Convert Permissions/Users/Groups pages to table layouts

- Permissions: table with Subject, Scope, Domain, Role, Actions columns
- Users: table with Username, Auth Type, Password, Actions columns; per-field validation errors
- Groups: auto-refresh after create/remove operations

CHANGELOG.md

@@ -6,6 +6,15 @@ correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
 ## [Unreleased]
 
+## [1.9.0] - 2026-07-30
+
+### Added
+- **`app_super_admin` cross-app group** recognized as a global admin (`conf.auth.adminGroups`), same group also recognized by sso-manager-node and jump-host, and by `ldap-client`'s SSSD access filter (SSH login on every host).
+
+### Changed
+- **Users and Permissions pages**: the always-visible sidebar "Add" forms are now an "Add User"/"Add Permission" button in the list header that opens an `app.modal` dialog, matching the hosts.ejs convention.
+- **Let's Encrypt ACME account key** now defaults to the already-persisted `/data` volume instead of a CWD-relative path (`./le_key.cert` -> `/app/le_key.cert` in the container), which was lost on every image rebuild.
+
 ## [1.8.0] - 2026-07-28
 
 ### Added

config/proxy-secrets.js

@@ -0,0 +1,86 @@
+'use strict';
+
+// Example secrets configuration for the theta42/proxy.
+//
+// The proxy is an OIDC client of an SSO Manager (or any OIDC provider) AND a
+// direct LDAP client for user lookups. This file supplies that wiring.
+//
+// Docker / unified stack: place at ./config/proxy-secrets.js and bind-mount
+// ./config at /config (see docker-compose.yml); docker-entrypoint.sh points the
+// CONF_SECRETS env var at it so @simpleworkjs/conf reads it. No app_* env
+// should be passed — app_* env beats this file in @simpleworkjs/conf, so the
+// file is authoritative only if the matching app_* env is absent.
+//
+// Bare-metal: ops/install.sh seeds this file at /etc/proxy/secrets.js on first
+// run (with placeholders for the values it can't guess) and points the
+// systemd unit's CONF_SECRETS env var at it. Fill in your values, then
+// `sudo systemctl restart proxy`. Values here override conf/base.js and win
+// over <environment>.js.
+//
+// Only the keys the app reads are listed below. The `stack` key is read by the
+// theta-env orchestrator (setup.sh) and ignored by the app.
+
+module.exports = {
+    name: 'Dynamic Proxy',                // shown in the UI
+    logo: '/static/img/theta42.svg',      // nav image; point at your own file under public/ to white-label
+
+    // OpenID Connect — point at your SSO Manager. Issuer + authorization/
+    // endSession are browser-facing URLs; token/userinfo can be the internal
+    // URL if the SSO is on the same docker network (avoids a TLS hairpin).
+    oidc: {
+        enabled: true,
+        issuer: 'https://sso.example.com',
+        authorizationEndpoint: 'https://sso.example.com/oauth/authorize',
+        tokenEndpoint: 'http://sso-manager:3001/oauth/token',
+        userinfoEndpoint: 'http://sso-manager:3001/oauth/userinfo',
+        endSessionEndpoint: 'https://sso.example.com/oauth/logout',
+        clientId: '391136c8-9631-47c4-aac6-d6b760b7a9ae',   // registered on the SSO
+        clientSecret: 'b29cce9c-de0c-4acc-b76a-494168f0381d', // from the SSO client record
+        redirectUri: 'https://proxy.example.com/api/auth/oidc/callback',
+        scopes: ['openid', 'profile', 'email', 'groups'],
+        groupsClaim: 'groups',
+        usernameClaim: 'preferred_username',
+    },
+
+    // Direct LDAP user lookups. ldaps:// + rejectUnauthorized:false for a
+    // self-signed cert (the SSO's default), or set tlsOptions.ca to a CA path
+    // for strict verification. bindPassword MUST match the
+    // serviceAccountPass in the SSO's sso-secrets.js (the proxy binds as that
+    // service account).
+    ldap: {
+        url: 'ldaps://sso-manager:636',
+        bindDN: 'cn=ldapclient,ou=people,dc=example,dc=com',
+        bindPassword: 'proxy-service-pass',
+        searchBase: 'ou=people,dc=example,dc=com',
+        userFilter: '(objectClass=inetOrgPerson)',
+        userNameAttribute: 'uid',
+        tlsOptions: {
+            rejectUnauthorized: false,            // true + ca for a CA-signed cert
+        },
+    },
+
+    // Authorization. adminUsers is the local anti-lockout admin (matches
+    // auth.adminUsers in conf/base.js). adminGroups: SSO/LDAP groups whose
+    // members are always global admins.
+    auth: {
+        adminGroups: [],
+        adminUsers: ['proxyadmin'],
+        groupRoleMap: {},
+        // Optional: the local anti-lockout admin's initial password, used
+        // ONLY the first time that account is created. Leave unset and it
+        // defaults to the username itself ("proxyadmin2") — fine for a quick
+        // local test, but change it (or set this) before exposing the proxy
+        // publicly. Once the account exists, this key is never read again;
+        // change the password via the app itself (or delete the Redis user
+        // to force it to be re-bootstrapped with a new value here).
+        localAdminPass: 'proxyadmin-test-pass',
+    },
+
+    // ── Orchestrator-only (ignored by the app) ───────────────────────────────
+    // Read by the theta-env setup.sh (e.g. to seed the OAuth client). Omit for
+    // bare-metal use.
+    stack: {
+        ssoHost: 'sso.example.com',               // public SSO hostname
+        proxyHost: 'proxy.example.com',            // public proxy hostname
+    },
+};

