How to save both "auth pasword" and "private key password"

[seededplyr]

I am connecting from linux openwrt openvpn client to a sever which used the angristan script to install and setup openvpn.
I am family with auth-user-pass for other servers and have used that before, but it does not seem to work for this openvpn setup, which means I need to enter via STDIN each time I connect. How do I go about saving the password so that it no longer asks me on the cli when connecting?

┌──(root@rpi4-owrt)-[02:50:19]-[/etc/openvpn]
└─# openvpn --config es-jp-0.ovpn
2024-01-12 02:50:24 OpenVPN 2.5.8 aarch64-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2024-01-12 02:50:24 library versions: OpenSSL 3.0.12 24 Oct 2023, LZO 2.10
Enter Private Key Password:
2024-01-12 02:50:27 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2024-01-12 02:50:27 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2024-01-12 02:50:27 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2024-01-12 02:50:27 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2024-01-12 02:50:27 TCP/UDP: Preserving recently used remote address: [AF_INET]**.***.***.***:*****
2024-01-12 02:50:27 Socket Buffers: R=[212992->212992] S=[212992->212992]
2024-01-12 02:50:27 UDP link local: (not bound)
2024-01-12 02:50:27 UDP link remote: [AF_INET]**.***.***.***:*****
2024-01-12 02:50:27 TLS: Initial packet from [AF_INET]**.***.***.***:*****, sid=fc***** ******
2024-01-12 02:50:28 VERIFY OK: depth=1, CN=cn_********
2024-01-12 02:50:28 VERIFY KU OK
2024-01-12 02:50:28 Validating certificate extended key usage
2024-01-12 02:50:28 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2024-01-12 02:50:28 VERIFY EKU OK
2024-01-12 02:50:28 VERIFY X509NAME OK: CN=server_1********
2024-01-12 02:50:28 VERIFY OK: depth=0, CN=server_1********
2024-01-12 02:50:28 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 256 bit EC, curve prime256v1, signature: ecdsa-with-SHA256
2024-01-12 02:50:28 [server_1********] Peer Connection Initiated with [AF_INET]**.***.***.***:*****
2024-01-12 02:50:28 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 1.0.0.1,dhcp-option DNS 1.1.1.1,redirect-gateway def1 bypass-dhcp,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.18 255.255.255.0,peer-id 2,cipher AES-128-GCM'
2024-01-12 02:50:28 OPTIONS IMPORT: timers and/or timeouts modified
2024-01-12 02:50:28 OPTIONS IMPORT: --ifconfig/up options modified
2024-01-12 02:50:28 OPTIONS IMPORT: route options modified
2024-01-12 02:50:28 OPTIONS IMPORT: route-related options modified
2024-01-12 02:50:28 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2024-01-12 02:50:28 OPTIONS IMPORT: peer-id set
2024-01-12 02:50:28 OPTIONS IMPORT: adjusting link_mtu to 1624
2024-01-12 02:50:28 OPTIONS IMPORT: data channel crypto options modified
2024-01-12 02:50:28 Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
2024-01-12 02:50:28 Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
2024-01-12 02:50:28 net_route_v4_best_gw query: dst 0.0.0.0
2024-01-12 02:50:28 net_route_v4_best_gw result: via 192.168.1.1 dev br0
2024-01-12 02:50:28 TUN/TAP device tun0 opened
2024-01-12 02:50:28 net_iface_mtu_set: mtu 1500 for tun0
2024-01-12 02:50:28 net_iface_up: set tun0 up
2024-01-12 02:50:28 net_addr_v4_add: 10.8.0.18/24 dev tun0
2024-01-12 02:50:28 net_route_v4_add: 45.149.101.109/32 via 192.168.1.1 dev [NULL] table 0 metric -1
2024-01-12 02:50:28 net_route_v4_add: 0.0.0.0/1 via 10.8.0.1 dev [NULL] table 0 metric -1
2024-01-12 02:50:28 net_route_v4_add: 128.0.0.0/1 via 10.8.0.1 dev [NULL] table 0 metric -1
2024-01-12 02:50:28 Initialization Sequence Completed```

[seededplyr]

Found the solution https://stackoverflow.com/questions/11240184/pass-private-key-password-to-openvpn-command-directly-in-ubuntu-10-10
use: askpass directive