhD)5+H?(B+bsEjTDp#5;{@lpd>d~+ZFaUL8`FqG7nKbqL&=c3mI
zKj(zkA<V|?9flOgD{>K6v1nDM{4@5ke}-QBlKlv8<JptE0GWaDxTiZP-Unhk-Hc<B
zDx4&pH35K)L2M`#TcuTXIdYlolN<ORq5`USzLG~#yQ9QG_0QVOvm!c(HT!hL`rR5M
zl5ScF#+K~Xun<ekXD|ss<3obDoqZrH9Ew5Vu3q*Hk>qfZqlFGvPXVbZ!r+F+%sX`w
z@zAE`@XO{ntp#RXA=4-~=_tePPey=yy36II4T&^A!@Fqz6{SUj?m*3jh!5PS)wP*8
zUda~#FpzFJJ$VR&tk5#S1AS<{F;jc$T&lu{*NIx|$CBe#`fxF73A;r?y_A5n$)_Qc
zui|B)BFP)nPb<ue7$MbF@I~Nq-jr06(0^?69<t$m+3=RSqQ*#V99g0I#Ca}3TAs}O
zeu{!+_huv6KM1B1b?ciXK}8G&l*>;N?xAkOS7Rwy5g&NET=_qT1h@f0>a5?hQ*lY(
z)y2Mzky7$x&IBxQ7#$tCL#`nIk*Vl8nVQ%J!VqG)O^2tlLkeZ;3VhB+xQ2lf3m*4%
z45Hpk=Bc?B`q!?;uJ=P?b3~*+ZU7;~B!8EMvQ?9SzH_UdzXt=<yd-dJF0+Q<b;X;L
z*3#hN#9mr8;XjStB%BZTXOV@X6DSjt>cvLIQF2w*jHbg>**_jzi`hH?VPod-%E8uF
ziHY_?GD*A@%GWDc!eDaA?ZuuCQ&%;G5nbz+X%4I2IH-y1N1QjKsWN0rXEz54j5DFE
zy-0-tbQ9-=zC;?Libpr^@Zc)b*mY8$Z(YnL_)1xs)eoF3;K%db4}N!>XsX7?nuYvz
zA|B=swO4ksIh5;seD?_lZ+2i_cy@6vM&(US9(CZ%fTottuH*YR<gsY#Ki<dD^EzJ4
zC~JBv{7Aq^HAF_GWL(|a1y_9ZuO4=(+oo-}A%6C(Q^7r1ORxic)LRf~-7GQTuEgjf
zKN_3$C8<k%pbDJa<Wv!RDzQMoR_=iP<9HR0HbtHVkIm4`XJs<WPJxd%`}y#%+;rx8
z-yOnlw6fE&p6Iy(iEl)e^;%Jd6~;}!;^8-ZN5ci`OzA(2@45*F!UQJ*qw6?#)N6^;
zPM@i5EPi8Q00;xx<vzR%z>4yD;us<z>$i_1N6zA6usM57JQ9)!doBjWu1X(E))<oS
z;okg#)MEL8BWDQeZ*1Iq8{rlcoJl%XpY*5QzAuHkvvK0_|Ju)I+8%t8&irRTpGqD$
z^MzNoF_Pcd-x2-H7*031U2YPtpL8?qnw9umbH)IfH<$23Zbcn#^EtMLlD|o;j#{G<
zyXp+eVVtVTmq5}fTzwFeH>kFXOk!krf8RABtm)JnAJ#p1yM$t?rpQut2d!%e6ezO_
z<1y>J$_dq&@rsl0FxRX{x#5h_CB=&c!NJWy_aH?kW|pU0n8glaE8sxK@wA9QcErXg
z;UN+mh<x?b5c|72&61?9rTpZa>z=EtTit|$%Y^LK_XtO?ifoH&Nm~8dg?S-^t2U;q
zmw0vAr*PQMCJe1wfmh~Q$(vFK-n`MjqF7%NWq}=epnY2NXBY=f<7O&1Q4-(UhNhbT
z{4j1UrynAUiH7js9L%gX_~4U0E=h4du`+65+smwoiPkfj#yc}NLlq0l8(2EsS5759
z5b|4jM<NlTlwq%0?VOjX$&vvKCQoBYUr*;q0vy>nFyjI|!_Px}XYR4NBs~H|OJwM3
zEYCN`D=G&i;;ZxB3@8qUe$OOg`RfsIHto*(%sl^O?RihY`K-Cw-=?C-@CKiHni{kU
z?kGj(j2Mb}<b>2uyGY}1B29YgO1|vsA~wNqCI)^jMv-4|y}5Z>nRvML<iAi@=y;`v
zeiuAu%x!8Mz4?tuZQ;%IVl!G^IK%$%Fuk7+A7Rg}8WK#aW-<6)3@Ng*Y2&a_AR#tM
zCV$R@@O|`Rt-k-eLONA7N)FhU2)qyQ)<;JHyJ_gBnihKq7R!7TUKKQvfZx#F^qoVZ
ze~4<NG~04l=`=F;S_e@5%Z7dUladbD+j6Bf07(pc6#Q_y>p(uRlpl<cviy_X%+?n<
zUsa=D{kQs26+sT8*(&tf%B408u$X+!(veM(m;_Ib1sp}8DS-T`44}d<#He8!GRo|3
zgE!+DNal!twNeraOD!w-7cW;Ee+&%sh?+G~gfmW75KgewX6m^;Q_Onp`o|D4CV<CJ
z^NQk61I@GBE#7Xj>vw6>i$Y&+{V!o>xtLkfy=cpXSzrA5=1B9309=+JfdCw2G(V@0
za62QkB;5Rv;hSfuH=%((L0I3Q`CcW95Q5WwHXv%kZ)Zn7{QmdYuL-uUa|we{>so2e
zl*F~oP+BLi8xU@`j%GF<GAX~dvT~=O+RC@&oLLO|j7q{$8SC{0c3<)R`z%6HK>Zpr
z)zp$4{MYu^+}t+*v7|zxq_7_kJOx(2IN>dqCIG>B^V&Z9%kqws&%~d)^5I4WqQ1uZ
zy#_nTo@+<IVY0)u5+W*Cr~M)ov&H*>h&?xOk)@yTA32yRnsNhTpKVX)Rnc;#^l{i9
zVOZ<e#gh4I2_8x2r(?btEU32G2U<E{CXw0pX|N6dn2GcHDv`D}0>3vfRa#c>Ap_3`
z(nVta6OV*mp3^%8)7^XzCH>77;2d?C_Lf)lqpSJ+pd)fCW>A>@L?2yU*merGo{>c^
z{W|9p`9>Pl%IqS#L1Bp*92T$`t|22H)U;?JcNL2LcPj?8|7Io3Q?)VJ0ocap!?%a8
zR&fQE4v$I>_Y636ka-8wyB##@e>wQ)=ujcFVz?C9@WfB#H)D1V38|LSvX7Vl^v0=8
zfoBH8n_O4cV^;Fe{;L>!`qzKGHS?UOzVsKO4zIsqTW~j>ZK{uK7w0(pCoHbC#zTFe
zVfYx`s)zv4LsmgsGFCq1DBq>EthB#TVuOrnaxtoS&fvS6c%qMuC%k|pH?e*W(w=z>
z5lS1O9bYI@qWt8eDRN(v;A3`~p>iItpGpJu@Kxy{*^P7Qq*hx%ThlL^J3`r}NKmjz
z_Zy5b*jMAd=yDFt`Werm@`)XPGw&5Sryb}aN@@9^MP!a|m#O_f7fz`OTjwIGRr#a2
zOwslnm$0WSKbET2mCT2I<oae3&$oiCe4+j%;&V-3A9vE(O1+PQm%~j501tj602e8#
z9*8C{k|mX=wSXmN-kC4<tYe=c<XTjEF-xE^ECnK`<t7}}>-&`cf=}7KqyMRZ1rE`4
zj(Dy{zk%X5ka=(<iZ%wSW=r?N!g(U~XMRI(pMTLk{;yfWo#)1O#(?rg+wP-wlIL3n
zY7r#^4gt!3hO25pAI*PLb;RQmyJ*sJU4iXzx{|Q1Xj1d45)1?S4!>!6Z4E0Wld$4@
zTHqurU>S$w9D4!B2<`Eso(lBRy!ja8>u&up5TDH*wE>NyV$ZH&NT6LrVIL7I@#CTB
zc`>@9tU4;+mZ5GVu^nvBm}sK>5xgDGCj~7Co%>h~uzUg1ec&*H@9ln4_z{GmI#!>3
z9O+Uv15jJIyuH*8*SZj;+7ada%AvO7t@aBYvVg;wBFi{jaf`4dHcYS8v9pW1O=HFl
zcVG0NP_43#(QsyIjwqq^$F)s%{@<Z0hNvgV=Kn$Dsq>&*0$F?yeyt8ZfA*%m@K>s~
z%i`@lKkL<ip!Amiip4lUNX7$494*G@C{ytHDuMKb{;9K0)2L-H$W!1iN5gSO&XrWL
zjwJdX#@DK80xx&SMfvG}TTrQlE<uWMDl_9~;G^MjQ(>~{EED#mU{zv#+J1Sun`ey<
zl!}&Tzg!`{1mZ8H_leM6YLBkg;)2#*k`=TD+u7D?*azlfUa*Ns++R}h*ZBV`rF-N+
zr~-U7|HvvAq=Cas-hH(t5OIqLM!j=GnIo@A&%npIOc$VcC+B3Nv1e4161k!#bb}X+
zbLW;|Av0+i1L-$_J*H3AxV4Z8UL{D5$3!o!<r&!=+|sGrJoCspnxq|y`e>A~H^Sr$
zGId(h@D1$3yxe2rn$~MvHtMajP8E|dpRvLDpTGy0CGP`3!OMX6Mb-F=Jb*nf;2v(q
z4-w+T*+f|UM5dm6ynX0G(Iaw)HIA@H?gg$qGCQvZxh&yp8v{62g>=!g%6)N%&$x|j
z{y=~tJjb^$dkr}$I!Tq;f!s)-34r|Cc@;j6THJdMQIFvQep(PypXNw=h`&9-1THfm
zMiUOg^iJ^?nA&~m-srnA_BQw^bZFqPItrjJ{!6+`JUMLp!=&;-2hv5VHp7{R(7b)w
z*W*|>q&#|~KwaF+dC@$pV|{(d!quanO|8)ZVDJTJFq4l3&UJ7?;v5f<`7v`stO(M{
z3WNs~;4R-o=LGf1Yz|oM|K)haj;^-NJNPd4J>yGGE6M%x1P$8TaffT!8tF%lbSk=U
z50L5FWafh+gf<!Nlv_2{x$L)vP4$JBqTbDmcP?zsysvVkaLuGRkZ28wJwdAOW|xtV
z>y2z1NT-Rl5oW|PLO5GDZa$*m36krC$sDfhyU;)0GEcGX$2t<qURS-YaeETDK0rV#
z|FXN$N}TY#=u@Wvu6Dw!SUw@)G6^M|8@0oDcbVMe5$g`87S)xIpJW3Wk#A_WRaxI0
z#plJ`89zx;kZ3C)OwOxZc`jnxikI;857kP#QO6grP;_R2)?=4b1{}~dOah>DZcy|~
zf_>%r&fs4ZGFtsyii$--$z-M(iY1Jiak_pMzD?Bu*dsudS*p_~;L>U)4DXLqA>BEg
zPLiSM!<gJiE)F8u=5EbDWQT%6FX5ndDqK(T{l8>y^wr@PE5(2xGLWXx`l{=2G!-x!
z*ZhchK(Ipmx_59fly=RC{>HHJ1>ZMGlJf~@F!|#VioknodN!fxy|}H-O+*B?Cv}sn
z`9>8LL390EZXlQ2*$zz&70YV&7znq5c0Y@1A9M_)7iugn07ua7dj6Imy{N(@JRo0U
zqi6(p)4g%7)O#_haO&{LFMnK2aE@?alH29pkVr|8Ec^?G5Of|C0{X!sf|4Vw##5qM
z0Jkyu<-^K&y5%;N+ZUg_nfl$M6XkW)m^iE_oskc|tH9-E-3gcq2x<?vqdans%sWmE
zQ}1F@K)#@>>Gvl=Dcd;cm4E38ga&z|yV>oiuRB$9nANNaQ%F4GMQ<h!DP~OJYQiio
z<mQuk{q!j%W(}KBj{qH^kh~R0Wbj>xXwnpp2@{GxPjrCeiQJ1Z<tgO#?0bKbtUVtS
zOn;18W7v>)NWu@G<ij;!ZWlcBlZb9PNK1=yi`z%$9w4Q{haX&M4TO7@?BSqNdr}c{
zT>VF3^Tp4YPF@VRXUF@Kt|YzDOA5FWCVD8EFducBh#}1)&+!nNl#o~XP4~BrDXheY
zlS_*FFfLA7Fr#a0$0-D@j+95`W5>TR^ZkD=KoX8e;#K*^H6j-CmDJ}eeZrP(0ls|N
zCyz*>8Fp@{%-dUqzEZ3in(A0}>pOA*(tt2LjD4Tr<{#W>&Zo#5A=rt)`7_c;dnA(b
z8_%JoSHL}Nq}%K9eh1OfSjpC$Q)@JfLxZ+yB$2$~%o4H=QT$$dvJ-wox6$+<qvgsn
z>r>EoqAo3u=)i7Fbg*tY`=ttD<*1E4&dz%_UOBw!c)Lw^$nOF@B-!`r+)6Z_Pk@ye
z2&(e=;3>tyKjNC1*~5#5jH+X0;xJ=8qJ;Zo*J+<#4>+*H5wK!{d#;}uaZ%D8(i<8$
zp)rZ8M`@T*Y<4%x;@nOIUjHAN;meN80kW9BxBGiWoVTO^reLjHqBa1BD?~ED<!NR$
zWx3(1er2#Z?uiU-23I=4TOs2I3lh2W+rMN*o-(gOd}+y2#U<Z=W0cnJW9`TOM9AHn
z=VXvc8vK7WeR&|1-}nD8mSk&)ve($k)?(k2u?(TaSYsq(-;-T~Vj^Vhd&@)^8v7PT
zL}jbVzAr^~vS#ahy+6O--*e}A?mhRObI*C5*EtWK%z@W-vrE!_m>4W=<^%tJt=bmC
z|IR9&J0oFA?t?A`4xoy&_0|$w_tBR}gNMRoXH??yy-yFEslIaYZ1RE9nI&rGzj<rG
z6Aq8+dbY<jleOyyf|}pT6jcrzif2k?GvS&a<6TjFDqSf&tn8akxPkk7SLOV0f~XTQ
zg4WY<hEIzm_o+)EokM}G7D*|B%_D`h@1L>9uz4eQP0&nU5U(^soJ;E4r4v;}=#pYS
z1w<%&F^oEDXBQMWRi4N++C2d(N6R0p&`%+o;=^(r4u#pqFMP5UE)v184%s}oIJI1V
z`nG?TR0H(NG@n0OPwKq3(Is=u2bmk@H~Hes4K8Ro`ET9;OtyNm&`diw$QA^1-SQ6>
zk2-yOO?*MskC8o6La>=<mE6IgRW?`_>e&_;lnUrFkpJ=fs_nX}&zz9KgiF}GbK8D0
zjc87P4|9VhzDtuJ?R}~L<#b6JqD~DevF*k`nrO|jsAQsH34lAzu7EQ++aRo3fM&Kk
z&=}=8vwy70?_K18Ev|5Dt%LU@oxipE9$X}o_|=jSwbR+a{Ht5nTy@C!$XBbpF&+-m
z74ohOX`f#?au6@N<$VI2VDqP%(dEo*Mjow*PlRYRob$`J^>gnh7xpxTy3K2@uDo!d
zw?T&Z1LT1vL;0#{=M~*vaq}~o;*K7z!dOP&>+yhN2TJJRJ$KJV&gHsNFI-H=X&Fz%
zN~@C2sTva=#sJO#bThgfN?&d6B)awVWCI?L*ns2moa-@(*UMl|?$&VBGece07K8-;
z&xD%5R1W;DJ*dCdbNS3-t>i$TTJZiX@ggWgnjwEDx9R@4r3HvYk_(I$Ke`a}Oqm>#
zpfiQ})<Gjj#mzk>@(Q4XZB5`d&x+JRgA)K12?*Wk!1cjEKJIQe^I>YTd%9Cznw$DP
zaQ!v?LcYwCWF3Ub?^MGYnUj=B{tH&LuBS$8pv6#SNG~GWMRDSb+^t4tb}gKRjQq8!
zAvtep;u5CEuB>KWC)@E|&9pF{6YvZl2>GMee(av+d?Ju}OYq-$4b6mKa=c&VLUbuq
zN0y(Z?r?nxO2HYZPug#iN6TuK*zbGVH&qf1e!B-G6Ec7v0{eR6Mr#g*we0YdW7^!K
zlundXN1dZw-=wD*xP;$#w<;oJJJyE=C3YTNy9w(u&rypSi`vy4sb3tjLRKJ^qV`q+
z6blW1y5vQV8K?uUHwu)<H6<STJ0dsrGxJBU$6c7UCU+=vz1d;CLtpKgSjkOdoEFKF
zq?j<WpB~O(2x;AE)l@FOGWP+LOkY{4ASYGZ#t7-ZzpAUTdUUuBk~v{b9r?l^x|&uf
zU&V&NVfQD)o^YF8OK06<TxUiGk2VpKTFU2J9+4BCxt2vtv5Ymw@5tfXA+``X`hjl6
zEhMs;Hoj)O>f9aV5B8r2@Qcd@f^^0$)Ff2~1r()_{E8e;bIz7YjX6Y*V)q1lAX(9D
zP&j0e{7}-1Ze4%$iVj}%JJbH(=`<(0qp*bTucyKftHJ%AT6yi&BRitr3V?z1l>~-*
zcbKncY}*IkeB*rT>(m>vDtWuw^K1M)x;@1+%E-lQAjBOR)g3vj@cjPZ43r#3&c%n(
z@Y)53ocpQFyLUTfwm#B5+kM|oFx}pB$xF3pESGkNrtg#NQ1z2+PZNpOCT8;k4|l7+
z(8+?5W_k1y-PruK8sXE#mh)4=Ps&-!e$|~*$eN09^;>>JULZgDe7#ZQccX%)!S2iQ
zzsi4^{y{J<q!2+5C`V*U^hz;<Cyy<?4bg%Zt9WW;OR+HBc@lr0#8$>d!-$fqo+KS<
z-u&GDEb*5G&CsdzQgRt1B#TX5*^6s*(l4|T`WPADz4~N3yi=&#BwXdL@zW4NN@0X-
zsIajN%_zH@fYu&9Tld?|B@A?m4e1MVQLlaWkEYY!<%KnOobKoy3H!RULk`+{oN~~C
z?dC0qHt@U3J|X;rJ}PpmbqH_P%dCFA@uHHo|I4nFk|`-Zr82bH^jgi)+H&k3Lqzij
zkJJn1<uM;PgoC30^-11%z4q6CoEnk;mey6z&GwW8avim0W&Hhi*|$&bd3OpfShx+d
zit|6xMAwMXef@c$!C@b#4NB{HpD6LA=~<Rj2Xa4M>BPQ0W!qK{?Ew|cVZZ$|(Xz{Q
zv#v73qIA(|;Q$1KC31CUKL`$iHge?nTq7m(+?J4$u0MQ!f3<fMdl$=i`4Qhvnv6gF
z4D%O%8Sn9ml>QdWq}$k)ClbN0Jx{o|XBDb2-aGh8MBB!}v`)U+J1aXQCJ4)&57&Zs
z`n#EOvfU0Ax~$4Ly&Q$v{PJGif3-BQz>*#D>lB~KpFPH_13TBNYswq>Um-q)Jt6=5
zp3d>R((ilB&q1y%nrym|!X#u7laGK)SV%KLRY<F!sUhy983seh={?8j)<)XHC@=Q-
zGRX-1zVsi)p9aj!{nKO5FfT^#2-Rz;Pr9bGQH?f5oSD7rhyT${v(yzxek{&=?qkJ_
zPM?WHC2h&smzv@3ZbqDpjt9*aH$S3&TG`b6zTK2#wX8n2!})N?=887wwA+(<LHRBF
zP5aSvXAXBKX}{J6*a#=r41L*=te)&@Z~XY`>tPUiQ*r(=igKXWmF2{FbofnQCN``(
z6_x5FtA+pZg^$Ibn}l8YCB4)|2Qq=ZcMOci9-o;ZHVszZj_f+B*6z6|KRlsaQ5uia
zEGgCWZ8t9@)<`6I4s-qqZRi@h%T{r#wfw`6!&<?|&Ob;;`72Nccdp}!xdq$q2nijY
zgVX52?9GCU1fob#7NAi4w{|`N3c&S!_9aNy))CJx#?x0<s#?5RxfOmO-lA%X`Vy4<
zg0J?K=Cyv2>&m2uJ;#El<2M^P4?3edyEK|YqSJVH@3oai%9<Sivq3iOyc%7<Gnyw7
z0u%7?Q}L3&-Ig4D{ngBY6Y(zkIig}=KHBEB#a0DvvCoOkcVxGDosb{!n*4@bDoK=1
zpbD<M+{5$a`3J3~9u^65I_E*J)OFknJ=O|Te)6o{dlsVg8};h@FhdFCBr;2zTjm}<
z=k5LR+=VMqiw{TH8J{~&WoK)ON&cF=N+<kH4ct;5-+Om00S%43(^=iDeQEeE;p+M|
z7WW}bZ|+xCI<OvL6XIm=&Jt~JVG_!(XargRS-CppwG4NOB@HU|EM-M+wG%Q3K!GN)
zZ07^N(E}>8Io{NBR<gngzm~IV;=I|q33(-_pJBfDo<=!niEffY6<ezOAIECOS~|8T
zdFF)Q{^24%$|F0(r@-b}Ib{3p%7eKL%M0@_YEJ9RC<bbu!6qaF3HE&#a|HFYH3Y-E
zl3BXBJEMj-Fg8zTQ1ZI3|8Ds%hMWlP`s7#cJ6zRyaGJvT?>(NIzLGmej3H*mHa8xz
z2R;pX8}<W~*f4hGRs1Xb$Yx+D{#U8{c1V^|Fsui9s6qLQ=X42txc0&^aQ_z1tXoRO
z`*+TY->ttkg$lE+TyOHAf>ZiyZANR@W{BGMZal5s)>G-i;Y&h%mkLEKe>i9vdUh)Q
z94)y%Eo=ZiBz!U%tP<y;sk!p^&&tJxBZu}}yogM&4QuUPN|Wi%`J%)R_x(C`Evxz=
z_*8iFDa-eqZTg^PmDoZit?T)O`Q_2t&k#JPFwm}#m1H&Yy?=R)2l04f(S+J@Xw=o8
zOfe5$WYcQV3Ku>&Lv`ouZ6w_prY8dLgxKlM+&*K&L<2)aTtG&@#3B-T&t83zgndF4
zm2q_J?NZ5A@A;OeIJeibs;zD}x1piF-er*CKzD@D>ROaqRUZ~Mbsg!+y@Gbtul=E0
zb+N<81+ld$ydCk}p7BL>K96jZN8iPk2$_dFep9{p@>C-^4OHFZM7d&K-{)qOk7UIM
z|2(8tRaJ_g*=2Nj_VfH4wB%qw4X6;ug-a6syo&{=Y3kQPt=MXHDHeFn#XlqEIfjp}
z9Gxal3We%ZKun)nSxY!V9{lr|%s=wof4(MDUi|4j-5BfgSg*k%9&J!{z3|4uMFYu&
zZ<Y~R{eE?)Kw}(L9n5F^+>1)67j!rYk_VCM6&?!W{>d7d81-wua*_FuYe`J+Ggs+&
z1Ny@-Vq>6i9DSJHf%}7UH+`|tN+Z`xC66pO`@{O?Du=_N*eoO?`Isey$4TDd_kNhZ
zDWXk~?Coxtm7+Fp-!It`(Z?5b^)iD+{vtZ4&trMdfG{HV5C1TUkcI6CxBV9ObP7g`
zT3z`SXI`gchY95VNmCr-EPM_>esE15fCkb+jkc5!JSTq34mACmRcyPeT!@~J%ekdo
z_*sKs^HRltsww-fRWvl=SKq+9eFM^nq{T{yGEy^2Kx~~~OOds<JaQ8ww4zf>m(#zs
zC+-!pX2<b5Q8iBXoAdNdX&$SEFZKu(je}jg#HhM3osmdDsJw;l&u+Dd>*Mm)<M)mF
z(^oXSedj{&$h~0gw*EkwvoIqnf!8&XYf2Q)h^i~=m;Ve~Im=W~HK+D@*tc6cbDSQ3
zy3^^^u%Y4{`vlI|y-gWcx##LBy3})FSIoST2}rl-ikPi1vva?OyZ^0cI36VXzk~4`
z%GgLae2^sySDRXSzxhSE;*p3s45kiErHvP97_Bs;j&~oS>ws-QNF0CrUIsGk=_1Bb
zG_5Rx_<G;Z-mb_Hj?6|^jdQ&@1>4{)j4m?VUY--_4z7P?sGN^zb0Bo*1(#UK!iE&#
zO&PW(|JY&YsMp?9=pEhr@+<NhJU0#(syq7WP%1&L;F{o7GpZF%F?i|4M$-P@{LM=w
z8-#VTkx5370m()2d-)vQU(H^kL<)0NO^~A+q7g5lORMxg@gbgIv%A!3iWoDrR1AQO
z$1NXnnqPw(N(zxuakcR#zRRZ;>rD+2V>~dP#P)jv-4*V}_<jYLx45(4PtPE?nbs2Z
zpVzlWs<Iu^wn#$!{3zKa+qb@4f;0Z)pgzZ1uOe@Pv)HcgekI|n4i|hz9p+6#QgE(V
zV&n>aGVcTU;xn)^EkyF4G3~Y=FmH%+akf#CQtZB7_31#0;0%+o)~NmGHP)A9TDpQW
zS}zBM3cEtv#v)B~ZREvdmr#OY*xh&diysr=Ga{6q+iR3CfhK2FolJ;ra-c5zAI}$C
z@ziTS%5VV};qlLK-GcX7C`-Ql=pEc`gxh)8q*IDY5xl7bKJx_S_+4k;xtK(hgXhNL
z8pD~xn}2=#NeaWI4Zpb?%}=zurr%FB^vx^6l!OaVgYQ5&sdpg9<e>vLHCk($5b6L%
zXO_)D>7L$JZcrFwm@MNNzPn(F_`nP6t*jp6y7bhaN4qVBuzY;V<xj`$L=mRY{#W$H
zll>wF(=?r5XK0FrU>j>Vg=_Eu!K1h<3`C<$M574l0isI)mZjD91-4<lv|&o&orC)?
zoTp!=8xwclRbt{{sW;A@!le&!kB+6Al=Uwb4k9ks@Dp)+*9wDHBLk}}?nWNIa@@ZD
z`AbNmgX=yU>@Iv}4d(5Du;zq4?#VPd3)|Id%O|IvRW5L~p`cXd2b`;>FNn!T#^D$U
z2I3{TK?cb_d`)q<3Z%FpUEtj%jpJ_>L0rJ#)%fPRT!BkLP&6!Whw|3k$$6Gqdah+7
zUf)c<YwhLnzjyt3#wt~$%{GvAz@%hj&suC}pzp%t-xiHbKAz5ro2g<yxVIIb$hZaA
zh1X<S61HrR!Gndm3m4YU6XQ%``H3*P)zO7hh9sgy<e??c&)rk-nPc2g_DnSMJYCq0
z?wDk`9Citw!a<tick=5RVVk@^SyhYEG*(-<f9~S`{UO;&n<k>`$oE6HEnSK4#15dt
zN0T!^)Ym`1uhIxh2;gJokxK|BeZ9M+XpYCc+|8Mo?~zW0(fu7=_@B!A+!-wqx_8Mr
zf{+CGEY6V{hNs22<wDHDce%_BNleICDl>?{@3LpVe3%>wmZEP%eT+&|9A4PEx<az>
zr!ChIBlmw@pSp$=t(+L8Gyc*VHCP$NeD2b^8nghZ`6Tkt&Wa0JoLIeK(U5?7l(r>`
z6#aQNHN!%E4*E!R<<oAz#>)3h%+Pub?S#uBX<C(EZaEuF_lIkQx%vIe&PX)%x3vfD
zZ?XP~Y$Z0qEnQuI<k-E=dp#oz7qR4DDzR&oyyQ8wu8mxi0&i?#7<hq~5%gjyEb`24
zO7#uKV2*+WE`Q<vU6&xt!c)p(y<*o2dgw(B&M$--2dDb$TfW0S>h9VvlUtuHio7&}
zvuowJ>^StTn7QK{LDAg6EKBi0iKjRHL$AfR1jO<Yxx?~bv->8&!$rEHei%vNG^M{2
zg$qEpk*1+w0a6swv;lrUqf^;yEK)YRS}@pYJrEs>8&ZJBgQEuX4nnvwxj|IM@{daX
zobKzAXpJRrkYON#^X0SNyoc1>93JGBvwjA4-wayn!pzfDNIsBh|MubYvY%Y9f*kFT
z5?p)5G9D+c%RVCT#mW92GSWJ@qib<`9k=I(;5`EqfO1l?z=PY+7U(y|uZy3Zj$$q-
