I used to include openvpn as part of the default build of cero. It broke entirely in the the 3.7.5 release so it was removed. It is fixed in the 3.8.6-2 release but it appears the luci gui is currently marked as broken in openwrt head.
You can get the openvpn-openssl and openvpn-easyrsa packages via
opkg update opkg install openvpn-openssl
I note I'm not huge on generating rsa keys on devices with minimal entropy.
I also note that either vtun or openvpn could use some debloating and love, in that when I last pounded a lot of data through it, it had interesting drop characteristics, and that it appears useful to attach fq_codel to a vtun interface in some cases.