Docker compose: How to switch off BasicAuth for Traefik in a service farm

Question

I have several identical directories from the same repo for a service farm. Each customer gets an identical service offering (one directory with one docker-compose.yml per customer). There is one Traefik running as reverse proxy for all customers.

In each directory there is a docker-compose.yml file to power all services for one customer.

version: "3"
services:
  service_1:
    [...]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers...
      [...]
      # here comes the BasicAuth protection
      - "traefik.http.routers.service_1.middlewares=${CUSTOMER_NAME}-service_1_auth"
      - "traefik.http.middlewares.${CUSTOMER_NAME}-service_1_auth.basicAuth.users=user:pwdencoded"

Each service is protected using BasicAuth. This works well.

How do I release BasicAuth for one customers services without affecting the other services? That means I cannot have different docker-compose.yml files since the live in the same repo!

My Idea is to enable BasicAuth protection using ENV variables or the .env file, e.g. by settings in .envfile:

BASIC_AUTH=on

Unfortunately conditional labels are not supported in docker-compose.yml.

How to proceed?