Spring Boot 4 Actuator in production: endpoints, security, custom health indicators

Companion repository for the ankurm.com article. Every transcript in docs/output/
was produced by running this project; scripts/run-all.sh regenerates all of them.

Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 /
Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.

docs/01-what-actuator-exposes.md

@@ -0,0 +1,57 @@
+[← README](../README.md) · **01 · What Actuator actually exposes** · [02 What changed in Spring Boot 4 →](02-boot-4-changes.md)
+
+# 01 — What Actuator actually exposes
+
+Add the starter, configure nothing, and ask the application what it publishes.
+
+```xml
+<dependency>
+  <groupId>org.springframework.boot</groupId>
+  <artifactId>spring-boot-starter-actuator</artifactId>
+</dependency>
+```
+
+The answer, from [`../docs/output/01-default-exposure.txt`](output/01-default-exposure.txt):
+
+```json
+{"_links":{"self":{...},"health":{...},"health-path":{...}}}
+```
+
+One endpoint. `GET /actuator/env` returns **404**, not 403 — it was discovered, it exists as a
+JMX endpoint, and it is simply not mapped onto HTTP.
+
+That distinction matters more than it looks:
+
+- **Discovery** — Actuator finds every `@Endpoint` bean on the classpath.
+- **Access** (`management.endpoint.<id>.access`) — whether the endpoint may be operated at all.
+  Defaults to `unrestricted` for everything except `heapdump` and `shutdown`.
+- **Exposure** (`management.endpoints.web.exposure.include`) — whether it is mapped onto HTTP.
+  Defaults to `health` only.
+
+All three have to line up. A 404 from an Actuator path tells you nothing about whether the
+endpoint is enabled, and people read it as "it's off" when it is often "it's on, over JMX".
+
+## The default health body
+
+```json
+{"groups":["liveness","readiness"],"status":"DOWN"}
+```
+
+Two things to notice.
+
+**The groups are there by default.** In Spring Boot 3 the liveness and readiness probes only
+appeared when you asked for them or when Boot detected Kubernetes. In Boot 4 they are enabled
+out of the box — see [chapter 02](02-boot-4-changes.md).
+
+**`show-details` defaults to `never`**, so even an authenticated caller sees a bare status. That
+is a sensible default and almost everyone overrides it to `always` without thinking about who
+can reach the endpoint. [Chapter 04](04-securing-actuator.md) covers the middle option.
+
+**The status is `DOWN`** because this repository registers a Kafka indicator and there is no
+broker. One custom indicator that touches a third party is all it takes to turn the default
+`/actuator/health` red — and that URL is what most Kubernetes manifests point their readiness
+*and* liveness probes at. [Chapter 07](07-groups-and-probes.md) is about not doing that.
+
+---
+
+[← README](../README.md) · **01** · [02 What changed in Spring Boot 4 →](02-boot-4-changes.md)