feat(openvpn): OPENVPN_PROCESS_USER and deprecates OPENVPN_ROOT

internal/configuration/sources/env/openvpn.go

@@ -52,13 +52,11 @@ func (r *Reader) readOpenVPN() (
 
 	openVPN.Interface = os.Getenv("OPENVPN_INTERFACE")
 
-	openVPN.Root, err = envToBoolPtr("OPENVPN_ROOT")
+	openVPN.ProcessUser, err = r.readOpenVPNProcessUser()
 	if err != nil {
-		return openVPN, fmt.Errorf("environment variable OPENVPN_ROOT: %w", err)
+		return openVPN, err
 	}
 
-	// TODO ProcUser once Root is deprecated.
-
 	openVPN.Verbosity, err = envToIntPtr("OPENVPN_VERBOSITY")
 	if err != nil {
 		return openVPN, fmt.Errorf("environment variable OPENVPN_VERBOSITY: %w", err)
@@ -123,3 +121,21 @@ func (r *Reader) readPIAEncryptionPreset() (presetPtr *string) {
 
 	return nil
 }
+
+func (r *Reader) readOpenVPNProcessUser() (processUser string, err error) {
+	// Retro-compatibility
+	root, err := envToBoolPtr("OPENVPN_ROOT")
+	if err != nil {
+		r.onRetroActive("OPENVPN_ROOT", "OPENVPN_PROCESS_USER")
+		return "", fmt.Errorf("environment variable OPENVPN_ROOT: %w", err)
+	} else if root != nil {
+		r.onRetroActive("OPENVPN_ROOT", "OPENVPN_PROCESS_USER")
+		if *root {
+			return "root", nil
+		}
+		const defaultNonRootUser = "nonrootuser"
+		return defaultNonRootUser, nil
+	}
+
+	return os.Getenv("OPENVPN_PROCESS_USER"), nil
+}