Just a suggestion: Move the code for renewal of crl.pem into openvpn::ca. Why? It seems to fit better in there, and in some cases you want all the regeneration stuff, but not the rest of the stuff from server.pp