move openvpn to correct place: roles, and add disable cdn op.