zm6LGcsnT9QV;ATmjX3pSMb;06uuk>!MyQ-x&hh?wi=5d=gTV|u9c+BB-L?taFqmQ|
z6P_<si(h|NU*t68l|#LD*A<+&>m`597#*{HFwq7%jEBmzdw4#22TbZ4oWfI+2#f?z
zGKW52ih^6M*m{Q@pWMR;*$|9i!@06Ip0coOT(wtblZ}v;A2vx{T|V1K&+TLNG8-#(
zT|O5x$If5;_@~bS=jD?%JN{vzE5qCE-c%`y!=bn1dPVtow)d?qTXf)sWCb?`QRkuc
z-d50|4XJAGhrFG+%2hru@^I^8TID6@a;MY`q-nBeS|!qPIwRxP%v-q*$4kO7QBKS}
zQmo6GmN^#5rp`AKjgb`)<*gsuNo*3G8VDLMo%YKORYf0aHa|&u9H6G)$oZh5Z(Vxj
z_p@euli9Q)5pBgVZy5k3xrEmgZBIm%SUUSt39J<GvBFpi)G@rl;_Gq5SYh|m%l)mP
z>ZisoFNovYcfA@jEDEZ76m|rr3d^aTGjRcz;E&)O8BGObD}!;+Gz)1_JgR?jp#=27
z>Y?Xcs!`oVrxX}wss1bK-ngQ_|B9ffef);7f#0DG(_DL>V}WfAS5|Rz!f3sygp)km
zFUup^lFMhDi*V^TxGCa6L+kEjS)dPpPk-orC)6#maE9``r#-N0iN^JmR$Cr+X(W3`
zamp4nXL}eyU_^e>YKH#2qvG+CWH&i^wyO*DETFQcd$5hqGc#6*Gn*kzE7&xTkdhA{
zw0TXnJZQ$$&(XLBtQZ|klqn*|mm8p2)SG9|bkHM<nOXmkUS;?>yCO$*gYpPD!Z|F~
ztPlFFgZTFx6sMWv*?=j#$joDNWno2Y96>QIiI3b2{}fxR!{M+T?Z<*DL1}2W2?+BU
zEbdEwj3tYg{NudJcUAC>IxF1W)B7a>NmvQGVERPB#8>aDSf5L38qr70poY$K*)&jg
zHY5>s?pT8oOL(w^G!Bdi#x_&$Y9mC0xmn)g(l0ohPDzsokyRYABoVJ1LK61q&wfs2
zjQc+Ul7Ql_xq<7uU54vBw5inl<M+bgg+i^m71jK5N{J!?nHFo9mj^zK(uw1(PYLw8
zDN~}5G@Z5|jZfv%;WMUFPDn@Sq!9B8haImoje|b&09sIu`nXGw<qeP_Aq+Ph{s3(Y
z3cYi7VD=pBJ=G{g)Gu)1tj)j8TUpi_8M4E80_%<~m62|}B}m>KzIA#6YmLf+?w$)M
zmWPTa1?2?67m^6mWMjOzS4PyUbFd`%eR*`+qk=!puNu7fcAYS-cDy9Hb$gHocSP>r
z_;jsb4`F?Zcq7y2&rNXAyg9o3)OwVC7u|1b;alV3=4-vTeIL{6u0oRZDkNA5t(ern
zGfcU_Jr)>q&wZ$vqD-5)6&^?;Q0jMxHc5ZFyIe4)6jHw=zPd;$z5e_)w>>p5&^*|H
z8$On8g8Ju#)GD#OWIWEE>O8x7=4FOOusGE`GV?;=_%Tsa5H1Bpz1p*D9dR*c<s>*9
z=h3gGR^IJzVTu`;h|GI+j0AtU=YHx?i()1mDCm5w+)>lh8uir0GD5chBl!zn%G3QB
zS`}Y;%8Pd0V$9V6GmwxG-l{v=6riWyDbpI|Z^mb2QKU-}nI9V1CwMaH7&Um>F!z`G
z>rzt5lH`Ws_)lGK*bg~d!<Fv+;eANg6Xh7(v%R?JvGs%DTc@L!ZQiJ<ka?p@p#|mw
zGtY#evko$HfH5ife*Vua!clF^&~ba0+fX;dp&n%#x>wg%feTQCv(O(;bp8q*t52KM
zu;sBfOGG=k+kZ=-4Zo{vb%AK|O?CfH?9DeN!k<K6RG(fK00zLDCWLk`Luf7AxP+pU
z2xiPLI%)UOxskrsf>I;gZ9EmqT~L+rCxh%^+HoHvhX93i&MT3Qny<HL#Nnk>6I9k_
zQ|=fD=$eYJ3=7|Nevb0-gE_nMN=u6ma*}CFcJK30rx4-Kaal<AV*iUP4{VY@VfDF>
zBUT%%Dr6-B#7G+drqeSl669!l9&YdIF&PQ(>V}<`U_8XlL@_(k%t^jm@i0-OU%G^D
z;2pUpU2*KDwcl0Y!~BVtIQR_b2)}QHHkitc@Q}9ESV?{L{@hanG`!I#=2KVKeoZvt
zsF>w-`2K>|`CNXYvsRlVfnhO^CiipQU!`RDCDq{6N~yx%IT;!Ko$^9~Bieyc@9A9$
z1ElF*WNTCh<o&O{hkVtNmt?^>h?mk-S(tRieg=zz7Uj^C{<=_94H%3Ikc01t0OOIP
zndGNS((B9>j)NLPCyWPFySs?4jEQ)OK_T87Rkuj_F*vL6UAzl!OWMsmnx^<x17z*J
z(kW?aS66$AV>WZTrKtJ(q+RP>>@TczkQ>HH?6+Pf{T`;@8;GZ)NwkoqcwADa%IM@l
zj#z=MfIvPrVtLf5X3YvSgUk%(tibTrVwR78`qOEO-wt{&<{xFNCT_7%#BPCCq^b%v
zmMmV7P}fWh=tFR+n%lNE-<7Tq;no>BKN53o%z^uK-%k#1zQ#*JC8ymiy(BOgR5q)g
zW!>Thy5vq7^IjIh@H0ZjFo}KrG4Lqxl;GsAauN&!H$?gIsnpelN-WaSOQX@kl6U;h
z3^eBpn;RG=$8-(&f8-eL?xJgXNRBt9w>xsRjOZ^G5yfO!a$wbM{CF{#)GWSx<Bfl#
zgj={DEJ5^9d{4l&I9Ebe2KyGpo$`=HKcfGgtzMcM$`1lYH#BLBoY3SU$mX;yBV>~B
zQ$VK~zqCMuv_f*{nUQyb{N8z~NyKDEZih#V$Vyi%ZdK+HK{KybZ1?#_Uppyu_kg`W
z@C7>{I$CX=s_iasyjW3zJ_#C>`&hHA^bF?Qw^nN#e2FqSg!j~g(5xSS9ec8n2ZIx0
z&Lyj@m1Ru&5wh<lK*MGrpY&}dMI_}RxmQ=!OnNKe{Ry?+y?=IFE)J}}afkXOt~j-1
z%7@L!;J`$(^eU%@=qYzG0flYwb#nbJE7{^w4#%r_GPz*nYEhp45d>DMye}KM($tQ~
zOu-JhXbMTl+yHnrem)_^`a{3Cy1M8FDJ8r6caWfX;ttg=;9q-Et*~&2ns-+zT)o?`
z0S<~ChMMz>LX)^NJ}9*z{0g<FX#XGp`5Ds3=IT|2yNB$u<znoRq(xHUg9+qBxnhkY
z2D6>CZPRR(<(fc)ip9Nw&*bB3)!|a{xN&S%`26+KoY<au?C_;*wCv!FDLop4dCKD_
zh9huce_bzCmWDT-g}sk|bQNAoU+wO@mh0keL8+v1JrlhjB<t8u1*SCJp6S-aG%U>3
zG+H{1ONUtFy<=*Y7Bqjb5p95sK&MNuo$OI*pj%u^jbSa%U00vs)cuE!H@G@dS4nX;
zebc^mw_EXOX1J(11{3K?+}$T?8P@oJKX&Kpz%0Gy%W4OLicG(J@YE9{x7W@M=dB2V
ze(TPSxZ=QDJnHE9CZB;>Kf;tgu=#4xI1BL5Gws1MI<A*~$vjjmAqK^;KKdSSU~kSw
ztaq5k0FQjnvAwKDfAL|&ekoVS>H<8sUR;&c2^`*cs~TXQa73FuIh3m)`|@Sq8djt-
zRo+*HU;d44sJn0HSq=0_L8j6C5~9)IycWb>kC!|>248R$WS2z#&<`pg{0L9tI;e1F
z^9l=l#gYfMq6=(mxAz0jKxt*KOJ2={0^xDi4-jj{kV=Em0-ZL^zfTmifqoQevZCH+
z@-~3OBm`fjHC$WY0)h2Nhrib<BiXL8-QgKK@lOEm8;C!u<%c)ncisO#7l3^tc;hWD
z;KICIbPo^|SRhmso=a5?$^BgT#Z#;8nPQb}UuG(LdxX&hOdKq5Osj2$Tu;skm62vp
zxBzGA5)}igEBjof(g}mffY0y)llzB1YwrevH_=|#Z&u0Ny;k&VSC`va*v9qYs<QHj
z6_4%M>sU}cjcOWxziEp!nJ^f+p`aC<7rl1R$*aU%?{<|39H#@*o1*UOb7D$JhuL7z
zSSBU1zw?M&maVU{?aiQQjk9_|Mux=|5dY@?<bKL*Fmoq5ui{QdO-2SY2P<rj$ns2w
zYjNFo|C1{QqviVb%rv=JbLLKz(qZ;$%XR6B*NQDg&y<At9nPob{pji<o--u*3{<w+
zm+-&0x@*j*Ckv*)@kP~K_B)P7pF+fkF^3d%h&-Z_N|N!9xAW`t1N%dCG9<aY-eE{3
z42Lt2<wE7Eq`c|~b^8fLqPdX{7>wU98ga)eLy{1~9_@NhcBVD6!ad`X#~whE{6Gi>
zeX8GwsD|M4a`IG7FMPAW2KY@~{FwR99W-;GoBGCL7|L8rrvR<x4JeFsWl59K5t!co
zsQCn#7&9<i)F=((&}nnfM^zLWtJ9_g+xU(fI%9rnPvolNY<)&J-zLM!!sGxJ!|rE9
zDqrS-<>7GAI>!K+<AKp9ihObuwrJSlc?rbWt#Bd@QS&87US(x?QyPe{4x{>#WK&JW
z&Wp%MOBd(hoNj_+UML4HEX!xTH@ON939b1(T?%q6=5@0#!C75=pN1%8_+mQScfEyr
z0`Ki+jIbU<3c|cay@J~>Z$9KOeaxK_n3Z86C<~1G9-*|9VW5kvqkjC4$dY4rNoVzc
z=bbF7Z2HbMV%w*^%o{(qLP$itq7YZSZ5G6ej%(>VySicqlKF|@W`i_K*QPR_&o(?9
z>IweB?{Vnb0m}e~CXbz%`OX3K+Ub3fa~PsQp;&;rGlo5n_RGCc|Lrrm85zSDydzAp
zmLleoqK>@5(pNPonQ!=#Wz@Z3>pRco!uVkm!C!#pJqsqe+}|&Pe)f{`I(s$j`D`rp
zAX2HyZ?%<dO{T}HViiX#|8-{1EGN&SfdIc}qx%u=>_l9^EeZp9UfM8=We>6RJx(7!
zGs3SaEiKI>#NU1SMo#o8Di)g6FLmALu%SL4C;P*4vOnOEz-P43^iyxMGqahNxna9=
zeKztc2%uJeKYI(P`;=O!akyrP)r))8uh_3Z@?vnr72n0rlM-%2s`{Dse+LI<rw5ud
zhIzK}68&oDoL-Ogv~XXBOQluHIbT00SC#SRBiSRy(mWqvQj@*_Pg9mWUWqRRq1_T3
z$(S_3o=TMp9iT&X2%MMuK&RN^Vq#<^$R>fs)ml-C$Z6Okr)Iq~Qy61OVg>xZPvVB(
z%R5(?D%cLQDlZ<qB@4h`FWD5LsCUkI4fj1xl94A#k*<;Weyu9HpsF+sN!)L*F>u~M
ze4q}wOGzZ7$QW`Ad4_PVpOHL?Eye<L!B6W|=J0P3XtQvCUBgwlP4@v^$<0smz%d`m
z+EOd?U3%Ow-r47NUZF+o#v3+bA$-PxB0rhmU2vTTm4ubXdM4L>CTzc5<^_#A^<SXQ
zthEenZ+B((0R5d7ty1BKSK6H=8)4tV?-#_N*7I+`kNIK2Npo&F&(FOWLN6{<Xyeu2
z_{`B1)8JEuN}enaG>2#Suyhb5YN*zp;qD2}v=l{Vh{2D!V0jnZ=^h7vnoj>!GKeT#
z4na>fPk~vb6S~8#!mEO6L-?m$kjg)KQY>D97S62Zg7DHprS!7OIj1J(z0;R56?StW
z7aYTGG734n8aqE5-gm;tO_?AYezJpq@KX;Y;5>B@D@m!i07-Zg6%l&)X2z@Q&$p99
zKQCH&p#;xXkl1@O!kfH-pGeZQ!f0hchy!i?4KQ!j^+!{GitMi~B>^2+XSakPe?Zlt
zm@j3+T-YSxK*QAj?{#EO*v7;D@GUVosPed2@<_&2O!P!VmFERSO_Mz4HKy7IX2V%}
zY^jGD5^B3*)&<d{sK3eDuKmA8s1(W<&AaseH~rW$+pO8gbOTV%Se&Y5!dtAYRY&>q
z<u9MuN~GcwaH@j$_4>nq3gfR(b(rwQTCkoR^01q}A`9;1KU@W4r@)Qy7>65_yc>s8
zhb}=Mf36L)L$@|TWtS!c$u_`~e0c@pXv+7*A`K|kle}+-4#Mh5SfdBscc0<rLFwf=
z=@E;Xj-jqUK8mDJ=AAu>Tg7G`I_1sl>HTr+#KWzs*+}rGl2q^I8C-4gJt)ju-C6xp
z8S%TH3FdDg@18mA;M9PDYjF-MGyw%B*pm5zHTj-<SX7vl$4B-NnN19D!>iaw<vSMH
z?_(cz{gHW^Y^{p&yWsE)C#uUnNnc&lLl*-~#7841!{m@`6MaVs_6DcxOWlW(0Tq_T
z?RGG4i++t{Nq8wulPPd$`2a3`B7h4ED?s%M2`ldH<<{rAOEbOQG|-(=BiB1yZNojy
z_z+K7=*32fBSf@KPOh}5dFYGEmxMg3L8`UIDSWqZ72gl{6uY7PZfEI7Ug{Mpq4~0+
z&X=m@vYG!BA$gb@chGe>zn*OL_6<q^@*t_HJ1n9nuY)%HNLj&C9=(wpAuZm1MezRb
zn#5<g$yo|B$`jmR9~n?-LhiI<NN%x=#%K|il*$Bx{2{Dz&O4M_p|tmE_a7N91;XM5
zm!GbLFUJ_aKGz6Y-_kqj>_kJP<sHfz@)Jke;+sNm@*M!It6f}h$EPM&GJ0`&sr<U4
zCEMwPLL62tURZ>~SE+hHKu~c_<}JPWNFKg8k4gvnKE<zfp|k$ZU1TP`!r48UziPIw
zRs0w~&VcPPrzXQp(S<9Ta+m1p>BZr>(4EAsyOiU?rL&<%yXZI#$`)Qt$5OFM)KDAr
zD&vCHnDQaU5p5-8f#Ud9x3m24u5Ur=!B?D*w`R2_IvEBo34zF+cJJcwQ_XI=@yn+4
zx9tm1e87bT8JM}RvN7DQ?!UvX7e1u0UVeuou@hlJlJJGIXljyi|3<p$vhdV$QRKU_
z3f<mBi<~XXUYBF*H%{390zJ69y1&81igF9JP`4Psue_$>Iil@R=bD|})jZzdaQ`6Z
zP<+u`Sn!R6P}ZTs4iUK|nX|1=ez-9IZKfaM3V^?V6s^?alA<;AEZLmz)<*HA4|YV^
zFKb0CFR2cBEq;OT!&sjVc{UMD8i1B2Zq0p|alwOd^fJM&b@sE}ke3s?1k#mikXkfp
zXGfgkPNsuxaH2V;#0hqvJHqF~&xM;=%{Se!G^`gdd=MFZfhcBX!gmA86uMzrjB@pV
zv8l^o+>D|xO*R?)YwqrUbHNOu!Vb$5ToDg3nq1l57*c^dQ6iIX<=hlIJJj1d@nsf3
zR?!PeI9HXzSf4|ge@z#>s4r(pDcPtWrtjCjUu^ErSHU(9PVN5cm{K!z-P~7xjSbGF
ze>c^fWfhEby}q#N)q_8-uK7J5$eYPe9N62MAdeFQQCb7<1DQc>g&I7J7v|o;EjW{c
zs};*1UXq0K$Kh0UhqwGbJ#pQk8$|Klh&(J@gt#dnEuYFrq}P;S#~Gb!Y-e@7#|51W
zzCS{IvDot6xGe;_v>_H352&u{wA3`5H5Z2O;BW<hTx8%LbOUs1P?aRJ28?}e%_4-m
z&2+UyEc!=SPybnp*S~9oiPA|(j@w8WmQX+NI7Hexs5b@g(lGP*C6INee*KfmzK~}T
zp1bl>t*|n0#Mr$yX83(Q#Nqh>@ncBk{lDA&it1)4C1fl#t449<I(h*&bOF8-kAuQz
zBFV4Gb?&A2vMa4LavIO=#S-3Fu^+iQTmVnr)KlWF<r{i8HQJ~<qUZPvr%*f<OmznK
zkIqAE)<&)}TjpU;Z;Gj%Yq@&s6)L%S9DTm(8JN)ve8D5+Kzn1fS>{4GaCK^msQcP)
z2%DD#q7JBclXBN>(uyD5KkdavGC}ZOUm3ex5fw~0S@g-X#-H0KVS5p6={!6-nV*g_
z2I}ks{S(SerzHWRRr;dxW`7GAB5aPI&>5MSQzmEAPOj3SS8zj;@YCa+pNVj(t0Q&)
zO!%<O=a5z}a?s;owoZeFOPfnY&+l@sNtIigv(~<qbyKiP371g=J?ydxvDitdmSYKP
zl2~JtH2lNsUb=pv-OrDt;39YwOBRP7<s&`}d;@1^BK+~%>*2=^yjicvDM4DLCb{7<
zF@DhmR?dLDTX6;?q3$aS0aGmKB(M=|UZ+U65ZRPPOIaS1)yBo#JZbUggbX3RTb5<@
z_vq6eO2;J0rp(En7IQue%cGNntctxpO8tcO6*hQLX$_J_rn77kNNL@D_`=g2=a?Kv
z4l)<n2j=aBs4c2zhCU9zTAc7ymyaPDlC#QDi#jLFIg#kS+=NS~*eTzO#ffA4v7x#R
z>1Q1@rv`v-5@{#q{kT)map{iRq2&!an_ki+4@8IzoL^$k2IF@<nWt&TIkgB%3a{cP
znWPO$K-@-Gg^-=potSJN$F$uQOT?`h+#6&tB-e7P1S15nJ`v{%>a|VVI9-yEr1-*3
zib^pDW7GH#g4;eHEK&AvuiNczp+eXiv){MH%jso{3SIdds!03Q3UTL0#$`Pc=jM1Q
zL-3ht+z>;6fZ{S$x*c+=1~2u(#3{7PviX@_W`Sw%A`ALQgs1#7lZ8ixIEDJ8756T>
zJ_QQk@pWZgezYW6VIzSkde}5qNiXD%uw-sVwQs-w)?|oUh0k0^bHoV9jqw6*$wfRy
zY=#bm3PJ`~oc)bC4+4!Zmcb1mC|A?^(9)^k4B3|S$&eN1Lu-qBlFVb57Pyh3dP-Up
zC;?7b5efZADC%tmuyW_!WzuvPxdkv+eQYHL0WZLH;@5((yIv7FjQZ;1T=#?-597C^
zyE=$Oajve+{NE*S>Asvm5d-ZF;p14og=NnJT8dh9N(?UAvNg(z+Vh=m-kTcgb5$VE
z*IE2MjGb8W+1bn$*{NHPm6@~J^7-l*4%KZ$rE!K_sSqjB68;(WZUs|;QQh}JsG$7L
z+|_EMB{WxPhNm%p=$|9s14)aGBe~R$Gt&`-XFg`Si$T=&pgUb?R-bFX$L!ZIgNuIh
zQamsnkcXk2>?IbWN|ms5-VqLwKOJG-H~TeiiNi&-+b$BCYv7`jy*Ih#J}{d%=0zcz
zWIb(Y<7t}sVOR7rxy(~!7#>nhaT#kgHRvArhi00L+E4J>pYP-#tHHdj7<R?72|ut2
zrhL)N#Aw0$(?yX^)X0PvO-`Az<5#do+K7SUCsp4@q<%ZOsN`H+qj4>IoH!?6!uVWP
z`Jd@mi;+Wr^dwH9;Yn~xJ40#;x)68CXF_upX-NmnqC%JDsz?d{@*|HeS3+n=Glh_&
zXPKjLP{aR}NVBYSr})%4S~>Uuy_8a25S79ybGvVN@d~_~i64Y{YX0-$l%lakq^a&x
z&Brvime)tr6BpI^`v^Zz+sM1sUiZ55Y5IePWT(v5<-JLjVoz;EBKu4i-7w0O{u?C4
zUC6clpW0fgYrkg*u>Qc!41XFv9`1{6PR#!eQK7Zg%<QRfK@j<1j|(sCj3L@WVP#w(
zIj%0oGT$7-4JUrx1{cbpDWC3l5Jw3I&<5xu4jUG4Eb3AY$*p8209$J=@T1@3(r^1+
z@Pj*ZqScMxVw=pUckFKmk@%?|(M`xQeMzxEwnLRo_z-cSyrO2Proz^6apk(8H@E<2
zkU14LZ3jIgmmH?7K*r;4rd*iY0HgujtZ|{`;A;8}h#Jm|Ug-XoJ`2R5BwUWFnx4N1
z9#zgpjMime@DN@3n-=Yh<q(`91CckwE9|N>3EKeR^biV#44$s|Ge-A89$t;Z>EWLO
zY}YnX<XAv2bLV#EYjz^AHiGvP2N2*pM)Fj)uXY8t9-&)tL+$#XyY<RE`>FcAr4_S~
zquTSrW#KbLMNsFWqA2FrTcj{%H#S(!^TQ5YfCz{$+-?;;?Jq0{?@eT@?%ZVj(KRxJ
zpo{?b`y76NYQol!7c`&S@ItG7<(HEXYuP_X@<lu!*5`nkQPV&AHsDGwBU51B)`(j@
zq6q1wk2Szu(T;zo1d(34XVDs^C2S7BRDHhe-A=iV_rm=Pdm#vwA9L2y;yuAap}?Um
z5^<)V8aM5*!yH|<A0oY@DSl(j0NXhAqRM`k7UpfHb}_>uFCH&r)~{irMNuKlJjcjg
z&}QQCU^tZSt&Y_r<u1>R5#doOoD9+xgMre{zWsK7OwNh%8O-UpT8Mc#Z!|L)RUgQn
zDL*@O_lWL3rf$UfeDrDI6`a4}RUW56Rvyk2wEN^2BtBI{nX9v^p{L8oJA%Mb#PV7K
zkAl1Bx?(g>QsmP|m3K`ds*(u5loZxpKDXBpGqgMna63ywO0aOF5yb^RC$V&lVZKi9
zl}o5AW+6D?=b%0GnD<JY(&FRHN7mLR5whpJUJ-ujD8B=4^bxef#~q<^Pxs;b1bb=Z
zJU&WrjqVt7$Pc*Ul>{E)6?G;75zIYv?pkvS(Ujgec_6=Ro?0J-QW>&F%?tyZ00O1)
zz&|7q{DitMJBJ|!guy3a05GV&B3*q8KS4F7H!`{qNp@;9{XykQJxRx(T$x8$h<V;g
z)EJ=d!OM8X-mz5wQAbuf$=-DLc}Dm>%9^bJT=Y`vT-scSp=jeZ$2tLps@|b?A!pku
z?)p)EH<WRB3uuIVTNjP#u3-2dkwNH6iA~*RIO~5iGXpdGOR%d_p(Xhv9#+H|b_j(+
z_gJomCK!BR+>0bU-HiQ8{5~KkY_Vy^r`v34n=3N)^J~{Wc)cvc5NE)}X!HF2Fobow
zeegeFXI7=r+=856SVp1lWDw{^qTQ#Ikm4vl-S<Kzw=(<odqAvPF}D<q4=$$c=aV1r
zvqt};U(N&d`QL&zRm3_(%mg|3Whx#Zr?ip5;C(ehD~L><dh`CW^kMX82M#-gwbnje
za4?u0bqH)o5T5@N_Ty4KHD-0{!)3DcL(~^PGvsl#>yElKRQ<(6ZT2W8VaW>%X5=q~
zz*G#T?sLg4O~e?LTmS4YQSG)nFj(LxX*_`$%RHLBql^wkr{dD1D}U_FV|B_iMGQjZ
zD+WjTYxOCkMJx{_@N&>q>gr-}I(Sq92U{|&|M=y&$UpD~q^GkmGwn8U2yCMlr@&&K
zvYcDDtLIW9MsYjet>ay_^M}MXY~`1cu}zfn4AWv}q!hI`-D$rps?{dnp>!T*lo-^^
z-|J-G!QU#)^B^f4<V)bK?kDJcr1%<5@!-X#k8BdgIl07}I9t!b8weGKL!sGZR)3!4
z;WGi(;UXwLMAYMx)C6;B_*x4*SbBj6{`v>=+ulxvIXk)v`JmE8$Vfo-BBaaBi&--w
zrOIc$MQS8aX6dDn-}ltvtDh^>Y+#H0c^R@pSD9d#{`o~rXBN>nPtt{!U=i7W<oSAa
zBf}z+S(A03m8)ao;zBoHb&~1a#U*}#e#$+FdPTpK`rLlj+4dt9(id{@Ae-VEZh8Wr
z-GEL;_Gh+**|uM{#aFhP(+hW>&Sv=_{3cF3IJV~mJG^r*h!m5{=nbGlE>M1Vbb}&>
zZ`aTx3b|8TQ@N#j9|=uG9Nv@#;A?)dJ}c_GA;hLjL5<J(-8yPY4k=H?3OPsR>G@-4
z0k&Z-bte-bg*VQ}&=i|q+H&Q~ZGw~Na!Rg-@GH~~)`GXWUF~<kk(hLn<R13uL-Lkh
z-!263BlELYzfXX=FXTt$yiF&Tp(}91?pKm0^S|2K7pa9fq&H_(XimV0P><@g?fNhP
zY`lxE=i3(AfCF{~B0%%#RZYotj~HCVpSb^i`f__4{Pe{rTsf$AOq{N}t4rd?w{7&V
z3&mrR;C&hF0F{@n_+XId8yt5Y4uD!7PCSNYf>nZ5f~AXAg;9msn%=rUGtc@V?=03I
z+DYvT-GmrX8$tY`H3&pvFngNV8Vx{IyIgKis6nlVA^DK2z!3jX#0!Dgx-MULkJlI2
z1T|WTOmEOMLyD%!7QySVdFB-m4kS^=kP=1?1r0I`OE0W^Iq;^SyeE@n)H=)`QLWOm
zTvV=$I6E(jwGuuurhEwebm!?SYb}6h%Hf2%>8+`Gsk$asei5E5FNP)YAf=J}v|emi
zZPU^cplZ}0yRN+d?2X<DP%q5`!Ou}i33k^kc4U&l2QkO(c|jtKN_mT`174yq@Vg>M
zua>?zxOH7R6C5nvOcn)JbKwFJGtq6e?HL91X7)@vw3Z~BN4zt3g2@kr&_mV${>q9R
zsmo#%ayJ;c48Gq<9p7Eo{ju%@U?#Q*H8LoWT7Trx95a0AoBkVJ6?Lfe474&G<*Qas
zG|8Nv<jehMhg@4+AG18a0}?s_kRNy$OjS{-IIn`P!kJ%ybBZ!IHVV{!==O`nqs~9N
zFOJTTn;)A{@*KdKUxd%mqG)>-ULJ)iJ%7U)rFybR*ZP%F-hYn}ZhWvB!=q?iIxmb}
z7dhZRV*PKLWp+;&U~Q0rc-*GoOfw%Z%-ag#2IU=_+b<ES(id`V)qFC3_avj1L8WU+
z9pKu2*$he_=SMPCJc5)5mk*@LxYAD()4Z1h(FcGUDVW-d^_3nu&nkmS|HgpYjhc3p
zk*>g)mvwKfRgQ+`_h%)`J`2%C*AeA}8lNr)nSo1u*229qq_BI#RN3hb=YO#DfVHQK
