### Spring Boot Actuator, starter added, ZERO management.* configuration

$ curl -s -u ops:ops-password http://localhost:8080/actuator
{
    "_links": {
        "self": {
            "href": "http://localhost:8080/actuator",
            "templated": false
        },
        "health": {
            "href": "http://localhost:8080/actuator/health",
            "templated": false
        },
        "health-path": {
            "href": "http://localhost:8080/actuator/health/{*path}",
            "templated": true
        }
    }
}

$ curl -s -o /dev/null -w '%{http_code}' -u ops:ops-password http://localhost:8080/actuator/env
404
  404 = discovered but NOT exposed over HTTP. Exposure and existence are different things.

$ curl -s -u ops:ops-password http://localhost:8080/actuator/health
{
    "groups": [
        "liveness",
        "readiness"
    ],
    "status": "DOWN"
}

  Only 'health' is web-exposed by default. show-details defaults to 'never', so even an
  authenticated caller sees a bare status until you say otherwise.