Add fail2ban log viewer and service health to Config page

Task 2: adds a new Log tab to the Configuration page.

Backend:
- New Pydantic models: Fail2BanLogResponse, ServiceStatusResponse
  (backend/app/models/config.py)
- New service methods in config_service.py:
    read_fail2ban_log() — queries socket for log target/level, validates the
    resolved path against a safe-prefix allowlist (/var/log) to prevent
    path traversal, then reads the tail of the file via the existing
    _read_tail_lines() helper; optional substring filter applied server-side.
    get_service_status() — delegates to health_service.probe() and appends
    log level/target from the socket.
- New endpoints in routers/config.py:
    GET /api/config/fail2ban-log?lines=200&filter=...
    GET /api/config/service-status
  Both require authentication; log endpoint returns 400 for non-file log
  targets or path-traversal attempts, 502 when fail2ban is unreachable.

Frontend:
- New LogTab.tsx component:
    Service Health panel (Running/Offline badge, version, jail count, bans,
    failures, log level/target, offline warning banner).
    Log viewer with color-coded lines (error=red, warning=yellow,
    debug=grey), toolbar (filter input + debounce, lines selector, manual
    refresh, auto-refresh with interval selector), truncation notice, and
    auto-scroll to bottom on data updates.
  fetchData uses Promise.allSettled so a log-read failure never hides the
  service-health panel.
- Types: Fail2BanLogResponse, ServiceStatusResponse (types/config.ts)
- API functions: fetchFail2BanLog, fetchServiceStatus (api/config.ts)
- Endpoint constants (api/endpoints.ts)
- ConfigPage.tsx: Log tab added after existing tabs

Tests:
- Backend service tests: TestReadFail2BanLog (6), TestGetServiceStatus (2)
- Backend router tests: TestGetFail2BanLog (8), TestGetServiceStatus (3)
- Frontend: LogTab.test.tsx (8 tests)

Docs:
- Features.md: Log section added under Configuration View
- Architekture.md: config.py router and config_service.py descriptions updated
- Tasks.md: Task 2 marked done

backend/app/models/config.py

@@ -860,3 +860,34 @@ class JailActivationResponse(BaseModel):
         description="New activation state: ``True`` after activate, ``False`` after deactivate.",
     )
     message: str = Field(..., description="Human-readable result message.")
+
+
+# ---------------------------------------------------------------------------
+# fail2ban log viewer models
+# ---------------------------------------------------------------------------
+
+
+class Fail2BanLogResponse(BaseModel):
+    """Response for ``GET /api/config/fail2ban-log``."""
+
+    model_config = ConfigDict(strict=True)
+
+    log_path: str = Field(..., description="Resolved absolute path of the log file being read.")
+    lines: list[str] = Field(default_factory=list, description="Log lines returned (tail, optionally filtered).")
+    total_lines: int = Field(..., ge=0, description="Total number of lines in the file before filtering.")
+    log_level: str = Field(..., description="Current fail2ban log level.")
+    log_target: str = Field(..., description="Current fail2ban log target (file path or special value).")
+
+
+class ServiceStatusResponse(BaseModel):
+    """Response for ``GET /api/config/service-status``."""
+
+    model_config = ConfigDict(strict=True)
+
+    online: bool = Field(..., description="Whether fail2ban is reachable via its socket.")
+    version: str | None = Field(default=None, description="fail2ban version string, or None when offline.")
+    jail_count: int = Field(default=0, ge=0, description="Number of currently active jails.")
+    total_bans: int = Field(default=0, ge=0, description="Aggregated current ban count across all jails.")
+    total_failures: int = Field(default=0, ge=0, description="Aggregated current failure count across all jails.")
+    log_level: str = Field(default="UNKNOWN", description="Current fail2ban log level.")
+    log_target: str = Field(default="UNKNOWN", description="Current fail2ban log target.")

