Signed, replay-proof UDP pulse daemon: a server learns and verifies a NAT'd client's real source IP and runs a hook (server + client binaries)
SignedPulse client: periodically proves its source IP to the server with a signed pulse
Shared protocol, crypto, and config types for SignedPulse
SignedPulse server: verifies signed UDP pulses and runs a hook command