Encrypt UDP packet with time-generated encryption key
Setup a DTLS proxy that invokes your server program to respond to requests should work. You don't need to put security and functionality in a single monolithic bundle. 

This is called the Unix philosophy - write multiple programs that works together instead of trying to solve everything at once. 

I don't know about NodeRTC you've mentioned in the comment, but there's another archtypical program called "ssh" we use everyday. At its minimal, it's a program that establishes secure channels between client and server, the channels can carry anything from stdio, tty, x11, to just any data. (which by the way is much easier to setup than a DTLS proxy if you may consider). 

SSH saves its configs and keys in local files protected by permissions - had it been encrypted, it can't automatically start itself and would require user to input passphrase. 

Since this site is about cryptography, the software part of the question should be kept out or it will be off-topic.