backend/app/routers/config.py

@@ -28,6 +28,8 @@ global settings, test regex patterns, add log paths, and preview log files.
 * ``PUT  /api/config/actions/{name}``               — update an action's .local override
 * ``POST /api/config/actions``                      — create a new user-defined action
 * ``DELETE /api/config/actions/{name}``             — delete an action's .local file
+* ``GET  /api/config/fail2ban-log``                 — read the tail of the fail2ban log file
+* ``GET  /api/config/service-status``               — fail2ban health + log configuration
 """
 
 from __future__ import annotations
@@ -46,6 +48,7 @@ from app.models.config import (
     AddLogPathRequest,
     AssignActionRequest,
     AssignFilterRequest,
+    Fail2BanLogResponse,
     FilterConfig,
     FilterCreateRequest,
     FilterListResponse,
@@ -63,6 +66,7 @@ from app.models.config import (
     MapColorThresholdsUpdate,
     RegexTestRequest,
     RegexTestResponse,
+    ServiceStatusResponse,
 )
 from app.services import config_file_service, config_service, jail_service
 from app.services.config_file_service import (
@@ -1319,3 +1323,83 @@ async def remove_action_from_jail(
             detail=f"Failed to write jail override: {exc}",
         ) from exc
 
+
+# ---------------------------------------------------------------------------
+# fail2ban log viewer endpoints
+# ---------------------------------------------------------------------------
+
+
+@router.get(
+    "/fail2ban-log",
+    response_model=Fail2BanLogResponse,
+    summary="Read the tail of the fail2ban daemon log file",
+)
+async def get_fail2ban_log(
+    request: Request,
+    _auth: AuthDep,
+    lines: Annotated[int, Query(ge=1, le=2000, description="Number of lines to return from the tail.")] = 200,
+    filter: Annotated[  # noqa: A002
+        str | None,
+        Query(description="Plain-text substring filter; only matching lines are returned."),
+    ] = None,
+) -> Fail2BanLogResponse:
+    """Return the tail of the fail2ban daemon log file.
+
+    Queries the fail2ban socket for the current log target and log level,
+    reads the last *lines* entries from the file, and optionally filters
+    them by *filter*.  Only file-based log targets are supported.
+
+    Args:
+        request: Incoming request.
+        _auth: Validated session — enforces authentication.
+        lines: Number of tail lines to return (1–2000, default 200).
+        filter: Optional plain-text substring — only matching lines returned.
+
+    Returns:
+        :class:`~app.models.config.Fail2BanLogResponse`.
+
+    Raises:
+        HTTPException: 400 when the log target is not a file or path is outside
+            the allowed directory.
+        HTTPException: 502 when fail2ban is unreachable.
+    """
+    socket_path: str = request.app.state.settings.fail2ban_socket
+    try:
+        return await config_service.read_fail2ban_log(socket_path, lines, filter)
+    except config_service.ConfigOperationError as exc:
+        raise _bad_request(str(exc)) from exc
+    except Fail2BanConnectionError as exc:
+        raise _bad_gateway(exc) from exc
+
+
+@router.get(
+    "/service-status",
+    response_model=ServiceStatusResponse,
+    summary="Return fail2ban service health status with log configuration",
+)
+async def get_service_status(
+    request: Request,
+    _auth: AuthDep,
+) -> ServiceStatusResponse:
+    """Return fail2ban service health and current log configuration.
+
+    Probes the fail2ban daemon to determine online/offline state, then
+    augments the result with the current log level and log target values.
+
+    Args:
+        request: Incoming request.
+        _auth: Validated session — enforces authentication.
+
+    Returns:
+        :class:`~app.models.config.ServiceStatusResponse`.
+
+    Raises:
+        HTTPException: 502 when fail2ban is unreachable (the service itself
+            handles this gracefully and returns ``online=False``).
+    """
+    socket_path: str = request.app.state.settings.fail2ban_socket
+    try:
+        return await config_service.get_service_status(socket_path)
+    except Fail2BanConnectionError as exc:
+        raise _bad_gateway(exc) from exc
+

