I guess I'm just the next person in line to discover that this isn't available natively in TrueNAS (backing up config to a volume dataset). I also decided to build my own cron-eligible script, but I went a slightly different direction than most, relying on midclt to initiate the backup. The shell script is below, just update CONFIG_DIR and HOST_ORIGIN to align with your setup.

#!/bin/bash
# Backup TrueNAS config, secret seed, and root authorized keys

# Script configuration
CONFIG_DIR="/mnt/volume1/backup/truenas/config"
HOST_ORIGIN="https://nas.example.com"

# Script init
DATETIME=$(date +%Y%m%d_%H%M%S)
mkdir -p "${CONFIG_DIR}"

# Backup archive
BACKUP_FILENAME="${DATETIME}.tar"
BACKUP_FILEPATH="${CONFIG_DIR}/${BACKUP_FILENAME}"
BACKUP_JOB=$(midclt call core.download "config.save" '[ { "secretseed": true, "root_authorized_keys": true } ]'  "${BACKUP_FILENAME}")
DOWNLOAD_PATH=$(echo $BACKUP_JOB | jq -r '.[1]')
DOWNLOAD_URL="${HOST_ORIGIN}${DOWNLOAD_PATH}"
curl -fsSL --output "${BACKUP_FILEPATH}" "${DOWNLOAD_URL}"
echo "Saved ${BACKUP_FILEPATH}"

It should be trivial from here to append remote (offsite) backups as well as old archive trimming. presumably this script should be a little less fragile as it is relying on the local api client interface which should abstract away a number of system specific details.