nodejs/conf/base.js

@@ -49,7 +49,8 @@ module.exports = {
 	// Per-user overrides are Grant records managed in the app.
 	auth: {
 		// Members of these SSO/LDAP groups are always global admins.
-		adminGroups: [],
+		// app_super_admin is the cross-app super admin group (sso, proxy, jump-host).
+		adminGroups: ['app_super_admin'],
 		// Optional default role mapping for groups, e.g.
 		//   { 'dns-team': { role: 'manager', scope: 'domain', domain: 'foo.com' } }
 		//   { 'proxy-viewers': { role: 'viewer', scope: 'global' } }

nodejs/models/host.js

@@ -9,10 +9,23 @@ const tldExtract = require('tld-extract').parse_host;
 const LetsEncrypt = require('../utils/letsencrypt');
 const conf = require('@simpleworkjs/conf');
 
+const fs = require('fs');
+const path = require('path');
+
+// Defaults to the same persisted volume Redis uses (/data, see
+// docker-entrypoint.sh's REDIS_DATA_DIR) instead of the old CWD-relative
+// default (./le_key.cert -> /app/le_key.cert), which lives in the
+// container's writable layer and was lost on every rebuild. Falls back to
+// the old relative path when /data isn't present (e.g. local dev outside
+// docker), so it stays writable there too.
+const dataDir = process.env.REDIS_DATA_DIR || '/data';
+const accountKeyPath = fs.existsSync(dataDir) ? path.join(dataDir, 'le_key.cert') : './le_key.cert';
+
 const letsEncrypt = new LetsEncrypt({
 	directoryUrl: conf.environment === "production" ?
 		LetsEncrypt.AcmeClient.directory.letsencrypt.production :
 		LetsEncrypt.AcmeClient.directory.letsencrypt.staging,
+	accountKeyPath,
 });
 
 class Host extends Table{

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "proxy-api",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "author": [
     {
       "name": "William Mantly",

nodejs/views/groups.ejs

@@ -33,6 +33,14 @@
 		});
 	}
 
+	function refreshGroups(){
+		$.scope.LocalGroup.empty();
+		app.group.list(function(error, data){
+			if(error) return app.messages.action(error, $.scope.LocalGroup.$this, 'danger');
+			for(let g of data.results) $.scope.LocalGroup.push(g);
+		});
+	}
+
 	function removeMember(group, username){
 		app.group.removeMember(group, username, function(error, data){
 			if(error) return app.messages.action(error, $.scope.LocalGroup.$this, 'danger');
@@ -68,12 +76,16 @@
 		app.subscribe(/^model:LocalGroup:create/, function(data){
 			$.scope.LocalGroup.remove(data.name);
 			$.scope.LocalGroup.unshift(data);
-		});
-		app.subscribe(/^model:LocalGroup:update/, function(data, topic){
-			$.scope.LocalGroup.update(topic.split(':')[3], data);
+			// Also refresh to ensure the full list is up to date
+			setTimeout(refreshGroups, 500);
 		});
 		app.subscribe(/^model:LocalGroup:remove/, function(data, topic){
 			$.scope.LocalGroup.remove(topic.split(':')[3]);
+			// Also refresh to ensure the full list is up to date
+			setTimeout(refreshGroups, 500);
+		});
+		app.subscribe(/^model:LocalGroup:update/, function(data, topic){
+			$.scope.LocalGroup.update(topic.split(':')[3], data);
 		});
 	});
 </script>

