rc.conf, sysrc and service on FreeBSD: enabling, starting and checking what runs at boot

Goal

Enable a service to start at boot, start or stop it immediately, and check both its live status and what is actually configured to run, on FreeBSD 14.x, without hand-editing /etc/rc.conf incorrectly.

Prerequisites

Root access; the package providing the service already installed (installing a package does not enable its _enable variable).

Steps

1. Understand the split: rc.conf(5) states that the purpose of rc.conf "is not to run commands or perform system startup actions directly" — it is read by the generic startup scripts in /etc/rc.d and /usr/local/etc/rc.d, which check an <service>_enable variable (YES/NO) to decide whether to act.
2. Enable a service for boot: sudo sysrc sshd_enable=YES. sysrc(8) is documented as a utility to "safely edit system rc files" — it writes (or appends, if the variable is absent) to /etc/rc.conf without disturbing unrelated lines, which hand-editing with sed risks doing. service(8) documents service sshd enable as an equivalent.
3. Query a variable instead of guessing its current value: sysrc sshd_enable prints the current setting; sysrc -f /etc/rc.conf.d/nginx nginx_enable=YES writes into a per-service file instead — rc.conf(5) documents that files in /etc/rc.conf.d (and /usr/local/etc/rc.conf.d) are read by load_rc_config, that is, when the rc script of the service with that name runs.
4. Start or stop a service immediately: sudo service sshd start / stop / restart. These act only if sshd_enable is YES; otherwise the rc script refuses and points to onestart. service sshd onestart (documented in service(8)) skips the enable check for that one run.
5. Check status: service sshd status. To see the live state of everything enabled, loop over the script paths that service -e prints: for s in $(service -e); do "$s" status; done. Do not use service -R for this: it restarts all enabled local services.

Expected result

After sysrc sshd_enable=YES and a reboot (or sudo service sshd start), service sshd status reports the daemon running, and sysrc sshd_enable reports YES.

Limits and test basis

onestart/onestop bypass the enabled check for a single run only; they do not change what happens on the next reboot. Editing /etc/rc.conf directly is not wrong, but sysrc avoids duplicate or malformed variable lines, which is the more common source of a service silently not starting at boot.