clever_router.ovpn

client
dev tun
proto udp
remote vpn.example.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
comp-lzo
verb 3
<ca>
....
</ca>
<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>

router.nat.nix

{ ... }:

{
  services = {
    openvpn.servers.linkname = {
      config = pkgs.lib.readFile ./clever_router.ovpn;
    };
  };
}