Move to gollum. Filter everything except GET at haproxy with the appropriate acl Run gollum with –no-edit Sync from github from another container, shared volume.