diff --git a/ansible/inventory/dolo/01-hosts.yml b/ansible/inventory/dolo/01-hosts.yml
index 7675677..4fa734e 100644
--- a/ansible/inventory/dolo/01-hosts.yml
+++ b/ansible/inventory/dolo/01-hosts.yml
@@ -1,5 +1,5 @@
 ---
 plugin: "cloud.terraform.terraform_provider"
 # defaults to terraform, but we're using tofu
-binary_path: "/usr/bin/tofu"
+binary_path: "tofu"
 project_path: "../tf"
diff --git a/ansible/inventory/folly/01-hosts.yml b/ansible/inventory/folly/01-hosts.yml
index 7675677..4fa734e 100644
--- a/ansible/inventory/folly/01-hosts.yml
+++ b/ansible/inventory/folly/01-hosts.yml
@@ -1,5 +1,5 @@
 ---
 plugin: "cloud.terraform.terraform_provider"
 # defaults to terraform, but we're using tofu
-binary_path: "/usr/bin/tofu"
+binary_path: "tofu"
 project_path: "../tf"
diff --git a/ansible/inventory/full/01-hosts.yml b/ansible/inventory/full/01-hosts.yml
index c6af5cc..1de7d63 100644
--- a/ansible/inventory/full/01-hosts.yml
+++ b/ansible/inventory/full/01-hosts.yml
@@ -1,6 +1,6 @@
 ---
 plugin: "cloud.terraform.terraform_provider"
 # defaults to terraform, but we're using tofu
-binary_path: "/usr/bin/tofu"
+binary_path: "tofu"
 project_path: "../tf"
 
diff --git a/ansible/inventory/stingray/01-hosts.yml b/ansible/inventory/stingray/01-hosts.yml
index 7675677..4fa734e 100644
--- a/ansible/inventory/stingray/01-hosts.yml
+++ b/ansible/inventory/stingray/01-hosts.yml
@@ -1,5 +1,5 @@
 ---
 plugin: "cloud.terraform.terraform_provider"
 # defaults to terraform, but we're using tofu
-binary_path: "/usr/bin/tofu"
+binary_path: "tofu"
 project_path: "../tf"
diff --git a/docker/compose/calibre/docker-compose.yml b/docker/compose/calibre/docker-compose.yml
new file mode 100644
index 0000000..203a0e1
--- /dev/null
+++ b/docker/compose/calibre/docker-compose.yml
@@ -0,0 +1,80 @@
+---
+version: "3.8"
+
+networks:
+  traefik:
+    external: true
+  calibre:
+    name: calibre
+
+services:
+  calibre:
+    image: lscr.io/linuxserver/calibre:7.26.0
+    container_name: calibre
+    security_opt:
+      - seccomp:unconfined #optional
+    environment:
+      - PUID=${PUID:-8796}
+      - PGID=${PGID:-3005}
+      - TZ=America/Vancouver
+      # - PASSWORD= #optional
+      # - CLI_ARGS= #optional
+    volumes:
+      - ${CALIBRE_CONFIG:-/mnt/docker/volumes/calibre/calibre-config}:/config
+      - ${CALIBRE_BOOKS:-/mnt/docker/volumes/calibre/books}:/books
+    ports:
+      - 8081:8080
+      - 8182:8181
+      - 8082:8081
+    restart: unless-stopped
+    networks:
+      - traefik
+      - calibre
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.calibre.rule=Host(`${CALIBRE_HOST:-calibre.jumper.mnke.org}`)"
+      - "traefik.http.routers.calibre.entrypoints=websecure"
+      - "traefik.http.routers.calibre.tls=true"
+      - "traefik.http.services.calibre.loadbalancer.server.port=8080"
+      - "traefik.docker.network=traefik"
+    deploy:
+      resources:
+        limits:
+          cpus: '0.15'
+          memory: 512M
+        reservations:
+          cpus: '0.1'
+          memory: 128M
+
+  calibre-web:
+    image: lscr.io/linuxserver/calibre-web:0.6.24
+    container_name: calibre-web
+    environment:
+      - PUID=${PUID:-8796}
+      - PGID=${PGID:-3005}
+      - TZ=America/Vancouver
+      # - DOCKER_MODS=linuxserver/mods:universal-calibre #optional
+      # - OAUTHLIB_RELAX_TOKEN_SCOPE=1 #optional
+    volumes:
+      - ${CALIBRE_WEB_CONFIG:-/mnt/docker/volumes/calibre/calibre-web-config}:/config
+      - ${CALIBRE_BOOKS:-/mnt/docker/volumes/calibre/books}:/books
+
+    restart: unless-stopped
+    networks:
+      - traefik
+      - calibre
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.calibre-web.rule=Host(`${CALIBRE_WEB_HOST:-calibre-web.jumper.mnke.org}`)"
+      - "traefik.http.routers.calibre-web.entrypoints=websecure"
+      - "traefik.http.routers.calibre-web.tls=true"
+      - "traefik.http.services.calibre-web.loadbalancer.server.port=8083"
+      - "traefik.docker.network=traefik"
+    deploy:
+      resources:
+        limits:
+          cpus: '0.25'
+          memory: 512M
+        reservations:
+          cpus: '0.1'
+          memory: 128M
diff --git a/flake.lock b/flake.lock
index 1d0fc86..d96579b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,16 +2,16 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1739736696,
-        "narHash": "sha256-zON2GNBkzsIyALlOCFiEBcIjI4w38GYOb+P+R4S8Jsw=",
-        "rev": "d74a2335ac9c133d6bbec9fc98d91a77f1604c1f",
-        "revCount": 754461,
+        "lastModified": 1740695751,
+        "narHash": "sha256-D+R+kFxy1KsheiIzkkx/6L63wEHBYX21OIwlFV8JvDs=",
+        "rev": "6313551cd05425cd5b3e63fe47dbc324eabb15e4",
+        "revCount": 760502,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.754461%2Brev-d74a2335ac9c133d6bbec9fc98d91a77f1604c1f/01951426-5a87-7b75-8413-1a0d9ec5ff04/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.760502%2Brev-6313551cd05425cd5b3e63fe47dbc324eabb15e4/01954f5d-9aa0-742c-829e-dfa0c472c2db/source.tar.gz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.1.%2A.tar.gz"
+        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.1.tar.gz"
       }
     },
     "root": {
diff --git a/flake.nix b/flake.nix
index 0c73716..01fdb75 100644
--- a/flake.nix
+++ b/flake.nix
@@ -14,11 +14,16 @@
       devShells = forEachSupportedSystem ({ pkgs }: {
         default = pkgs.mkShell {
           venvDir = ".venv";
-          packages = with pkgs; [ python311 ] ++
-            (with pkgs.python311Packages; [
-              pip
-              venvShellHook
-            ]);
+          packages = with pkgs; [
+            python311
+            opentofu
+            kubectl
+            k9s
+          ] ++
+          (with pkgs.python311Packages; [
+            pip
+            venvShellHook
+          ]);
         };
       });
     };
diff --git a/k8s/apps/nextcloud/release.yaml b/k8s/apps/nextcloud/release.yaml
index bac0f24..591e3e1 100644
--- a/k8s/apps/nextcloud/release.yaml
+++ b/k8s/apps/nextcloud/release.yaml
@@ -71,7 +71,7 @@ spec:
         enabled: true
         storageClass: nfs-client
         accessMode: ReadWriteMany
-        size: 64Gi
+        size: 128Gi
 
     livenessProbe:
       # it takes so long for nextcloud to start up