example inside FOO_VAR.env
located somewhere in your secret folder

PROD_DB_USERNAME = "foobar"
PROD_DB_PASSWORD = "veryveryharduncrackablepassword"
PROD_DB_HOST = "localhost"
PROD_DSN = "mysql:host=localhost;dbname=something_db"

then in your web/index.php

<?php
// comment out the following two lines when deployed to production
defined('YII_DEBUG') or define('YII_DEBUG', true);
defined('YII_ENV') or define('YII_ENV', 'dev');
require(__DIR__ . '/../vendor/autoload.php');
require(__DIR__ . '/../vendor/yiisoft/yii2/Yii.php');
# load the environment before loading the configuration
(new Dotenv\Dotenv(dirname(__FILE__)  .  '/../' ,  'APP_DEV.env' ))->load();
$config = require(__DIR__ . '/../config/web.php');
(new yii\web\Application($config))->run();

then inside your config/db.php

$dbConf = [
    'class' => 'yii\db\Connection',
    'dsn' => getenv('PROD_DSN'),
    'username' => getenv('PROD_DB_USERNAME'),
    'password' => getenv('PROD_DB_PASSWORD'),
    'charset' => 'utf8',
];
return $dbConf;