OpenVPN in a separate network namespace

I love how NixOS can take verbose system configurations and boil them down into a line or two! So does anyone have a module, or patch for the openvpn module, to run in a separate network namespace?

Probably, the easiest way is to run OpenVPN in a separate NixOS container with its own network namespace.