OpenConnect VPN (ocserv) behind NPM

[jeffshead]

I haven't found any tutorials or example configurations specifically for NPM. Has anyone been successful in setting up an OpenConnect VPN server behind NPM? If so, can you please answer some questions?

1. Does it matter if you use a stream or proxy host?
2. How do you specify the NPM SSL cert in the ocserv config file? Where are the Let's Encrypt host certs stored?
3. Is there a noticeable performance hit putting ocserv behind NPM?

Thank you!