Actuator and health checks

Key points

• Add spring-boot-starter-actuator and you get operational endpoints under /actuator.
• Only health is exposed over HTTP by default. Opt the others in explicitly — they leak internals.
• /actuator/health aggregates contributors: database, disk space, Redis, and any you add.
• Enable probes for /actuator/health/liveness and /readiness. Failing readiness pulls the pod out of rotation.
• Never expose env, heapdump or configprops publicly. Put actuator on a separate port or behind auth.
• Add micrometer-registry-prometheus and /actuator/prometheus serves scrapeable metrics.

Example

management:
  endpoints:
    web:
      exposure:
        include: health,info,metrics,prometheus   # explicit allow-list
  endpoint:
    health:
      show-details: when_authorized
      probes:
        enabled: true          # adds /health/liveness and /health/readiness
  server:
    port: 9090                 # separate port: keep ops traffic off the public one
  metrics:
    tags:
      application: ${spring.application.name}

# Custom check:
# @Component
# class PaymentGatewayHealth implements HealthIndicator {
#     public Health health() {
#         return gateway.ping() ? Health.up().build()
#                               : Health.down().withDetail("gateway", "unreachable").build();
#     }
# }

Health endpoints are for your platform, not the public internet — expose deliberately.