Syncthing will do a 1 to 1 connection if possible, else it will use a relay server. Traffic is encrypted. Open source. After the initial setup of marrying the devices together, it's just a matter of starting the application. Pretty much what you want?

Doesn't it still need a public relay server? I understand that's nitpicking, since even with tailscale, I need someone in the cloud to handle the IPs.