[chef] Ideas for using Chef across VPN

[Dmitry V'yal < >]

Hello chef-list,

I administer several geographically separated workstations which are 
hidden behind NATs. Currently we're working through OpenVPN with a 
server on a VPS which is used as web hosting and mail server, which I 
want to configure with Chef too.

I have some ideas about using chef-solo to bootstrap chef-client and 
OpenVPN client on the workstations but I'm interesting in comments from 
more experienced chef users.

Is it a feasible idea? How best to manage openvpn keys?

Another question what bothers me, is where to place the chef-server. We 
don't have a separate host for it and seems to me it's better not to 
combine server with a client doing something useful. Would it be a good 
solution to have it as a guest os in VirtualBox on one of workstations? 
Is it required that chef-server is online 24/7 or it can be activated 
only then something in configuration changed?

As a newbie I have many more questions, but these are most urgent. 
Thanks for attention.

Best wishes,
Dmitry