single-wan OpnSense HA setup. Put this file into /usr/local/etc/rc.syshook.d/carp on both primary/backup firewalls

10-wancarp

#!/usr/local/bin/php
<?php

require_once("config.inc");
require_once("system.inc");
require_once("interfaces.inc");
require_once("util.inc");

$subsystem = !empty($argv[1]) ? $argv[1] : '';
$type = !empty($argv[2]) ? $argv[2] : '';

if ($type != 'MASTER' && $type != 'BACKUP') {
    log_error("Carp '$type' event unknown from source '{$subsystem}'");
    exit(1);
}

if (!strstr($subsystem, '@')) {
    log_error("Carp '$type' event triggered from wrong source '{$subsystem}'");
    exit(1);
}

// Add more interfaces that need to be disabled/enabled after a CARP event.
$wan_interfaces = array('wan');

// interfaces object
$conf_ifs = $config['interfaces'];

foreach ($wan_interfaces as $if_name) {
    if (!array_key_exists($if_name, $conf_ifs))
        continue;
    $os_if_name = $conf_ifs[$if_name]['if'];
    print "Configuring $if_name ($os_if_name)\n";
    if ($type === "MASTER") {
        log_error("enable interface '$if_name' due CARP event '$type'");
        $config['interfaces'][$if_name]['enable'] = '1';
        interfaces_bring_up($if_name);
        interface_configure(false, $if_name, true, true);
        write_config("enable interface '$if_name' due CARP event '$type'", false);
        usleep(200 * 1000);
    } else {
        log_error("disable interface '$if_name' due CARP event '$type'");
        interface_reset($if_name, true);
        unset($config['interfaces'][$if_name]['enable']);
        interface_configure(false, $if_name, false, false);
        exec("/sbin/ifconfig {$os_if_name} down 2>&1", $ifc, $ret);
        write_config("disable interface '$if_name' due CARP event '$type'", false);
    }
}
?>

Updated, thanks (haven't been using this script recently)

also should change line 42 to interface_reset
as they removed interface_bring_down

Updated again.