nodejs/views/permissions.ejs

@@ -9,12 +9,9 @@
 		font-weight: bold;
 		margin-bottom: 1px;
 	}
-	.card-title{
-		font-weight: bold;
-	}
-	.field-hint{
-		font-size: .8rem;
-	}
+	.card-title{ font-weight: bold; }
+	.member-pill{ cursor: default; }
+	.member-pill i{ cursor: pointer; }
 </style>
 
 <script type="text/javascript">
@@ -40,6 +37,50 @@
 		}
 	}
 
+	function permissionAddOpen(){
+		app.modal.open({title: 'Add Permission', bodyHtml:
+			'<form action="permission/" onsubmit="formAJAX(this)" evalAJAX="app.modal.close();">'
+			+   '<div class="form-group">'
+			+     '<label class="control-label">Subject type</label>'
+			+     '<select class="form-control" name="subjectType" onchange="subjectTypeChanged(this)">'
+			+       '<option value="user">User</option>'
+			+       '<option value="group">Group</option>'
+			+     '</select>'
+			+   '</div>'
+			+   '<div class="form-group">'
+			+     '<label class="control-label">Subject (username or group)</label>'
+			+     '<input type="text" class="form-control" name="subject" list="subjectUsers" placeholder="alice" autocomplete="off" />'
+			+   '</div>'
+			+   '<div class="form-group">'
+			+     '<label class="control-label">Scope</label>'
+			+     '<select class="form-control" name="scope">'
+			+       '<option value="domain">Domain</option>'
+			+       '<option value="global">Global</option>'
+			+     '</select>'
+			+   '</div>'
+			+   '<div class="form-group">'
+			+     '<label class="control-label">Domain (for domain scope)</label>'
+			+     '<input type="text" class="form-control" name="domain" placeholder="example.com" autocomplete="off" />'
+			+     '<div class="field-hint text-muted">'
+			+       'Wildcards: <code>*.example.com</code> matches one label, '
+			+       '<code>**.example.com</code> matches any depth (incl. the apex), '
+			+       '<code>**</code> matches every domain.'
+			+     '</div>'
+			+   '</div>'
+			+   '<div class="form-group">'
+			+     '<label class="control-label">Role</label>'
+			+     '<select class="form-control" name="role">'
+			+       '<option value="viewer">Viewer (read)</option>'
+			+       '<option value="manager">Manager (full over domain)</option>'
+			+       '<option value="admin">Admin (global only)</option>'
+			+     '</select>'
+			+   '</div>'
+			+   '<hr />'
+			+   '<button type="submit" class="btn btn-info">Add Permission</button>'
+			+ '</form>',
+		});
+	}
+
 	function removePermission(id){
 		app.permission.remove(id, function(error, data){
 			if(error) return app.messages.action(error, $.scope.Permission.$this, 'danger');
@@ -79,63 +120,7 @@
 <datalist id="subjectGroups"></datalist>
 
