Looks like AES-128-CBC and no regeneration of Diffie Hellman params. I'm not sure that's the greatest choice when you have full control over the endpoints.
I noticed DH params do get generated via easy-rsa (although not audited that code, so can't comment on how rigid it is, nor what keysize is being used so that could be defaulting to 1024 which isn't all that great nowadays)
set_var EASYRSA_KEY_SIZE 2048
# gen-dh backend: gen_dh() { verify_pki_init
local out_file="$EASYRSA_PKI/dh.pem" "$EASYRSA_OPENSSL" dhparam -out "$out_file" $EASYRSA_KEY_SIZE || \ die "Failed to build DH params" notice "\
https://github.com/OpenVPN/easy-rsa/blob/master/easyrsa3/eas...