When variables expand inside a here-doc

Config templates written with here-docs depend on whether the delimiter is quoted:

cat <<EOF
host=$HOST
EOF

With a bare EOF, $HOST expands; <<'EOF' prints it literally. The same quoting also disables command substitution.

Traps: <<-EOF strips tabs but not spaces, so indentation may still land in the file. Under sudo, the here-doc is expanded by your current shell before sudo runs, not by the target user's environment. And with set -u, an unset variable aborts the script — use ${VAR:-default} in templates.

Run bash -n afterwards, or print to stdout once before redirecting.