Spring Boot 4 Actuator in production: endpoints, security, custom health indicators

Companion repository for the ankurm.com article. Every transcript in docs/output/
was produced by running this project; scripts/run-all.sh regenerates all of them.

Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 /
Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.

scripts/demo-slow-indicator.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# A health indicator with no timeout, and what it does to the endpoint.
+set -uo pipefail
+cd "$(dirname "$0")/.."
+OUT=docs/output/10-slow-upstream.txt
+B=http://localhost:8080
+{
+  echo "### profile: details    upstream deliberately sleeping 30s per request"
+  echo "### demo.upstream.timeout-ms = 750, so the indicator gives up long before the stub replies"
+  echo
+  curl -s -o /dev/null -u ops:ops-password -X POST "$B/stub/upstream/mode?value=slow"
+  sleep 1
+  echo "\$ time curl -s $B/actuator/health/externalApi"
+  s=$(date +%s.%N)
+  curl -s -u ops:ops-password --max-time 60 "$B/actuator/health/externalApi" | python3 -m json.tool
+  e=$(date +%s.%N)
+  printf 'wall clock: %.2f s\n' "$(echo "$e - $s" | bc)"
+  echo
+  echo "  The read timeout is what bounds this, not the endpoint. Remove setReadTimeout from"
+  echo "  ExternalApiHealthIndicator and this call blocks for the full 30 seconds, holding a"
+  echo "  Tomcat worker the whole time."
+  curl -s -o /dev/null -u ops:ops-password -X POST "$B/stub/upstream/mode?value=up"
+} > "$OUT" 2>&1
+echo "wrote $OUT"