z@1ZAOwXbW|tbUE+MCtRJI^Kx3$#64i!$4ormA>$k!&x!sQuERCe)P&M7vB%#JBlmu
z{xXf)cr1}$zV~F|6(6g_eZMWp$;Q?w9$RM38r3K^xkY<RobF2YJ{)ElEd-Q0a6B`Y
z*4*Q3tcK<L2i)WTRdjDee_5q<9XvJ}tyDa|9lc`G0~Ru-4|0}%-i*Uqn!Bl$HYg}Q
zl~yguTMts>Pz8grhc`dSF2C7Ov|bWdwA-mfUt8V1F|vMgmMt{3+KS0**9|kM6l^J}
zARSPt<aPO~uQtyhqV2KLsrd-Gjs#Elx6+opj5RZ#Gb{gH^3tLA?)$j)U)mEBstDUd
zw{HxGPwMWg7T(`KBJ>B0;^iDX28aLrV3}3OFp+pj9J`MJ;B+&zhwk`$jC<%5`;7)m
zD{yiAWU()_o?t-z2qI;2z6Xj`DMeKZofw|`uv^1FUdy`YAPPoB;ti?Q#^?H2EBVI*
zSQMH%UB!MWo}}!U2gJ_SpIgzF+?w%)ZTOs<7hqCB-QYd&Gk;epr}E!{o(9z05i^ao
zfff)YHoI0T<U-W656W4_L00OYkK6mR|4+|g-V$EAhTVL_BRr%u1u4;#=+AF-R^-W|
zIvy<JCxa?p_l4ST)ps}!RN(+tC$xSO+?|l+^RUqED6O_(;BGe#lw{uG_81d^$DH4n
z0Lx09Bz3tJ5gjJ|zNJgbch$pS>hzD6HvSmtv^gt&@)jO9!sIO;fL0JmC}zV>klR8f
zD*`Vv?&Kv29wPY(eG3y$wQAD*dEfd*^sBN)X8K_?kSlW75(?XYw^}DdY6gdc5_+L1
z^7FTaxe5&C-X^bvv^b@qnB_vN(tl%Ihk{8eV~!{yb1@5A2A>ZdC<eR)9_!XzbcRJ4
zfZ~GtHJ;Cel0yI&0TcP(6P;1UEiLtb9{{x)M*sJ~k>iq!b(SwG&yoxP^I{n7%L-oX
zei>a*6nTDni42Yc_-{9uP0I8s<faMV6T)`k{EN34%;!ON8Wr_7JWs#KjXRuBhs`tb
zdo0Z(b&?`<0N<>+&mr&8O{L6i<|$u+KQU#cISvC2Yq}$^x_GLCy5s5P#5bEj0yG;;
zHlv-YKzF3%c~(_WsUbwKE-z!)gdZ+bQEot=ePQ7g@@dIj5}>3o7?ySssaq!^e@&}Z
zxSSed-Frhw@$s}C;jVpZQa0X2eE8qet0rj2Bo@vi8Fxq12~|S(PG>_UhWsC5FseQg
z4j9ucsv$<uqTz~=yM%L;;gwXGGy<S~vDLEd-O%vP%<${#f8I@$0^w05{}sJ`LFe?f
z_vBgfCSjL23_`VE*eWdO>{s7K42yc?@o0i!;G0?^Cbifi+`y7mx}u$H=i*HxA9-K`
z#+ZY_>p)gq`6Q2zi7Xhrtem@;#Qr}6@k-bkg}#Qqz8-*3$<k?PZHn;<`Onx{1PXQE
zw7ju-(byvGZ@%KOkk_^K_hGBj$sixgfwd3!Kk-RH68C+T?4SqvBAJ@2poew2Z|x{b
ztOYN_vo4DkF!ug0HRpxrr0JoVxI3U4jbTY8NMZ%3V|Rv=^_7811@(S!vEoSD7=7t=
zRdal*C^Nl>xgVgxU{L%>Mo8KnA0Jw%b-o704IdBj`1B<OXz*2~XO%Ze521>PA#N6x
z)R<foa7!1b5=yX=fXb-gCAH3qW+Mr&d-$XmsNU9mf=?CfuJB1X`Ky<5ZTE&?_`g`3
zna*(*;ZykCaKHV!zc-j*dYPt_n#*Ad>kd;!wAG$q0-^XyF;Y<b<!G(8w0vYK1c!SJ
z$%6WCv1`r(AaRsx7jgiV<_su~#iqb#=4mHdfg#<macD17#;#%R@xu7CUz9)~0z@Q2
z!=#r=bc_9l{XF<OLaGe!UQ>kUwh?*_w`b6@dkt(+$O8^Gb#=JS@0W3p!MNEVfV{y^
zaBg(smwutC^TzK}lEhD}y*Ye#$g}g*%R8#(!lf)9sE4HCt73a<C)-LaTBP=M;1w6n
z*WN-SgNgwNxOrKwE{FycPsn-soZQXkp6MUdK8}L_4=@birpd~>%C_em7QLnb45t_V
z-%MsyQ@odF@%c+H<7f{UURE=pTou+0jrn3XXeSm~$&0Wue}szdR47<0k=H_)bAYBP
z*{_U{f$iO9zp(-UK7jQk%kb6)gx7#KUxW|D;*=RbB!GjGvXtN+FK}_8^Ud}HWRSF%
z9LYtUst<#2AXs1{buAncRZ;H~qoAzb|83NbdPu<2<&c>MvZL@3cWq*Fs~c0usq~6T
z$YQx^j}lpm{F-)hJ^@gSYR-iSob10YLPc`H1U)EMAVsxog<z^<27Ah}7nG3JoOeH|
zxC5Jm-OdIS%M9kHt>Is_i+qp(=DW3MGb)_0<Fm!>CFATjRS1Kb(mw#wbl<*L4Dyk*
z%SoCNstd~CBN-x;Z=-*XqLYe?v9j>{c>}pO!LZiXgEVi8KE8a4!{t#9ep}jtQl54y
zNBli}liS^B=wKWUgd^=hRz>VETUs^!M;qVAwzJUgr--91f$ZT8So(txwyA?yfvM>m
zCtfTl(x68P^*2dqfl!adJ${nb?Q|C>OdP*xS;BO9>a#S}zTkQ_ZZ9Gl3Vc;JOPIHS
zmx;yhl6*_%mDwQ&awg2%8*z&Yhr0~()<G;Ix!afIzXY8fg1u(}&TGXEzvPm(mZ{HU
znjruM$NSwxfSS=a9XmQK^tp5Y&0vX~T<&3F60!XQ7my#h8UOachM3qI{%=7I{9l^K
z_-zRu02NBbNlEY-hN-VCqoAXS0{?#xp8(i%kXVOr!75*E2;%T#Yd8?lz#EDW?)47b
z`h^T@F*~CJZvz)Nj;p`bg}~#)Eyho$rKX}e`Xj5{MMXh|%3OLj+5W#xvM}V%L$8QA
zAG7ova9*`<-{A3yaXjOodZL&++HpptIj9s~X3bnwcb}T%s?EcSXdAE78SuilBS&b5
zPBN)oUEKK_44i~l%~ryo9Q`!}k9kp9MyLp1tEv0PMcY20i=UvghGx?|f3E;&lhQnz
zcap{mEOC{RJ&AZ5>U`+j@2Pq-%Ry!UT0__9Cg>z?1=-k89W#&7S<6)Qq!H?nS{DAI
zz@}m3cx{MESgId;rcZuw8~LkBspD{lW*6mRKvUl%Y)Sa=b;D33<rmqWjJhG}I|6o&
zq+;s_fnuiEh#q6iyf%Jk0+VDw>yY)!N<5i4v_l`h0m=t)6;QuS#@UDkSXQmJ8-CC9
zEZJ($o9Cabjd<sSuys>ZIsFn0{R3B9uz2H-kn^=E7vl{O%~g1)+&g*t1r+Sj?0s|`
zuD0sG-$kaVPh@N1xmt2E+ut;<*S#+1__^9JyK%s>wA<`y+l;GPu_=Jf2!yxfX-a<;
z&8>_GU?!O%K+GTks7Vc2VWh(;5hyEF4K+J_MnG}0Sx!ijdU?F1uouD#HKN{p!B$?s
zB>`duzg%E2LB>^Uu{zpr@Q)sepLU1dFct^wXqv9(<8$*56Y_^+msi|us97K&9hH=S
zY%hN8K#g>-3~=-<y0@i8>wtD`JTu^l<AR68B{NB!gB2JWlt$$UQ3-re_(co8iKy`C
zfe-B&7^`+$bU1tL^Y0+iT3alFp1%=?B&i9&Y;!HW$Bvgu$Z)QX-8fv<Nacpb)X3pY
zKv0URd%XyuyKT=#r1yPxf1Q}>?FL`pe8h}sdoV@(znZQ)tck7Z6Odj50@6DODD_G&
zf`Eh~UP=II0VEm;MIsRhT|__uN$AxQ5$U~y5fP+I?-1!FH0k|a@ArKBPtKFGJE!f=
znKSd7nMQKp4g-JoBLLjT@NQs91*70AU*4&3c1zfCvos4$J5qqxrvMh-=3*$l3wi7l
zKJ0Can`}tCJ?44Yc1g`Utq*vZj4*utq86Gt<T235Rv6heq5eb?lBKn^L6<l~aTacQ
z0n9ShcXtAp6}9|3V5z5q09YO6$XaO@bCqhanVtrn$x5jvz}ddeGCtnfQ1b>F2@z_r
zUS)v{y4?~)*uoCqSU6G@yPqF^nSKe#=C_s(_vTapbR%?ex<KLHG1;~;1oZ}ef8Ysz
zv91DM`4pko`0Hc~721x89tLJ=QJ&ZcNLR2=J+!EBtIYWc-dUzvhk<X{k%Y={ysy}K
zYUSenhGXl`rswfdsWiO9PPM?cOfkFV@~O_ZPt%5ih$L1kE#IKy)m_`DXRBo$qe%VK
z<ExAdC^Arst1JOT|67BD1X^HxL|}Xl0B1r|I(F2pN)l4+HsTv+cL`;xv%s0KbN9sv
zrjEUxc0@2LiYKfI<$3Tn>YDp$ga~B*5SYgs%=7h;Zr<Uyt_#myAr3BB6s+kH*SQV@
zn8uV}odQtDy5^Oc0`u<sBe9vVq<2XVJs8d^+Qr2al%i%tgcX$Y-$V_Dc47W*LrGq`
zdT04-f{}V7YiIVV-=rXVCS*`5CaUa}Jq2P7p%c8*B;#4bdE9pnyaH!U3?y4$mOHIL
z&tjsMMdsvS^28T}9fBzVS7hNx#xE*nMNMw3*UABY>XmX>M?WT8Ljdr{*PTcQnlmTn
z0C+FRR=NBVF|2aTNa?x61#UNdka94&0rdG+Z%ovD0h7zmZs<s?5wIEc+{<@t*4P#Y
zA}#9^od~gneeli$t}=!+2f*|tR>0KS-R-y>466Z_Om}0=WGVL-fSgOmzb`foO#>K=
z-T(woSA8j|kn79}?lYR8I--zUtJVNkto~70k)8C{B70Pl??>Gw7$n_dfQ!IL7<njR
zP38q^{_9NFCG5ft1wW-PWk(2qN=vg^w}Lf9)i$l&jvR7vo4$SsG*wR6CmcNc`eiO7
zY*&;o`MLe~8vy)5OINE3(AX3zTZG0}L6bN=cKA!W)IqkDK;TiFWouh^0mrYUJRiW8
zcvEM>%xgS29n>tfni`%x_5LdOD+t{V0ersL#VHyLT1#FxMgtc7EShH)6OZs)hHB>K
zvy`f0K^(QE?Oo5wdz1fp{`Kjbs7H3Ny2c52i5j3!jRbwXW1a>{e}ZP*hZU?XRwR}A
zpZIuZft@G<-l-7w5=IydtnCGh_t77bd*|a<PofrY6Yo~$2q(I^6XUT<q>qe$&72Cv
z!r+NjXtt)!tng*`wmWv@XI;;G4)8Js&s(&IvSNh`<@Ut~O!0#_u?=qQtBo*`fV%qw
z?V(-^SKE#7*@axEkLN81mL0$7oh%+cc^!3Bgii{~Kzx<jDIxe0j0wVofJ)gDUthh(
z&+*qhfbhfQ!KNYK>j1HQV=*eVZY9HT;*BL<%?yO(2Xp#@+gk`8w>|G*ZeDVNXEzUo
zAv~az1zzJvhvGR`);|*@6njsVw|Amyk9?I=mdKbW4-lxF=LW6&L9K|7ZvpAsmFW7P
z<G?#{1HJcEDWb6yn}WmX$Yl^w9;O3}X6g-Lu_>I^sugijO{uhisK=AVlcUIu`-A_T
z3JLur@?o%ODYp$Jzk%6zq?DoB6k`{5;It{rIDI2_;)lGqRuv#KpD7W>E*xIQPtft$
z+&wQ`KVR7bk&L9yCi>jJF>9Y~e~(wza+Lb58TgTD4p15)($}G&-Yw$9zS^7lB7(ce
z#0kZA9HQ9n>X8sa==MmJ)7Bq<+tL?GAynP!omClR@rTC^TkCT@VO0~E6~@$NEh;cw
z10H2)Rs_Qd1&~hZQ{U(df#9RxuLMd$5))uq6XKC2aC_;2@bbcSvvs++^T|q-xLi=%
zz8x+A*H(YgE0dGbR~@}<c$;f9q%mhUh#xmqQ7<Zi4c<u;25k4bZIam%mVkGwiZGhI
zn(V^S7x;K6KD_a{vkvD40M|?c>oCz*Z?QRL$bRQ>yoX|(rooyw7s{?NN`>>t$bd)M
z@In0xmD~xb`LUaLe}{ypy%i2q>x_R4OF4e3ppEq!C!E!lAMs{5m?KW987rcWZX!s>
zyZEx_0FRf1?BY0LV;5_gGStN8$9VC4))O7+HG6=2$@>>d!8&UoZe!(_x)oA9ncU!#
zXZ_GofNXh8g66EgI&Ok@tB(Jbuf$(#XBj^Fl{!xR0@y;&ABt(2k&OZn&QC?V?bxJN
zAp}&=y=tK<>k1gmOp)T2Sq_ufsC+oQ*jV)%9e}+XzHic2_M_pkg!EvhUV4OwSWFZI
z{FJVge4C%BS8tpSxD@=*Bd!4q=!XWN9u!uaX!_{u2<`i~p+66OCu%wn{YLeT;i=Dk
z5jWqdtIgV8{Inw!fGH(m?|^CY*srZDq-qIaOZgYaVb2G~ylvJb>2a5AJ*g{9v;D5Y
zl&NzPn4V*KzrnLSvJSrbtcwSL*x6b<onYLm;(582yNrl?<7%6wHrSbdXSm0{IC~)h
z=3sVkftIM0M#&;v2jH!)t9kDIF`QsogVrzL9kBV~x)fdw{)jB(n`SJ0#6<S(5_t}Y
z#8}91;~H2XHp)q_^>w16bCX@XJlY2cHIAvg7ntXJVZ)C=or{{==9U!>LRhfLS7wr)
z8Yx>qH-D-m4}ZbE_N<>U03fiHbp9S%ZIT5P)`lmK^%{RiCsZmTSRJ9s4r>=WBWWXR
zuP5!|KYqSw!0Q8I)9evkg55JC*7AOFmOsR|uHILCJD$Ior>h%(-uS1OaCUth2WhBM
zC`B-j2F1H5UpOZB#xUMnzt%Y|jp9WpM|a@)#MfL5%#k{1W__-<gwEO<hHJK|Y61st
zMCSqb`a)T#-GHrpPr?P$*^}1Gkhnw>&DoP#iLg_Vx%W&HYhvG|{*ingMJ=lNV@y-;
z6jCqe9`0YTvUkB%<DWl$Wj`uacval|Jg*-qyNUtJFG=k~zYTfG9iWsFHka->+|36o
zr85G|4=mwk4+IO*xE->uspM7UJ=OdIB|)xDtz~o)rcH77<;8k7RU4<n-PZU34MVT&
zrbZ6spQ>?QXusJ8LotJUf<ZXaLi&c!n_ZlymXjjK8D=WCy%zrE<krgFAOZZ$Cr>Af
zlm)-b9!%|JmzajElNZ}}b^^Jpy}Guyf5v*qm^1HWHDZ|`mL^}E#dQS9Snt~a7)O~Y
zrX+zbE1qX@;zy`DCQyL>=VvAkJby0QcF_dSj`)l_pj3+^c@n-bMTMuBPu%|L5tohM
zA$$hRNq1q3e-+0EQI|btb~$_E*u`Dd2;1lV^S=5A`L?_J13W|P?(!w4DZfq1Lwff^
zCq*}85nK>O;|JygoRFO9^%}$_CturB`EgWLGNmVW&lFMs0a8MKz@kM=<&P~h4l35%
znsxN1AO|fGtA-t`npmd9$|O9W*m*>vebKL;^W5P>7NOht;%^RyT{`W{{qQa;{F{-;
zyCq(c{xac5g5x|%j#rR8;1ZtBn7t|>zt)ySQ1rC|@oqKj%vEswGOLH?;_-VploJ4j
z2+yG*oNpuVxBn3*P8Qu&mH`eU#y1+TuRb;}`DFvAz9`vWX^X|1vreB#eW8}^8o<Br
zuwNYhYd+x`!=268T!vr{`F-zN%{)Cjz5Vvem4#f`{S?vbFRvtoSDLd~e1L&1J*5Qa
zKCu=o3bWHo$=tUyp$zA^`cOz_=r+47s4nlCi-i>9<HcZ{K`bN3WA5)_F1VZ!5^ZCI
zB1Yy>U#9AEkd}MX<-<NwMV~4zZJE?nkwWg3RKovk5l=df+Aq{%INLw@Hf%$OQk^k9
zyKEt)dl-LOCHqNnLper`3+4vAL)=;IVK}L5l(@Io9J-J)t}nP1D!fW1sMMD)-$8zZ
z>}7|`*5}Jt)0zYmNY|-X5|4tfK)0m8%BfywG0w6woeFXZnqpUd_+SzGX?X8N3&oA)
zaA>%~%Z~YW?B?an1EK?VvtTUlE-k9eTn2jFUf%Rr^&Xk$z2VeyER_uzRz~p6;m9=H
zO{+8o?<D4)$RqCSWdP7;6LGVGR<<1+#CXULM;24vcGwj1E*>2Hj6WvKnrGtje{vJ`
zAeZKT54X@$2G@#B$`lR*iIu@p_YKQ-0$Su;-LcdFc@7HeA&v8YAlWwq&(>NPZ&cs3
zNSYb9QJORFxa1ys**9M2Ja~MmjO`WKYngSbh_NDMhy@k*q0d;xa7S9-<u93eB~~dU
zbLk)tbjA`MI)3#{8a50~iq^Du31sg-8d<ny3q{huoR%75n@oJ>_A(&-*D(K$<@&;1
z5JxCpEP^-jGfR1YiW+0>)iK)vtLTZRoX+>wJFZGd@vW;7+37HI;y5?aJhi&!YH<O$
zFNGL$DUdLFiV(~tsg5_Hw4G~ijKJuZ{LVxLCG6$l6=^Z#U+IseN`n=KXTfOKV--28
zfqu88R4B3?hrOWnlXT9gI@X-n!4RP^nbHRQx!81CIiG9B(EX-9tf=XoxOz>S<|p2P
z1w61%4BeiB+Vsc#a3DXhlVslfv$@H8t?1VRef2Cb^^`{|#b%HKT1c}jNUma;1uZ*f
zXzqU6VHAM<bq9?YiMvUYHXuR%6(R3>+Z~jA2&*ezZDAyF&xKta!_hX?s%wfi-gMjV
ze;!NIOwy|^M;dc(ngs#TpP-do_KTISpYX3l&jTz6<!_C@SOg^(xDo-a<>sx5mxN~3
zS4iElNs^jk1Fucu`Kb`Wnczq%y94lgj9(V&#o$ZT55?Ld@_H-4V;`lJOBH`ImyV3b
zpT+9!YA^-XL0`AMdcP&)EpoHEMJ3*8a9V-&PJ|Y9*KmJyMgm>{*JEo)`UhgnlQ*h5
z+NcIfUQbS-DP0@c0F4|eZ40%?1L(nyl@voYY3HEcIu}WSJbqZ+KsrO|nqyQjDBjDr
zq+{W$k?47t+-IpD9Q3=ilQz#@Zt1Vs`(6Zc2aEK-usYO5`Z%VpH_Pn9in=b;U%$PR
z8#hZK0E+8OmTaiK#{gDO`A$*zTbUIEovzm;aL=k8hW4-?G*PIK)qYw)xQ9uH0iJGr
z!)`x&V->YJrjte<%FX{B>*nF?k*UeRFdTi;nLg$tt=(@Ef!&FMPz;TKWpPh+^y5a`
zn~jkunQi_;Aqfb4qqPy}dU2Y~ZX;C5tT*6;=lejjWR&MKztBY^cZJj)Rh#0tde8_8
zTivo>;Mq4(%Xd${;wEj~D4I;1O^FYXZ0T-b_g07xl!we6E%;%vRQ)YYZJ1K~QImZC
zY-*d2&Qp{&@M>9a1!sAEM>EnB#RmRbhE&-OHU;KLYMbIpgK#cI^|x|&KgES8Rfve)
zG#k&|xjs3BdJZ$op7A>h3C*FXaYNA5=Xx@av_b6TPXaebLes_%2q`qLC1Omv<J8Gi
z#=Dmc>&rS0>aqi|r;o4o0uElMg5EOwm{K@MTfSl(yJ<XHKGTh)CJMr+<k-iO-@XhM
zbG|e4gYaBbbLg3!xm*Q=kPtz3XthAiAD=pI9l9&3`3rh#v@N8o{HL459$}R$oB#CW
z87v_!$Y!9i@+OM1k=p&A%0Co}h)_597L``cyL?Ux`W~bg<SXR<Y(?sLFX1!oH>;WD
zQqQWfV>l4p35VVE`k*P9Iu0hJB{m?u7z1hizNTd{Wez7WM&;P;YA}~h-IuFK0nvxu
zJk5iXd&i}Dh_B)h50uI^aG17kM_LjHS>f1U6!CAY+eXb3!ANO>LPb-kY;JzMT*t10
zBF3Zhn2KZMQ8rzs!SSm<S9IU`)~02VXG(ujymQ00WSBGb`G`sotI+if1pJjzfCggT
zNTDK{&>qI-4lQ$SS*rcUwfg(2;v~7v?GRu?c$7LGgq1P2%z4dIPuA6~L>WiTM0N3x
z&kDEVDZh6DUYZBl2POQI9eklhJ0-GOW7@RzP89Ob6F3hACpP%YnG=i58_{m0NK3L<
z&IiZ%c0D35kyUZMHKY=mJzSH=X&<{!MNB6(Ad}LXLbqRESgx7*T&AW4jZ7GM&)I9{
zkU3`8_R{x|UPiA!Yx13Ic1lj;qnk3lRuoNX%`!8oLm*eQgTZAXV{v@lBo)O5J{zhV
z<iT&xZ;~gckDtR2oE0Y}ht~}%2XwGfxKmI>$B=wM*z2%6VL>#Sx=zAKF;<i=haTP=
zv^{cVpO?`-@m=;+8L|U2%Tb1R!#z<wNEGn_v5(dAIjc81JRsA!w>y_y;JOM@ep{J9
zA6gVTO12wn6BF4(CLoS%|8>O%j@Iy2723E9C@GZFZU4Ow9g2j&55Pp3mMN0M>bXdO
zupDJ7{gg9&8Q#=nitxB%6m-@k&m(yX|MpZHgidTd35lT1=%VY@&L6F_x(HPbY94hA
zL7jM5=WMN(Qq2Hy6CMOIJGs9*zsvLogE;0^$z6I>>HK{|trXr+eQod21o4p%dLgI;
zq{XND{B!u}!V}n}&ewJht?ym#_7>I>f#-cge&@F+jxv|T>Qjoz9c?QZabcIF`Km2y
z^pllc+pLw{=!^Ynz?Ro1(%kJQFK4VOJuEs+)tFZ5BirXR;wAKOdihbZ$}_I*SW-#1
z-}V&JufTWQ`%&7VWxKtiyHAc0fTdCL){DNgMO@ulyfos~mTi!6&|<6y%}1x13I-QB
zNv(eLe@Q2ue<<;_J;b$zS!T4bz97@i6^=4gu3D-iB*CGGs)96Akf$(G0y=tC*C0&u
zB+vDoxrW}MP;ft=#A>t+CDv1XFMM&l=HB<VBaGn4bZvy3#(@jum9ZM{ST@VpG+5P3
zv89!y<EQ?Ets#UyFmapDRE*(!)|InzV&gOosysdU^mfM$s$AoAr6tTb)seJd@&gwh
zVy&LXvwc6ZLz4!!$nyZOx6!{qQxc-wJ&Fwm4feOPm`b}zixJM%iQ;ULhn>~V(!_jH
zW3Y#QDjQTH3t}RD`1vYmq&J~lUF^K@p{BK7Cpu64SS@27WwP)#gc@#qV(k|6ij0nf
zb?NpLx9Vk7q4F1xyX=XVEMxiu+J^Q20`|#i(N$ziDand*Ic3#0zo#30#gRw#A!z%A
z^#0FPh`Xr69h&;B*i0aa*7l~F=z;OYtff}jA7x>;L8;32;lWk1*QKHE72&P`057#v
zZo{PoZK6Meja5l}DzsDkF5j1n(tM`xl{g`0pW)p4Wx(c}L=UndzCZpH$DC7a1ZQk;
z%JXtOdjw3xiw0#3fa9u%v6LBQqxMX^!mA+|cB2QBjf_!ZKAP`-lZh!6o(Xy*3zsbh
z%v&B3HDrYs<Wb+<EMLq?CX_cw53zN9PdTw}##93f%#%`dqFzfZ?F#L{!j06R0~k>c
zX42iApKWDg6LRz_cs<l8i-8coARcl3&yyBK_dGmJsmu2et3OEnS76CQvAsX}hU2<P
zh7YAynOfvrvYVu9^0fz}Kc}T~(sP4EH4OrP5IG3O?v+J_V{3_9hEiu%VygjjVg8e|
zuTlOkO;c9E8lDe!Z`pJE29!>m^lzi*`u281pXap~i(;FZ8{_=m?u#p8f^~TA-MsDu
z%G60ck=Gx%N;IRfu#Q0+OXfGkRMD<?CJ7T_f`l-S=F8k##mhC*_eF>0HO)DAlI@+4
zaW*{u>TOaF(5L6v{i*x+v&%D{2U&=?SzG5xB(s!kZ2hRyC=-h2V*j)DBY+xe^*FxZ
zGXN7P6Dayhb<g}^O&n6_$E^O^Sd^T0&1a;`Y2nXfX13h<K-~ccSI5IJ<XR^K(K=!G
zbDC|;Gp!;B81^FooqadDBV#<KN;Tn5XYc%)8_v-7U#8;nc2B$a*;kchughkDYaZ)6
z;*@b?zkHIm+<fuf)~xl#QH<@{IY-{g+e2}TckePua?d?IUnj8$?eL$z7EP)vanw0G
z-dUz}D-)pGO4u80)P+1}JLr#fyXt3(FN}c(u%9xOmggxey&~!<Vk~rSEwea*P^OEK
znl}$#ZkfN&b^s)E^6;zt($}3ra=vKjkLP4G(zs3vSRFgMuwif>WeX1!^HHTP^loHY
zZt#*`>F#RmiQ3N0ddAv6$e#=+Co4Xo>=sYfGm!7CNn>O2o1^-jn@N@LTGwU87kUbJ
zxveUF`1Tt(e{aI80UW^DZ#-jIR}YE2rL(HcVbP94;(q3j)8BN`*G4!q8hqcRP2b*$
z38#(N+0e+?>u*+ziKJOh9j`GSvPc{bZlIdACMkwERe#b=Fb!2U=v4MN#&AVQeOs|P
zO}E8KBVy3#pNfOsF1B5-hN%c55g13=42sc=@gIcv&?MJRv`Aq@oauA2qphdjO`{#^
zwZ1KVVq2%LpR8h{DYY?aw&T@aoRS%={<3A2I>u6gRN4|q+-Mg)TTpWBvVR225C3NF
z<xEs>UBrXvIp9}yxs8pv^uNNuT8OOf-#XPphIl|C`&&vG@%jJS`f1=K1^ic6*}RV6
z{=X;u8B$4_HUN=K)M};};?p7QZ?X4N83Vv$q_)2K{H<D_eL{pm3Is*D9Tdh6RQ}$;
zSS1lEB6<^$<7s)wy25f8D{cQH@*Tk?cW0mm)Q!AD#4?7yplN7S|F2CSerhcWlGG~P
zPpbAr!Fyp0vS~(!3$QHZupu*{tfr_&)c^R80^csnwxGAVw-^vtGHIQz2TATNxvdnc
ZP0o7b$0)B>nF|?kLG<tG73;#n{|7Rx()9oU

