T6478 skips the restart when only server client entries change, assuming OpenVPN reads client-config-dir at connect time. But server.conf.j2 renders client-config-dir only once a server client exists, so the first entry adds the directive while _only_client_config_changed() still returns True and apply() skips reload-or-restart. The running daemon doesn't read the CCD directory.
Steps:
- OpenVPN server with no server client entries and a connected client.
- set interfaces openvpn vtun10 server client <cn> subnet 10.77.0.0/24, commit.
- Reconnect the client.
The daemon keeps its PID; on reconnect there is no OPTIONS IMPORT, no iroute, and the client subnet is unreachable (with DCO, no kernel route either):
pid=12062 same-process=yes ccd-in-render=1 iroute-in-ccd-file=1 reload-or-restart-lines-since-commit=0 ping 10.77.0.1: 3 packets transmitted, 0 received, 100% packet loss
After restart openvpn interface vtun10 it works.
Impact: subnets behind OpenVPN clients stay unreachable after the first client entry until the daemon restarts for another reason.
Suggested fix: in _only_client_config_changed(), return False when the rendered server config changes, not only the CCD files.