RemotePulse
Zero-Trust Remote Execution & Fleet Management
System Architecture & Roles
Zero-Trust ProtocolRemotePulse enables secure, end-to-end authenticated remote command dispatch across your machines. The architecture separates identity, relay, and execution into three strictly bounded components:
RemotePulse App
Mobile Dispatch ClientRuns as a progressive web app (PWA) on your phone. Generates and stores your ECDSA NIST P-256 private key inside the hardware-backed browser SubtleCrypto vault. Cryptographically signs every PowerShell command before sending. The private key never leaves your device.
RemotePulse Hub
Untrusted Secure RelayStateless high-performance ASP.NET Core server backed by PostgreSQL. Operates under zero-trust: holds encrypted command envelopes and queues long-polls between clients and workers. The Hub cannot forge commands, cannot inspect private keys, and cannot tamper with execution privileges.
RemotePulse Worker
Execution DaemonRuns as a local background daemon (Windows Service or Linux systemd). Uses outbound-only HTTPS polling (zero open inbound ports, NAT/firewall friendly). Validates caller ECDSA signatures, nonces, timestamps, and privilege envelopes before executing PowerShell scripts.
Security & Integrity Principles
Commands are signed client-side with hardware-isolated browser keys. The Hub serves only as an untrusted message broker; only workers holding your registered public key can verify and execute commands.
Execution parameters (privilege level CurrentUser vs System, timeout duration, command script) are cryptographically bound directly into the signed payload envelope. Rogue relays cannot elevate privileges.
The Worker maintains an outbound-only HTTPS long-poll connection through firewalls and NATs. It never opens listening ports, making direct external network penetration impossible.
Every command contains a unique cryptographic nonce and strict ±5-minute timestamp window. Replayed commands or intercepted stale requests are automatically discarded.
Initial pairing QR codes and tokens are served strictly on 127.0.0.1:7923 (loopback interface only). An operator must be physically present at the machine to authorize a new phone.
Worker Setup & Installation Instructions
Windows & LinuxDeploy the Worker on your target machine in seconds. Follow these steps to register your machine and pair it with your mobile device:
Open PowerShell (or Windows Terminal) on your target computer and run:
• Fetches the verified release zip into temporary storage.
• Extracts and launches Installer.ps1 with non-interactive self-elevation.
• Configures permissions, registers Windows Service, and automatically opens the local QR pairing console.
71c9d079d61cb42c6e9d49782ec4d6ac5c777bc8b0ffa7fe97bf10d962d595bb
1. The installer automatically starts the service and opens http://localhost:7923/ on your computer.
2. On your mobile phone, open the Mobile Console (/app).
3. Tap Pair New Client, scan the displayed QR code, and your machine is paired in under 5 seconds!
For offline or air-gapped environments, download the complete standalone zip:
⬇️ Download RemotePulse-Worker-windows-x64.zip- Extract the downloaded archive to a temporary folder.
- Right-click
Installer.ps1and choose Run with PowerShell (PowerShell 7). - The service will start and open
http://localhost:7923/for instant pairing.
Deploy on Debian 12+, Ubuntu 22.04+, Fedora 38+, or Arch using PowerShell Core:
Installs binaries to /opt/remotepulse/worker and registers the remotepulse-worker systemd unit.