backend/app/services/config_service.py

@@ -26,6 +26,7 @@ if TYPE_CHECKING:
 from app.models.config import (
     AddLogPathRequest,
     BantimeEscalation,
+    Fail2BanLogResponse,
     GlobalConfigResponse,
     GlobalConfigUpdate,
     JailConfig,
@@ -39,6 +40,7 @@ from app.models.config import (
     MapColorThresholdsUpdate,
     RegexTestRequest,
     RegexTestResponse,
+    ServiceStatusResponse,
 )
 from app.services import setup_service
 from app.utils.fail2ban_client import Fail2BanClient
@@ -754,3 +756,174 @@ async def update_map_color_thresholds(
         threshold_medium=update.threshold_medium,
         threshold_low=update.threshold_low,
     )
+
+
+# ---------------------------------------------------------------------------
+# fail2ban log file reader
+# ---------------------------------------------------------------------------
+
+# Log targets that are not file paths — log viewing is unavailable for these.
+_NON_FILE_LOG_TARGETS: frozenset[str] = frozenset(
+    {"STDOUT", "STDERR", "SYSLOG", "SYSTEMD-JOURNAL"}
+)
+
+# Only allow reading log files under these base directories (security).
+_SAFE_LOG_PREFIXES: tuple[str, ...] = ("/var/log",)
+
+
+def _count_file_lines(file_path: str) -> int:
+    """Count the total number of lines in *file_path* synchronously.
+
+    Uses a memory-efficient buffered read to avoid loading the whole file.
+
+    Args:
+        file_path: Absolute path to the file.
+
+    Returns:
+        Total number of lines in the file.
+    """
+    count = 0
+    with open(file_path, "rb") as fh:
+        for chunk in iter(lambda: fh.read(65536), b""):
+            count += chunk.count(b"\n")
+    return count
+
+
+async def read_fail2ban_log(
+    socket_path: str,
+    lines: int,
+    filter_text: str | None = None,
+) -> Fail2BanLogResponse:
+    """Read the tail of the fail2ban daemon log file.
+
+    Queries the fail2ban socket for the current log target and log level,
+    validates that the target is a readable file, then returns the last
+    *lines* entries optionally filtered by *filter_text*.
+
+    Security: the resolved log path is rejected unless it starts with one of
+    the paths in :data:`_SAFE_LOG_PREFIXES`, preventing path traversal.
+
+    Args:
+        socket_path: Path to the fail2ban Unix domain socket.
+        lines: Number of lines to return from the tail of the file (1–2000).
+        filter_text: Optional plain-text substring — only matching lines are
+            returned.  Applied server-side; does not affect *total_lines*.
+
+    Returns:
+        :class:`~app.models.config.Fail2BanLogResponse`.
+
+    Raises:
+        ConfigOperationError: When the log target is not a file, when the
+            resolved path is outside the allowed directories, or when the
+            file cannot be read.
+        ~app.utils.fail2ban_client.Fail2BanConnectionError: Socket unreachable.
+    """
+    client = Fail2BanClient(socket_path=socket_path, timeout=_SOCKET_TIMEOUT)
+
+    log_level_raw, log_target_raw = await asyncio.gather(
+        _safe_get(client, ["get", "loglevel"], "INFO"),
+        _safe_get(client, ["get", "logtarget"], "STDOUT"),
+    )
+
+    log_level = str(log_level_raw or "INFO").upper()
+    log_target = str(log_target_raw or "STDOUT")
+
+    # Reject non-file targets up front.