 <div class="row" style="display:none">
-	<div class="col-md-4">
-		<div class="card shadow-lg">
-
-			<div class="card-header text-center">
-				<span class="card-icon float-start">
-					<i class="fa-solid fa-user-shield"></i>
-				</span>
-				<span class="card-title">Add Permission</span>
-				<a href="/docs/access" class="text-reset float-end" title="Help"><i class="fa-solid fa-circle-question"></i></a>
-			</div>
-
-			<div class="card-header actionMessage" style="display:none"></div>
-			<div class="card-body">
-				<form action="permission/" onsubmit="formAJAX(this)">
-					<div class="form-group">
-						<label class="control-label">Subject type</label>
-						<select class="form-control" name="subjectType" onchange="subjectTypeChanged(this)">
-							<option value="user">User</option>
-							<option value="group">Group</option>
-						</select>
-					</div>
-					<div class="form-group">
-						<label class="control-label">Subject (username or group)</label>
-						<input type="text" class="form-control" name="subject" list="subjectUsers" placeholder="alice" autocomplete="off" />
-					</div>
-					<div class="form-group">
-						<label class="control-label">Scope</label>
-						<select class="form-control" name="scope">
-							<option value="domain">Domain</option>
-							<option value="global">Global</option>
-						</select>
-					</div>
-					<div class="form-group">
-						<label class="control-label">Domain (for domain scope)</label>
-						<input type="text" class="form-control" name="domain" placeholder="example.com" autocomplete="off" />
-						<div class="field-hint text-muted">
-							Wildcards: <code>*.example.com</code> matches one label,
-							<code>**.example.com</code> matches any depth (incl. the apex),
-							<code>**</code> matches every domain.
-						</div>
-					</div>
-					<div class="form-group">
-						<label class="control-label">Role</label>
-						<select class="form-control" name="role">
-							<option value="viewer">Viewer (read)</option>
-							<option value="manager">Manager (full over domain)</option>
-							<option value="admin">Admin (global only)</option>
-						</select>
-					</div>
-					<hr />
-					<button type="submit" class="btn btn-info">Add Permission</button>
-				</form>
-			</div>
-		</div>
-	</div>
-
-	<div class="col-md-8">
+	<div class="col-12">
 		<div class="card shadow-lg">
 
 			<div class="card-header text-center">
@@ -143,33 +128,48 @@
 					<i class="fa-solid fa-list-check"></i>
 				</span>
 				<span class="card-title">Permissions</span>
-				<a href="/docs/access" class="text-reset float-end" title="Help"><i class="fa-solid fa-circle-question"></i></a>
+				<span class="float-end">
+					<a href="/docs/access" class="text-reset me-2" title="Help"><i class="fa-solid fa-circle-question"></i></a>
+					<button type="button" class="btn btn-sm btn-success" onclick="permissionAddOpen()">
+						<i class="fa-solid fa-user-shield"></i>
+						Add Permission
+					</button>
+				</span>
 			</div>
 
 			<div class="card-header actionMessage" style="display:none"></div>
 			<div class="card-body">
-			<div class="row row-cols-1 row-cols-lg-2 g-3" id="permission-cards">
-				<div class="col" jq-repeat="Permission" jq-repeat-index="id" id="permission-row-{{id}}" style="display:none">
-					<div class="card shadow-sm h-100">
-						<div class="card-body">
-							<h6 class="mb-2">
-								<span class="badge text-bg-secondary">{{ subjectType }}</span>
-								{{ subject }}
-							</h6>
-							<dl class="row mb-2 small">
-								<dt class="col-4">Scope</dt><dd class="col-8">{{ scope }}</dd>
-								<dt class="col-4">Domain</dt><dd class="col-8">{{ domain }}</dd>
-								<dt class="col-4">Role</dt><dd class="col-8">{{ role }}</dd>
-							</dl>
-							<button type="button" class="btn btn-sm btn-danger" onclick="removePermission('{{id}}')">
-								<i class="fa-solid fa-trash"></i>
-								Delete
-							</button>
-						</div>
-					</div>
+				<div class="table-responsive">
+					<table class="table table-striped mb-0">
+						<thead>
+							<tr>
+								<th>Subject</th>
+								<th>Scope</th>
+								<th>Domain</th>
+								<th>Role</th>
+								<th class="text-end">Actions</th>
+							</tr>
+						</thead>
+						<tbody id="permission-cards">
+							<tr jq-repeat="Permission" jq-repeat-index="id" id="permission-row-{{id}}" style="display:none">
+								<td>
+									<span class="badge text-bg-secondary">{{ subjectType }}</span>
+									{{ subject }}
+								</td>
+								<td>{{ scope }}</td>
+								<td>{{ domain }}</td>
+								<td>{{ role }}</td>
+								<td class="text-end">
+									<button type="button" class="btn btn-sm btn-danger" onclick="removePermission('{{id}}')">
+										<i class="fa-solid fa-trash"></i>
+										Delete
+									</button>
+								</td>
+							</tr>
+						</tbody>
+					</table>
 				</div>
 			</div>
-			</div>
 		</div>
 	</div>
 </div>

