Without index.php in permalinks I get 404 across site

As the title says, when I change my permalinks in the admin, all my pages return a 404 (except homepage). I have to inlclude index.php as the start of all the different paths. The paths all work fine, if I include index.php.

For example:

Custom structure: /index.php/%postname%/%day%/ will work as I navigate my site.
Custom structure: /%postname%/%day%/ will not work (except homepage).

mod_rewrite is enabled on the server:

$ sudo a2enmod rewrite
Module rewrite already enabled

I have a .htaccess file:

$cat /var/www/directory_name/.htaccess
# BEGIN WordPress
# The directives (lines) between `BEGIN WordPress` and `END WordPress` are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

…and it is writeable by the web server:

$ ls -al
-rwxr-xr-x  1 www-data www-data   461 Dec  3 14:11 .htaccess

My apache config:

$ cat /etc/apache2/sites-enabled/domain.conf
<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    ServerName mydomain.com
    ServerAlias www.mydomain.com
    DocumentRoot /var/www/domain
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =domain.com [OR]
RewriteCond %{SERVER_NAME} =www.domain.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
<Directory /var/www/domain/>
    AllowOverride All
    Options +FollowSymLinks
    Require all granted
</Directory>
</VirtualHost>

$cat /etc/apache2/sites-enabled/domain-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerAdmin webmaster@localhost
    ServerName domain.com
    ServerAlias www.domain.com
    DocumentRoot /var/www/domain
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/domain.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/domain.com/privkey.pem
</VirtualHost>
</IfModule>

Adding junk doesn’t do anything either.

That suggests your .htaccess file is not being processed at all. You need to set AllowOverride All in the appropriate <Directory> container in the main server config (or <VirtualHost> container) to enable the parsing of per-directory .htaccess files (to allow .htaccess directives to override the server config).

The FollowSymLinks (or SymLinksIfOwnerMatch) options also need to be enabled for mod_rewrite to function. (Although FollowSymLinks is enabled by default.) This can be enabled in the server config or .htaccess file.

For example:

<Directory /var/www/directory_name>
    AllowOverride All
    Options +FollowSymLinks

    # etc...    

    Require all granted
</Directory>

Where /var/www/directory_name is your DocumentRoot and location of the .htaccess file.

Strictly speaking, you only need AllowOverride FileInfo to enable the use of mod_rewrite in .htaccess. However, you would need to enable more groups if you later used authorization directives, directory listings, etc.

As always, after making any changes to the server config you need to restart Apache for the changes to take effect.

UPDATE: Perhaps there is an issue with my SSL conf?

Since you are redirecting everything to HTTPS in your server config, you need to apply the above <Directory> section to your <VirtualHost *:443> container. Applying this to <VirtualHost *:80> (ie. HTTP) is not required and will do nothing here.

Aside:

RewriteEngine on
RewriteCond %{SERVER_NAME} =domain.com [OR]
RewriteCond %{SERVER_NAME} =www.domain.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

Your HTTP to HTTPS redirect is overly complex and can be simplified to a single mod_alias Redirect directive – the additional overhead of mod_rewrite is not required here.

You should also canonicalise the hostname (www or non-www) here also.

For example:

Redirect 301 / https://www.example.com/