+    if log_target.upper() in _NON_FILE_LOG_TARGETS:
+        raise ConfigOperationError(
+            f"fail2ban is logging to {log_target!r}. "
+            "File-based log viewing is only available when fail2ban logs to a file path."
+        )
+
+    # Resolve and validate (security: no path traversal outside safe dirs).
+    try:
+        resolved = Path(log_target).resolve()
+    except (ValueError, OSError) as exc:
+        raise ConfigOperationError(
+            f"Cannot resolve log target path {log_target!r}: {exc}"
+        ) from exc
+
+    resolved_str = str(resolved)
+    if not any(resolved_str.startswith(safe) for safe in _SAFE_LOG_PREFIXES):
+        raise ConfigOperationError(
+            f"Log path {resolved_str!r} is outside the allowed directory. "
+            "Only paths under /var/log are permitted."
+        )
+
+    if not resolved.is_file():
+        raise ConfigOperationError(f"Log file not found: {resolved_str!r}")
+
+    loop = asyncio.get_event_loop()
+
+    total_lines, raw_lines = await asyncio.gather(
+        loop.run_in_executor(None, _count_file_lines, resolved_str),
+        loop.run_in_executor(None, _read_tail_lines, resolved_str, lines),
+    )
+
+    filtered = (
+        [ln for ln in raw_lines if filter_text in ln]
+        if filter_text
+        else raw_lines
+    )
+
+    log.info(
+        "fail2ban_log_read",
+        log_path=resolved_str,
+        lines_requested=lines,
+        lines_returned=len(filtered),
+        filter_active=filter_text is not None,
+    )
+
+    return Fail2BanLogResponse(
+        log_path=resolved_str,
+        lines=filtered,
+        total_lines=total_lines,
+        log_level=log_level,
+        log_target=log_target,
+    )
+
+
+async def get_service_status(socket_path: str) -> ServiceStatusResponse:
+    """Return fail2ban service health status with log configuration.
+
+    Delegates to :func:`~app.services.health_service.probe` for the core
+    health snapshot and augments it with the current log-level and log-target
+    values from the socket.
+
+    Args:
+        socket_path: Path to the fail2ban Unix domain socket.
+
+    Returns:
+        :class:`~app.models.config.ServiceStatusResponse`.
+    """
+    from app.services.health_service import probe  # lazy import avoids circular dep
+
+    server_status = await probe(socket_path)
+
+    if server_status.online:
+        client = Fail2BanClient(socket_path=socket_path, timeout=_SOCKET_TIMEOUT)
+        log_level_raw, log_target_raw = await asyncio.gather(
+            _safe_get(client, ["get", "loglevel"], "INFO"),
+            _safe_get(client, ["get", "logtarget"], "STDOUT"),
+        )
+        log_level = str(log_level_raw or "INFO").upper()
+        log_target = str(log_target_raw or "STDOUT")
+    else:
+        log_level = "UNKNOWN"
+        log_target = "UNKNOWN"
+
+    log.info(
+        "service_status_fetched",
+        online=server_status.online,
+        jail_count=server_status.active_jails,
+    )
+
+    return ServiceStatusResponse(
+        online=server_status.online,
+        version=server_status.version,
+        jail_count=server_status.active_jails,
+        total_bans=server_status.total_bans,
+        total_failures=server_status.total_failures,
+        log_level=log_level,
+        log_target=log_target,
+    )

