This is pretty easy whether you get the .ovpn configuration file from a service like NordVPN, ProtonVPN, or your own openvpn install on your own server.
1-Install the packages for openvpn and the gnome network GUI on your phone.
sudo apt install openvpn networkmanager-openvpn networkmanager-openvpn-gnome
2-This second step is a server-side install, if you are using a commercial service or someone already has a working server you are invited to use ignote this step. If you need to new install openvpn on your server or VPS openvpn-install.sh is the easy way in my opinion. GitHub - angristan/openvpn-install: Set up your own OpenVPN server on Debian, Ubuntu, Fedora, CentOS, Arch Linux and more · GitHub
I like OpenVPN over Wireguard for the ability to setup a TCP VPN for inside more secure networks who block UDP and I have never seen more than maybe 5% difference in performance and even that didn’t always favor wireguard except on tiny CPU AP-routers VPNing the whole network. This is the download–>run one-liner to start the script to create a VPN daemon on your server(don’t run this on your phone it is for your server):
curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
3-Back to our phone, import the .ovpn file the script produces, I move the *.ovpn into /home/purism, and once you run the line below you have the VPN toggle right there with your wifi, cellular, and bluetooth.
nmcli connection import type openvpn file /path/to/your-config.ovpn
For new users this is most easily accomplished using ssh to your phone vs typing it in via touchscreen. Having ssh access to nearly every function on your phone is one of the superpowers of a Linux phone.