I don't think this is a good idea.

1. The user could, and should specify config = "config /path/to/ovpn" as is.

2. Interpolating configFile as a path will mean that it gets imported to the store, rather silently even, and render any secrets within world-readable on the system. (Provide options for storing secrets outside the Nix store #24288)

(2) could be fixed by liberally applying toString to ensure that this doesn't happen, but then we're back to essentially method (1) anyway. I think this could be better fixed by simply documenting the use of config = " config ..." as it's a common pattern anyway. What do you think?

Thanks, Sarah, your points make absolute sense!
I created this PR after porting some some old custom vpn code and was so mentally fixated on my own implementation that I didn't notice (1).

I've created a commit that documents the use of config .... If it looks good to you, I'll squash the old obsolete commits.

@erikarvstedt Looks perfect to me, go ahead and squash, and thank you. :)

(Side note: Glad to see another Copenhagener here!)

Done.

Thanks again, neighbour 😉