If the PHP code is handling the subdomain rules by itself, there's no need to overcomplicate the Apache configuration. This is what I do for my PHP projects that support multiple addresses:
<VirtualHost *:80>
ServerAdmin your@email.addy
DocumentRoot /var/www/project/public
ServerName website.com
ServerAlias *.website.com *.* *.*.*
DirectoryIndex index.php index.html
ErrorLog ${APACHE_LOG_DIR}/project-error.log
CustomLog ${APACHE_LOG_DIR}/project-access.log combined
</VirtualHost>
<Directory /var/www/project/public>
Options FollowSymLinks
AllowOverride All
Order Allow,Deny
Allow From All
</Directory>
Note the multiple wildcards in the ServerAlias
line. This will allow the server to respond to all traffic, even if the domain is not known by the application (which then allows for a PHP-based redirect to other capture process).
I generally keep rewrite rules out of the Apache configuration an instead put them in an .htaccess
file, which I understand you do not currently use. Experience has shown that keeping rewrites out of the configuration file results in fewer "weird situations".
This is how I configure the .htaccess
file that is used for projects with the Apache configuration found above:
Options +MultiViews +FollowSymLinks
Options -Indexes
DirectoryIndex index.php
RewriteEngine On
RewriteBase /
RewriteCond %{SCRIPT_FILENAME} !-d
RewriteCond %{SCRIPT_FILENAME} !-f
RewriteRule ^.*$ ./index.php
Header always edit Set-Cookie (.*) "$1; SameSite=None; Secure"
<filesMatch "\.(ico|css|js|pdf|jpg|jpeg|png|gif)$">
Header set Cache-Control "max-age=1209600, public"
</FilesMatch>
<FilesMatch "\.(htaccess|htpasswd|inc|log|sql|user|token)$">
Order Allow,Deny
Deny from all
</FilesMatch>
<ifModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/html text/xml text/css text/plain
AddOutputFilterByType DEFLATE image/svg+xml application/xhtml+xml application/xml
AddOutputFilterByType DEFLATE application/rdf+xml application/rss+xml application/atom+xml
AddOutputFilterByType DEFLATE text/javascript application/javascript application/x-javascript application/json
AddOutputFilterByType DEFLATE application/x-font-ttf application/x-font-otf
AddOutputFilterByType DEFLATE font/truetype font/opentype
</ifModule>
With this, Apache will pass all traffic to the PHP-based site and it's up to that code to perform redirects, access control, and URL translations