So here is the deal. OpnSense is based on FreeBSD (as the users know but others may not understand) and utilizes ZFS Snapshots which are an amazing way to go back to a previous state when something breaks after an update. However for some reason the cron section has been changed so you can not add any random cron job and can only select from predefined options. This means we have to work from the CLI to add jobs, but even worse after an update the cron jobs are removed.... which becomes self defeating.
I think I have a decent solution that will work to not only persist the backup script that will automatically create and remove snapshots but also recreate the cron jobs automatically. Ideally there would be some sort of addon where we could adjust things but this is the best I can do for now and want to share with everyone.
Here is the script, place it at: /usr/local/etc/rc.syshook.d/start/99-snapshot-addon.sh and preform a chmod +x so that it is executable. Then reboot and the script to create the snapshot automatically and the cron job should be created. Since this runs on boot it will do this check after every update that requires a reboot or reboot in general and if the script and cron jobs are removed due to an update it will recreate them.
#!/bin/sh
CAT_PATH="/usr/local/opnsense/scripts/auto_be_retention.sh"
# Ensure target directory exists
mkdir -p /usr/local/opnsense/scripts
# 1. Write/Update the auto_be_retention.sh script
cat << 'EOF' > "$CAT_PATH"
#!/bin/sh
WEEKLY_RETENTION=6
MONTHLY_RETENTION=4
TYPE=$1
if [ "$TYPE" != "weekly" ] && [ "$TYPE" != "monthly" ]; then
echo "Usage: $0 [weekly|monthly]"
exit 1
fi
DATE_TAG=$(date +%Y%m%d_%H%M%S)
BE_NAME="auto_${TYPE}_${DATE_TAG}"
/sbin/bectl create "${BE_NAME}"
if [ "$TYPE" = "weekly" ]; then
KEEP=$WEEKLY_RETENTION
else
KEEP=$MONTHLY_RETENTION
fi
/sbin/bectl list -H | awk '{print $1}' | grep "^auto_${TYPE}_" | sort | \
awk -v keep="$KEEP" '
{ lines[NR] = $1 }
END {
to_delete = NR - keep
for (i = 1; i <= to_delete; i++) {
print lines[i]
}
}
' | while read -r OLD_BE; do
if [ -n "$OLD_BE" ]; then
/sbin/bectl destroy -F -o "$OLD_BE"
fi
done
EOF
chmod +x "$CAT_PATH"
# 2. Inject cron tasks into /etc/crontab if missing
CRON_FILE="/etc/crontab"
if ! grep -q "auto_be_retention.sh weekly" "$CRON_FILE"; then
echo "0 3 * * 0 root /usr/local/opnsense/scripts/auto_be_retention.sh weekly" >> "$CRON_FILE"
fi
if ! grep -q "auto_be_retention.sh monthly" "$CRON_FILE"; then
echo "30 3 1 * * root /usr/local/opnsense/scripts/auto_be_retention.sh monthly" >> "$CRON_FILE"
fi
# 3. Reload cron daemon
service cron restart
This will check for and if missing create a script at /usr/local/opnsense/scripts/auto_be_retention.sh and it will check for and if missing create two cron jobs.
The script located at /usr/local/opnsense/scripts/auto_be_retention.sh will create a snapshot with a timestamp named similar to: auto_monthly_20261001_033000
It will also look the count of previous snapshots (6 for weekly and 4 for monthly which can be adjusted if you choose) and delete the oldest one. Weekly snapshots will happen every Sunday at 3:00 AM and monthly snapshots will happen on the 1st of the month at 3:30 AM.
Why do we need this?
We don't "need" this but the advantage is that if you can have automatic updates (which are an option that is available in the cron section) it's probably better to have a snapshot that can easily be rolled back to in the case of something acting up automatically created as well. The other option is try and undo the issue or take a config backup and reinstall then use that to get everything up and running again.
Rolling back a snapshot takes a few minutes and gets everything back up and running until a solution for the issue/s are available.
I ran the script and I am not seeing anything in the Settings > cron section!!
You won't... that is part of the deal with how OpnSense has decided to handle things. You will need to look in: /etc/crontab This is because of how OpnSense is using menu drive cron selections, since the selections are not available it seems to not want to create or show them.
I have done some testing and removed the files and jobs and also had them recreated. At the next update we will see if everything sticks around or if it is removed.
Please remember that the script above is given without warranty or guarantee, use it at your own risk. I am not responsible if this script causes things not limited to but including data loss, testicular/breast shrinkage/growth, rude children, nagging wives/girlfriends/husbands/partners, alien visitation, global warming, or thermonuclear war. ID10T errors are also your own responsibility... you should not be running things you find on the internet without understanding how they work.
