Spring Boot 4 Actuator in production: endpoints, security, custom health indicators

Companion repository for the ankurm.com article. Every transcript in docs/output/
was produced by running this project; scripts/run-all.sh regenerates all of them.

Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 /
Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.

docs/output/01-default-exposure.txt

@@ -0,0 +1,35 @@
+### Spring Boot Actuator, starter added, ZERO management.* configuration
+
+$ curl -s -u ops:ops-password http://localhost:8080/actuator
+{
+    "_links": {
+        "self": {
+            "href": "http://localhost:8080/actuator",
+            "templated": false
+        },
+        "health": {
+            "href": "http://localhost:8080/actuator/health",
+            "templated": false
+        },
+        "health-path": {
+            "href": "http://localhost:8080/actuator/health/{*path}",
+            "templated": true
+        }
+    }
+}
+
+$ curl -s -o /dev/null -w '%{http_code}' -u ops:ops-password http://localhost:8080/actuator/env
+404
+  404 = discovered but NOT exposed over HTTP. Exposure and existence are different things.
+
+$ curl -s -u ops:ops-password http://localhost:8080/actuator/health
+{
+    "groups": [
+        "liveness",
+        "readiness"
+    ],
+    "status": "DOWN"
+}
+
+  Only 'health' is web-exposed by default. show-details defaults to 'never', so even an
+  authenticated caller sees a bare status until you say otherwise.