My aim is to forget the use of sudo / su command for starting openvpn service on Devuan. Running it so has the possibility for some hostile parties to gain control of its terminal session -which is unlikely- but I would like to make it a way more secure.

For the first step I'd create a user with only access to /etc/openvpn:
sudo adduser vpnhandler
sudo chown -R vpnhandler:vpnhandler /etc/openvpn

Then it would be great to set it up as a service which is auto-started by vpnhandler so I don't have to type openvpn xxxxx.ovpn in the terminal every time with that user.

Can someone help me with this? I'm open to any idea.