You should change the cipher, all my clients complain about a possible attack called SWEET32. https://community.openvpn.net/openvpn/wiki/SWEET32
I would also like if you would add " list push ‘redirect-gateway def1’ " as standard, so all traffic is routed through the tunnel ( i guess that’s what 99% of the user would like to see)
Besides this it’s not too bad.