Found this: OpenVPN failing to connect with auth failure - #4 by davenet, which allowed me to make it work.
Add a grouped network
Enable DHCP on a subrange of this network
When connecting, openvpn choked on adding a route ; so I had to determine the peer IP (“via”), add it as a single host static route to my client, then add a network static route to the “grouped network”.