Why all the easy-rsa setup commands are in the openvpn::tunnel define (which can be declared multiple times inside the host) and not in the main openvpn class?
I expect a single CA for node and eventually a different define to manage single users and their certifiicates creation.
Things like:
openvpn::user - Manages certs for users
openvpn (which may include openvpn::ca) - Manages CA setup
openvpn::tunnel - Manages single configuration files (.conf in config_dir)

my2c