I wish the official OpenVPN howto [0] highlighted this sort of things a bit more.

As it is, it provides a clear and easy to follow path to a minimally viable setup, but only mentions many additional security parameters (tls-auth, running as unpriviledged user, chroot, increasing key size) under "Hardening OpenVPN Security", very far down the page, where people probably miss it. And this, even though some of these elements vastly increase the security with little to no downside.

[0] https://openvpn.net/index.php/open-source/documentation/howt...