backend/tests/test_routers/test_config.py

@@ -13,12 +13,14 @@ from app.config import Settings
 from app.db import init_db
 from app.main import create_app
 from app.models.config import (
+    Fail2BanLogResponse,
     FilterConfig,
     GlobalConfigResponse,
     JailConfig,
     JailConfigListResponse,
     JailConfigResponse,
     RegexTestResponse,
+    ServiceStatusResponse,
 )
 
 # ---------------------------------------------------------------------------
@@ -1711,3 +1713,164 @@ class TestRemoveActionFromJailRouter:
         ).delete("/api/config/jails/sshd/action/iptables")
         assert resp.status_code == 401
 
+
+# ---------------------------------------------------------------------------
+# GET /api/config/fail2ban-log
+# ---------------------------------------------------------------------------
+
+
+class TestGetFail2BanLog:
+    """Tests for ``GET /api/config/fail2ban-log``."""
+
+    def _mock_log_response(self) -> Fail2BanLogResponse:
+        return Fail2BanLogResponse(
+            log_path="/var/log/fail2ban.log",
+            lines=["2025-01-01 INFO sshd Found 1.2.3.4", "2025-01-01 ERROR oops"],
+            total_lines=100,
+            log_level="INFO",
+            log_target="/var/log/fail2ban.log",
+        )
+
+    async def test_200_returns_log_response(self, config_client: AsyncClient) -> None:
+        """GET /api/config/fail2ban-log returns 200 with Fail2BanLogResponse."""
+        with patch(
+            "app.routers.config.config_service.read_fail2ban_log",
+            AsyncMock(return_value=self._mock_log_response()),
+        ):
+            resp = await config_client.get("/api/config/fail2ban-log")
+
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["log_path"] == "/var/log/fail2ban.log"
+        assert isinstance(data["lines"], list)
+        assert data["total_lines"] == 100
+        assert data["log_level"] == "INFO"
+
+    async def test_200_passes_lines_query_param(self, config_client: AsyncClient) -> None:
+        """GET /api/config/fail2ban-log passes the lines query param to the service."""
+        with patch(
+            "app.routers.config.config_service.read_fail2ban_log",
+            AsyncMock(return_value=self._mock_log_response()),
+        ) as mock_fn:
+            resp = await config_client.get("/api/config/fail2ban-log?lines=500")
+
+        assert resp.status_code == 200
+        _socket, lines_arg, _filter = mock_fn.call_args.args
+        assert lines_arg == 500
+
+    async def test_200_passes_filter_query_param(self, config_client: AsyncClient) -> None:
+        """GET /api/config/fail2ban-log passes the filter query param to the service."""
+        with patch(
+            "app.routers.config.config_service.read_fail2ban_log",
+            AsyncMock(return_value=self._mock_log_response()),
+        ) as mock_fn:
+            resp = await config_client.get("/api/config/fail2ban-log?filter=ERROR")
+
+        assert resp.status_code == 200
+        _socket, _lines, filter_arg = mock_fn.call_args.args
+        assert filter_arg == "ERROR"
+
+    async def test_400_when_non_file_target(self, config_client: AsyncClient) -> None:
+        """GET /api/config/fail2ban-log returns 400 when log target is not a file."""
+        from app.services.config_service import ConfigOperationError
+
+        with patch(
+            "app.routers.config.config_service.read_fail2ban_log",
+            AsyncMock(side_effect=ConfigOperationError("fail2ban is logging to 'STDOUT'")),
+        ):
+            resp = await config_client.get("/api/config/fail2ban-log")
+
+        assert resp.status_code == 400
+
+    async def test_400_when_path_traversal_detected(self, config_client: AsyncClient) -> None:
+        """GET /api/config/fail2ban-log returns 400 when the path is outside safe dirs."""
+        from app.services.config_service import ConfigOperationError
