How to indent an heredoc inside an heredoc the right way?

A here-document is a redirection of the form:

<<[-]DELIMITER
    ....
    ....
    ....
DELIMITER

The optional - (inside the brackets above) changes the way the delimiter is matched and allows indenting each line inside the heredoc content, with tabulations (no spaces allowed).

• _{"Matched" means the delimiter is matched to the opener (as when DELIMITER matches <<DELIMITER or <<-DELIMITER, for example).}

• _{Note that you may use one or more spaces between << or <<-, and the word that follows).}

So to sum up the basic laws for matching inside a singlar heredoc:

1. The opener must be placed at the very beginning of the line in an applicable syntax.
2. The delimiter must be the only word of its line.
3. All content under the opener (including the delimiter) can be indented with any number of tabulations, with the <<-DELIMITER syntax.

---

Since with the former syntax, no blanks can precede the heredoc opener, if you want to indent it, your only choice is to use the following syntax and you must exclusively use tabulations at the beginning of each line inside the heredoc's content.

Now you have two options with the <<- syntax.

First option

Use the <<- syntax for the inner heredoc.

bash << APACHE
    ... 
    ... 
    cat <<- MOD_REWRITE
⇨       ...     
⇨       ....    
⇨       MOD_REWRITE
    ... 
    ... 
APACHE

(indentation is 4 spaces, tabulations are symbolized with ⇨)

The code seen by bash will be exactly what is written on your screen (i.e. bash will see the indentation of each line as you see it now). When the inner heredoc is met, owing to the <<- syntax, bash will strip the tabulation characters leading each line until the MOD_REWRITE delimiter.

Second option

Use the <<- syntax for the outer heredoc.

bash <<- APACHE
⇨       ...
⇨       ...
⇨       cat << MOD_REWRITE
⇨       ⇨       ...
⇨       ⇨       ....
⇨       MOD_REWRITE
⇨       ...
⇨       ...
APACHE

This time, the code seen by bash will differ from what you see: it won't contain any leading tabulation. That's why this is not a problem that I use the << syntax for the inner heredoc: the MOD_REWRITE delimiter will be at the beginning of the line.

In both cases, the MOD_REWRITE delimiter is recognized and your Apache configuration file /etc/apache2/apache2.conf is not indented. If you want to indent parts of it, your only option is to use spaces (after the initial tabulations that will be stripped).

Of course, there is a third option: to use the <<- syntax for both heredocs, but that won't change anything from option 2 since all the leading tabulations are removed when the code is sent to bash.

First of all, indenting the cat line and the subsequent lines (except the line with the NGINX terminator) should work. The leading indentation within the document will be preserved in the output, which may or may not be an issue in your case (if the output is indeed HTML, there is a chance it does not matter if extra whitespace is introduced).

Also, the Bash documentation says this:

The format of here-documents is:

       <<[-]word
               here-document
       delimiter

[...]

If the redirection operator is <<-, then all leading tab characters are
stripped from input lines and  the  line  containing  delimiter.   This
allows  here-documents within shell scripts to be indented in a natural
fashion.

So you could use <<-'PHP_FPM' and indent each of the lines that follow with tabs, which would get stripped by the redirection.