Refactor CDN and run_once handling

- Move run_once include from main.yml to 01_core.yml in desk-gnome-caffeine and desk-ssh
- Introduce sys-svc-cdn/01_core.yml to handle shared/vendor dirs once and role dirs per run
- Replace cdn.* with cdn_paths_all.* across inj roles
- Split cdn_dirs into cdn_dirs_role and CDN_DIRS_GLOBAL
- Ensure cdn_urls uses cdn_paths_all

Details: https://chatgpt.com/share/68b58d64-1e28-800f-8907-36926a9e9a9b

roles/sys-svc-cdn/tasks/01_core.yml

@@ -0,0 +1,30 @@
+- name: "Load CDN for '{{ domain }}'"
+  include_role:
+    name: web-svc-cdn
+    public: false
+  when:
+  - application_id != 'web-svc-cdn'
+  - run_once_web_svc_cdn is not defined
+
+- name: Overwritte CDN handlers with neutral handlers
+  ansible.builtin.include_tasks: "{{ [ playbook_dir, 'tasks/utils/load_handlers.yml'] | path_join }}"
+  loop:
+  - svc-prx-openresty
+  - docker-compose
+  loop_control:
+    label: "{{ item }}"
+  vars:
+    handler_role_name: "{{ item }}"
+
+# ------------------------------------------------------------------
+# Only-once creations (shared root and vendor)
+# ------------------------------------------------------------------
+- name: Ensure shared root and vendor exist (run once)
+  ansible.builtin.file:
+    path:  "{{ item }}"
+    state: directory
+    owner: "{{ NGINX.USER }}"
+    group: "{{ NGINX.USER }}"
+    mode:  "0755"
+  loop: "{{ CDN_DIRS_GLOBAL }}"
+- include_tasks: utils/run_once.yml

roles/sys-svc-cdn/tasks/main.yml

@@ -1,25 +1,6 @@
 ---
 - block:
-  - name: "Load CDN for '{{ domain }}'"
-    include_role:
-      name: web-svc-cdn
-      public: false
-    when:
-    #- inj_enabled.logout
-    #- inj_enabled.desktop
-    - application_id != 'web-svc-cdn'
-    - run_once_web_svc_cdn is not defined
-
-  - name: Overwritte CDN handlers with neutral handlers
-    ansible.builtin.include_tasks: "{{ [ playbook_dir, 'tasks/utils/load_handlers.yml'] | path_join }}"
-    loop:
-    - svc-prx-openresty
-    - docker-compose
-    loop_control:
-      label: "{{ item }}"
-    vars:
-      handler_role_name: "{{ item }}"
-  - include_tasks: utils/run_once.yml
+    - include_tasks: 01_core.yml
   when:
     - run_once_sys_svc_cdn is not defined
 
@@ -30,12 +11,12 @@
     owner: "{{ NGINX.USER }}"
     group: "{{ NGINX.USER }}"
     mode:  "0755"
-  loop: "{{ cdn_dirs }}"
+  loop: "{{ cdn_dirs_role }}"
 
 - name: Ensure 'latest' symlink points to current release
   file:
-    src:   "{{ cdn.role.release.root }}"
-    dest:  "{{ [cdn.role.root, 'latest'] | path_join }}"
+    src:   "{{ cdn_paths_all.role.release.root }}"
+    dest:  "{{ [cdn_paths_all.role.root, 'latest'] | path_join }}"
     state: link
     force: true
   when: CDN_VERSION != 'latest'

roles/sys-svc-cdn/vars/main.yml

@@ -1,19 +1,22 @@
 # Base CDN root (shared across all roles)
-CDN_ROOT:     "{{ NGINX.DIRECTORIES.DATA.CDN }}"
+CDN_ROOT:         "{{ NGINX.DIRECTORIES.DATA.CDN }}"
 
 # Default version identifier: UTC timestamp
-CDN_VERSION:  "latest" # Latest is used atm because timestamp based would just lead to an unneccessary overhead
+CDN_VERSION:      "latest" # Latest is used atm because timestamp based would just lead to an unneccessary overhead
 
 # Base Url to deliver the files
-CDN_BASE_URL: "{{ domains | get_url('web-svc-cdn', WEB_PROTOCOL) }}"
+CDN_BASE_URL:     "{{ domains | get_url('web-svc-cdn', WEB_PROTOCOL) }}"
 
 # Role specific CDN paths
 
 ## Build CDN path structure (via filter)
-cdn:          "{{ CDN_ROOT | cdn_paths(application_id, CDN_VERSION) }}"
+cdn_paths_all:    "{{ CDN_ROOT | cdn_paths(application_id, CDN_VERSION) }}"
+
+## Global CDN dirs
+CDN_DIRS_GLOBAL:  "{{ (cdn_paths_all.shared | cdn_dirs) + [cdn_paths_all.vendor] }}"
 
 ## Flatten CDN dict to list of all string paths
-cdn_dirs:     "{{ cdn | cdn_dirs }}"
+cdn_dirs_role:    "{{ cdn_paths_all.role | cdn_dirs }}"
 
 # Dictionary with all urls
-cdn_urls:     "{{ cdn | cdn_urls(CDN_BASE_URL) }}"
+cdn_urls:         "{{ cdn_paths_all | cdn_urls(CDN_BASE_URL) }}"