docker service create --name $serviceName \
  --label "traefik.docker.network=$networkName" \
  --label "traefik.http.services.apache.loadbalancer.server.port=80" \
  --label "traefik.http.routers.apache.rule=Host(\`your.fqdn\`)" \
  --label "traefik.http.routers.apache.entrypoints=http" \
  --label "traefik.http.routers.apache.middlewares=https_redirect" \
  --label "traefik.http.routers.apachesecured.rule=Host(\`your.fqdn\`)" \
  --label "traefik.http.routers.apachesecured.entrypoints=https" \
  --label "traefik.http.routers.apachesecured.tls=true" \
  --label "traefik.http.middlewares.https_redirect.redirectscheme.scheme=https" \
  --label "traefik.http.middlewares.https_redirect.redirectscheme.permanent=true" \
  --network $networkName \
  --mount type=bind,src=/$basedir/etc,dst=/etc/apache2 \
  --mount type=bind,src=/$basedir/var,dst=/var/www \
  --mount type=bind,src=/$basedir/log,dst=/var/log/apache2 \
  --mount type=bind,src=/$basedir/php.ini,dst=/etc/php/7.2/apache2/php.ini \
pdbs/apache```

php.ini can be copied from a running container:
docker cp $serviceName:/etc/php/7.2/apache2/php.ini /$basedir/

# enable SSL #
make sure the following files exist:

/$basedir/etc/apache2/init/ssl/root.crt
/$basedir/etc/apache2/init/ssl/server.crt
/$basedir/etc/apache2/init/ssl/server.key