literal 0
HcmV?d00001

diff --git a/assets/img/password.svg b/assets/img/password.svg
new file mode 100644
index 0000000..db7eb11
--- /dev/null
+++ b/assets/img/password.svg
@@ -0,0 +1 @@
+<svg data-v-c3ad5561="" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" viewBox="0 0 24 24"><path fill="currentColor" d="M12 17a2 2 0 0 0 2-2a2 2 0 0 0-2-2a2 2 0 0 0-2 2a2 2 0 0 0 2 2m6-9a2 2 0 0 1 2 2v10a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V10a2 2 0 0 1 2-2h1V6a5 5 0 0 1 5-5a5 5 0 0 1 5 5v2h1m-6-5a3 3 0 0 0-3 3v2h6V6a3 3 0 0 0-3-3Z"></path></svg>
diff --git a/assets/img/user.svg b/assets/img/user.svg
new file mode 100644
index 0000000..74ce0d9
--- /dev/null
+++ b/assets/img/user.svg
@@ -0,0 +1 @@
+<svg data-v-c3ad5561="" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" viewBox="0 0 24 24"><path fill="currentColor" d="M12 19.2c-2.5 0-4.71-1.28-6-3.2c.03-2 4-3.1 6-3.1s5.97 1.1 6 3.1a7.232 7.232 0 0 1-6 3.2M12 5a3 3 0 0 1 3 3a3 3 0 0 1-3 3a3 3 0 0 1-3-3a3 3 0 0 1 3-3m0-3A10 10 0 0 0 2 12a10 10 0 0 0 10 10a10 10 0 0 0 10-10c0-5.53-4.5-10-10-10Z"></path></svg>
diff --git a/src/http/login.rs b/src/http/login.rs
new file mode 100644
index 0000000..2ffd75f
--- /dev/null
+++ b/src/http/login.rs
@@ -0,0 +1,52 @@
+use axum::extract::{Form, State};
+use axum::response::{Html, IntoResponse, Redirect, Response};
+use axum_extra::extract::cookie::CookieJar;
+use http::StatusCode;
+use minijinja::context;
+use serde::{Deserialize, Serialize};
+
+use crate::db::DatabaseInterface;
+use crate::http::HttpState;
+
+#[derive(Debug, Deserialize)]
+pub struct LoginForm {
+    username: String,
+    password: String,
+}
+
+#[derive(Debug, Serialize)]
+pub enum LoginError {
+    InvalidCredentials,
+    SessionInvalidated,
+}
+
+pub async fn login_page<D: DatabaseInterface>(
+    State(state): State<HttpState<D>>,
+    login_error: Option<LoginError>,
+) -> (StatusCode, Html<String>) {
+    let page = state
+        .templates
+        .get_template("login.html")
+        .unwrap()
+        .render(context! {login_error => login_error})
+        .unwrap();
+    (StatusCode::OK, Html(page))
+}
+
+pub async fn post_login<D: DatabaseInterface>(
+    State(state): State<HttpState<D>>,
+    cookies: CookieJar,
+    Form(form): Form<LoginForm>,
+) -> Response {
+    if let Some(_session) = state.sessions.get_session(&cookies) {
+        // Already logged in
+        (cookies, Redirect::to("/")).into_response()
+    } else if form.username == "admin" && form.password == "adminadmin" {
+        let cookies = state.sessions.add_session("admin", true, cookies);
+        (cookies, Redirect::to("/")).into_response()
+    } else {
+        login_page(State(state), Some(LoginError::InvalidCredentials))
+            .await
+            .into_response()
+    }
+}
diff --git a/src/http/logout.rs b/src/http/logout.rs
new file mode 100644
index 0000000..5e38309
--- /dev/null
+++ b/src/http/logout.rs
@@ -0,0 +1,23 @@
+use axum::extract::State;
+use axum::response::{IntoResponse, Redirect, Response};
+use axum_extra::extract::cookie::CookieJar;
+
+use crate::db::DatabaseInterface;
+use crate::http::HttpState;
+use crate::http::login::{LoginError, login_page};
+
+pub async fn logout<D: DatabaseInterface>(
+    State(state): State<HttpState<D>>,
+    cookies: CookieJar,
+) -> Response {
+    let Some(session) = state.sessions.get_session(&cookies) else {
+        return (cookies, Redirect::to("/")).into_response();
+    };
+
+    let cookies = state.sessions.remove_session(&session, cookies);
+    (
+        cookies,
+        login_page(State(state), Some(LoginError::SessionInvalidated)).await,
+    )
+        .into_response()
+}
diff --git a/src/http/mod.rs b/src/http/mod.rs
index cba0164..2f6070c 100644
--- a/src/http/mod.rs
+++ b/src/http/mod.rs
@@ -1,11 +1,22 @@
 use axum::Router;
-use axum::routing::get;
+use axum::extract::State;
+use axum::response::Html;
+use axum::routing::{get, post};
 use axum::serve::Listener as AxumListener;
+use axum_extra::extract::cookie::CookieJar;
+use http::StatusCode;
+use minijinja::{Environment, context, path_loader};
+use static_serve::embed_assets;
 
 use crate::db::{Database, DatabaseInterface};
 use crate::listener::{Listener, ListenerKind};
 use crate::stream::{AbstractSocketAddr, AbstractStreamKind};
 
+mod login;
+mod logout;
+mod session;
+use session::HttpSessionManager;
+
 impl AxumListener for Listener {
     type Io = AbstractStreamKind;
     type Addr = AbstractSocketAddr;
@@ -46,12 +57,51 @@ impl AxumListener for Listener {
     }
 }
 
+#[derive(Clone)]
+pub struct HttpState<D: DatabaseInterface> {
+    pub db: Database<D>,
+    pub sessions: HttpSessionManager,
+    pub templates: Environment<'static>,
+}
+
+impl<D: DatabaseInterface> HttpState<D> {
+    pub fn new(db: Database<D>) -> Self {
+        let mut templates = Environment::new();
+        templates.set_loader(path_loader("templates"));
+        Self {
+            db,
+            sessions: HttpSessionManager::new(),
+            templates,
+        }
+    }
+}
+
 pub async fn http_listen<D: DatabaseInterface>(listener: Listener, db: Database<D>) {
-    let app = Router::new().route("/", get(handler)).with_state(db);
+    embed_assets!("assets");
+    let app = Router::new()
+        .nest("/assets", static_router())
+        .route("/", get(home))
+        .route("/login", get(home))
+        .route("/login", post(login::post_login))
+        .route("/logout", get(logout::logout))
+        .with_state(HttpState::new(db));
 
     axum::serve(listener, app).await.unwrap();
 }
 
-pub async fn handler() -> &'static str {
-    "hello world"
+pub async fn home<D: DatabaseInterface>(
+    State(state): State<HttpState<D>>,
+    cookies: CookieJar,
+) -> (StatusCode, Html<String>) {
+    if let Some(session) = state.sessions.get_session(&cookies) {
+        let page = state
+            .templates
+            .get_template("home.html")
+            .unwrap()
+            .render(context! {username => session.username})
+            .unwrap();
+        (StatusCode::OK, Html(page))
+    } else {
+        login::login_page(State(state), None).await
+    }
 }
diff --git a/src/http/session.rs b/src/http/session.rs
new file mode 100644
index 0000000..f1e951c
--- /dev/null
+++ b/src/http/session.rs
@@ -0,0 +1,75 @@
+use axum_extra::extract::cookie::{Cookie, CookieJar};
+use uuid::Uuid;
+
+use std::sync::{Arc, RwLock};
+
+pub const COOKIE_NAME: &str = "lldap_session";
+
+#[derive(Clone, Debug)]
+pub struct HttpSessionManager {
+    inner: Arc<RwLock<Vec<HttpSession>>>,
+}
+
+impl HttpSessionManager {
+    pub fn new() -> Self {
+        Self {
+            inner: Arc::new(RwLock::new(vec![])),
+        }
+    }
+
+    pub fn add_session(&self, username: &str, is_admin: bool, cookies: CookieJar) -> CookieJar {
+        let uuid = Uuid::new_v4();
+
+        let mut cookie = Cookie::new(COOKIE_NAME, uuid.to_string());
+        cookie.set_path("/");
+
+        let session = HttpSession {
+            username: username.to_string(),
+            is_admin,
+            uuid,
+        };
+
+        {
+            self.inner.write().unwrap().push(session);
+        }
+
+        cookies.add(cookie)
+    }
+
+    pub fn get_session(&self, cookies: &CookieJar) -> Option<HttpSession> {
+        let cookie = cookies.get(COOKIE_NAME)?;
+        let previous_uuid = Uuid::parse_str(cookie.value()).ok()?;
+
+        self.inner
+            .read()
+            .unwrap()
+            .iter()
+            .find(|session| session.uuid == previous_uuid)
+            .cloned()
+    }
+
+    pub fn remove_session(&self, session: &HttpSession, cookies: CookieJar) -> CookieJar {
+        let mut cookie = Cookie::new(COOKIE_NAME, String::new());
+        cookie.set_path("/");
+
+        let idx = {
+            let Some(idx) = self.inner.read().unwrap().iter().position(|s| s == session) else {
+                return cookies;
+            };
+            idx
+        };
+
+        {
+            self.inner.write().unwrap().remove(idx);
+        }
+
+        cookies.remove(cookie)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct HttpSession {
+    pub username: String,
+    pub is_admin: bool,
+    pub uuid: Uuid,
+}
diff --git a/templates/base.html b/templates/base.html
new file mode 100644
index 0000000..b92b6da
--- /dev/null
+++ b/templates/base.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>LLLDAP</title>
+    <link rel="stylesheet" href="/assets/css/main.css">
+  </head>
+  <body>
+{% block main %}
+{% endblock %}
+</html>
+
diff --git a/templates/home.html b/templates/home.html
new file mode 100644
index 0000000..a142aee
--- /dev/null
+++ b/templates/home.html
@@ -0,0 +1,11 @@
+{% extends 'base.html' %}
+{% block main %}
+<main id="center">
+  <img src="/assets/img/logo.png" id="logo">
+	<p style="text-align: center;">You are logged in as {{ username }}</p>
+	<div id="login-line">
+		<a href="/logout" id="submit-login" value="Logout">Logout</a>
+	</div>
+</main>
+{% endblock %}
+
diff --git a/templates/login.html b/templates/login.html
new file mode 100644
index 0000000..11ae59a
--- /dev/null
+++ b/templates/login.html
@@ -0,0 +1,29 @@
+{% extends 'base.html' %}
+{% block main %}
+<main id="center">
+  <img src="/assets/img/logo.png" id="logo">
+  {% if login_error == "InvalidCredentials" %}
+  <div class="banner is-error">
+    <p>Bad login/password</p>
+  </div>
+  {% elif login_error == "SessionInvalidated" %}
+  <div class="banner is-success">
+    <p>Logout successful</p>
+  </div>
+  {% endif %}
+  <form method="POST" action="/login">
+  	<div id="login-line">
+  		<img src="/assets/img/user.svg">
+  		<input type="text" name="username" id="username" placeholder="Username">
+  	</div>
+  	<div id="login-line">
+  		<img src="/assets/img/password.svg">
+  		<input type="password" name="password" id="password" placeholder="Password">
+  	</div>
+  	<div id="login-line">
+  		<input type="submit" id="submit-login" value="LOG IN">
+  	</div>
+  </form>
+</main>
+{% endblock %}
+

From 10548295cdf1830f594ddac952ee4939852ff950 Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Fri, 4 Sep 2026 18:35:46 +0200
Subject: [PATCH 06/20] feat: Start implementing roles (and domainless service
 users)

---
 src/db/error.rs         | 14 ++++++++++----
 src/db/interface.rs     | 24 +++++++++++++++++++++---
 src/db/memory.rs        | 30 ++++++++++++++++++++++++++----
 src/db/mod.rs           |  2 ++
 src/db/role.rs          | 37 +++++++++++++++++++++++++++++++++++++
 src/db/user.rs          | 29 +++++++++++++++++++++++++----
 src/ldap/dn.rs          |  6 ++++--
 src/ldap/filter/mail.rs |  2 +-
 src/ldap/op/bind.rs     |  8 +++++++-
 src/main.rs             | 25 +++++++++++++++++++++++--
 10 files changed, 156 insertions(+), 21 deletions(-)
 create mode 100644 src/db/role.rs

diff --git a/src/db/error.rs b/src/db/error.rs
index 573bbe1..ccdcd47 100644
--- a/src/db/error.rs
+++ b/src/db/error.rs
@@ -5,12 +5,18 @@ use crate::db::UserRef;
 pub type BoxedError = Box<dyn std::error::Error + Send + Sync + 'static>;
 
 #[derive(Debug)]
-pub struct UserAlreadyExists(pub UserRef);
+pub enum UserCreationError {
+    UserAlreadyExists(UserRef),
+    Permissions,
+}
 
-impl fmt::Display for UserAlreadyExists {
+impl fmt::Display for UserCreationError {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "User already exists: {}", self.0)
+        match self {
+            Self::UserAlreadyExists(user) => write!(f, "User already exists: {user}"),
+            Self::Permissions => write!(f, "You do not have permissions to create this user"),
+        }
     }
 }
 
-impl std::error::Error for UserAlreadyExists {}
+impl std::error::Error for UserCreationError {}
diff --git a/src/db/interface.rs b/src/db/interface.rs
index 7a6d8ad..53a9ce2 100644
--- a/src/db/interface.rs
+++ b/src/db/interface.rs
@@ -1,4 +1,4 @@
-use crate::db::error::{BoxedError, UserAlreadyExists};
+use crate::db::error::{BoxedError, UserCreationError};
 use crate::db::{Database, User, UserRef};
 
 impl<D: DatabaseInterface> DatabaseInterface for Database<D> {
@@ -9,9 +9,21 @@ impl<D: DatabaseInterface> DatabaseInterface for Database<D> {
     async fn create_user(
         &mut self,
         user: User,
-    ) -> Result<Result<(), UserAlreadyExists>, BoxedError> {
+    ) -> Result<Result<(), UserCreationError>, BoxedError> {
         self.inner.write().await.create_user(user).await
     }
+
+    async fn try_create_user(
+        &mut self,
+        new_user: User,
+        current_user: &User,
+    ) -> Result<Result<(), UserCreationError>, BoxedError> {
+        self.inner
+            .write()
+            .await
+            .try_create_user(new_user, current_user)
+            .await
+    }
 }
 
 pub trait DatabaseInterface: Clone + Send + Sync + 'static {
@@ -19,5 +31,11 @@ pub trait DatabaseInterface: Clone + Send + Sync + 'static {
     async fn create_user(
         &mut self,
         user: User,
-    ) -> Result<Result<(), UserAlreadyExists>, BoxedError>;
+    ) -> Result<Result<(), UserCreationError>, BoxedError>;
+    #[expect(unused)]
+    async fn try_create_user(
+        &mut self,
+        new_user: User,
+        current_user: &User,
+    ) -> Result<Result<(), UserCreationError>, BoxedError>;
 }
diff --git a/src/db/memory.rs b/src/db/memory.rs
index a3cfad5..75aea66 100644
--- a/src/db/memory.rs
+++ b/src/db/memory.rs
@@ -1,7 +1,7 @@
 use std::future::{Future, ready};
 
-use crate::db::error::{BoxedError, UserAlreadyExists};
-use crate::db::{Database, DatabaseInterface, Group, User, UserRef};
+use crate::db::error::{BoxedError, UserCreationError};
+use crate::db::{Database, DatabaseInterface, Group, Operation, User, UserRef};
 
 #[derive(Clone, Debug, Default)]
 pub struct MemoryDatabase {
@@ -33,13 +33,35 @@ impl DatabaseInterface for MemoryDatabase {
     async fn create_user(
         &mut self,
         user: User,
-    ) -> Result<Result<(), UserAlreadyExists>, BoxedError> {
+    ) -> Result<Result<(), UserCreationError>, BoxedError> {
         let user_ref = user.user_ref();
         if self.get_user(&user_ref).await?.is_some() {
-            return Ok(Err(UserAlreadyExists(user_ref)));
+            return Ok(Err(UserCreationError::UserAlreadyExists(user_ref)));
         }
 
         self.users.push(user);
         Ok(Ok(()))
     }
+
+    async fn try_create_user(
+        &mut self,
+        new_user: User,
+        current_user: &User,
+    ) -> Result<Result<(), UserCreationError>, BoxedError> {
+        // First check permissions, then apply the operation
+        //
+        // TODO: for now we don't allow creating service users manually
+        // so we assume there's a domain provided
+        // TODO: restrict user creation on non-declared domains
+        let Some(new_user_domain) = &new_user.domain else {
+            return Ok(Err(UserCreationError::Permissions));
+        };
+
+        let op = Operation::CreateUser(new_user_domain.clone());
+        if !current_user.can_perform(&op) {
+            return Ok(Err(UserCreationError::Permissions));
+        }
+
+        self.create_user(new_user).await
+    }
 }
diff --git a/src/db/mod.rs b/src/db/mod.rs
index b54747a..d77daca 100644
--- a/src/db/mod.rs
+++ b/src/db/mod.rs
@@ -7,5 +7,7 @@ mod interface;
 pub use interface::DatabaseInterface;
 mod memory;
 pub use memory::MemoryDatabase;
+mod role;
+pub use role::{Operation, Role};
 mod user;
 pub use user::{User, UserRef};
diff --git a/src/db/role.rs b/src/db/role.rs
new file mode 100644
index 0000000..aa42854
--- /dev/null
+++ b/src/db/role.rs
@@ -0,0 +1,37 @@
+#[derive(Clone, Debug)]
+pub enum Operation {
+    CreateUser(String),
+}
+
+#[derive(Clone, Debug)]
+pub enum Role {
+    /// Can do anything
+    Admin,
+    /// Can only read data across all vhosts
+    #[expect(unused)]
+    ReadonlyAdmin,
+    /// Can do anything on a domain, except removing
+    /// oneself as a domain admin.
+    ///
+    /// Can not give away roles other than DomainModerator/User
+    DomainAdmin(String),
+    /// Can create users and reset passwords on a domain
+    #[expect(unused)]
+    DomainModerator(String),
+    /// Can only edit own profile
+    User,
+}
+
+impl Role {
+    pub fn can_perform(&self, operation: &Operation) -> bool {
+        match operation {
+            Operation::CreateUser(op_domain) => match self {
+                Self::Admin => true,
+                Self::DomainAdmin(usr_domain) | Self::DomainModerator(usr_domain) => {
+                    op_domain == usr_domain
+                }
+                _ => false,
+            },
+        }
+    }
+}
diff --git a/src/db/user.rs b/src/db/user.rs
index 4301d73..3986e44 100644
--- a/src/db/user.rs
+++ b/src/db/user.rs
@@ -1,23 +1,35 @@
 use std::fmt;
 
+use crate::db::{Operation, Role};
+
 #[derive(Clone, Debug)]
 pub struct UserRef {
     pub username: String,
-    pub domain: String,
+    pub domain: Option<String>,
 }
 
 impl fmt::Display for UserRef {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}@{}", self.username, self.domain)
+        if let Some(domain) = &self.domain {
+            write!(f, "{}@{}", self.username, domain)
+        } else {
+            write!(f, "{}", self.username)
+        }
     }
 }
 
 #[derive(Clone, Debug)]
 pub struct User {
+    /// Username, without the domain part. Once set, cannot be edited.
     pub username: String,
-    pub domain: String,
+    /// Domain of the user. Once set, cannot be edited.
+    ///
+    /// Service accounts may exist with an empty domain.
+    pub domain: Option<String>,
     pub password: String,
+    /// Mail for the user. Computed from username/domain, cannot be edited.
     pub mail: String,
+    pub role: Role,
     // recovery_mail: String,
 }
 
@@ -28,10 +40,19 @@ impl User {
             domain: self.domain.clone(),
         }
     }
+
+    #[expect(unused)]
+    pub fn can_perform(&self, operation: &Operation) -> bool {
+        self.role.can_perform(operation)
+    }
 }
 
 impl fmt::Display for User {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}@{}", self.username, self.domain)
+        if let Some(domain) = &self.domain {
+            write!(f, "{}@{}", self.username, domain)
+        } else {
+            write!(f, "{}", self.username)
+        }
     }
 }
diff --git a/src/ldap/dn.rs b/src/ldap/dn.rs
index 0f492f8..33371fe 100644
--- a/src/ldap/dn.rs
+++ b/src/ldap/dn.rs
@@ -149,8 +149,10 @@ impl Dn {
         let mut keys = VecMap::new();
         keys.insert_or_append("uid", &user.username);
         keys.insert_or_append("ou", "people");
-        for domain_component in user.domain.split('.') {
-            keys.insert_or_append("dc", domain_component);
+        if let Some(domain_components) = &user.domain {
+            for domain_component in domain_components.split('.') {
+                keys.insert_or_append("dc", domain_component);
+            }
         }
 
         Self { keys }
diff --git a/src/ldap/filter/mail.rs b/src/ldap/filter/mail.rs
index 0f17ac0..625ca8d 100644
--- a/src/ldap/filter/mail.rs
+++ b/src/ldap/filter/mail.rs
@@ -109,7 +109,7 @@ impl MailFilter {
     pub fn to_user_ref(&self) -> UserRef {
         UserRef {
             username: self.username.clone(),
-            domain: self.domain.clone(),
+            domain: Some(self.domain.clone()),
         }
     }
 }
diff --git a/src/ldap/op/bind.rs b/src/ldap/op/bind.rs
index 5b44c41..fabdfa6 100644
--- a/src/ldap/op/bind.rs
+++ b/src/ldap/op/bind.rs
@@ -76,9 +76,15 @@ impl BindDn {
 
     pub fn to_user_ref(&self) -> UserRef {
         let username = self.0.keys.get("uid").unwrap()[0].clone();
+        // TODO: if we want service domains to connect over LDAP
+        // we need to remove this unwrap and allow a BindDn to
+        // not have a domain part.
         let domain = self.0.keys.get("dc").unwrap().join(".");
 
-        UserRef { username, domain }
+        UserRef {
+            username,
+            domain: Some(domain),
+        }
     }
 }
 
diff --git a/src/main.rs b/src/main.rs
index 0edea35..2b63b97 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -12,18 +12,39 @@ mod stream;
 #[cfg(feature = "http")]
 use crate::http::http_listen;
 use cli::CliArgs;
-use db::{Database, DatabaseInterface, MemoryDatabase, User};
+use db::{Database, DatabaseInterface, MemoryDatabase, Role, User};
 use error::GlobalError;
 use ldap::ldap_handler;
 use listener::ListenerPath;
 
 async fn create_dummy_users<D: DatabaseInterface>(db: &mut Database<D>) {
+    db.create_user(User {
+        username: "admin".to_string(),
+        domain: None,
+        password: "adminadmin".to_string(),
+        mail: "TODO".to_string(),
+        role: Role::Admin,
+    })
+    .await
+    .unwrap()
+    .unwrap();
     for domain in &["a", "b", "c"] {
         db.create_user(User {
             username: domain.to_string(),
-            domain: format!("{domain}.localhost"),
+            domain: Some(format!("{domain}.localhost")),
             password: "adminadmin".to_string(),
             mail: format!("{domain}@{domain}.localhost"),
+            role: Role::DomainAdmin(format!("{domain}.localhost")),
+        })
+        .await
+        .unwrap()
+        .unwrap();
+        db.create_user(User {
+            username: domain.to_string(),
+            domain: Some(format!("user{domain}.localhost")),
+            password: "adminadmin".to_string(),
+            mail: format!("user{domain}@{domain}.localhost"),
+            role: Role::User,
         })
         .await
         .unwrap()

From dba07912d287a51addb4e16884310fe114b53f00 Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Tue, 8 Sep 2026 16:39:50 +0200
Subject: [PATCH 07/20] feat: Add ListUsers operation

---
 src/db/interface.rs | 13 ++++++++++++-
 src/db/memory.rs    | 14 ++++++++++++++
 src/db/role.rs      | 12 +++++++++++-
 src/db/user.rs      | 39 +++++++++++++++++++++++++++++++++++++--
 src/http/login.rs   | 40 ++++++++++++++++++++++++++++++++++------
 src/http/mod.rs     | 34 +++++++++++++++++++++++++++++-----
 src/http/session.rs | 23 ++++++++++++++---------
 src/main.rs         |  7 ++++---
 templates/home.html | 12 +++++++++++-
 9 files changed, 166 insertions(+), 28 deletions(-)

diff --git a/src/db/interface.rs b/src/db/interface.rs
index 53a9ce2..668e03b 100644
--- a/src/db/interface.rs
+++ b/src/db/interface.rs
@@ -24,10 +24,17 @@ impl<D: DatabaseInterface> DatabaseInterface for Database<D> {
             .try_create_user(new_user, current_user)
             .await
     }
+
+    async fn list_users(&self, domain: Option<String>) -> Result<Vec<User>, BoxedError> {
+        self.inner.read().await.list_users(domain).await
+    }
 }
 
 pub trait DatabaseInterface: Clone + Send + Sync + 'static {
-    async fn get_user(&self, user: &UserRef) -> Result<Option<User>, BoxedError>;
+    fn get_user(
+        &self,
+        user: &UserRef,
+    ) -> impl std::future::Future<Output = Result<Option<User>, BoxedError>> + Send;
     async fn create_user(
         &mut self,
         user: User,
@@ -38,4 +45,8 @@ pub trait DatabaseInterface: Clone + Send + Sync + 'static {
         new_user: User,
         current_user: &User,
     ) -> Result<Result<(), UserCreationError>, BoxedError>;
+    fn list_users(
+        &self,
+        domain: Option<String>,
+    ) -> impl std::future::Future<Output = Result<Vec<User>, BoxedError>> + Send;
 }
diff --git a/src/db/memory.rs b/src/db/memory.rs
index 75aea66..56c5934 100644
--- a/src/db/memory.rs
+++ b/src/db/memory.rs
@@ -64,4 +64,18 @@ impl DatabaseInterface for MemoryDatabase {
 
         self.create_user(new_user).await
     }
+
+    fn list_users(&self, domain: Option<String>) -> impl Future<Output = Result<Vec<User>, BoxedError>> {
+        let users = if let Some(domain) = domain {
+            self
+                .users
+                .iter()
+                .filter(|user| user.domain.as_ref() == Some(&domain))
+                .cloned()
+                .collect()
+        } else {
+            self.users.clone()
+        };
+        ready(Ok(users))
+    }
 }
diff --git a/src/db/role.rs b/src/db/role.rs
index aa42854..f717813 100644
--- a/src/db/role.rs
+++ b/src/db/role.rs
@@ -1,9 +1,12 @@
+use serde::Serialize;
+
 #[derive(Clone, Debug)]
 pub enum Operation {
     CreateUser(String),
+    ListUsers(Option<String>),
 }
 
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, Serialize)]
 pub enum Role {
     /// Can do anything
     Admin,
@@ -32,6 +35,13 @@ impl Role {
                 }
                 _ => false,
             },
+            Operation::ListUsers(op_domain) => match self {
+                Self::Admin => true,
+                Self::DomainAdmin(usr_domain) | Self::DomainModerator(usr_domain) => {
+                    op_domain.as_ref() == Some(usr_domain)
+                }
+                _ => false,
+            },
         }
     }
 }
diff --git a/src/db/user.rs b/src/db/user.rs
index 3986e44..5a325b1 100644
--- a/src/db/user.rs
+++ b/src/db/user.rs
@@ -1,13 +1,49 @@
+use serde::Serialize;
+
 use std::fmt;
 
 use crate::db::{Operation, Role};
 
+/// A requested user/domain combo for login, lowercased.
+///
+/// Domain may be empty, but a value with more than one
+/// `@` is considered invalid.
 #[derive(Clone, Debug)]
 pub struct UserRef {
     pub username: String,
     pub domain: Option<String>,
 }
 
+#[derive(Clone, Debug)]
+pub struct InvalidUserRef(pub String);
+
+impl std::error::Error for InvalidUserRef {}
+
+impl fmt::Display for InvalidUserRef {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "Invalid username: {}", self.0)
+    }
+}
+
+impl UserRef {
+    pub fn from_user_maybe_domain(value: &str) -> Result<Self, InvalidUserRef> {
+        let value = value.to_lowercase();
+
+        let mut parts = value.split('@');
+        let username = parts.next().unwrap();
+        let domain = parts.next();
+
+        if parts.next().is_some() {
+            return Err(InvalidUserRef(value.clone()));
+        }
+
+        Ok(Self {
+            username: username.to_string(),
+            domain: domain.map(Into::into),
+        })
+    }
+}
+
 impl fmt::Display for UserRef {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         if let Some(domain) = &self.domain {
@@ -18,7 +54,7 @@ impl fmt::Display for UserRef {
     }
 }
 
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, Serialize)]
 pub struct User {
     /// Username, without the domain part. Once set, cannot be edited.
     pub username: String,
@@ -41,7 +77,6 @@ impl User {
         }
     }
 
-    #[expect(unused)]
     pub fn can_perform(&self, operation: &Operation) -> bool {
         self.role.can_perform(operation)
     }
diff --git a/src/http/login.rs b/src/http/login.rs
index 2ffd75f..f62a7b0 100644
--- a/src/http/login.rs
+++ b/src/http/login.rs
@@ -5,7 +5,7 @@ use http::StatusCode;
 use minijinja::context;
 use serde::{Deserialize, Serialize};
 
