Spring Boot 4 Actuator in production: endpoints, security, custom health indicators

Companion repository for the ankurm.com article. Every transcript in docs/output/
was produced by running this project; scripts/run-all.sh regenerates all of them.

Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 /
Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.

scripts/demo-groups-probes.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Health groups: keeping a dependency outage out of the liveness probe.
+set -uo pipefail
+cd "$(dirname "$0")/.."
+OUT=docs/output/08-groups-and-probes.txt
+B=http://localhost:8080/actuator/health
+{
+  echo "### profile: groups"
+  echo
+  echo "--- baseline: upstream UP ---"
+  for g in "" liveness readiness startup; do
+    u="$B${g:+/$g}"
+    printf '  %-40s HTTP %s\n' "GET ${u#http://localhost:8080}" "$(curl -s -o /dev/null -w '%{http_code}' -u ops:ops-password "$u")"
+  done
+  echo
+  echo "--- upstream DOWN (a third party is having an outage) ---"
+  curl -s -o /dev/null -u ops:ops-password -X POST "http://localhost:8080/stub/upstream/mode?value=down"
+  sleep 1
+  for g in "" liveness readiness startup; do
+    u="$B${g:+/$g}"
+    printf '  %-40s HTTP %s\n' "GET ${u#http://localhost:8080}" "$(curl -s -o /dev/null -w '%{http_code}' -u ops:ops-password "$u")"
+  done
+  echo
+  echo "  liveness stayed 200. readiness went 503."
+  echo "  Kubernetes takes this instance out of the Service and leaves the process alone."
+  echo "  Wire readiness to /actuator/health and you get a restart loop instead."
+  echo
+  echo "--- what each group contains ---"
+  echo "\$ curl -s $B/liveness"
+  curl -s -u ops:ops-password "$B/liveness" | python3 -m json.tool
+  echo "\$ curl -s $B/readiness"
+  curl -s -u ops:ops-password "$B/readiness" | python3 -m json.tool
+  echo
+  curl -s -o /dev/null -u ops:ops-password -X POST "http://localhost:8080/stub/upstream/mode?value=up"
+} > "$OUT" 2>&1
+echo "wrote $OUT"