Lumen and PHP-FPM: where should production configuration enter?

Assuming Lumen 5.8 deployed behind Nginx with PHP-FPM, the goal is to define one authoritative source for production configuration without masking values supplied by the hosting layer. Lumen supports loading a .env file during bootstrap, while PHP-FPM can also expose environment variables to worker processes.

The integration boundary is not fully determined by Lumen alone. Process configuration, the application’s working directory, and whether configuration caching is enabled can affect which values are available. A configuration that works locally therefore does not establish the production source or precedence.

The deployment contract should keep secrets out of version control, avoid exposing values through diagnostics, and make a non-sensitive configuration key comparable across environments. A minimal endpoint could support that cross-environment check without revealing credentials.

Should PHP-FPM environment variables be the authoritative production source, with .env reserved for local defaults, or should production rely on a securely provisioned .env file? When configuration caching is enabled, what source precedence should the deployment contract require?