The configuration file for opnSense is stored in /conf/config.xml. To back up this file, simply use scp to copy it. The directory /conf/backup contains all of the configurations back to the first one you did, so if you want that, grab that entire directory (plus /conf/config.xml).

On our servers, we have nightly backup runs, so we created a special ssh key and put it in the .ssh/authorized_keys file on the firewall, then our process can rsync the configuration (I just grab the whole /conf directory). This is inherently insecure as anyone with cli access to the server “owns” the router, so I create a special user for only this purpose, then create an ssh key for them. You could be a bit more secure by using the “allow root login for command only” but I'm not going to cover that here.

NOTE: you must manually install rsync if you want to do this. The full procedure is:

su specialuser
# on client machine, as special user
ssh-keygen -t rsa -b 4096
# leave password blank (just press enter)
cat ~/.ssh/id_rsa.pub
# ssh to router
ssh root@router
vi ~/.ssh/authorized_keys
# copy/paste the key you cat'd earlier, then save the file
chmod 700 ~/.ssh/authorized_keys
exit
# following should log in without asking for password
ssh root@router
# install rsync
pkg install rsync
exit

Now, you can simply create a script on your server which will grab the config. It only has one line

rsync -av --delete router:/conf /home/routerbackups/router/

Setting a cron job to run occasionally means you'll always have a copy of your router configuration someplace else!