Configuration files, typically in (or under) /etc or /usr/local/etc would be my choice. For packages installing in /opt/package, /opt/etc and /opt/package/etc are acceptable as well. For applications where it make sense, they could first look for a configuration file in the current directory, the users home directory, and /etc, using the first one they find. Or the other ways around, using all the find (with later ones overwriting previous values). Sophisticated apps could allow the use of environment variables and/or command line switches to overrule which configuration file to use.

I'd generally frown upon using configuration files that need to be retrieved over the network. Not only does that mean that if the service providing the configuration file isn't reachable, your applications cannot start (you're introducing a single point of failure), you'd still need a local configuration file anyway, because at least you need to configure where applications can find their configuration from.

A configuration file in a central location would be simple, but then anyone could read it, could see how to connect to the databases, etc.

That's what file permissions/ACLs are for.