Aha, I'm not the only one centrally hosting fava. But I wanted read-write for the option to make occasional changes from my phone.
For inspiration, I'm using an iteration of this script which detects local changes and pushes after a delay. Collisions are handled by rebase if possible, hard reset otherwise.
I've been too lazy to build and save my own image, so my entry point runs pip every time to get dashboards and other plugins. Auth is via family-only WiFi (separate from guest and even home automation) and Traefik middleware.