nodejs/views/users.ejs

@@ -47,6 +47,52 @@
 		});
 	}
 
+	function userAddOpen(){
+		app.modal.open({title: 'Add New User', bodyHtml:
+			'<form action="user/" onsubmit="formAJAX(this)" evalAJAX="'
+			+ '$.scope.users.splice(0, 0, processUser(data));'
+			+ 'setTimeout(function(){ app.util.revealItem($(\'#user-row-\' + data.username)); }, 100);'
+			+ 'app.modal.close();'
+			+ '">'
+			+   '<input type="hidden" class="form-control" name="delete" value="false" />'
+			+   '<div class="form-group">'
+			+     '<label class="control-label">User-name</label>'
+			+     '<input type="text" class="form-control" name="username" placeholder="Letter, numbers, -, _, . and @ only" validate="user:3" />'
+			+     '<div class="invalid-feedback d-none" data-field-error="username"></div>'
+			+   '</div>'
+			+   '<div class="form-group">'
+			+     '<label class="control-label">Password</label>'
+			+     '<input type="password" class="form-control" name="password" placeholder="8+ chars; mix upper/lower/number/symbol (or 12+)" validate="password"/>'
+			+     '<div class="invalid-feedback d-none" data-field-error="password"></div>'
+			+   '</div>'
+			+   '<div class="form-group">'
+			+     '<label class="control-label">Again</label>'
+			+     '<input type="password" class="form-control" name="passwordMatch" placeholder="Retype password" validate="eq:password"/>'
+			+     '<div class="invalid-feedback d-none" data-field-error="passwordMatch"></div>'
+			+   '</div>'
+			+   '<hr />'
+			+   '<button type="submit" class="btn btn-info">Add</button>'
+			+ '</form>',
+		onValidationError: function(errors){
+			// Clear all field errors first
+			$('[data-field-error]').addClass('d-none').text('');
+			$('.form-control.is-invalid').removeClass('is-invalid');
+
+			// Show action message at top
+			let errorMsg = 'Please fix the following errors:';
+			for(let field in errors){
+				let $field = $('[name="' + field + '"]');
+				$field.addClass('is-invalid');
+				$field.siblings('[data-field-error]').removeClass('d-none').text(errors[field]);
+				errorMsg += ' ' + field + ': ' + errors[field] + ';';
+			}
+			$('.modal-body .actionMessage').first().length ?
+				$('.modal-body .actionMessage').first().text(errorMsg).removeClass('d-none').addClass('alert alert-danger') :
+				app.messages.action(errorMsg, $('.modal-body'), 'danger');
+		}
+		});
+	}
+
 	$(document).ready(function(){
 		populateUsers(); //populate the table
 
@@ -61,50 +107,7 @@
 </script>
 <div class="container mt-4">
 <div class="row" style="display:none">
-	<div class="col-md-4">
-		<div class="card shadow-lg">
-
-			<div class="card-header text-center">
-				<span class="card-icon float-start">
-					<i class="fa-solid fa-user-plus"></i>
-				</span>
-				<span class="card-title">
-					Add New User
-				</span>
-				<span class="float-end">
-					<a href="/docs/access" class="text-reset me-2" title="Help"><i class="fa-solid fa-circle-question"></i></a>
-					<i class="fa-solid fa-circle-minus"></i>
-				</span>
-			</div>
-
-			<div class="card-header actionMessage" style="display:none"></div>
-			<div class="card-body">
-				<form action="user/" onsubmit="formAJAX(this)" evalAJAX="
-					$.scope.users.splice(0, 0, processUser(data));
-					setTimeout(function(){ app.util.revealItem($('#user-row-' + data.username)); }, 100);
-				">
-					<input type="hidden" class="form-control" name="delete" value="false" />
-					<div class="form-group">
-						<label class="control-label">User-name</label>
-						<input type="text" class="form-control" name="username" placeholder="Letter, numbers, -, _, . and @ only" validate="user:3" />
-					</div>
-					<div class="form-group">
-						<label class="control-label">Password</label>
-						<input type="password" class="form-control" name="password" placeholder="8+ chars; mix upper/lower/number/symbol (or 12+)" validate="password"/>
-					</div>
-					<div class="form-group">
-						<label class="control-label">Again</label>
-						<input type="password" class="form-control" name="passwordMatch" placeholder="Retype password" validate="eq:password"/>
-					</div>
-					<hr />
-					<button type="submit" class="btn btn-info">
-						Add
-					</button>
-				</form>
-			</div>
-		</div>
-	</div>
-	<div class="col-md-8">
+	<div class="col-12">
 		<div class="card shadow-lg">
 
