What core configurations should be used in settings.php for a production site? Can someone please share Drupal core configurations that should be included and/or excluded from settings.php to make the site both performant and secure?
Drupal 8 has a default settings.php you can use:

sites/default/default.settings.php


Just copy it as sites/default/settings.php, add your DB connection array - and you are pretty much ready to go. Then use the UI to turn on caching and CSS/JS aggregation. 

For security you may want to add in your Trusted Host Pattern

# TRUSTED HOST PROD
$settings['trusted_host_patterns'] = [
  'mysite\.com$',
];


If you really want to you can lock down your caching &amp; preprocessing settings in the settings.php file, rather than setting it through the UI

# CACHING &amp; JS/CSS AGGREGATION PROD
$config['system.performance']['css']['preprocess'] = 1;
$config['system.performance']['css']['gzip'] = 1;
$config['system.performance']['js']['preprocess'] = 1;
$config['system.performance']['js']['gzip'] = 1;
$config['system.performance']['cache']['page']['max_age'] = 86400;