+
+        with patch(
+            "app.routers.config.config_service.read_fail2ban_log",
+            AsyncMock(side_effect=ConfigOperationError("outside the allowed directory")),
+        ):
+            resp = await config_client.get("/api/config/fail2ban-log")
+
+        assert resp.status_code == 400
+
+    async def test_502_when_fail2ban_unreachable(self, config_client: AsyncClient) -> None:
+        """GET /api/config/fail2ban-log returns 502 when fail2ban is down."""
+        from app.utils.fail2ban_client import Fail2BanConnectionError
+
+        with patch(
+            "app.routers.config.config_service.read_fail2ban_log",
+            AsyncMock(side_effect=Fail2BanConnectionError("socket error", "/tmp/f.sock")),
+        ):
+            resp = await config_client.get("/api/config/fail2ban-log")
+
+        assert resp.status_code == 502
+
+    async def test_422_for_lines_exceeding_max(self, config_client: AsyncClient) -> None:
+        """GET /api/config/fail2ban-log returns 422 for lines > 2000."""
+        resp = await config_client.get("/api/config/fail2ban-log?lines=9999")
+        assert resp.status_code == 422
+
+    async def test_401_when_unauthenticated(self, config_client: AsyncClient) -> None:
+        """GET /api/config/fail2ban-log requires authentication."""
+        resp = await AsyncClient(
+            transport=ASGITransport(app=config_client._transport.app),  # type: ignore[attr-defined]
+            base_url="http://test",
+        ).get("/api/config/fail2ban-log")
+        assert resp.status_code == 401
+
+
+# ---------------------------------------------------------------------------
+# GET /api/config/service-status
+# ---------------------------------------------------------------------------
+
+
+class TestGetServiceStatus:
+    """Tests for ``GET /api/config/service-status``."""
+
+    def _mock_status(self, online: bool = True) -> ServiceStatusResponse:
+        return ServiceStatusResponse(
+            online=online,
+            version="1.0.0" if online else None,
+            jail_count=2 if online else 0,
+            total_bans=10 if online else 0,
+            total_failures=3 if online else 0,
+            log_level="INFO" if online else "UNKNOWN",
+            log_target="/var/log/fail2ban.log" if online else "UNKNOWN",
+        )
+
+    async def test_200_when_online(self, config_client: AsyncClient) -> None:
+        """GET /api/config/service-status returns 200 with full status when online."""
+        with patch(
+            "app.routers.config.config_service.get_service_status",
+            AsyncMock(return_value=self._mock_status(online=True)),
+        ):
+            resp = await config_client.get("/api/config/service-status")
+
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["online"] is True
+        assert data["jail_count"] == 2
+        assert data["log_level"] == "INFO"
+
+    async def test_200_when_offline(self, config_client: AsyncClient) -> None:
+        """GET /api/config/service-status returns 200 with offline=False when daemon is down."""
+        with patch(
+            "app.routers.config.config_service.get_service_status",
+            AsyncMock(return_value=self._mock_status(online=False)),
+        ):
+            resp = await config_client.get("/api/config/service-status")
+
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["online"] is False
+        assert data["log_level"] == "UNKNOWN"
+
+    async def test_401_when_unauthenticated(self, config_client: AsyncClient) -> None:
+        """GET /api/config/service-status requires authentication."""
+        resp = await AsyncClient(
+            transport=ASGITransport(app=config_client._transport.app),  # type: ignore[attr-defined]
+            base_url="http://test",
+        ).get("/api/config/service-status")
+        assert resp.status_code == 401
+

