Draft: 3node+ setup with sslh

We only want to merge this one, or the other one, not both

As an alternate to !20 (merged) this is the same thing, but done without removing sslh.

Note: this fixes a bug in the sslh implementation, which incorrectly did not have a dependency set for the openvpn role to require that the openvpn-early-setup be evaluated first.

Neither this MR, nor !20 (merged) fix the secondary gateway issue. It can be fixed with either approach, however, this one has the additional complexity of the sslh setup.