Disable receive.denyNonFastForwards when setting up a gcrypt special remote

gcrypt needs to be able to fast-forward the master branch. If a git
repository is set up with git init --shared --bare, it gets that set, and
pushing to it will then fail, even when it's up-to-date.

Remote/GCrypt.hs

@@ -191,8 +191,9 @@ gCryptSetup mu c = go $ M.lookup "gitrepo" c
  - repo, or it is accessed via rsync directly, or it is accessed over ssh
  - and git-annex-shell is available to manage it.
  -
- - The gcrypt-id is stored in the gcrypt repository for later
- - double-checking and identification. This is always done using rsync.
+ - The GCryptID is recorded in the repository's git config for later use.
+ - Also, if the git config has receive.denyNonFastForwards set, disable
+ - it; gcrypt relies on being able to fast-forward branches.
  -}
 setupRepo :: Git.GCrypt.GCryptId -> Git.Repo -> Annex AccessMethod
 setupRepo gcryptid r
@@ -208,14 +209,14 @@ setupRepo gcryptid r
 	| otherwise = localsetup r
   where
 	localsetup r' = do
-		liftIO $ Git.Command.run [Param "config", Param coreGCryptId, Param gcryptid] r'
+		let setconfig k v = liftIO $ Git.Command.run [Param "config", Param k, Param v] r'
+		setconfig coreGCryptId gcryptid
+		setconfig denyNonFastForwards (Git.Config.boolConfig False)
 		return AccessDirect
 
-	{- Download any git config file from the remote,
-	 - add the gcryptid to it, and send it back.
-	 -
-	 - At the same time, create the objectDir on the remote,
-	 - which is needed for direct rsync to work.
+	{- As well as modifying the remote's git config, 
+	 - create the objectDir on the remote,
+	 - which is needed for direct rsync of objects to work.
 	 -}
   	rsyncsetup = Remote.Rsync.withRsyncScratchDir $ \tmp -> do
 		liftIO $ createDirectoryIfMissing True $ tmp </> objectDir
@@ -225,11 +226,9 @@ setupRepo gcryptid r
 			[ Param $ rsyncurl ++ "/config"
 			, Param tmpconfig
 			]
-		liftIO $ appendFile tmpconfig $ unlines
-			[ ""
-			, "[core]"
-			, "\tgcrypt-id = " ++ gcryptid
-			]
+		liftIO $ do
+			Git.Config.changeFile tmpconfig coreGCryptId gcryptid
+			Git.Config.changeFile tmpconfig denyNonFastForwards (Git.Config.boolConfig False)
 		ok <- liftIO $ rsync $ rsynctransport ++
 			[ Params "--recursive"
 			, Param $ tmp ++ "/"
@@ -244,6 +243,8 @@ setupRepo gcryptid r
 	usablegitannexshell = either (const False) (const True)
 		<$> Ssh.onRemote r (Git.Config.fromPipe r, Left undefined) "configlist" [] []
 
+	denyNonFastForwards = "receive.denyNonFastForwards"
+
 shellOrRsync :: Remote -> Annex a -> Annex a -> Annex a
 shellOrRsync r ashell arsync = case method of
 	AccessShell -> ashell