-use crate::db::DatabaseInterface;
+use crate::db::{DatabaseInterface, UserRef};
 use crate::http::HttpState;
 
 #[derive(Debug, Deserialize)]
@@ -23,14 +23,14 @@ pub enum LoginError {
 pub async fn login_page<D: DatabaseInterface>(
     State(state): State<HttpState<D>>,
     login_error: Option<LoginError>,
-) -> (StatusCode, Html<String>) {
+) -> Response {
     let page = state
         .templates
         .get_template("login.html")
         .unwrap()
         .render(context! {login_error => login_error})
         .unwrap();
-    (StatusCode::OK, Html(page))
+    (StatusCode::OK, Html(page)).into_response()
 }
 
 pub async fn post_login<D: DatabaseInterface>(
@@ -40,9 +40,37 @@ pub async fn post_login<D: DatabaseInterface>(
 ) -> Response {
     if let Some(_session) = state.sessions.get_session(&cookies) {
         // Already logged in
-        (cookies, Redirect::to("/")).into_response()
-    } else if form.username == "admin" && form.password == "adminadmin" {
-        let cookies = state.sessions.add_session("admin", true, cookies);
+        return (cookies, Redirect::to("/")).into_response();
+    }
+
+    let req_user = match UserRef::from_user_maybe_domain(&form.username) {
+        Ok(req_user) => req_user,
+        Err(e) => {
+            return e.to_string().into_response();
+        }
+    };
+
+    let success = match state.db.check_password(&req_user, &form.password).await {
+        Ok(success) => success,
+        Err(e) => {
+            return format!("Database error: {e}").into_response();
+        }
+    };
+
+    if success {
+        let maybe_user = match state.db.get_user(&req_user).await {
+            Ok(user) => user,
+            Err(e) => {
+                return format!("Database error: {e}").into_response();
+            }
+        };
+
+        let Some(user) = maybe_user else {
+            return "Woops, user has been deleted while you were logging in. What are the chances?!".to_string()
+            .into_response();
+        };
+
+        let cookies = state.sessions.add_session(user, cookies);
         (cookies, Redirect::to("/")).into_response()
     } else {
         login_page(State(state), Some(LoginError::InvalidCredentials))
diff --git a/src/http/mod.rs b/src/http/mod.rs
index 2f6070c..89187c2 100644
--- a/src/http/mod.rs
+++ b/src/http/mod.rs
@@ -1,6 +1,6 @@
 use axum::Router;
 use axum::extract::State;
-use axum::response::Html;
+use axum::response::{Html, IntoResponse, Response};
 use axum::routing::{get, post};
 use axum::serve::Listener as AxumListener;
 use axum_extra::extract::cookie::CookieJar;
@@ -8,7 +8,7 @@ use http::StatusCode;
 use minijinja::{Environment, context, path_loader};
 use static_serve::embed_assets;
 
-use crate::db::{Database, DatabaseInterface};
+use crate::db::{Database, DatabaseInterface, Operation};
 use crate::listener::{Listener, ListenerKind};
 use crate::stream::{AbstractSocketAddr, AbstractStreamKind};
 
@@ -92,15 +92,39 @@ pub async fn http_listen<D: DatabaseInterface>(listener: Listener, db: Database<
 pub async fn home<D: DatabaseInterface>(
     State(state): State<HttpState<D>>,
     cookies: CookieJar,
-) -> (StatusCode, Html<String>) {
+) -> Response {
     if let Some(session) = state.sessions.get_session(&cookies) {
+        // When the user has no domain (service admin) list all domains
+        let op = Operation::ListUsers(session.user.domain.clone());
+        let other_users = if session.user.can_perform(&op) {
+            match state.db.list_users(session.user.domain.clone()).await {
+                Ok(other_users) => other_users,
+                Err(e) => {
+                    return format!("Database error: {e}").into_response();
+                }
+            }
+        } else {
+            vec![]
+        };
+
+        tracing::info!(
+            "Found {} users on domain {:?}",
+            other_users.len(),
+            session.user.domain
+        );
+
+        let ctx = context! {
+            user => session.user,
+            other_users,
+        };
+
         let page = state
             .templates
             .get_template("home.html")
             .unwrap()
-            .render(context! {username => session.username})
+            .render(ctx)
             .unwrap();
-        (StatusCode::OK, Html(page))
+        (StatusCode::OK, Html(page)).into_response()
     } else {
         login::login_page(State(state), None).await
     }
diff --git a/src/http/session.rs b/src/http/session.rs
index f1e951c..5a3a8db 100644
--- a/src/http/session.rs
+++ b/src/http/session.rs
@@ -3,6 +3,8 @@ use uuid::Uuid;
 
 use std::sync::{Arc, RwLock};
 
+use crate::db::User;
+
 pub const COOKIE_NAME: &str = "lldap_session";
 
 #[derive(Clone, Debug)]
@@ -17,17 +19,13 @@ impl HttpSessionManager {
         }
     }
 
-    pub fn add_session(&self, username: &str, is_admin: bool, cookies: CookieJar) -> CookieJar {
+    pub fn add_session(&self, user: User, cookies: CookieJar) -> CookieJar {
         let uuid = Uuid::new_v4();
 
         let mut cookie = Cookie::new(COOKIE_NAME, uuid.to_string());
         cookie.set_path("/");
 
-        let session = HttpSession {
-            username: username.to_string(),
-            is_admin,
-            uuid,
-        };
+        let session = HttpSession { user, uuid };
 
         {
             self.inner.write().unwrap().push(session);
@@ -67,9 +65,16 @@ impl HttpSessionManager {
     }
 }
 
-#[derive(Clone, Debug, PartialEq)]
+#[derive(Clone, Debug)]
 pub struct HttpSession {
-    pub username: String,
-    pub is_admin: bool,
+    // TODO: by storing the session here, it means
+    // it needs to be updated every time we change the user.
+    pub user: User,
     pub uuid: Uuid,
 }
+
+impl PartialEq<HttpSession> for HttpSession {
+    fn eq(&self, other: &Self) -> bool {
+        self.uuid == other.uuid
+    }
+}
diff --git a/src/main.rs b/src/main.rs
index 2b63b97..ace3805 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -22,7 +22,8 @@ async fn create_dummy_users<D: DatabaseInterface>(db: &mut Database<D>) {
         username: "admin".to_string(),
         domain: None,
         password: "adminadmin".to_string(),
-        mail: "TODO".to_string(),
+        // TODO: what should we put here?
+        mail: "admin".to_string(),
         role: Role::Admin,
     })
     .await
@@ -40,8 +41,8 @@ async fn create_dummy_users<D: DatabaseInterface>(db: &mut Database<D>) {
         .unwrap()
         .unwrap();
         db.create_user(User {
-            username: domain.to_string(),
-            domain: Some(format!("user{domain}.localhost")),
+            username: format!("user{domain}"),
+            domain: Some(format!("{domain}.localhost")),
             password: "adminadmin".to_string(),
             mail: format!("user{domain}@{domain}.localhost"),
             role: Role::User,
diff --git a/templates/home.html b/templates/home.html
index a142aee..584fad4 100644
--- a/templates/home.html
+++ b/templates/home.html
@@ -2,10 +2,20 @@
 {% block main %}
 <main id="center">
   <img src="/assets/img/logo.png" id="logo">
-	<p style="text-align: center;">You are logged in as {{ username }}</p>
+	<p style="text-align: center;">You are logged in as {{ user.username }}</p>
 	<div id="login-line">
 		<a href="/logout" id="submit-login" value="Logout">Logout</a>
 	</div>
+	{% if other_users %}
+		<div>
+			<h2>Other users you have permission to see</h2>
+			<ul>
+				{% for user in other_users %}
+					<li>{{ user.mail }}</li>
+				{% endfor %}
+			</ul>
+		</div>
+	{% endif %}
 </main>
 {% endblock %}
 

From 1bbdb04dc98e123803e590560104c5e6e81bcb4c Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Tue, 8 Sep 2026 17:24:01 +0200
Subject: [PATCH 08/20] feat: Add `embed` and `noembed` feature flags for HTTP
 assets/templates

---
 Cargo.lock       | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 Cargo.toml       | 13 +++++++++++--
 build.rs         |  4 ++++
 src/db/memory.rs |  8 +++++---
 src/http/mod.rs  | 26 ++++++++++++++++++++++----
 5 files changed, 88 insertions(+), 9 deletions(-)
 create mode 100644 build.rs

diff --git a/Cargo.lock b/Cargo.lock
index 45bb96d..545982a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -125,6 +125,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+
 [[package]]
 name = "block-buffer"
 version = "0.12.1"
@@ -369,6 +375,12 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "http-range-header"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
+
 [[package]]
 name = "httparse"
 version = "1.10.1"
@@ -504,11 +516,13 @@ dependencies = [
  "http",
  "ldap3_proto",
  "minijinja",
+ "minijinja-embed",
  "serde",
  "static-serve",
  "tokio",
  "tokio-util",
  "tower",
+ "tower-http",
  "tracing",
  "tracing-subscriber",
  "uuid",
@@ -564,6 +578,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "minijinja-embed"
+version = "2.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2795289c499a1331f73166ff8b8e0e68fdc81ef0b385eecb0e4de96f1638b66"
+
 [[package]]
 name = "minimal-lexical"
 version = "0.2.1"
@@ -964,6 +984,7 @@ version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
+ "bytes",
  "libc",
  "mio",
  "pin-project-lite",
@@ -1013,6 +1034,31 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "tower-http"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08a05a66a4fdd61cbbe0a1d755ffe0ca6aba159dd4820936a0ff8a8278245b9c"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "http-range-header",
+ "httpdate",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "tower-layer"
 version = "0.3.3"
diff --git a/Cargo.toml b/Cargo.toml
index 9ce4c55..903b294 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,11 +13,13 @@ futures-util = { version = "0.3.34", features = ["sink"] }
 http = { version = "1.5.0", optional = true }
 ldap3_proto = "0.8.1"
 minijinja = { version = "2.24.0", optional = true }
+minijinja-embed = { version = "2.24.0", optional = true }
 serde = { version = "1.0.229", features = ["derive"] }
 static-serve = { version = "0.6.3", optional = true }
 tokio = { version = "1.53.1", features = ["macros", "net", "rt", "time", "sync"] }
 tokio-util = { version = "0.7.19", features = ["codec"] }
 tower = "0.5.3"
+tower-http = { version = "0.7.1", features = ["fs"], optional = true }
 tracing = "0.1.44"
 tracing-subscriber = "0.3.23"
 uuid = { version = "1.26.0", features = ["v4"] }
@@ -30,5 +32,12 @@ perf = "deny"
 style = "deny"
 
 [features]
-default = [ "http" ]
-http = ["dep:axum", "dep:axum-extra", "dep:http", "dep:minijinja", "dep:static-serve"]
+default = [ "http", "noembed" ]
+# Embed assets and templates in binary
+embed = [ "dep:minijinja-embed", "dep:static-serve" ]
+# Don't embed assets and templates in binary
+noembed = [ "dep:tower-http" ]
+http = ["dep:axum", "dep:axum-extra", "dep:http", "dep:minijinja"]
+
+[build-dependencies]
+minijinja-embed = { version = "2.24.0", optional = true }
diff --git a/build.rs b/build.rs
new file mode 100644
index 0000000..19fb9dc
--- /dev/null
+++ b/build.rs
@@ -0,0 +1,4 @@
+fn main() {
+    #[cfg(feature = "embed")]
+    minijinja_embed::embed_templates!("templates");
+}
diff --git a/src/db/memory.rs b/src/db/memory.rs
index 56c5934..62b98a3 100644
--- a/src/db/memory.rs
+++ b/src/db/memory.rs
@@ -65,10 +65,12 @@ impl DatabaseInterface for MemoryDatabase {
         self.create_user(new_user).await
     }
 
-    fn list_users(&self, domain: Option<String>) -> impl Future<Output = Result<Vec<User>, BoxedError>> {
+    fn list_users(
+        &self,
+        domain: Option<String>,
+    ) -> impl Future<Output = Result<Vec<User>, BoxedError>> {
         let users = if let Some(domain) = domain {
-            self
-                .users
+            self.users
                 .iter()
                 .filter(|user| user.domain.as_ref() == Some(&domain))
                 .cloned()
diff --git a/src/http/mod.rs b/src/http/mod.rs
index 89187c2..98a20ed 100644
--- a/src/http/mod.rs
+++ b/src/http/mod.rs
@@ -5,8 +5,13 @@ use axum::routing::{get, post};
 use axum::serve::Listener as AxumListener;
 use axum_extra::extract::cookie::CookieJar;
 use http::StatusCode;
-use minijinja::{Environment, context, path_loader};
+#[cfg(not(feature = "embed"))]
+use minijinja::path_loader;
+use minijinja::{Environment, context};
+#[cfg(feature = "embed")]
 use static_serve::embed_assets;
+#[cfg(not(feature = "embed"))]
+use tower_http::services::ServeDir;
 
 use crate::db::{Database, DatabaseInterface, Operation};
 use crate::listener::{Listener, ListenerKind};
@@ -67,6 +72,9 @@ pub struct HttpState<D: DatabaseInterface> {
 impl<D: DatabaseInterface> HttpState<D> {
     pub fn new(db: Database<D>) -> Self {
         let mut templates = Environment::new();
+        #[cfg(feature = "embed")]
+        minijinja_embed::load_templates!(&mut templates);
+        #[cfg(not(feature = "embed"))]
         templates.set_loader(path_loader("templates"));
         Self {
             db,
@@ -77,9 +85,19 @@ impl<D: DatabaseInterface> HttpState<D> {
 }
 
 pub async fn http_listen<D: DatabaseInterface>(listener: Listener, db: Database<D>) {
-    embed_assets!("assets");
-    let app = Router::new()
-        .nest("/assets", static_router())
+    #[cfg(all(feature = "embed", feature = "noembed"))]
+    compile_error!("You cannot have `embed` and `noembed` features enabled at the same time.");
+    #[cfg(not(any(feature = "embed", feature = "noembed")))]
+    compile_error!("You must have `embed` or `noembed` feature enabled.");
+
+    #[cfg(feature = "embed")]
+    let app = {
+        embed_assets!("assets");
+        Router::new().nest("/assets", static_router())
+    };
+    #[cfg(not(feature = "embed"))]
+    let app = { Router::new().nest_service("/assets", ServeDir::new("assets")) };
+    let app = app
         .route("/", get(home))
         .route("/login", get(home))
         .route("/login", post(login::post_login))

From bd12632a7e0a091066af7858f845064f52b7bd30 Mon Sep 17 00:00:00 2001
From: leckye <>
Date: Mon, 14 Sep 2026 19:10:40 +0200
Subject: [PATCH 09/20] maj README

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index bf3fa61..d28b9ff 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,7 @@ Compared to lldap, llldap:
 - does not use GraphQL to build an API, and therefore does not require custom logic in the client (JS/WASM)
 - supports virtualhosts out-of-the-box
 - supports mailalias with multiple values in search queries
+- support listening on unix domain sockets (UDS) out-of-the-box
 
 ## Potential future features
 

From f1a2721cbeb204189066b97c9b7175df66337067 Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Mon, 14 Sep 2026 21:05:23 +0200
Subject: [PATCH 10/20] feat: Basic domain creation API

---
 src/db/domain.rs    |  35 +++++++++++++
 src/db/error.rs     |  24 +++++++++
 src/db/interface.rs |  25 +++++++++-
 src/db/memory.rs    | 116 +++++++++++++++++++++++++++++++-------------
 src/db/mod.rs       |   2 +
 src/main.rs         |  18 ++++---
 6 files changed, 176 insertions(+), 44 deletions(-)
 create mode 100644 src/db/domain.rs

diff --git a/src/db/domain.rs b/src/db/domain.rs
new file mode 100644
index 0000000..5ea6d43
--- /dev/null
+++ b/src/db/domain.rs
@@ -0,0 +1,35 @@
+use crate::db::error::UserCreationError;
+use crate::db::{Group, User, UserRef};
+
+#[derive(Clone, Debug, Default)]
+pub struct Domain {
+    pub name: String,
+    pub users: Vec<User>,
+    #[expect(unused)]
+    pub groups: Vec<Group>,
+}
+
+impl Domain {
+    pub fn get_user(&self, req_user: &UserRef) -> Option<User> {
+        assert!(
+            req_user.domain.as_deref().unwrap_or("") == self.name,
+            "Should only call Domain::get_user on the matching domain. Asked for {:?} on domain {}",
+            req_user,
+            self.name
+        );
+
+        self.users
+            .iter()
+            .find(|u| u.username == req_user.username)
+            .cloned()
+    }
+
+    pub fn create_user(&mut self, user: User, user_ref: UserRef) -> Result<(), UserCreationError> {
+        if self.get_user(&user_ref).is_some() {
+            return Err(UserCreationError::UserAlreadyExists(user_ref));
+        }
+
+        self.users.push(user);
+        Ok(())
+    }
+}
diff --git a/src/db/error.rs b/src/db/error.rs
index ccdcd47..9fdce05 100644
--- a/src/db/error.rs
+++ b/src/db/error.rs
@@ -6,6 +6,7 @@ pub type BoxedError = Box<dyn std::error::Error + Send + Sync + 'static>;
 
 #[derive(Debug)]
 pub enum UserCreationError {
+    DomainNotFound(String),
     UserAlreadyExists(UserRef),
     Permissions,
 }
@@ -13,6 +14,7 @@ pub enum UserCreationError {
 impl fmt::Display for UserCreationError {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
+            Self::DomainNotFound(domain) => write!(f, "No domain {domain} to create user in"),
             Self::UserAlreadyExists(user) => write!(f, "User already exists: {user}"),
             Self::Permissions => write!(f, "You do not have permissions to create this user"),
         }
@@ -20,3 +22,25 @@ impl fmt::Display for UserCreationError {
 }
 
 impl std::error::Error for UserCreationError {}
+
+#[derive(Debug)]
+pub enum DomainCreationError {
+    DomainAlreadyExists(String),
+    InvalidDomain(String),
+}
+
+impl fmt::Display for DomainCreationError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::DomainAlreadyExists(domain) => {
+                write!(f, "Cannot create domain {domain} because it already exists")
+            }
+            Self::InvalidDomain(domain) => write!(
+                f,
+                "Cannot create domain `{domain}` because it's not considered a valid domain"
+            ),
+        }
+    }
+}
+
+impl std::error::Error for DomainCreationError {}
diff --git a/src/db/interface.rs b/src/db/interface.rs
index 668e03b..ed6d86c 100644
--- a/src/db/interface.rs
+++ b/src/db/interface.rs
@@ -1,7 +1,18 @@
-use crate::db::error::{BoxedError, UserCreationError};
-use crate::db::{Database, User, UserRef};
+use crate::db::error::{BoxedError, DomainCreationError, UserCreationError};
+use crate::db::{Database, Domain, User, UserRef};
 
 impl<D: DatabaseInterface> DatabaseInterface for Database<D> {
+    async fn create_domain(
+        &mut self,
+        domain: &str,
+    ) -> Result<Result<(), DomainCreationError>, BoxedError> {
+        self.inner.write().await.create_domain(domain).await
+    }
+
+    async fn get_domain(&self, domain: &str) -> Result<Option<Domain>, BoxedError> {
+        self.inner.read().await.get_domain(domain).await
+    }
+
     async fn get_user(&self, user: &UserRef) -> Result<Option<User>, BoxedError> {
         self.inner.read().await.get_user(user).await
     }
@@ -31,6 +42,12 @@ impl<D: DatabaseInterface> DatabaseInterface for Database<D> {
 }
 
 pub trait DatabaseInterface: Clone + Send + Sync + 'static {
+    fn create_domain(
+        &mut self,
+        domain: &str,
+    ) -> impl Future<Output = Result<Result<(), DomainCreationError>, BoxedError>>;
+    fn get_domain(&self, domain: &str) -> impl Future<Output = Result<Option<Domain>, BoxedError>>;
+
     fn get_user(
         &self,
         user: &UserRef,
@@ -45,6 +62,10 @@ pub trait DatabaseInterface: Clone + Send + Sync + 'static {
         new_user: User,
         current_user: &User,
     ) -> Result<Result<(), UserCreationError>, BoxedError>;
+
+    /// Use empty string domain to request global users (TODO: this is not very DX)
+    ///
+    /// When domain does not exist, the returned list is empty.
     fn list_users(
         &self,
         domain: Option<String>,
diff --git a/src/db/memory.rs b/src/db/memory.rs
index 62b98a3..b9b8545 100644
--- a/src/db/memory.rs
+++ b/src/db/memory.rs
@@ -1,46 +1,90 @@
 use std::future::{Future, ready};
 
-use crate::db::error::{BoxedError, UserCreationError};
-use crate::db::{Database, DatabaseInterface, Group, Operation, User, UserRef};
+use crate::db::error::{BoxedError, DomainCreationError, UserCreationError};
+use crate::db::{Database, DatabaseInterface, Domain, Operation, User, UserRef};
 
 #[derive(Clone, Debug, Default)]
 pub struct MemoryDatabase {
-    pub users: Vec<User>,
-    #[expect(unused)]
-    pub groups: Vec<Group>,
+    pub domains: Vec<Domain>,
+    /// Where global users/groups are registered
+    pub global_domain: Domain,
 }
 
 impl MemoryDatabase {
     pub fn new() -> Database<Self> {
         Database::new(Self::default())
     }
+
+    pub fn get_domain_mut(&mut self, domain: &str) -> Option<&mut Domain> {
+        self.domains.iter_mut().find(|d| d.name == domain)
+    }
 }
 
 impl DatabaseInterface for MemoryDatabase {
-    fn get_user(
-        &self,
-        req_user: &UserRef,
-    ) -> impl Future<Output = Result<Option<User>, BoxedError>> {
-        for user in &self.users {
-            if user.username == req_user.username && user.domain == req_user.domain {
-                return ready(Ok(Some(user.clone())));
-            }
+    fn create_domain(
+        &mut self,
+        domain: &str,
+    ) -> impl Future<Output = Result<Result<(), DomainCreationError>, BoxedError>> {
+        if domain.is_empty() {
+            return ready(Ok(Err(DomainCreationError::InvalidDomain(
+                domain.to_string(),
+            ))));
         }
 
-        ready(Ok(None))
+        if self.domains.iter().find(|d| d.name == domain).is_some() {
+            return ready(Ok(Err(DomainCreationError::DomainAlreadyExists(
+                domain.to_string(),
+            ))));
+        }
+
+        self.domains.push(Domain {
+            name: domain.to_string(),
+            users: vec![],
+            groups: vec![],
+        });
+
+        ready(Ok(Ok(())))
     }
 
-    async fn create_user(
+    fn get_domain(&self, domain: &str) -> impl Future<Output = Result<Option<Domain>, BoxedError>> {
+        let Some(domain) = self.domains.iter().find(|d| d.name == domain) else {
+            return ready(Ok(None));
+        };
+
+        ready(Ok(Some(domain.clone())))
+    }
+
+    async fn get_user(&self, req_user: &UserRef) -> Result<Option<User>, BoxedError> {
+        let Some(req_domain) = &req_user.domain else {
+            // If no domain is provided for the user query, look up the global users
+            return Ok(self.global_domain.get_user(req_user));
+        };
+
+        let Some(domain) = self.get_domain(req_domain).await? else {
+            return Ok(None);
+        };
+
+        Ok(domain.get_user(req_user))
+    }
+
+    fn create_user(
         &mut self,
         user: User,
-    ) -> Result<Result<(), UserCreationError>, BoxedError> {
+    ) -> impl Future<Output = Result<Result<(), UserCreationError>, BoxedError>> {
         let user_ref = user.user_ref();
-        if self.get_user(&user_ref).await?.is_some() {
-            return Ok(Err(UserCreationError::UserAlreadyExists(user_ref)));
-        }
 
-        self.users.push(user);
-        Ok(Ok(()))
+        let Some(req_domain) = &user.domain else {
+            // No domain requested, this is a global user creation
+            return ready(Ok(self.global_domain.create_user(user, user_ref)));
+        };
+
+        let Some(domain) = self.get_domain_mut(req_domain) else {
+            return ready(Ok(Err(UserCreationError::DomainNotFound(
+                req_domain.clone(),
+            ))));
+        };
+
+        ready(Ok(domain.create_user(user, user_ref)))
     }
 
     async fn try_create_user(
@@ -65,19 +109,23 @@ impl DatabaseInterface for MemoryDatabase {
         self.create_user(new_user).await
     }
 
-    fn list_users(
-        &self,
-        domain: Option<String>,
-    ) -> impl Future<Output = Result<Vec<User>, BoxedError>> {
-        let users = if let Some(domain) = domain {
-            self.users
-                .iter()
-                .filter(|user| user.domain.as_ref() == Some(&domain))
-                .cloned()
-                .collect()
+    async fn list_users(&self, domain: Option<String>) -> Result<Vec<User>, BoxedError> {
+        if let Some(domain) = domain {
+            if domain.is_empty() {
+                Ok(self.global_domain.users.clone())
+            } else {
+                let Some(domain) = self.get_domain(&domain).await? else {
+                    return Ok(vec![]);
+                };
+                Ok(domain.users.clone())
+            }
         } else {
-            self.users.clone()
-        };
-        ready(Ok(users))
+            // Aggregate all users
+            let mut users = self.global_domain.users.clone();
+            for domain in &self.domains {
+                users.extend(domain.users.clone());
+            }
+            Ok(users)
+        }
     }
 }
diff --git a/src/db/mod.rs b/src/db/mod.rs
index d77daca..c2544e0 100644
--- a/src/db/mod.rs
+++ b/src/db/mod.rs
@@ -1,5 +1,7 @@
 mod common;
 pub use common::Database;
+mod domain;
+pub use domain::Domain;
 pub mod error;
 mod group;
 pub use group::Group;
diff --git a/src/main.rs b/src/main.rs
index ace3805..cb6ee76 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -29,22 +29,24 @@ async fn create_dummy_users<D: DatabaseInterface>(db: &mut Database<D>) {
     .await
     .unwrap()
     .unwrap();
-    for domain in &["a", "b", "c"] {
+    for letter in &["a", "b", "c"] {
+        let domain = format!("{letter}.localhost");
+        db.create_domain(&domain).await.unwrap().unwrap();
         db.create_user(User {
-            username: domain.to_string(),
-            domain: Some(format!("{domain}.localhost")),
+            username: letter.to_string(),
+            domain: Some(domain.clone()),
             password: "adminadmin".to_string(),
-            mail: format!("{domain}@{domain}.localhost"),
-            role: Role::DomainAdmin(format!("{domain}.localhost")),
+            mail: format!("{letter}@{domain}"),
+            role: Role::DomainAdmin(domain.clone()),
         })
         .await
         .unwrap()
         .unwrap();
         db.create_user(User {
-            username: format!("user{domain}"),
-            domain: Some(format!("{domain}.localhost")),
+            username: format!("user{letter}"),
+            domain: Some(domain.clone()),
             password: "adminadmin".to_string(),
-            mail: format!("user{domain}@{domain}.localhost"),
+            mail: format!("user{letter}@{domain}"),
             role: Role::User,
         })
         .await

From 58a8c375f0ab1ee31016ee6c6be2039d4f6fdf14 Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Sat, 19 Sep 2026 09:25:25 +0200
Subject: [PATCH 11/20] refactor: Store domains separately from users

---
 src/db/domain.rs    | 31 ---------------
 src/db/interface.rs | 17 ++++++---
 src/db/memory.rs    | 91 ++++++++++++++++++++-------------------------
 src/http/mod.rs     |  6 ++-
 templates/home.html |  2 +-
 5 files changed, 59 insertions(+), 88 deletions(-)

diff --git a/src/db/domain.rs b/src/db/domain.rs
index 5ea6d43..6cca261 100644
--- a/src/db/domain.rs
+++ b/src/db/domain.rs
@@ -1,35 +1,4 @@
-use crate::db::error::UserCreationError;
-use crate::db::{Group, User, UserRef};
-
 #[derive(Clone, Debug, Default)]
 pub struct Domain {
     pub name: String,
-    pub users: Vec<User>,
-    #[expect(unused)]
-    pub groups: Vec<Group>,
-}
-
-impl Domain {
-    pub fn get_user(&self, req_user: &UserRef) -> Option<User> {
-        assert!(
-            req_user.domain.as_deref().unwrap_or("") == self.name,
-            "Should only call Domain::get_user on the matching domain. Asked for {:?} on domain {}",
-            req_user,
-            self.name
-        );
-
-        self.users
-            .iter()
-            .find(|u| u.username == req_user.username)
-            .cloned()
-    }
-
-    pub fn create_user(&mut self, user: User, user_ref: UserRef) -> Result<(), UserCreationError> {
-        if self.get_user(&user_ref).is_some() {
-            return Err(UserCreationError::UserAlreadyExists(user_ref));
-        }
-
-        self.users.push(user);
-        Ok(())
-    }
 }
diff --git a/src/db/interface.rs b/src/db/interface.rs
index ed6d86c..e5d58ec 100644
--- a/src/db/interface.rs
+++ b/src/db/interface.rs
@@ -36,8 +36,12 @@ impl<D: DatabaseInterface> DatabaseInterface for Database<D> {
             .await
     }
 
