proper place to keep userid and password for mysql

You can find the information in the Docs, on what you need to change to be able to move the application and system folder.
https://codeigniter.com/user_guide/insta...index.html

On my Docker install on my laptop base url= 'http://localhost' is aok. I really only have a local install so far. 

When I finally put the whole thing up on my server, the base url will be different.  It seems to be saying to just set my view folder to point outside the application folder. That I can do and reset the $view_folder in index.php.  But right now the userid and password of the mysql sit in .env. This is ABOVE the app directory. 
/opt
    /docker-substantiator
        .env
        /app     <<<includes the /application, /system, /vendor, etc

So .env is not accessible from doc root. Is that sufficient for holding my passwords? Must /system be moved?

proof that an old dog can learn new tricks