Spring Boot 4 Actuator in production: endpoints, security, custom health indicators

Companion repository for the ankurm.com article. Every transcript in docs/output/
was produced by running this project; scripts/run-all.sh regenerates all of them.

Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 /
Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.

scripts/demo-secured.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# The authorisation matrix produced by SecuredActuatorConfig.
+set -uo pipefail
+cd "$(dirname "$0")/.."
+OUT=docs/output/05-secured-matrix.txt
+B=http://localhost:8080/actuator
+probe() { # $1 label, $2 path, $3 curl auth args...
+  local label="$1" path="$2"; shift 2
+  printf '  %-46s %s\n' "$label" "$(curl -s -o /dev/null -w '%{http_code}' "$@" "$B/$path")"
+}
+{
+  echo "### profile: secured    (SecuredActuatorConfig + application-secured.yaml)"
+  echo "### exposure is \"*\" - the security chain, not the exposure list, is what protects it"
+  echo
+  echo "ANONYMOUS"
+  probe "GET /actuator/health"              health
+  probe "GET /actuator/info"                info
+  probe "GET /actuator/env"                 env
+  probe "GET /actuator/beans"               beans
+  probe "GET /actuator/threaddump"          threaddump
+  probe "GET /actuator  (the links index)"  ""
+  echo
+  echo "AUTHENTICATED as ops (ROLE_ACTUATOR)"
+  probe "GET /actuator/health"     health     -u ops:ops-password
+  probe "GET /actuator/env"        env        -u ops:ops-password
+  probe "GET /actuator/beans"      beans      -u ops:ops-password
+  probe "GET /actuator/threaddump" threaddump -u ops:ops-password
+  echo
+  echo "WRONG PASSWORD"
+  probe "GET /actuator/env"        env        -u ops:wrong
+  echo
+  echo "--- health body, anonymous (show-details: when-authorized) ---"
+  curl -s "$B/health" | python3 -m json.tool
+  echo
+  echo "--- health body, authenticated as ROLE_ACTUATOR ---"
+  curl -s -u ops:ops-password "$B/health" | python3 -m json.tool
+  echo
+  echo "  Same endpoint, same status code, different body. An anonymous prober learns that the"
+  echo "  service is unhealthy but not WHICH dependency is unhealthy."
+  echo
+  echo "--- the business endpoint is untouched by the actuator chain ---"
+  printf '  %-46s %s\n' "GET /orders/count (anonymous)" \
+    "$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8080/orders/count)"
+} > "$OUT" 2>&1
+echo "wrote $OUT"