-    async fn list_users(&self, domain: Option<String>) -> Result<Vec<User>, BoxedError> {
-        self.inner.read().await.list_users(domain).await
+    async fn list_all_users(&self) -> Result<Vec<User>, BoxedError> {
+        self.inner.read().await.list_all_users().await
+    }
+
+    async fn list_domain_users(&self, domain: Option<String>) -> Result<Vec<User>, BoxedError> {
+        self.inner.read().await.list_domain_users(domain).await
     }
 }
 
@@ -63,10 +67,13 @@ pub trait DatabaseInterface: Clone + Send + Sync + 'static {
         current_user: &User,
     ) -> Result<Result<(), UserCreationError>, BoxedError>;
 
-    /// Use empty string domain to request global users (TODO: this is not very DX)
+    #[expect(unused)]
+    fn list_all_users(&self) -> impl Future<Output = Result<Vec<User>, BoxedError>>;
+
+    /// List users on a specific domain.
     ///
-    /// When domain does not exist, the returned list is empty.
-    fn list_users(
+    /// A `None` domain requested lists global service users.
+    fn list_domain_users(
         &self,
         domain: Option<String>,
     ) -> impl std::future::Future<Output = Result<Vec<User>, BoxedError>> + Send;
diff --git a/src/db/memory.rs b/src/db/memory.rs
index b9b8545..1ba13dd 100644
--- a/src/db/memory.rs
+++ b/src/db/memory.rs
@@ -1,23 +1,21 @@
 use std::future::{Future, ready};
 
 use crate::db::error::{BoxedError, DomainCreationError, UserCreationError};
-use crate::db::{Database, DatabaseInterface, Domain, Operation, User, UserRef};
+use crate::db::{Database, DatabaseInterface, Domain, Group, Operation, User, UserRef};
 
 #[derive(Clone, Debug, Default)]
 pub struct MemoryDatabase {
+    // We store data in tables like in SQL
     pub domains: Vec<Domain>,
-    /// Where global users/groups are registered
-    pub global_domain: Domain,
+    #[expect(unused)]
+    pub groups: Vec<Group>,
+    pub users: Vec<User>,
 }
 
 impl MemoryDatabase {
     pub fn new() -> Database<Self> {
         Database::new(Self::default())
     }
-
-    pub fn get_domain_mut(&mut self, domain: &str) -> Option<&mut Domain> {
-        self.domains.iter_mut().find(|d| d.name == domain)
-    }
 }
 
 impl DatabaseInterface for MemoryDatabase {
@@ -39,8 +37,6 @@ impl DatabaseInterface for MemoryDatabase {
 
         self.domains.push(Domain {
             name: domain.to_string(),
-            users: vec![],
-            groups: vec![],
         });
 
         ready(Ok(Ok(())))
@@ -54,37 +50,36 @@ impl DatabaseInterface for MemoryDatabase {
         ready(Ok(Some(domain.clone())))
     }
 
-    async fn get_user(&self, req_user: &UserRef) -> Result<Option<User>, BoxedError> {
-        let Some(req_domain) = &req_user.domain else {
-            // If no domain is provided for the user query, look up the global users
-            return Ok(self.global_domain.get_user(req_user));
-        };
-
-        let Some(domain) = self.get_domain(req_domain).await? else {
-            return Ok(None);
-        };
-
-        Ok(domain.get_user(req_user))
+    fn get_user(
+        &self,
+        req_user: &UserRef,
+    ) -> impl Future<Output = Result<Option<User>, BoxedError>> {
+        ready(Ok(self
+            .users
+            .iter()
+            .find(|u| u.username == req_user.username && u.domain == req_user.domain)
+            .cloned()))
     }
 
-    fn create_user(
+    async fn create_user(
         &mut self,
         user: User,
-    ) -> impl Future<Output = Result<Result<(), UserCreationError>, BoxedError>> {
+    ) -> Result<Result<(), UserCreationError>, BoxedError> {
         let user_ref = user.user_ref();
 
-        let Some(req_domain) = &user.domain else {
-            // No domain requested, this is a global user creation
-            return ready(Ok(self.global_domain.create_user(user, user_ref)));
-        };
+        if self.get_user(&user_ref).await?.is_some() {
+            return Ok(Err(UserCreationError::UserAlreadyExists(user_ref)));
+        }
 
-        let Some(domain) = self.get_domain_mut(req_domain) else {
-            return ready(Ok(Err(UserCreationError::DomainNotFound(
-                req_domain.clone(),
-            ))));
-        };
+        // If a domain is requested (i.e. not a global user), make sure the domain exists
+        if let Some(req_domain) = &user.domain
+            && self.get_domain(req_domain).await?.is_none()
+        {
+            return Ok(Err(UserCreationError::DomainNotFound(req_domain.clone())));
+        }
 
-        ready(Ok(domain.create_user(user, user_ref)))
+        self.users.push(user);
+        Ok(Ok(()))
     }
 
     async fn try_create_user(
@@ -109,23 +104,19 @@ impl DatabaseInterface for MemoryDatabase {
         self.create_user(new_user).await
     }
 
-    async fn list_users(&self, domain: Option<String>) -> Result<Vec<User>, BoxedError> {
-        if let Some(domain) = domain {
-            if domain.is_empty() {
-                Ok(self.global_domain.users.clone())
-            } else {
-                let Some(domain) = self.get_domain(&domain).await? else {
-                    return Ok(vec![]);
-                };
-                Ok(domain.users.clone())
-            }
-        } else {
-            // Aggregate all users
-            let mut users = self.global_domain.users.clone();
-            for domain in &self.domains {
-                users.extend(domain.users.clone());
-            }
-            Ok(users)
-        }
+    fn list_all_users(&self) -> impl Future<Output = Result<Vec<User>, BoxedError>> {
+        ready(Ok(self.users.clone()))
+    }
+
+    fn list_domain_users(
+        &self,
+        domain: Option<String>,
+    ) -> impl Future<Output = Result<Vec<User>, BoxedError>> {
+        ready(Ok(self
+            .users
+            .iter()
+            .filter(|u| u.domain == domain)
+            .cloned()
+            .collect()))
     }
 }
diff --git a/src/http/mod.rs b/src/http/mod.rs
index 98a20ed..bd5b2ec 100644
--- a/src/http/mod.rs
+++ b/src/http/mod.rs
@@ -115,7 +115,11 @@ pub async fn home<D: DatabaseInterface>(
         // When the user has no domain (service admin) list all domains
         let op = Operation::ListUsers(session.user.domain.clone());
         let other_users = if session.user.can_perform(&op) {
-            match state.db.list_users(session.user.domain.clone()).await {
+            match state
+                .db
+                .list_domain_users(session.user.domain.clone())
+                .await
+            {
                 Ok(other_users) => other_users,
                 Err(e) => {
                     return format!("Database error: {e}").into_response();
diff --git a/templates/home.html b/templates/home.html
index 584fad4..e9f4925 100644
--- a/templates/home.html
+++ b/templates/home.html
@@ -8,7 +8,7 @@
 	</div>
 	{% if other_users %}
 		<div>
-			<h2>Other users you have permission to see</h2>
+			<h2>Other users you have permission to see on your own domain</h2>
 			<ul>
 				{% for user in other_users %}
 					<li>{{ user.mail }}</li>

From 8a7e644960ec05fe943e6f825a9820fa46f487f4 Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Sat, 19 Sep 2026 10:00:24 +0200
Subject: [PATCH 12/20] feat: List domains user can see on homepage

---
 Cargo.lock          | 12 +++++++++
 Cargo.toml          |  2 +-
 src/db/common.rs    | 11 +++++++-
 src/db/domain.rs    |  4 ++-
 src/db/interface.rs |  7 ++++-
 src/db/memory.rs    |  4 +++
 src/db/role.rs      | 12 ++++++++-
 src/db/user.rs      |  4 +++
 src/http/home.rs    | 63 +++++++++++++++++++++++++++++++++++++++++++++
 src/http/mod.rs     | 58 ++++-------------------------------------
 templates/home.html | 17 ++++++++++++
 11 files changed, 136 insertions(+), 58 deletions(-)
 create mode 100644 src/http/home.rs

diff --git a/Cargo.lock b/Cargo.lock
index 545982a..0b55b38 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -52,6 +52,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
  "axum-core",
+ "axum-macros",
  "bytes",
  "form_urlencoded",
  "futures-util",
@@ -119,6 +120,17 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "axum-macros"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aa268c23bfbbd2c4363b9cd302a4f504fb2a9dfe7e3451d66f35dd392e20aca"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "base64"
 version = "0.22.1"
diff --git a/Cargo.toml b/Cargo.toml
index 903b294..2a473bd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ edition = "2024"
 
 [dependencies]
 argh = "0.1.19"
-axum = { version = "0.8.9", optional = true }
+axum = { version = "0.8.9", optional = true, features = ["macros"] }
 axum-extra = { version = "0.12.6", features = ["cookie"], optional = true }
 camino = "1.2.5"
 dn_escape = { path = "vendor/dn_escape" }
diff --git a/src/db/common.rs b/src/db/common.rs
index 4f278b8..d75ba10 100644
--- a/src/db/common.rs
+++ b/src/db/common.rs
@@ -3,7 +3,7 @@ use tokio::sync::RwLock;
 use std::sync::Arc;
 
 use crate::db::error::BoxedError;
-use crate::db::{DatabaseInterface, UserRef};
+use crate::db::{DatabaseInterface, Domain, User, UserRef};
 
 #[derive(Clone, Debug)]
 pub struct Database<D: DatabaseInterface> {
@@ -36,4 +36,13 @@ impl<D: DatabaseInterface> Database<D> {
         tracing::debug!("Comparing {} and {}", user.password, password);
         Ok(user.password == password)
     }
+
+    pub async fn domains_user_can_see(&self, user: &User) -> Result<Vec<Domain>, BoxedError> {
+        Ok(self
+            .list_all_domains()
+            .await?
+            .into_iter()
+            .filter(|d| user.role.can_see_domain(&d.name))
+            .collect())
+    }
 }
diff --git a/src/db/domain.rs b/src/db/domain.rs
index 6cca261..59a1a94 100644
--- a/src/db/domain.rs
+++ b/src/db/domain.rs
@@ -1,4 +1,6 @@
-#[derive(Clone, Debug, Default)]
+use serde::Serialize;
+
+#[derive(Clone, Debug, Default, Serialize)]
 pub struct Domain {
     pub name: String,
 }
diff --git a/src/db/interface.rs b/src/db/interface.rs
index e5d58ec..42154e7 100644
--- a/src/db/interface.rs
+++ b/src/db/interface.rs
@@ -36,6 +36,10 @@ impl<D: DatabaseInterface> DatabaseInterface for Database<D> {
             .await
     }
 
+    async fn list_all_domains(&self) -> Result<Vec<Domain>, BoxedError> {
+        self.inner.read().await.list_all_domains().await
+    }
+
     async fn list_all_users(&self) -> Result<Vec<User>, BoxedError> {
         self.inner.read().await.list_all_users().await
     }
@@ -67,8 +71,9 @@ pub trait DatabaseInterface: Clone + Send + Sync + 'static {
         current_user: &User,
     ) -> Result<Result<(), UserCreationError>, BoxedError>;
 
+    fn list_all_domains(&self) -> impl Future<Output = Result<Vec<Domain>, BoxedError>> + Send;
     #[expect(unused)]
-    fn list_all_users(&self) -> impl Future<Output = Result<Vec<User>, BoxedError>>;
+    fn list_all_users(&self) -> impl Future<Output = Result<Vec<User>, BoxedError>> + Send;
 
     /// List users on a specific domain.
     ///
diff --git a/src/db/memory.rs b/src/db/memory.rs
index 1ba13dd..83c3178 100644
--- a/src/db/memory.rs
+++ b/src/db/memory.rs
@@ -104,6 +104,10 @@ impl DatabaseInterface for MemoryDatabase {
         self.create_user(new_user).await
     }
 
+    fn list_all_domains(&self) -> impl Future<Output = Result<Vec<Domain>, BoxedError>> {
+        ready(Ok(self.domains.clone()))
+    }
+
     fn list_all_users(&self) -> impl Future<Output = Result<Vec<User>, BoxedError>> {
         ready(Ok(self.users.clone()))
     }
diff --git a/src/db/role.rs b/src/db/role.rs
index f717813..102933b 100644
--- a/src/db/role.rs
+++ b/src/db/role.rs
@@ -2,11 +2,12 @@ use serde::Serialize;
 
 #[derive(Clone, Debug)]
 pub enum Operation {
+    CreateDomain,
     CreateUser(String),
     ListUsers(Option<String>),
 }
 
-#[derive(Clone, Debug, Serialize)]
+#[derive(Clone, Debug, PartialEq, Serialize)]
 pub enum Role {
     /// Can do anything
     Admin,
@@ -28,6 +29,7 @@ pub enum Role {
 impl Role {
     pub fn can_perform(&self, operation: &Operation) -> bool {
         match operation {
+            Operation::CreateDomain => self == &Self::Admin,
             Operation::CreateUser(op_domain) => match self {
                 Self::Admin => true,
                 Self::DomainAdmin(usr_domain) | Self::DomainModerator(usr_domain) => {
@@ -44,4 +46,12 @@ impl Role {
             },
         }
     }
+
+    pub fn can_see_domain(&self, domain: &str) -> bool {
+        match self {
+            Self::Admin | Self::ReadonlyAdmin => true,
+            Self::DomainAdmin(d) | Self::DomainModerator(d) => domain == d,
+            Self::User => false,
+        }
+    }
 }
diff --git a/src/db/user.rs b/src/db/user.rs
index 5a325b1..967426a 100644
--- a/src/db/user.rs
+++ b/src/db/user.rs
@@ -80,6 +80,10 @@ impl User {
     pub fn can_perform(&self, operation: &Operation) -> bool {
         self.role.can_perform(operation)
     }
+
+    pub fn can_create_domain(&self) -> bool {
+        self.role.can_perform(&Operation::CreateDomain)
+    }
 }
 
 impl fmt::Display for User {
diff --git a/src/http/home.rs b/src/http/home.rs
new file mode 100644
index 0000000..595ac17
--- /dev/null
+++ b/src/http/home.rs
@@ -0,0 +1,63 @@
+use axum::extract::State;
+use axum::response::{Html, IntoResponse, Response};
+use axum_extra::extract::cookie::CookieJar;
+use http::StatusCode;
+use minijinja::context;
+
+use crate::db::{DatabaseInterface, Operation};
+use crate::http::HttpState;
+use crate::http::login::login_page;
+
+pub async fn home<D: DatabaseInterface>(
+    State(state): State<HttpState<D>>,
+    cookies: CookieJar,
+) -> Response {
+    if let Some(session) = state.sessions.get_session(&cookies) {
+        // When the user has no domain (service admin) list all domains
+        let op = Operation::ListUsers(session.user.domain.clone());
+        let other_users = if session.user.can_perform(&op) {
+            match state
+                .db
+                .list_domain_users(session.user.domain.clone())
+                .await
+            {
+                Ok(other_users) => other_users,
+                Err(e) => {
+                    return format!("Database error: {e}").into_response();
+                }
+            }
+        } else {
+            vec![]
+        };
+
+        tracing::info!(
+            "Found {} users on domain {:?}",
+            other_users.len(),
+            session.user.domain
+        );
+
+        let domains = match state.db.domains_user_can_see(&session.user).await {
+            Ok(domains) => domains,
+            Err(e) => {
+                return format!("Database error: {e}").into_response();
+            }
+        };
+
+        let ctx = context! {
+            domains,
+            user => session.user,
+            can_create_domain => session.user.can_create_domain(),
+            other_users,
+        };
+
+        let page = state
+            .templates
+            .get_template("home.html")
+            .unwrap()
+            .render(ctx)
+            .unwrap();
+        (StatusCode::OK, Html(page)).into_response()
+    } else {
+        login_page(State(state), None).await
+    }
+}
diff --git a/src/http/mod.rs b/src/http/mod.rs
index bd5b2ec..1d65472 100644
--- a/src/http/mod.rs
+++ b/src/http/mod.rs
@@ -1,22 +1,19 @@
 use axum::Router;
-use axum::extract::State;
-use axum::response::{Html, IntoResponse, Response};
 use axum::routing::{get, post};
 use axum::serve::Listener as AxumListener;
-use axum_extra::extract::cookie::CookieJar;
-use http::StatusCode;
+use minijinja::Environment;
 #[cfg(not(feature = "embed"))]
 use minijinja::path_loader;
-use minijinja::{Environment, context};
 #[cfg(feature = "embed")]
 use static_serve::embed_assets;
 #[cfg(not(feature = "embed"))]
 use tower_http::services::ServeDir;
 
-use crate::db::{Database, DatabaseInterface, Operation};
+use crate::db::{Database, DatabaseInterface};
 use crate::listener::{Listener, ListenerKind};
 use crate::stream::{AbstractSocketAddr, AbstractStreamKind};
 
+mod home;
 mod login;
 mod logout;
 mod session;
@@ -98,56 +95,11 @@ pub async fn http_listen<D: DatabaseInterface>(listener: Listener, db: Database<
     #[cfg(not(feature = "embed"))]
     let app = { Router::new().nest_service("/assets", ServeDir::new("assets")) };
     let app = app
-        .route("/", get(home))
-        .route("/login", get(home))
+        .route("/", get(home::home))
+        .route("/login", get(home::home))
         .route("/login", post(login::post_login))
         .route("/logout", get(logout::logout))
         .with_state(HttpState::new(db));
 
     axum::serve(listener, app).await.unwrap();
 }
-
-pub async fn home<D: DatabaseInterface>(
-    State(state): State<HttpState<D>>,
-    cookies: CookieJar,
-) -> Response {
-    if let Some(session) = state.sessions.get_session(&cookies) {
-        // When the user has no domain (service admin) list all domains
-        let op = Operation::ListUsers(session.user.domain.clone());
-        let other_users = if session.user.can_perform(&op) {
-            match state
-                .db
-                .list_domain_users(session.user.domain.clone())
-                .await
-            {
-                Ok(other_users) => other_users,
-                Err(e) => {
-                    return format!("Database error: {e}").into_response();
-                }
-            }
-        } else {
-            vec![]
-        };
-
-        tracing::info!(
-            "Found {} users on domain {:?}",
-            other_users.len(),
-            session.user.domain
-        );
-
-        let ctx = context! {
-            user => session.user,
-            other_users,
-        };
-
-        let page = state
-            .templates
-            .get_template("home.html")
-            .unwrap()
-            .render(ctx)
-            .unwrap();
-        (StatusCode::OK, Html(page)).into_response()
-    } else {
-        login::login_page(State(state), None).await
-    }
-}
diff --git a/templates/home.html b/templates/home.html
index e9f4925..15eb0da 100644
--- a/templates/home.html
+++ b/templates/home.html
@@ -6,6 +6,23 @@
 	<div id="login-line">
 		<a href="/logout" id="submit-login" value="Logout">Logout</a>
 	</div>
+	{% if can_create_domain %}
+		<div>
+			<h2>Create domain</h2>
+			<form action="/domains" method="POST">
+				<input type="text" name="domainname" placeholder="example.com">
+				<button type="submit" class="button is-info">Create</button>
+			</form>
+		</div>
+		<div>
+			<h2>Active domains you can see</h2>
+			<ul>
+			{% for domain in domains %}
+				<li><a href="/domain/{{ domain.name }}">{{ domain.name }}</a></li>
+			{% endfor %}
+			</ul>
+		</div>
+	{% endif %}
 	{% if other_users %}
 		<div>
 			<h2>Other users you have permission to see on your own domain</h2>

From 38700ee4cb5d5743251b5d4e3a223cebd4a987b8 Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Sat, 19 Sep 2026 10:38:32 +0200
Subject: [PATCH 13/20] fix: Domain admin can see domain in home

---
 src/db/common.rs    |  2 +-
 src/db/user.rs      |  6 ++++++
 templates/home.html | 16 ++++++++--------
 3 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/src/db/common.rs b/src/db/common.rs
index d75ba10..f7408c6 100644
--- a/src/db/common.rs
+++ b/src/db/common.rs
@@ -42,7 +42,7 @@ impl<D: DatabaseInterface> Database<D> {
             .list_all_domains()
             .await?
             .into_iter()
-            .filter(|d| user.role.can_see_domain(&d.name))
+            .filter(|d| user.can_see_domain(&d.name))
             .collect())
     }
 }
diff --git a/src/db/user.rs b/src/db/user.rs
index 967426a..b7c8bcd 100644
--- a/src/db/user.rs
+++ b/src/db/user.rs
@@ -84,6 +84,12 @@ impl User {
     pub fn can_create_domain(&self) -> bool {
         self.role.can_perform(&Operation::CreateDomain)
     }
+
+    pub fn can_see_domain(&self, domain: &str) -> bool {
+        let allowed = self.role.can_see_domain(domain);
+        tracing::debug!("{} can see domain {}: {}", self.mail, domain, allowed);
+        allowed
+    }
 }
 
 impl fmt::Display for User {
diff --git a/templates/home.html b/templates/home.html
index 15eb0da..13f717e 100644
--- a/templates/home.html
+++ b/templates/home.html
@@ -14,15 +14,15 @@
 				<button type="submit" class="button is-info">Create</button>
 			</form>
 		</div>
-		<div>
-			<h2>Active domains you can see</h2>
-			<ul>
-			{% for domain in domains %}
-				<li><a href="/domain/{{ domain.name }}">{{ domain.name }}</a></li>
-			{% endfor %}
-			</ul>
-		</div>
 	{% endif %}
+	<div>
+		<h2>Active domains you can see</h2>
+		<ul>
+		{% for domain in domains %}
+			<li><a href="/domain/{{ domain.name }}">{{ domain.name }}</a></li>
+		{% endfor %}
+		</ul>
+	</div>
 	{% if other_users %}
 		<div>
 			<h2>Other users you have permission to see on your own domain</h2>

From ae5d466e992cfcfa0f50cde77b8a79b5bff6d25b Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Sat, 19 Sep 2026 10:44:44 +0200
Subject: [PATCH 14/20] feat: Basic domain admin page

---
 src/db/interface.rs   |  5 +++-
 src/http/domain.rs    | 54 +++++++++++++++++++++++++++++++++++++++++++
 src/http/mod.rs       |  3 +++
 templates/domain.html | 30 ++++++++++++++++++++++++
 templates/home.html   |  2 +-
 5 files changed, 92 insertions(+), 2 deletions(-)
 create mode 100644 src/http/domain.rs
 create mode 100644 templates/domain.html

diff --git a/src/db/interface.rs b/src/db/interface.rs
index 42154e7..c109873 100644
--- a/src/db/interface.rs
+++ b/src/db/interface.rs
@@ -54,7 +54,10 @@ pub trait DatabaseInterface: Clone + Send + Sync + 'static {
         &mut self,
         domain: &str,
     ) -> impl Future<Output = Result<Result<(), DomainCreationError>, BoxedError>>;
-    fn get_domain(&self, domain: &str) -> impl Future<Output = Result<Option<Domain>, BoxedError>>;
+    fn get_domain(
+        &self,
+        domain: &str,
+    ) -> impl Future<Output = Result<Option<Domain>, BoxedError>> + Send;
 
     fn get_user(
         &self,
diff --git a/src/http/domain.rs b/src/http/domain.rs
new file mode 100644
index 0000000..479b5f4
--- /dev/null
+++ b/src/http/domain.rs
@@ -0,0 +1,54 @@
+use axum::extract::{Path, State};
+use axum::response::{Html, IntoResponse, Response};
+use axum_extra::extract::cookie::CookieJar;
+use http::StatusCode;
+use minijinja::context;
+
+use crate::db::{DatabaseInterface, Operation};
+use crate::http::HttpState;
+use crate::http::login::login_page;
+
+pub async fn get_domain<D: DatabaseInterface>(
+    State(state): State<HttpState<D>>,
+    cookies: CookieJar,
+    Path(domain): Path<String>,
+) -> Response {
+    let Some(session) = state.sessions.get_session(&cookies) else {
+        return login_page(State(state), None).await.into_response();
+    };
+
+    let domain = match state.db.get_domain(&domain).await {
+        Ok(Some(domain)) => domain,
+        Ok(None) => return format!("Domain not found: {domain}").into_response(),
+        Err(e) => {
+            return format!("Database error: {e}").into_response();
+        }
+    };
+
+    let domain_users = match state.db.list_domain_users(Some(domain.name.clone())).await {
+        Ok(users) => users,
+        Err(e) => {
+            return format!("Database error: {e}").into_response();
+        }
+    };
+
+    // Redundant because someone who can see the domain admin page for the moment
+    // always can create accounts.
+    let op = Operation::CreateUser(domain.name.clone());
+    let can_create_user = session.user.can_perform(&op);
+
+    let ctx = context! {
+        can_create_user,
+        domain,
+        user => session.user,
+        users => domain_users,
+    };
+
+    let page = state
+        .templates
+        .get_template("domain.html")
+        .unwrap()
+        .render(ctx)
+        .unwrap();
+    (StatusCode::OK, Html(page)).into_response()
+}
diff --git a/src/http/mod.rs b/src/http/mod.rs
index 1d65472..4692ec9 100644
--- a/src/http/mod.rs
+++ b/src/http/mod.rs
@@ -13,6 +13,7 @@ use crate::db::{Database, DatabaseInterface};
 use crate::listener::{Listener, ListenerKind};
 use crate::stream::{AbstractSocketAddr, AbstractStreamKind};
 
+mod domain;
 mod home;
 mod login;
 mod logout;
@@ -99,6 +100,8 @@ pub async fn http_listen<D: DatabaseInterface>(listener: Listener, db: Database<
         .route("/login", get(home::home))
         .route("/login", post(login::post_login))
         .route("/logout", get(logout::logout))
+        .route("/domain/{domain}", get(domain::get_domain))
+        //.route("/domain", post(domain::create_domain))
         .with_state(HttpState::new(db));
 
     axum::serve(listener, app).await.unwrap();
diff --git a/templates/domain.html b/templates/domain.html
new file mode 100644
index 0000000..a5c46a4
--- /dev/null
+++ b/templates/domain.html
@@ -0,0 +1,30 @@
+{% extends 'base.html' %}
+{% block main %}
+<main id="center">
+  <img src="/assets/img/logo.png" id="logo">
+	<p style="text-align: center;">You are logged in as {{ user.username }}</p>
+	<div id="login-line">
+		<a href="/logout" id="submit-login" value="Logout">Logout</a>
+	</div>
+	{% if can_create_user %}
+		<div>
+			<h2>Create user</h2>
+			<form action="/user" method="POST">
+				<input type="hidden" name="domainname" value="{{ domain.name }}">
+				<input type="text" name="username" placeholder="username">
+				<input type="password" name="password" placeholder="password">
+				<button type="submit" class="button is-info">Create</button>
+			</form>
+		</div>
+	{% endif %}
+	<div>
+		<h2>Users on {{ domain.name }}</h2>
+		<ul>
+			{% for user in users %}
+				<li>{{ user.mail }}</li>
+			{% endfor %}
+		</ul>
+	</div>
+</main>
+{% endblock %}
+
diff --git a/templates/home.html b/templates/home.html
index 13f717e..d1f71b2 100644
--- a/templates/home.html
+++ b/templates/home.html
@@ -9,7 +9,7 @@
 	{% if can_create_domain %}
 		<div>
 			<h2>Create domain</h2>
-			<form action="/domains" method="POST">
+			<form action="/domain" method="POST">
 				<input type="text" name="domainname" placeholder="example.com">
 				<button type="submit" class="button is-info">Create</button>
 			</form>

From 78df25f150f732b1e03bce1a515a9886f59ab27c Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Sat, 19 Sep 2026 10:51:23 +0200
Subject: [PATCH 15/20] feat: Basic domain creation form

