@evan the answer as with some things, is that it depends.
I would say credentials such as database details should only exist as env variables or config file; they may be useful for testing if allowed to be set via cli args and only ever via a web interface if its an installer.
For things such as pagination_n_items having them settable by all of the above is fine, with a web interface being the overrider.