I love how NixOS can take verbose system configurations and boil them down into a line or two! So does anyone have a module, or patch for the openvpn module, to run in a separate network namespace?
Probably, the easiest way is to run OpenVPN in a separate NixOS container with its own network namespace.