---
 src/db/interface.rs |  2 +-
 src/http/domain.rs  | 31 +++++++++++++++++++++++++++++--
 src/http/mod.rs     |  2 +-
 3 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/src/db/interface.rs b/src/db/interface.rs
index c109873..baccc60 100644
--- a/src/db/interface.rs
+++ b/src/db/interface.rs
@@ -53,7 +53,7 @@ pub trait DatabaseInterface: Clone + Send + Sync + 'static {
     fn create_domain(
         &mut self,
         domain: &str,
-    ) -> impl Future<Output = Result<Result<(), DomainCreationError>, BoxedError>>;
+    ) -> impl Future<Output = Result<Result<(), DomainCreationError>, BoxedError>> + Send;
     fn get_domain(
         &self,
         domain: &str,
diff --git a/src/http/domain.rs b/src/http/domain.rs
index 479b5f4..8bccc5b 100644
--- a/src/http/domain.rs
+++ b/src/http/domain.rs
@@ -1,8 +1,9 @@
-use axum::extract::{Path, State};
-use axum::response::{Html, IntoResponse, Response};
+use axum::extract::{Form, Path, State};
+use axum::response::{Html, IntoResponse, Redirect, Response};
 use axum_extra::extract::cookie::CookieJar;
 use http::StatusCode;
 use minijinja::context;
+use serde::Deserialize;
 
 use crate::db::{DatabaseInterface, Operation};
 use crate::http::HttpState;
@@ -52,3 +53,29 @@ pub async fn get_domain<D: DatabaseInterface>(
         .unwrap();
     (StatusCode::OK, Html(page)).into_response()
 }
+
+#[derive(Clone, Debug, Deserialize)]
+pub struct DomainCreationForm {
+    domainname: String,
+}
+
+pub async fn create_domain<D: DatabaseInterface>(
+    State(mut state): State<HttpState<D>>,
+    cookies: CookieJar,
+    Form(form): Form<DomainCreationForm>,
+) -> Response {
+    let Some(session) = state.sessions.get_session(&cookies) else {
+        return login_page(State(state), None).await.into_response();
+    };
+
+    let op = Operation::CreateDomain;
+    if !session.user.can_perform(&op) {
+        return "Not authorized to create a new domain".into_response();
+    }
+
+    match state.db.create_domain(&form.domainname).await {
+        Ok(Ok(())) => Redirect::to(&format!("/domain/{}", form.domainname)).into_response(),
+        Ok(Err(e)) => format!("Failed to create domain {}: {}", form.domainname, e).into_response(),
+        Err(e) => format!("Database error: {e}").into_response(),
+    }
+}
diff --git a/src/http/mod.rs b/src/http/mod.rs
index 4692ec9..9cd0a94 100644
--- a/src/http/mod.rs
+++ b/src/http/mod.rs
@@ -101,7 +101,7 @@ pub async fn http_listen<D: DatabaseInterface>(listener: Listener, db: Database<
         .route("/login", post(login::post_login))
         .route("/logout", get(logout::logout))
         .route("/domain/{domain}", get(domain::get_domain))
-        //.route("/domain", post(domain::create_domain))
+        .route("/domain", post(domain::create_domain))
         .with_state(HttpState::new(db));
 
     axum::serve(listener, app).await.unwrap();

From e28c584b26f5a65c89d569c54edcd285bb82554e Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Sat, 19 Sep 2026 11:13:21 +0200
Subject: [PATCH 16/20] feat: Basic user creation form

---
 src/db/interface.rs   |  5 ++---
 src/db/memory.rs      |  1 -
 src/http/mod.rs       |  2 ++
 src/http/user.rs      | 49 +++++++++++++++++++++++++++++++++++++++++++
 templates/domain.html |  2 +-
 5 files changed, 54 insertions(+), 5 deletions(-)
 create mode 100644 src/http/user.rs

diff --git a/src/db/interface.rs b/src/db/interface.rs
index baccc60..ca84fd9 100644
--- a/src/db/interface.rs
+++ b/src/db/interface.rs
@@ -67,12 +67,11 @@ pub trait DatabaseInterface: Clone + Send + Sync + 'static {
         &mut self,
         user: User,
     ) -> Result<Result<(), UserCreationError>, BoxedError>;
-    #[expect(unused)]
-    async fn try_create_user(
+    fn try_create_user(
         &mut self,
         new_user: User,
         current_user: &User,
-    ) -> Result<Result<(), UserCreationError>, BoxedError>;
+    ) -> impl Future<Output = Result<Result<(), UserCreationError>, BoxedError>> + Send;
 
     fn list_all_domains(&self) -> impl Future<Output = Result<Vec<Domain>, BoxedError>> + Send;
     #[expect(unused)]
diff --git a/src/db/memory.rs b/src/db/memory.rs
index 83c3178..e170db0 100644
--- a/src/db/memory.rs
+++ b/src/db/memory.rs
@@ -91,7 +91,6 @@ impl DatabaseInterface for MemoryDatabase {
         //
         // TODO: for now we don't allow creating service users manually
         // so we assume there's a domain provided
-        // TODO: restrict user creation on non-declared domains
         let Some(new_user_domain) = &new_user.domain else {
             return Ok(Err(UserCreationError::Permissions));
         };
diff --git a/src/http/mod.rs b/src/http/mod.rs
index 9cd0a94..def0f22 100644
--- a/src/http/mod.rs
+++ b/src/http/mod.rs
@@ -19,6 +19,7 @@ mod login;
 mod logout;
 mod session;
 use session::HttpSessionManager;
+mod user;
 
 impl AxumListener for Listener {
     type Io = AbstractStreamKind;
@@ -102,6 +103,7 @@ pub async fn http_listen<D: DatabaseInterface>(listener: Listener, db: Database<
         .route("/logout", get(logout::logout))
         .route("/domain/{domain}", get(domain::get_domain))
         .route("/domain", post(domain::create_domain))
+        .route("/user", post(user::create_user))
         .with_state(HttpState::new(db));
 
     axum::serve(listener, app).await.unwrap();
diff --git a/src/http/user.rs b/src/http/user.rs
new file mode 100644
index 0000000..d6eb054
--- /dev/null
+++ b/src/http/user.rs
@@ -0,0 +1,49 @@
+use axum::extract::{Form, State};
+use axum::response::{IntoResponse, Redirect, Response};
+use axum_extra::extract::cookie::CookieJar;
+use serde::Deserialize;
+
+use crate::db::{DatabaseInterface, Role, User};
+use crate::http::HttpState;
+use crate::http::login::login_page;
+
+#[derive(Clone, Debug, Deserialize)]
+pub struct UserCreationForm {
+    pub username: String,
+    pub domain: String,
+    pub password: String,
+}
+
+pub async fn create_user<D: DatabaseInterface>(
+    State(mut state): State<HttpState<D>>,
+    cookies: CookieJar,
+    Form(form): Form<UserCreationForm>,
+) -> Response {
+    let Some(session) = state.sessions.get_session(&cookies) else {
+        return login_page(State(state), None).await.into_response();
+    };
+
+    // let domain = form.domain;
+    // let op = Operation::CreateUser(domain.clone());
+    // if !session.user.can_perform(&op) {
+    //     return format!("Not authorized to create a new user on domain {domain}").into_response()
+    // }
+
+    let new_user = User {
+        mail: format!("{}@{}", form.username, form.domain),
+        username: form.username.clone(),
+        domain: Some(form.domain.clone()),
+        password: form.password,
+        role: Role::User,
+    };
+
+    match state.db.try_create_user(new_user, &session.user).await {
+        Ok(Ok(())) => Redirect::to(&format!("/domain/{}", form.domain)).into_response(),
+        Ok(Err(e)) => format!(
+            "Failed to create user {} on domain {}: {}",
+            form.username, form.domain, e
+        )
+        .into_response(),
+        Err(e) => format!("Database error: {e}").into_response(),
+    }
+}
diff --git a/templates/domain.html b/templates/domain.html
index a5c46a4..758ad65 100644
--- a/templates/domain.html
+++ b/templates/domain.html
@@ -10,7 +10,7 @@
 		<div>
 			<h2>Create user</h2>
 			<form action="/user" method="POST">
-				<input type="hidden" name="domainname" value="{{ domain.name }}">
+				<input type="hidden" name="domain" value="{{ domain.name }}">
 				<input type="text" name="username" placeholder="username">
 				<input type="password" name="password" placeholder="password">
 				<button type="submit" class="button is-info">Create</button>

From 44c083a8efefab4cbb19b7f7005847e47607d03d Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Sat, 19 Sep 2026 12:30:47 +0200
Subject: [PATCH 17/20] refactor: HttpSession/OptionalHttpSession axum
 extractors

---
 src/http/domain.rs  | 16 ++------
 src/http/home.rs    | 91 +++++++++++++++++++++------------------------
 src/http/login.rs   | 16 +++++++-
 src/http/logout.rs  |  5 ++-
 src/http/mod.rs     |  4 +-
 src/http/session.rs | 46 ++++++++++++++++++++++-
 src/http/user.rs    | 16 +-------
 7 files changed, 112 insertions(+), 82 deletions(-)

diff --git a/src/http/domain.rs b/src/http/domain.rs
index 8bccc5b..1acfdbb 100644
--- a/src/http/domain.rs
+++ b/src/http/domain.rs
@@ -1,23 +1,17 @@
 use axum::extract::{Form, Path, State};
 use axum::response::{Html, IntoResponse, Redirect, Response};
-use axum_extra::extract::cookie::CookieJar;
 use http::StatusCode;
 use minijinja::context;
 use serde::Deserialize;
 
 use crate::db::{DatabaseInterface, Operation};
-use crate::http::HttpState;
-use crate::http::login::login_page;
+use crate::http::{HttpSession, HttpState};
 
 pub async fn get_domain<D: DatabaseInterface>(
     State(state): State<HttpState<D>>,
-    cookies: CookieJar,
+    session: HttpSession,
     Path(domain): Path<String>,
 ) -> Response {
-    let Some(session) = state.sessions.get_session(&cookies) else {
-        return login_page(State(state), None).await.into_response();
-    };
-
     let domain = match state.db.get_domain(&domain).await {
         Ok(Some(domain)) => domain,
         Ok(None) => return format!("Domain not found: {domain}").into_response(),
@@ -61,13 +55,9 @@ pub struct DomainCreationForm {
 
 pub async fn create_domain<D: DatabaseInterface>(
     State(mut state): State<HttpState<D>>,
-    cookies: CookieJar,
+    session: HttpSession,
     Form(form): Form<DomainCreationForm>,
 ) -> Response {
-    let Some(session) = state.sessions.get_session(&cookies) else {
-        return login_page(State(state), None).await.into_response();
-    };
-
     let op = Operation::CreateDomain;
     if !session.user.can_perform(&op) {
         return "Not authorized to create a new domain".into_response();
diff --git a/src/http/home.rs b/src/http/home.rs
index 595ac17..febb6b0 100644
--- a/src/http/home.rs
+++ b/src/http/home.rs
@@ -1,63 +1,58 @@
 use axum::extract::State;
 use axum::response::{Html, IntoResponse, Response};
-use axum_extra::extract::cookie::CookieJar;
 use http::StatusCode;
 use minijinja::context;
 
 use crate::db::{DatabaseInterface, Operation};
-use crate::http::HttpState;
-use crate::http::login::login_page;
+use crate::http::{HttpSession, HttpState};
 
 pub async fn home<D: DatabaseInterface>(
     State(state): State<HttpState<D>>,
-    cookies: CookieJar,
+    // Only logged in users are allowed here
+    session: HttpSession,
 ) -> Response {
-    if let Some(session) = state.sessions.get_session(&cookies) {
-        // When the user has no domain (service admin) list all domains
-        let op = Operation::ListUsers(session.user.domain.clone());
-        let other_users = if session.user.can_perform(&op) {
-            match state
-                .db
-                .list_domain_users(session.user.domain.clone())
-                .await
-            {
-                Ok(other_users) => other_users,
-                Err(e) => {
-                    return format!("Database error: {e}").into_response();
-                }
-            }
-        } else {
-            vec![]
-        };
-
-        tracing::info!(
-            "Found {} users on domain {:?}",
-            other_users.len(),
-            session.user.domain
-        );
-
-        let domains = match state.db.domains_user_can_see(&session.user).await {
-            Ok(domains) => domains,
+    // When the user has no domain (service admin) list all domains
+    let op = Operation::ListUsers(session.user.domain.clone());
+    let other_users = if session.user.can_perform(&op) {
+        match state
+            .db
+            .list_domain_users(session.user.domain.clone())
+            .await
+        {
+            Ok(other_users) => other_users,
             Err(e) => {
                 return format!("Database error: {e}").into_response();
             }
-        };
-
-        let ctx = context! {
-            domains,
-            user => session.user,
-            can_create_domain => session.user.can_create_domain(),
-            other_users,
-        };
-
-        let page = state
-            .templates
-            .get_template("home.html")
-            .unwrap()
-            .render(ctx)
-            .unwrap();
-        (StatusCode::OK, Html(page)).into_response()
+        }
     } else {
-        login_page(State(state), None).await
-    }
+        vec![]
+    };
+
+    tracing::info!(
+        "Found {} users on domain {:?}",
+        other_users.len(),
+        session.user.domain
+    );
+
+    let domains = match state.db.domains_user_can_see(&session.user).await {
+        Ok(domains) => domains,
+        Err(e) => {
+            return format!("Database error: {e}").into_response();
+        }
+    };
+
+    let ctx = context! {
+        domains,
+        user => session.user,
+        can_create_domain => session.user.can_create_domain(),
+        other_users,
+    };
+
+    let page = state
+        .templates
+        .get_template("home.html")
+        .unwrap()
+        .render(ctx)
+        .unwrap();
+    (StatusCode::OK, Html(page)).into_response()
 }
diff --git a/src/http/login.rs b/src/http/login.rs
index f62a7b0..8b4a26d 100644
--- a/src/http/login.rs
+++ b/src/http/login.rs
@@ -6,7 +6,7 @@ use minijinja::context;
 use serde::{Deserialize, Serialize};
 
 use crate::db::{DatabaseInterface, UserRef};
-use crate::http::HttpState;
+use crate::http::{HttpState, OptionalHttpSession};
 
 #[derive(Debug, Deserialize)]
 pub struct LoginForm {
@@ -33,12 +33,24 @@ pub async fn login_page<D: DatabaseInterface>(
     (StatusCode::OK, Html(page)).into_response()
 }
 
+pub async fn get_login<D: DatabaseInterface>(
+    State(state): State<HttpState<D>>,
+    maybe_session: Option<OptionalHttpSession>,
+) -> Response {
+    if maybe_session.is_some() {
+        return Redirect::to("/").into_response();
+    }
+
+    login_page(State(state), None).await
+}
+
 pub async fn post_login<D: DatabaseInterface>(
     State(state): State<HttpState<D>>,
+    session: Option<OptionalHttpSession>,
     cookies: CookieJar,
     Form(form): Form<LoginForm>,
 ) -> Response {
-    if let Some(_session) = state.sessions.get_session(&cookies) {
+    if session.is_some() {
         // Already logged in
         return (cookies, Redirect::to("/")).into_response();
     }
diff --git a/src/http/logout.rs b/src/http/logout.rs
index 5e38309..c742074 100644
--- a/src/http/logout.rs
+++ b/src/http/logout.rs
@@ -3,14 +3,15 @@ use axum::response::{IntoResponse, Redirect, Response};
 use axum_extra::extract::cookie::CookieJar;
 
 use crate::db::DatabaseInterface;
-use crate::http::HttpState;
 use crate::http::login::{LoginError, login_page};
+use crate::http::{HttpState, OptionalHttpSession};
 
 pub async fn logout<D: DatabaseInterface>(
     State(state): State<HttpState<D>>,
+    session: Option<OptionalHttpSession>,
     cookies: CookieJar,
 ) -> Response {
-    let Some(session) = state.sessions.get_session(&cookies) else {
+    let Some(session) = session else {
         return (cookies, Redirect::to("/")).into_response();
     };
 
diff --git a/src/http/mod.rs b/src/http/mod.rs
index def0f22..17c9448 100644
--- a/src/http/mod.rs
+++ b/src/http/mod.rs
@@ -18,7 +18,7 @@ mod home;
 mod login;
 mod logout;
 mod session;
-use session::HttpSessionManager;
+use session::{HttpSession, HttpSessionManager, OptionalHttpSession};
 mod user;
 
 impl AxumListener for Listener {
@@ -98,7 +98,7 @@ pub async fn http_listen<D: DatabaseInterface>(listener: Listener, db: Database<
     let app = { Router::new().nest_service("/assets", ServeDir::new("assets")) };
     let app = app
         .route("/", get(home::home))
-        .route("/login", get(home::home))
+        .route("/login", get(login::get_login))
         .route("/login", post(login::post_login))
         .route("/logout", get(logout::logout))
         .route("/domain/{domain}", get(domain::get_domain))
diff --git a/src/http/session.rs b/src/http/session.rs
index 5a3a8db..5005b8c 100644
--- a/src/http/session.rs
+++ b/src/http/session.rs
@@ -1,9 +1,13 @@
+use axum::extract::{FromRequestParts, OptionalFromRequestParts};
+use axum::response::Redirect;
 use axum_extra::extract::cookie::{Cookie, CookieJar};
+use http::request::Parts;
 use uuid::Uuid;
 
 use std::sync::{Arc, RwLock};
 
-use crate::db::User;
+use crate::db::{DatabaseInterface, User};
+use crate::http::HttpState;
 
 pub const COOKIE_NAME: &str = "lldap_session";
 
@@ -78,3 +82,43 @@ impl PartialEq<HttpSession> for HttpSession {
         self.uuid == other.uuid
     }
 }
+
+impl<D: DatabaseInterface> FromRequestParts<HttpState<D>> for HttpSession {
+    type Rejection = Redirect;
+
+    async fn from_request_parts(
+        parts: &mut Parts,
+        state: &HttpState<D>,
+    ) -> Result<Self, Self::Rejection> {
+        let cookies = CookieJar::from_request_parts(parts, state).await.unwrap();
+        state
+            .sessions
+            .get_session(&cookies)
+            .ok_or(Redirect::to("/login"))
+    }
+}
+
+pub struct OptionalHttpSession(pub HttpSession);
+
+impl std::ops::Deref for OptionalHttpSession {
+    type Target = HttpSession;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl<D: DatabaseInterface> OptionalFromRequestParts<HttpState<D>> for OptionalHttpSession {
+    type Rejection = Redirect;
+
+    async fn from_request_parts(
+        parts: &mut Parts,
+        state: &HttpState<D>,
+    ) -> Result<Option<Self>, Self::Rejection> {
+        let maybe_session = HttpSession::from_request_parts(parts, state)
+            .await
+            .ok()
+            .map(Self);
+        Ok(maybe_session)
+    }
+}
diff --git a/src/http/user.rs b/src/http/user.rs
index d6eb054..2d0d385 100644
--- a/src/http/user.rs
+++ b/src/http/user.rs
@@ -1,11 +1,9 @@
 use axum::extract::{Form, State};
 use axum::response::{IntoResponse, Redirect, Response};
-use axum_extra::extract::cookie::CookieJar;
 use serde::Deserialize;
 
 use crate::db::{DatabaseInterface, Role, User};
-use crate::http::HttpState;
-use crate::http::login::login_page;
+use crate::http::{HttpSession, HttpState};
 
 #[derive(Clone, Debug, Deserialize)]
 pub struct UserCreationForm {
@@ -16,19 +14,9 @@ pub struct UserCreationForm {
 
 pub async fn create_user<D: DatabaseInterface>(
     State(mut state): State<HttpState<D>>,
-    cookies: CookieJar,
+    session: HttpSession,
     Form(form): Form<UserCreationForm>,
 ) -> Response {
-    let Some(session) = state.sessions.get_session(&cookies) else {
-        return login_page(State(state), None).await.into_response();
-    };
-
-    // let domain = form.domain;
-    // let op = Operation::CreateUser(domain.clone());
-    // if !session.user.can_perform(&op) {
-    //     return format!("Not authorized to create a new user on domain {domain}").into_response()
-    // }
-
     let new_user = User {
         mail: format!("{}@{}", form.username, form.domain),
         username: form.username.clone(),

From 9933990fd3e2cb1cc1b4325c4d43dfb55f703cf7 Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Sat, 19 Sep 2026 14:17:41 +0200
Subject: [PATCH 18/20] feat: Implement JSON-backed database

---
 Cargo.lock           |   4 ++
 Cargo.toml           |   3 +-
 src/cli.rs           |   5 ++
 src/db/domain.rs     |   4 +-
 src/db/filesystem.rs | 145 +++++++++++++++++++++++++++++++++++++++++++
 src/db/group.rs      |   6 +-
 src/db/interface.rs  |   4 +-
 src/db/memory.rs     |   7 ++-
 src/db/mod.rs        |   2 +
 src/db/role.rs       |   6 +-
 src/db/user.rs       |   4 +-
 src/main.rs          |   7 ++-
 12 files changed, 179 insertions(+), 18 deletions(-)
 create mode 100644 src/db/filesystem.rs

diff --git a/Cargo.lock b/Cargo.lock
index 0b55b38..642d24c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -169,6 +169,9 @@ name = "camino"
 version = "1.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb1307f12aa967b5a58416e87b3653360e0fd614a016b6e970db08fecbb1b80d"
+dependencies = [
+ "serde_core",
+]
 
 [[package]]
 name = "cc"
@@ -530,6 +533,7 @@ dependencies = [
  "minijinja",
  "minijinja-embed",
  "serde",
+ "serde_json",
  "static-serve",
  "tokio",
  "tokio-util",
diff --git a/Cargo.toml b/Cargo.toml
index 2a473bd..2d31050 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,7 +7,7 @@ edition = "2024"
 argh = "0.1.19"
 axum = { version = "0.8.9", optional = true, features = ["macros"] }
 axum-extra = { version = "0.12.6", features = ["cookie"], optional = true }
-camino = "1.2.5"
+camino = { version = "1.2.5", features = ["serde1"] }
 dn_escape = { path = "vendor/dn_escape" }
 futures-util = { version = "0.3.34", features = ["sink"] }
 http = { version = "1.5.0", optional = true }
@@ -15,6 +15,7 @@ ldap3_proto = "0.8.1"
 minijinja = { version = "2.24.0", optional = true }
 minijinja-embed = { version = "2.24.0", optional = true }
 serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.151"
 static-serve = { version = "0.6.3", optional = true }
 tokio = { version = "1.53.1", features = ["macros", "net", "rt", "time", "sync"] }
 tokio-util = { version = "0.7.19", features = ["codec"] }
diff --git a/src/cli.rs b/src/cli.rs
index 6867704..d70e141 100644
--- a/src/cli.rs
+++ b/src/cli.rs
@@ -1,8 +1,13 @@
 use argh::FromArgs;
+use camino::Utf8PathBuf;
 
 /// Run the llldap server
 #[derive(FromArgs)]
 pub struct CliArgs {
+    /// path to the JSON file for the database
+    #[argh(option)]
+    pub db: Option<Utf8PathBuf>,
+
     /// address or socket to listen on for LDAP connections
     #[argh(option, default = "String::from(\"127.0.0.1:3389\")")]
     pub listen_ldap: String,
diff --git a/src/db/domain.rs b/src/db/domain.rs
index 59a1a94..9c7d7e6 100644
--- a/src/db/domain.rs
+++ b/src/db/domain.rs
@@ -1,6 +1,6 @@
-use serde::Serialize;
+use serde::{Deserialize, Serialize};
 
-#[derive(Clone, Debug, Default, Serialize)]
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
 pub struct Domain {
     pub name: String,
 }
diff --git a/src/db/filesystem.rs b/src/db/filesystem.rs
new file mode 100644
index 0000000..71fef14
--- /dev/null
+++ b/src/db/filesystem.rs
@@ -0,0 +1,145 @@
+use camino::{Utf8Path, Utf8PathBuf};
+use serde::{Deserialize, Serialize};
+use serde_json::Error as JsonError;
+
+use std::fmt;
+use std::io::Error as IOError;
+
+use crate::db::error::{BoxedError, DomainCreationError, UserCreationError};
+use crate::db::{Database, DatabaseInterface, Domain, MemoryDatabase, User, UserRef};
+
+#[derive(Debug)]
+pub enum FilesystemDatabaseError {
+    ReadFileIO(Utf8PathBuf, IOError),
+    ReadFileJson(Utf8PathBuf, JsonError),
+    WriteFileIO(Utf8PathBuf, IOError),
+    WriteFileJson(Utf8PathBuf, JsonError),
+}
+
+impl fmt::Display for FilesystemDatabaseError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(
+            f,
+            "{}",
+            match self {
+                Self::ReadFileIO(path, e) => format!("Failed to read database file {path}: {e}"),
+                Self::ReadFileJson(path, e) =>
+                    format!("Failed to parse database JSON file {path}: {e}"),
+                Self::WriteFileIO(path, e) => format!("Failed to write database file {path}: {e}"),
+                Self::WriteFileJson(path, e) =>
+                    format!("Failed to convert database to JSON file {path}: {e}"),
+            }
+        )
+    }
+}
+
+impl std::error::Error for FilesystemDatabaseError {}
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+pub struct FilesystemDatabase {
+    // TODO: Once we have common validation steps in place across DB backends, we can reduce cloning.
+    //       For now, we clone the DB on every write operation, and update it when saving to disk
+    //       succeeds.
+    pub inner: MemoryDatabase,
+    pub path: Utf8PathBuf,
+}
+
+impl FilesystemDatabase {
+    pub async fn from_path(path: impl AsRef<Utf8Path>) -> Result<Database<Self>, BoxedError> {
+        let path = path.as_ref();
+        let s = tokio::fs::read(path)
+            .await
+            .map_err(|e| Box::new(FilesystemDatabaseError::ReadFileIO(path.to_path_buf(), e)))?;
+        let inner: MemoryDatabase = serde_json::from_slice(&s)
+            .map_err(|e| Box::new(FilesystemDatabaseError::ReadFileJson(path.to_path_buf(), e)))?;
+        Ok(Database::new(Self {
+            inner,
+            path: path.to_path_buf(),
+        }))
+    }
+
+    pub async fn save(&mut self) -> Result<(), BoxedError> {
+        let s = serde_json::to_string(&self)
+            .map_err(|e| Box::new(FilesystemDatabaseError::WriteFileJson(self.path.clone(), e)))?;
+        Ok(tokio::fs::write(&self.path, &s)
+            .await
+            .map_err(|e| Box::new(FilesystemDatabaseError::WriteFileIO(self.path.clone(), e)))?)
+    }
+}
+
+impl DatabaseInterface for FilesystemDatabase {
+    async fn create_domain(
+        &mut self,
+        domain: &str,
+    ) -> Result<Result<(), DomainCreationError>, BoxedError> {
+        let mut new_db = self.inner.clone();
+
+        if let Err(e) = new_db.create_domain(domain).await? {
+            return Ok(Err(e));
+        }
+
+        self.save().await?;
+        self.inner = new_db;
+
+        Ok(Ok(()))
+    }
+
+    fn get_domain(&self, domain: &str) -> impl Future<Output = Result<Option<Domain>, BoxedError>> {
+        self.inner.get_domain(domain)
+    }
+
+    fn get_user(
+        &self,
+        req_user: &UserRef,
+    ) -> impl Future<Output = Result<Option<User>, BoxedError>> {
+        self.inner.get_user(req_user)
+    }
+
+    async fn create_user(
+        &mut self,
+        user: User,
+    ) -> Result<Result<(), UserCreationError>, BoxedError> {
+        let mut new_db = self.inner.clone();
+
+        if let Err(e) = new_db.create_user(user).await? {
+            return Ok(Err(e));
+        }
+
+        self.save().await?;
+        self.inner = new_db;
+
+        Ok(Ok(()))
+    }
+
+    async fn try_create_user(
+        &mut self,
+        new_user: User,
+        current_user: &User,
+    ) -> Result<Result<(), UserCreationError>, BoxedError> {
+        let mut new_db = self.inner.clone();
+
+        if let Err(e) = new_db.try_create_user(new_user, current_user).await? {
+            return Ok(Err(e));
+        }
+
+        self.save().await?;
+        self.inner = new_db;
+
+        Ok(Ok(()))
+    }
+
+    fn list_all_domains(&self) -> impl Future<Output = Result<Vec<Domain>, BoxedError>> {
+        self.inner.list_all_domains()
+    }
+
+    fn list_all_users(&self) -> impl Future<Output = Result<Vec<User>, BoxedError>> {
+        self.inner.list_all_users()
+    }
+
+    fn list_domain_users(
+        &self,
+        domain: Option<String>,
+    ) -> impl Future<Output = Result<Vec<User>, BoxedError>> {
+        self.inner.list_domain_users(domain)
+    }
+}
diff --git a/src/db/group.rs b/src/db/group.rs
index c07a891..6a2793f 100644
--- a/src/db/group.rs
+++ b/src/db/group.rs
@@ -1,7 +1,7 @@
-#[derive(Clone, Debug)]
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct Group {
-    #[expect(unused)]
     name: String,
-    #[expect(unused)]
     domain: String,
 }
diff --git a/src/db/interface.rs b/src/db/interface.rs
index ca84fd9..c434ec5 100644
--- a/src/db/interface.rs
+++ b/src/db/interface.rs
@@ -62,7 +62,7 @@ pub trait DatabaseInterface: Clone + Send + Sync + 'static {
     fn get_user(
         &self,
         user: &UserRef,
-    ) -> impl std::future::Future<Output = Result<Option<User>, BoxedError>> + Send;
+    ) -> impl Future<Output = Result<Option<User>, BoxedError>> + Send;
     async fn create_user(
         &mut self,
         user: User,
@@ -83,5 +83,5 @@ pub trait DatabaseInterface: Clone + Send + Sync + 'static {
     fn list_domain_users(
         &self,
         domain: Option<String>,
-    ) -> impl std::future::Future<Output = Result<Vec<User>, BoxedError>> + Send;
+    ) -> impl Future<Output = Result<Vec<User>, BoxedError>> + Send;
 }
diff --git a/src/db/memory.rs b/src/db/memory.rs
index e170db0..4ef39e4 100644
--- a/src/db/memory.rs
+++ b/src/db/memory.rs
@@ -1,13 +1,14 @@
-use std::future::{Future, ready};
+use serde::{Deserialize, Serialize};
+
+use std::future::ready;
 
 use crate::db::error::{BoxedError, DomainCreationError, UserCreationError};
 use crate::db::{Database, DatabaseInterface, Domain, Group, Operation, User, UserRef};
 
