proper place to keep userid and password for mysql

I am glad I asked!
/opt/docker-substantiator
    /apache
    /app
        /application
            /cache
            /config
            /controllers
            /core
            .
            .
        /assets
        /css
        /images
        /js
        /system
        /uploads
        /vendor
        composer.json
        index.php
    /mysql
    /php
    docker-compose.yml
    .env


I think my document root is /app. What do I need to do?

proof that an old dog can learn new tricks