backend/tests/test_services/test_config_service.py

@@ -604,3 +604,145 @@ class TestPreviewLog:
         result = await config_service.preview_log(req)
 
         assert result.total_lines <= 50
+
+
+# ---------------------------------------------------------------------------
+# read_fail2ban_log
+# ---------------------------------------------------------------------------
+
+
+class TestReadFail2BanLog:
+    """Tests for :func:`config_service.read_fail2ban_log`."""
+
+    def _patch_client(self, log_level: str = "INFO", log_target: str = "/var/log/fail2ban.log") -> Any:
+        """Build a patched Fail2BanClient that returns *log_level* and *log_target*."""
+        async def _send(command: list[Any]) -> Any:
+            key = "|".join(str(c) for c in command)
+            if key == "get|loglevel":
+                return (0, log_level)
+            if key == "get|logtarget":
+                return (0, log_target)
+            return (0, None)
+
+        class _FakeClient:
+            def __init__(self, **_kw: Any) -> None:
+                self.send = AsyncMock(side_effect=_send)
+
+        return patch("app.services.config_service.Fail2BanClient", _FakeClient)
+
+    async def test_returns_log_lines_from_file(self, tmp_path: Any) -> None:
+        """read_fail2ban_log returns lines from the file and counts totals."""
+        log_file = tmp_path / "fail2ban.log"
+        log_file.write_text("line1\nline2\nline3\n")
+        log_dir = str(tmp_path)
+
+        # Patch _SAFE_LOG_PREFIXES to allow tmp_path
+        with self._patch_client(log_target=str(log_file)), \
+             patch("app.services.config_service._SAFE_LOG_PREFIXES", (log_dir,)):
+            result = await config_service.read_fail2ban_log(_SOCKET, 200)
+
+        assert result.log_path == str(log_file.resolve())
+        assert result.total_lines >= 3
+        assert any("line1" in ln for ln in result.lines)
+        assert result.log_level == "INFO"
+
+    async def test_filter_narrows_returned_lines(self, tmp_path: Any) -> None:
+        """read_fail2ban_log filters lines by substring."""
+        log_file = tmp_path / "fail2ban.log"
+        log_file.write_text("INFO sshd Found 1.2.3.4\nERROR something else\nINFO sshd Found 5.6.7.8\n")
+        log_dir = str(tmp_path)
+
+        with self._patch_client(log_target=str(log_file)), \
+             patch("app.services.config_service._SAFE_LOG_PREFIXES", (log_dir,)):
+            result = await config_service.read_fail2ban_log(_SOCKET, 200, "Found")
+
+        assert all("Found" in ln for ln in result.lines)
+        assert result.total_lines >= 3  # total is unfiltered
+
+    async def test_non_file_target_raises_operation_error(self) -> None:
+        """read_fail2ban_log raises ConfigOperationError for STDOUT target."""
+        with self._patch_client(log_target="STDOUT"), \
+             pytest.raises(config_service.ConfigOperationError, match="STDOUT"):
+            await config_service.read_fail2ban_log(_SOCKET, 200)
+
+    async def test_syslog_target_raises_operation_error(self) -> None:
+        """read_fail2ban_log raises ConfigOperationError for SYSLOG target."""
+        with self._patch_client(log_target="SYSLOG"), \
+             pytest.raises(config_service.ConfigOperationError, match="SYSLOG"):
+            await config_service.read_fail2ban_log(_SOCKET, 200)
+
+    async def test_path_outside_safe_dir_raises_operation_error(self, tmp_path: Any) -> None:
+        """read_fail2ban_log rejects a log_target outside allowed directories."""
+        log_file = tmp_path / "secret.log"
+        log_file.write_text("secret data\n")
+
+        # Allow only /var/log — tmp_path is deliberately not in the safe list.
+        with self._patch_client(log_target=str(log_file)), \
+             patch("app.services.config_service._SAFE_LOG_PREFIXES", ("/var/log",)), \
+             pytest.raises(config_service.ConfigOperationError, match="outside the allowed"):
+            await config_service.read_fail2ban_log(_SOCKET, 200)
+
+    async def test_missing_log_file_raises_operation_error(self, tmp_path: Any) -> None:
+        """read_fail2ban_log raises ConfigOperationError when the file does not exist."""
+        missing = str(tmp_path / "nonexistent.log")
+        log_dir = str(tmp_path)
+
+        with self._patch_client(log_target=missing), \
+             patch("app.services.config_service._SAFE_LOG_PREFIXES", (log_dir,)), \
+             pytest.raises(config_service.ConfigOperationError, match="not found"):
+            await config_service.read_fail2ban_log(_SOCKET, 200)
+
+
+# ---------------------------------------------------------------------------
+# get_service_status
+# ---------------------------------------------------------------------------
+
+
+class TestGetServiceStatus:
+    """Tests for :func:`config_service.get_service_status`."""
+
+    async def test_online_status_includes_log_config(self) -> None:
+        """get_service_status returns correct fields when fail2ban is online."""
+        from app.models.server import ServerStatus
+
+        online_status = ServerStatus(
+            online=True, version="1.0.0", active_jails=2, total_bans=5, total_failures=3
+        )
+
+        async def _send(command: list[Any]) -> Any:
+            key = "|".join(str(c) for c in command)
+            if key == "get|loglevel":
+                return (0, "DEBUG")
+            if key == "get|logtarget":
+                return (0, "/var/log/fail2ban.log")
+            return (0, None)
+
+        class _FakeClient:
+            def __init__(self, **_kw: Any) -> None:
+                self.send = AsyncMock(side_effect=_send)
+
+        with patch("app.services.config_service.Fail2BanClient", _FakeClient), \
+             patch("app.services.health_service.probe", AsyncMock(return_value=online_status)):
+            result = await config_service.get_service_status(_SOCKET)
+
+        assert result.online is True
+        assert result.version == "1.0.0"
+        assert result.jail_count == 2
+        assert result.total_bans == 5
+        assert result.total_failures == 3
+        assert result.log_level == "DEBUG"
+        assert result.log_target == "/var/log/fail2ban.log"
+
+    async def test_offline_status_returns_unknown_log_fields(self) -> None:
+        """get_service_status returns 'UNKNOWN' log fields when fail2ban is offline."""
+        from app.models.server import ServerStatus
+
+        offline_status = ServerStatus(online=False)
+
+        with patch("app.services.health_service.probe", AsyncMock(return_value=offline_status)):
+            result = await config_service.get_service_status(_SOCKET)
+
+        assert result.online is False
+        assert result.jail_count == 0
+        assert result.log_level == "UNKNOWN"
+        assert result.log_target == "UNKNOWN"