-#[derive(Clone, Debug, Default)]
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
 pub struct MemoryDatabase {
     // We store data in tables like in SQL
     pub domains: Vec<Domain>,
-    #[expect(unused)]
     pub groups: Vec<Group>,
     pub users: Vec<User>,
 }
diff --git a/src/db/mod.rs b/src/db/mod.rs
index c2544e0..902e89c 100644
--- a/src/db/mod.rs
+++ b/src/db/mod.rs
@@ -3,6 +3,8 @@ pub use common::Database;
 mod domain;
 pub use domain::Domain;
 pub mod error;
+mod filesystem;
+pub use filesystem::FilesystemDatabase;
 mod group;
 pub use group::Group;
 mod interface;
diff --git a/src/db/role.rs b/src/db/role.rs
index 102933b..37f6b51 100644
--- a/src/db/role.rs
+++ b/src/db/role.rs
@@ -1,4 +1,4 @@
-use serde::Serialize;
+use serde::{Deserialize, Serialize};
 
 #[derive(Clone, Debug)]
 pub enum Operation {
@@ -7,12 +7,11 @@ pub enum Operation {
     ListUsers(Option<String>),
 }
 
-#[derive(Clone, Debug, PartialEq, Serialize)]
+#[derive(Clone, Debug, PartialEq, Deserialize, Serialize)]
 pub enum Role {
     /// Can do anything
     Admin,
     /// Can only read data across all vhosts
-    #[expect(unused)]
     ReadonlyAdmin,
     /// Can do anything on a domain, except removing
     /// oneself as a domain admin.
@@ -20,7 +19,6 @@ pub enum Role {
     /// Can not give away roles other than DomainModerator/User
     DomainAdmin(String),
     /// Can create users and reset passwords on a domain
-    #[expect(unused)]
     DomainModerator(String),
     /// Can only edit own profile
     User,
diff --git a/src/db/user.rs b/src/db/user.rs
index b7c8bcd..ba9e986 100644
--- a/src/db/user.rs
+++ b/src/db/user.rs
@@ -1,4 +1,4 @@
-use serde::Serialize;
+use serde::{Deserialize, Serialize};
 
 use std::fmt;
 
@@ -54,7 +54,7 @@ impl fmt::Display for UserRef {
     }
 }
 
-#[derive(Clone, Debug, Serialize)]
+#[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct User {
     /// Username, without the domain part. Once set, cannot be edited.
     pub username: String,
diff --git a/src/main.rs b/src/main.rs
index cb6ee76..91a8415 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -12,7 +12,7 @@ mod stream;
 #[cfg(feature = "http")]
 use crate::http::http_listen;
 use cli::CliArgs;
-use db::{Database, DatabaseInterface, MemoryDatabase, Role, User};
+use db::{Database, DatabaseInterface, FilesystemDatabase, MemoryDatabase, Role, User};
 use error::GlobalError;
 use ldap::ldap_handler;
 use listener::ListenerPath;
@@ -69,6 +69,11 @@ async fn main() -> Result<(), GlobalError> {
 
     let ldap_listener = ListenerPath::new(&cli.listen_ldap)?.listener().await?;
 
+    // let mut db = if let Some(db_path) = &cli.db {
+    //     FilesystemDatabase::from_path(db_path).await.unwrap()
+    // } else {
+    //     MemoryDatabase::new()
+    // };
     let mut db = MemoryDatabase::new();
     create_dummy_users(&mut db).await;
 

From ccbd97b8362b52fa344621b0b844a1df97a37f7d Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Sat, 19 Sep 2026 14:39:01 +0200
Subject: [PATCH 19/20] feat: Type-erase Database backend for simpler code

---
 Cargo.lock            | 12 ++++++++++
 Cargo.toml            |  1 +
 src/db/common.rs      | 12 +++++-----
 src/db/filesystem.rs  | 29 ++++++++++--------------
 src/db/interface.rs   | 33 +++++++++++----------------
 src/db/memory.rs      | 52 ++++++++++++++++++-------------------------
 src/http/domain.rs    |  8 +++----
 src/http/home.rs      |  4 ++--
 src/http/login.rs     | 12 +++++-----
 src/http/logout.rs    |  5 ++---
 src/http/mod.rs       | 12 +++++-----
 src/http/session.rs   | 10 ++++-----
 src/http/user.rs      |  4 ++--
 src/ldap/handler.rs   |  8 +++----
 src/ldap/op/bind.rs   |  6 ++---
 src/ldap/op/search.rs |  4 ++--
 src/main.rs           | 13 +++++------
 17 files changed, 108 insertions(+), 117 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 642d24c..bd10531 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -39,6 +39,17 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "async-trait"
+version = "0.1.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
@@ -523,6 +534,7 @@ name = "llldap"
 version = "0.1.0"
 dependencies = [
  "argh",
+ "async-trait",
  "axum",
  "axum-extra",
  "camino",
diff --git a/Cargo.toml b/Cargo.toml
index 2d31050..07c7928 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,6 +5,7 @@ edition = "2024"
 
 [dependencies]
 argh = "0.1.19"
+async-trait = "0.1.92"
 axum = { version = "0.8.9", optional = true, features = ["macros"] }
 axum-extra = { version = "0.12.6", features = ["cookie"], optional = true }
 camino = { version = "1.2.5", features = ["serde1"] }
diff --git a/src/db/common.rs b/src/db/common.rs
index f7408c6..3a5f655 100644
--- a/src/db/common.rs
+++ b/src/db/common.rs
@@ -6,19 +6,19 @@ use crate::db::error::BoxedError;
 use crate::db::{DatabaseInterface, Domain, User, UserRef};
 
 #[derive(Clone, Debug)]
-pub struct Database<D: DatabaseInterface> {
-    pub inner: Arc<RwLock<D>>,
+pub struct Database {
+    pub inner: Arc<RwLock<Box<dyn DatabaseInterface>>>,
 }
 
-impl<D: DatabaseInterface> Database<D> {
-    pub fn new(db: D) -> Self {
+impl Database {
+    pub fn new(db: impl DatabaseInterface) -> Self {
         Self {
-            inner: Arc::new(RwLock::new(db)),
+            inner: Arc::new(RwLock::new(Box::new(db))),
         }
     }
 }
 
-impl<D: DatabaseInterface> Database<D> {
+impl Database {
     /// Return false if the user doesn't exist, or the password is wrong.
     ///
     /// TODO: should we return something else when the account doesn't exist?
diff --git a/src/db/filesystem.rs b/src/db/filesystem.rs
index 71fef14..2cdb435 100644
--- a/src/db/filesystem.rs
+++ b/src/db/filesystem.rs
@@ -45,7 +45,7 @@ pub struct FilesystemDatabase {
 }
 
 impl FilesystemDatabase {
-    pub async fn from_path(path: impl AsRef<Utf8Path>) -> Result<Database<Self>, BoxedError> {
+    pub async fn from_path(path: impl AsRef<Utf8Path>) -> Result<Database, BoxedError> {
         let path = path.as_ref();
         let s = tokio::fs::read(path)
             .await
@@ -67,6 +67,7 @@ impl FilesystemDatabase {
     }
 }
 
+#[async_trait::async_trait]
 impl DatabaseInterface for FilesystemDatabase {
     async fn create_domain(
         &mut self,
@@ -84,15 +85,12 @@ impl DatabaseInterface for FilesystemDatabase {
         Ok(Ok(()))
     }
 
-    fn get_domain(&self, domain: &str) -> impl Future<Output = Result<Option<Domain>, BoxedError>> {
-        self.inner.get_domain(domain)
+    async fn get_domain(&self, domain: &str) -> Result<Option<Domain>, BoxedError> {
+        self.inner.get_domain(domain).await
     }
 
-    fn get_user(
-        &self,
-        req_user: &UserRef,
-    ) -> impl Future<Output = Result<Option<User>, BoxedError>> {
-        self.inner.get_user(req_user)
+    async fn get_user(&self, req_user: &UserRef) -> Result<Option<User>, BoxedError> {
+        self.inner.get_user(req_user).await
     }
 
     async fn create_user(
@@ -128,18 +126,15 @@ impl DatabaseInterface for FilesystemDatabase {
         Ok(Ok(()))
     }
 
-    fn list_all_domains(&self) -> impl Future<Output = Result<Vec<Domain>, BoxedError>> {
-        self.inner.list_all_domains()
+    async fn list_all_domains(&self) -> Result<Vec<Domain>, BoxedError> {
+        self.inner.list_all_domains().await
     }
 
-    fn list_all_users(&self) -> impl Future<Output = Result<Vec<User>, BoxedError>> {
-        self.inner.list_all_users()
+    async fn list_all_users(&self) -> Result<Vec<User>, BoxedError> {
+        self.inner.list_all_users().await
     }
 
-    fn list_domain_users(
-        &self,
-        domain: Option<String>,
-    ) -> impl Future<Output = Result<Vec<User>, BoxedError>> {
-        self.inner.list_domain_users(domain)
+    async fn list_domain_users(&self, domain: Option<String>) -> Result<Vec<User>, BoxedError> {
+        self.inner.list_domain_users(domain).await
     }
 }
diff --git a/src/db/interface.rs b/src/db/interface.rs
index c434ec5..6115f39 100644
--- a/src/db/interface.rs
+++ b/src/db/interface.rs
@@ -1,7 +1,8 @@
 use crate::db::error::{BoxedError, DomainCreationError, UserCreationError};
 use crate::db::{Database, Domain, User, UserRef};
 
-impl<D: DatabaseInterface> DatabaseInterface for Database<D> {
+#[async_trait::async_trait]
+impl DatabaseInterface for Database {
     async fn create_domain(
         &mut self,
         domain: &str,
@@ -49,39 +50,31 @@ impl<D: DatabaseInterface> DatabaseInterface for Database<D> {
     }
 }
 
-pub trait DatabaseInterface: Clone + Send + Sync + 'static {
-    fn create_domain(
+#[async_trait::async_trait]
+pub trait DatabaseInterface: std::fmt::Debug + Send + Sync + 'static {
+    async fn create_domain(
         &mut self,
         domain: &str,
-    ) -> impl Future<Output = Result<Result<(), DomainCreationError>, BoxedError>> + Send;
-    fn get_domain(
-        &self,
-        domain: &str,
-    ) -> impl Future<Output = Result<Option<Domain>, BoxedError>> + Send;
+    ) -> Result<Result<(), DomainCreationError>, BoxedError>;
+    async fn get_domain(&self, domain: &str) -> Result<Option<Domain>, BoxedError>;
 
-    fn get_user(
-        &self,
-        user: &UserRef,
-    ) -> impl Future<Output = Result<Option<User>, BoxedError>> + Send;
+    async fn get_user(&self, user: &UserRef) -> Result<Option<User>, BoxedError>;
     async fn create_user(
         &mut self,
         user: User,
     ) -> Result<Result<(), UserCreationError>, BoxedError>;
-    fn try_create_user(
+    async fn try_create_user(
         &mut self,
         new_user: User,
         current_user: &User,
-    ) -> impl Future<Output = Result<Result<(), UserCreationError>, BoxedError>> + Send;
+    ) -> Result<Result<(), UserCreationError>, BoxedError>;
 
-    fn list_all_domains(&self) -> impl Future<Output = Result<Vec<Domain>, BoxedError>> + Send;
+    async fn list_all_domains(&self) -> Result<Vec<Domain>, BoxedError>;
     #[expect(unused)]
-    fn list_all_users(&self) -> impl Future<Output = Result<Vec<User>, BoxedError>> + Send;
+    async fn list_all_users(&self) -> Result<Vec<User>, BoxedError>;
 
     /// List users on a specific domain.
     ///
     /// A `None` domain requested lists global service users.
-    fn list_domain_users(
-        &self,
-        domain: Option<String>,
-    ) -> impl Future<Output = Result<Vec<User>, BoxedError>> + Send;
+    async fn list_domain_users(&self, domain: Option<String>) -> Result<Vec<User>, BoxedError>;
 }
diff --git a/src/db/memory.rs b/src/db/memory.rs
index 4ef39e4..bae3c8e 100644
--- a/src/db/memory.rs
+++ b/src/db/memory.rs
@@ -1,7 +1,5 @@
 use serde::{Deserialize, Serialize};
 
-use std::future::ready;
-
 use crate::db::error::{BoxedError, DomainCreationError, UserCreationError};
 use crate::db::{Database, DatabaseInterface, Domain, Group, Operation, User, UserRef};
 
@@ -14,52 +12,49 @@ pub struct MemoryDatabase {
 }
 
 impl MemoryDatabase {
-    pub fn new() -> Database<Self> {
+    #[allow(clippy::new_ret_no_self)]
+    pub fn new() -> Database {
         Database::new(Self::default())
     }
 }
 
+#[async_trait::async_trait]
 impl DatabaseInterface for MemoryDatabase {
-    fn create_domain(
+    async fn create_domain(
         &mut self,
         domain: &str,
-    ) -> impl Future<Output = Result<Result<(), DomainCreationError>, BoxedError>> {
+    ) -> Result<Result<(), DomainCreationError>, BoxedError> {
         if domain.is_empty() {
-            return ready(Ok(Err(DomainCreationError::InvalidDomain(
-                domain.to_string(),
-            ))));
+            return Ok(Err(DomainCreationError::InvalidDomain(domain.to_string())));
         }
 
         if self.domains.iter().find(|d| d.name == domain).is_some() {
-            return ready(Ok(Err(DomainCreationError::DomainAlreadyExists(
+            return Ok(Err(DomainCreationError::DomainAlreadyExists(
                 domain.to_string(),
-            ))));
+            )));
         }
 
         self.domains.push(Domain {
             name: domain.to_string(),
         });
 
-        ready(Ok(Ok(())))
+        Ok(Ok(()))
     }
 
-    fn get_domain(&self, domain: &str) -> impl Future<Output = Result<Option<Domain>, BoxedError>> {
+    async fn get_domain(&self, domain: &str) -> Result<Option<Domain>, BoxedError> {
         let Some(domain) = self.domains.iter().find(|d| d.name == domain) else {
-            return ready(Ok(None));
+            return Ok(None);
         };
 
-        ready(Ok(Some(domain.clone())))
+        Ok(Some(domain.clone()))
     }
 
-    fn get_user(
-        &self,
-        req_user: &UserRef,
-    ) -> impl Future<Output = Result<Option<User>, BoxedError>> {
-        ready(Ok(self
+    async fn get_user(&self, req_user: &UserRef) -> Result<Option<User>, BoxedError> {
+        Ok(self
             .users
             .iter()
             .find(|u| u.username == req_user.username && u.domain == req_user.domain)
-            .cloned()))
+            .cloned())
     }
 
     async fn create_user(
@@ -104,23 +99,20 @@ impl DatabaseInterface for MemoryDatabase {
         self.create_user(new_user).await
     }
 
-    fn list_all_domains(&self) -> impl Future<Output = Result<Vec<Domain>, BoxedError>> {
-        ready(Ok(self.domains.clone()))
+    async fn list_all_domains(&self) -> Result<Vec<Domain>, BoxedError> {
+        Ok(self.domains.clone())
     }
 
-    fn list_all_users(&self) -> impl Future<Output = Result<Vec<User>, BoxedError>> {
-        ready(Ok(self.users.clone()))
+    async fn list_all_users(&self) -> Result<Vec<User>, BoxedError> {
+        Ok(self.users.clone())
     }
 
-    fn list_domain_users(
-        &self,
-        domain: Option<String>,
-    ) -> impl Future<Output = Result<Vec<User>, BoxedError>> {
-        ready(Ok(self
+    async fn list_domain_users(&self, domain: Option<String>) -> Result<Vec<User>, BoxedError> {
+        Ok(self
             .users
             .iter()
             .filter(|u| u.domain == domain)
             .cloned()
-            .collect()))
+            .collect())
     }
 }
diff --git a/src/http/domain.rs b/src/http/domain.rs
index 1acfdbb..4c05af0 100644
--- a/src/http/domain.rs
+++ b/src/http/domain.rs
@@ -7,8 +7,8 @@ use serde::Deserialize;
 use crate::db::{DatabaseInterface, Operation};
 use crate::http::{HttpSession, HttpState};
 
-pub async fn get_domain<D: DatabaseInterface>(
-    State(state): State<HttpState<D>>,
+pub async fn get_domain(
+    State(state): State<HttpState>,
     session: HttpSession,
     Path(domain): Path<String>,
 ) -> Response {
@@ -53,8 +53,8 @@ pub struct DomainCreationForm {
     domainname: String,
 }
 
-pub async fn create_domain<D: DatabaseInterface>(
-    State(mut state): State<HttpState<D>>,
+pub async fn create_domain(
+    State(mut state): State<HttpState>,
     session: HttpSession,
     Form(form): Form<DomainCreationForm>,
 ) -> Response {
diff --git a/src/http/home.rs b/src/http/home.rs
index febb6b0..32802b0 100644
--- a/src/http/home.rs
+++ b/src/http/home.rs
@@ -6,8 +6,8 @@ use minijinja::context;
 use crate::db::{DatabaseInterface, Operation};
 use crate::http::{HttpSession, HttpState};
 
-pub async fn home<D: DatabaseInterface>(
-    State(state): State<HttpState<D>>,
+pub async fn home(
+    State(state): State<HttpState>,
     // Only logged in users are allowed here
     session: HttpSession,
 ) -> Response {
diff --git a/src/http/login.rs b/src/http/login.rs
index 8b4a26d..578b5ff 100644
--- a/src/http/login.rs
+++ b/src/http/login.rs
@@ -20,8 +20,8 @@ pub enum LoginError {
     SessionInvalidated,
 }
 
-pub async fn login_page<D: DatabaseInterface>(
-    State(state): State<HttpState<D>>,
+pub async fn login_page(
+    State(state): State<HttpState>,
     login_error: Option<LoginError>,
 ) -> Response {
     let page = state
@@ -33,8 +33,8 @@ pub async fn login_page<D: DatabaseInterface>(
     (StatusCode::OK, Html(page)).into_response()
 }
 
-pub async fn get_login<D: DatabaseInterface>(
-    State(state): State<HttpState<D>>,
+pub async fn get_login(
+    State(state): State<HttpState>,
     maybe_session: Option<OptionalHttpSession>,
 ) -> Response {
     if maybe_session.is_some() {
@@ -44,8 +44,8 @@ pub async fn get_login<D: DatabaseInterface>(
     login_page(State(state), None).await
 }
 
-pub async fn post_login<D: DatabaseInterface>(
-    State(state): State<HttpState<D>>,
+pub async fn post_login(
+    State(state): State<HttpState>,
     session: Option<OptionalHttpSession>,
     cookies: CookieJar,
     Form(form): Form<LoginForm>,
diff --git a/src/http/logout.rs b/src/http/logout.rs
index c742074..3dc5151 100644
--- a/src/http/logout.rs
+++ b/src/http/logout.rs
@@ -2,12 +2,11 @@ use axum::extract::State;
 use axum::response::{IntoResponse, Redirect, Response};
 use axum_extra::extract::cookie::CookieJar;
 
-use crate::db::DatabaseInterface;
 use crate::http::login::{LoginError, login_page};
 use crate::http::{HttpState, OptionalHttpSession};
 
-pub async fn logout<D: DatabaseInterface>(
-    State(state): State<HttpState<D>>,
+pub async fn logout(
+    State(state): State<HttpState>,
     session: Option<OptionalHttpSession>,
     cookies: CookieJar,
 ) -> Response {
diff --git a/src/http/mod.rs b/src/http/mod.rs
index 17c9448..daf1507 100644
--- a/src/http/mod.rs
+++ b/src/http/mod.rs
@@ -9,7 +9,7 @@ use static_serve::embed_assets;
 #[cfg(not(feature = "embed"))]
 use tower_http::services::ServeDir;
 
-use crate::db::{Database, DatabaseInterface};
+use crate::db::Database;
 use crate::listener::{Listener, ListenerKind};
 use crate::stream::{AbstractSocketAddr, AbstractStreamKind};
 
@@ -62,14 +62,14 @@ impl AxumListener for Listener {
 }
 
 #[derive(Clone)]
-pub struct HttpState<D: DatabaseInterface> {
-    pub db: Database<D>,
+pub struct HttpState {
+    pub db: Database,
     pub sessions: HttpSessionManager,
     pub templates: Environment<'static>,
 }
 
-impl<D: DatabaseInterface> HttpState<D> {
-    pub fn new(db: Database<D>) -> Self {
+impl HttpState {
+    pub fn new(db: Database) -> Self {
         let mut templates = Environment::new();
         #[cfg(feature = "embed")]
         minijinja_embed::load_templates!(&mut templates);
@@ -83,7 +83,7 @@ impl<D: DatabaseInterface> HttpState<D> {
     }
 }
 
-pub async fn http_listen<D: DatabaseInterface>(listener: Listener, db: Database<D>) {
+pub async fn http_listen(listener: Listener, db: Database) {
     #[cfg(all(feature = "embed", feature = "noembed"))]
     compile_error!("You cannot have `embed` and `noembed` features enabled at the same time.");
     #[cfg(not(any(feature = "embed", feature = "noembed")))]
diff --git a/src/http/session.rs b/src/http/session.rs
index 5005b8c..1f88874 100644
--- a/src/http/session.rs
+++ b/src/http/session.rs
@@ -6,7 +6,7 @@ use uuid::Uuid;
 
 use std::sync::{Arc, RwLock};
 
-use crate::db::{DatabaseInterface, User};
+use crate::db::User;
 use crate::http::HttpState;
 
 pub const COOKIE_NAME: &str = "lldap_session";
@@ -83,12 +83,12 @@ impl PartialEq<HttpSession> for HttpSession {
     }
 }
 
-impl<D: DatabaseInterface> FromRequestParts<HttpState<D>> for HttpSession {
+impl FromRequestParts<HttpState> for HttpSession {
     type Rejection = Redirect;
 
     async fn from_request_parts(
         parts: &mut Parts,
-        state: &HttpState<D>,
+        state: &HttpState,
     ) -> Result<Self, Self::Rejection> {
         let cookies = CookieJar::from_request_parts(parts, state).await.unwrap();
         state
@@ -108,12 +108,12 @@ impl std::ops::Deref for OptionalHttpSession {
     }
 }
 
-impl<D: DatabaseInterface> OptionalFromRequestParts<HttpState<D>> for OptionalHttpSession {
+impl OptionalFromRequestParts<HttpState> for OptionalHttpSession {
     type Rejection = Redirect;
 
     async fn from_request_parts(
         parts: &mut Parts,
-        state: &HttpState<D>,
+        state: &HttpState,
     ) -> Result<Option<Self>, Self::Rejection> {
         let maybe_session = HttpSession::from_request_parts(parts, state)
             .await
diff --git a/src/http/user.rs b/src/http/user.rs
index 2d0d385..00fd976 100644
--- a/src/http/user.rs
+++ b/src/http/user.rs
@@ -12,8 +12,8 @@ pub struct UserCreationForm {
     pub password: String,
 }
 
-pub async fn create_user<D: DatabaseInterface>(
-    State(mut state): State<HttpState<D>>,
+pub async fn create_user(
+    State(mut state): State<HttpState>,
     session: HttpSession,
     Form(form): Form<UserCreationForm>,
 ) -> Response {
diff --git a/src/ldap/handler.rs b/src/ldap/handler.rs
index 32d2ac0..084cfa5 100644
--- a/src/ldap/handler.rs
+++ b/src/ldap/handler.rs
@@ -1,13 +1,13 @@
 use ldap3_proto::LdapMsg;
 use ldap3_proto::proto::LdapOp;
 
-use crate::db::{Database, DatabaseInterface};
+use crate::db::Database;
 use crate::ldap::{
     LdapClientState, LdapStream, LdapStreamError, op_bind, op_ext, search_by_mail_filter,
 };
 
 #[tracing::instrument(name = "ldap", skip(stream, db), fields(session = %stream.session))]
-pub async fn ldap_handler<D: DatabaseInterface>(mut stream: LdapStream, mut db: Database<D>) {
+pub async fn ldap_handler(mut stream: LdapStream, mut db: Database) {
     tracing::info! {
         remote_addr = ?stream.remote_addr,
         "New client connection"
@@ -45,11 +45,11 @@ pub async fn ldap_handler<D: DatabaseInterface>(mut stream: LdapStream, mut db:
 
 /// Return true to keep the connection going, false to close it.
 #[tracing::instrument(name = "ldap-handler", skip(client_state, db, stream))]
-pub async fn ldap_handler_inner<D: DatabaseInterface>(
+pub async fn ldap_handler_inner(
     stream: &mut LdapStream,
     msg: LdapMsg,
     client_state: &mut LdapClientState,
-    db: &mut Database<D>,
+    db: &mut Database,
 ) -> Result<bool, LdapStreamError> {
     tracing::debug!(msg = ?msg, "Received LDAP message");
     match msg {
diff --git a/src/ldap/op/bind.rs b/src/ldap/op/bind.rs
index fabdfa6..144efaa 100644
--- a/src/ldap/op/bind.rs
+++ b/src/ldap/op/bind.rs
@@ -2,7 +2,7 @@ use ldap3_proto::proto::{LdapBindCred, LdapBindRequest, LdapBindResponse, LdapOp
 use ldap3_proto::{LdapMsg, LdapResultCode};
 
 use crate::db::error::BoxedError;
-use crate::db::{Database, DatabaseInterface, UserRef};
+use crate::db::{Database, UserRef};
 use crate::ldap::{Dn, LdapReturnError, LdapStream, LdapStreamError, MalformedDn};
 
 #[derive(Debug)]
@@ -165,9 +165,9 @@ pub async fn bind_success(stream: &mut LdapStream, msgid: i32) -> Result<(), Lda
 ///
 /// On success, returns `Ok(Some(bound_dn))`. `Ok(None)` means credentials failed,
 /// either because the account does not exist, or the password is wrong.
-pub async fn op_bind<D: DatabaseInterface>(
+pub async fn op_bind(
     stream: &mut LdapStream,
-    db: &Database<D>,
+    db: &Database,
     req: LdapBindRequest,
     msgid: i32,
 ) -> Result<Option<BindDn>, LdapStreamError> {
diff --git a/src/ldap/op/search.rs b/src/ldap/op/search.rs
index 9182fdb..d881508 100644
--- a/src/ldap/op/search.rs
+++ b/src/ldap/op/search.rs
@@ -174,9 +174,9 @@ fn search_entry_from_user(user: &User, req_attrs: &[String]) -> LdapSearchResult
     }
 }
 
-pub async fn search_by_mail_filter<D: DatabaseInterface>(
+pub async fn search_by_mail_filter(
     stream: &mut LdapStream,
-    db: &Database<D>,
+    db: &Database,
     sr: LdapSearchRequest,
     msgid: i32,
 ) -> Result<(), LdapStreamError> {
diff --git a/src/main.rs b/src/main.rs
index 91a8415..ac42c60 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -17,7 +17,7 @@ use error::GlobalError;
 use ldap::ldap_handler;
 use listener::ListenerPath;
 
-async fn create_dummy_users<D: DatabaseInterface>(db: &mut Database<D>) {
+async fn create_dummy_users(db: &mut Database) {
     db.create_user(User {
         username: "admin".to_string(),
         domain: None,
@@ -69,12 +69,11 @@ async fn main() -> Result<(), GlobalError> {
 
     let ldap_listener = ListenerPath::new(&cli.listen_ldap)?.listener().await?;
 
-    // let mut db = if let Some(db_path) = &cli.db {
-    //     FilesystemDatabase::from_path(db_path).await.unwrap()
-    // } else {
-    //     MemoryDatabase::new()
-    // };
-    let mut db = MemoryDatabase::new();
+    let mut db = if let Some(db_path) = &cli.db {
+        FilesystemDatabase::from_path(db_path).await.unwrap()
+    } else {
+        MemoryDatabase::new()
+    };
     create_dummy_users(&mut db).await;
 
     #[cfg(feature = "http")]

From c35bfaeaf8871acdada05d9244d3d92972d5a950 Mon Sep 17 00:00:00 2001
From: selfhoster1312 <selfhoster1312@kl.netlib.re>
Date: Sat, 19 Sep 2026 14:42:55 +0200
Subject: [PATCH 20/20] fix: Initialize DB when it doesn't exist

---
 src/db/filesystem.rs | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/db/filesystem.rs b/src/db/filesystem.rs
index 2cdb435..9074822 100644
--- a/src/db/filesystem.rs
+++ b/src/db/filesystem.rs
@@ -47,6 +47,22 @@ pub struct FilesystemDatabase {
 impl FilesystemDatabase {
     pub async fn from_path(path: impl AsRef<Utf8Path>) -> Result<Database, BoxedError> {
         let path = path.as_ref();
+
+        if !tokio::fs::try_exists(path)
+            .await
+            .map_err(|e| Box::new(FilesystemDatabaseError::ReadFileIO(path.to_path_buf(), e)))?
+        {
+            // The database doesn't exist yet, we create an empty one and try to write it
+            // to make sure the permissions are correct and the destination folder exists.
+            let mut db = Self {
+                inner: MemoryDatabase::default(),
+                path: path.to_path_buf(),
+            };
+
+            db.save().await?;
+            return Ok(Database::new(db));
+        }
+
         let s = tokio::fs::read(path)
             .await
             .map_err(|e| Box::new(FilesystemDatabaseError::ReadFileIO(path.to_path_buf(), e)))?;