Automatically keep a secondary repo in sync with a primary repo?

Oh, don’t do all that, just do:

git --bare fetch

😉

(See this old thread for instance)
If you have added the relevant remote origins to your bare repo, you can fetch in turn each of those origins.