With https://anonscm.debian.org/git/collab-maint/openvpn.git/commit/?id=5fe7875501a2560542b462f9af5bb3346214147f
openvpn@.service pulls in network-online.target (to keep in sync with the
upstream openvpn-server@.service and openvpn-client@.service).

While this helps some issues (i.e. binding to a specific IP address, see
#876979) it should generally be avoided. Normal configurations should
not need this.

Pulling in network-online.target might lead to a boot-time regression. See
also https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/ .

One possible solution would be to change the generator to only add
Wants/After=network-online.target when a configuration option mandating
it is found (for example "local <ip>").