 			<div class="card-header text-center">
@@ -116,45 +119,62 @@
 				</span>
 				<span class="float-end">
 					<a href="/docs/access" class="text-reset me-2" title="Help"><i class="fa-solid fa-circle-question"></i></a>
-					<i class="fa-solid fa-circle-minus"></i>
+					<button type="button" class="btn btn-sm btn-success" onclick="userAddOpen()">
+						<i class="fa-solid fa-user-plus"></i>
+						Add User
+					</button>
 				</span>
 			</div>
 
 			<div class="card-header actionMessage" style="display:none"></div>
 			<div class="card-body">
-			<div class="row row-cols-1 row-cols-lg-2 g-3" id="user-cards">
-				<div class="col" jq-repeat="users" jq-repeat-index="username" id="user-row-{{username}}" style="display:none">
-					<div class="card shadow-sm h-100">
-						<div class="card-body">
-							<h6 class="d-flex align-items-center mb-2">
-								<i class="fa-solid fa-user me-2"></i>
-								{{ username }}
-								{{#isExternal}}
-								<span class="badge text-bg-secondary ms-2" title="Provisioned via SSO login; no local password to manage here.">
-									<i class="fa-solid fa-cloud"></i> External (SSO)
-								</span>
-								{{/isExternal}}
-							</h6>
-
-							{{^isExternal}}
-							<form class="input-group input-group-sm mb-2" action="user/password/{{ username }}" method="put" onsubmit="formAJAX(this)">
-							  <input type="password" name="password" class="form-control" placeholder="Change password" aria-label="Update password">
-							  <button class="btn btn-warning" type="submit">Change</button>
-							</form>
-							{{/isExternal}}
-							{{#isExternal}}
-							<p class="text-muted small mb-2">Authenticates via SSO -- cannot be edited here.</p>
-							{{/isExternal}}
-
-							<button type="button" class="btn btn-sm btn-danger" onclick="removeUser('{{username}}')">
-								<i class="fa-solid fa-user-slash"></i>
-								Delete
-							</button>
-						</div>
-					</div>
+				<div class="table-responsive">
+					<table class="table table-striped mb-0">
+						<thead>
+							<tr>
+								<th>Username</th>
+								<th>Auth Type</th>
+								<th>Password</th>
+								<th>Actions</th>
+							</tr>
+						</thead>
+						<tbody id="user-cards">
+							<tr jq-repeat="users" jq-repeat-index="username" id="user-row-{{username}}" style="display:none">
+								<td>
+									<strong>{{ username }}</strong>
+								</td>
+								<td>
+									{{#isExternal}}
+									<span class="badge text-bg-secondary" title="Provisioned via SSO login; no local password to manage here.">
+										<i class="fa-solid fa-cloud"></i> External (SSO)
+									</span>
+									{{/isExternal}}
+									{{^isExternal}}
+									<span class="badge text-bg-primary">Local</span>
+									{{/isExternal}}
+								</td>
+								<td>
+									{{^isExternal}}
+									<form class="input-group input-group-sm" style="max-width: 350px;" action="user/password/{{ username }}" method="put" onsubmit="formAJAX(this)">
+									  <input type="password" name="password" class="form-control" placeholder="Change password" aria-label="Update password">
+									  <button class="btn btn-warning" type="submit">Change</button>
+									</form>
+									{{/isExternal}}
+									{{#isExternal}}
+									<span class="text-muted">Authenticates via SSO — cannot be edited here.</span>
+									{{/isExternal}}
+								</td>
+								<td>
+									<button type="button" class="btn btn-sm btn-danger" onclick="removeUser('{{username}}')">
+										<i class="fa-solid fa-user-slash"></i>
+										Delete
+									</button>
+								</td>
+							</tr>
+						</tbody>
+					</table>
 				</div>
 			</div>
-			</div>
 		</div>
 	</div>
 </div>