openvpn:
  pkg:
    - installed
  service:
    - running
    - enable: True
    - require:
      - pkg: openvpn
    - watch:
      - file: /etc/openvpn

/etc/openvpn:
  file.recurse:
    - source: salt://openvpn/etc_openvpn
    - template: jinja
    - user: root
    - group: root
    - exclude_pat: E@(dnsmasq.settings.default)|(login.settings.default)
    - file_mode: 600

/etc/openvpn/up.sh:
  file.managed:
    - source: salt://openvpn/up.sh
    - user: root
    - group: root
    - mode: 700

openvpn:
  pkg:
    - installed
  service:
    - running
    - enable: True
    - require:
      - pkg: openvpn
    - watch:
      - file: /etc/openvpn

/etc/openvpn:
  file.recurse:
    - source: salt://openvpn/etc_openvpn
    - template: jinja
    - user: root
    - group: root
    - file_mode: 600

/etc/openvpn/up.sh:
  file.managed:
    - source: salt://openvpn/up.sh
    - user: root
    - group: root
    - mode: 700

Copy default files as well
Copy default files as well

They do not hurt and might be handy for reference on live systems.
moio/raspberry-openvpn-gateway