So there are a few ways todo this the below sections are a summary of each method.

Decentralized Databases

One way to architect it and the way I would do it would be to use a decentralized database such as GunDB or OrbitDB. Which would not require messing with network config like the below options. But do note that depending on the amount of data you are going to store in the database systems like these can become unreliable depending on your replication settings. Additionally depending on your security requirements you may want encrypted sharding. Though this should not be too hard to add as GunDB has internal support for encryption based off of their documentation. And it is very easy to add to OrbitDB with an external encryption library (i assume i haver never used OrbitDB).

WebRTC

Another way would be to use WebRTC for peer to peer connections but this is not possible without a relay server so that doesn’t really work if it can’t have any kind of backend server.

Local Networking

Another choice if the users are all connected the same WiFi network such as in an office would be to have something where you add a user’s ip address in to communicate with them, but do note that the IP address of every node will change quite a lot so this would probably be very inconvenient. Unless the communication is done from devices with fixed IPs in which case then that would probably be fine.

UPnP

Another way todo this would be to use UPnP this allows devices on a network to automatically reconfigure the NAT gateway for port forwarding. The issue with this being that UPnP is a pretty big security risk and unreliable. Also note that UPnP creates a lot of junk network traffic and if you have a large amount of devices on your network it may slow things down by quite a lot. One solution to that is to divide your network into subnets and isolate certain packet types so that UPnP can’t cross subnets. This way you would be able to avoid a lot of the slowdown on your primary network. But still be able to use UPnP on the dedicated subnet.

STUN

A much cleaner way todo this is to use a protocol called STUN which is a method for UDP hole punching in the NAT. Do note that UDP is by nature an unreliable protocol and is designed for realtime communication in things like games and not really for standard network transfer and as such does not include ACK/NACK messages so if a message gets lost it will not be re-sent. If you really want you can detect these lost message by including an incrementing counter with messages and detecting counter skips. Note that STUN does require a server but there are public servers you can use like the ones listed here though im not sure how reliable these will be.

TURN

TURN also allows for NAT hole punching but it supports both UDP and TCP so it can be used in a more standard manner for web applications. Though do note that TURN can be very resource intensive. TURN also requires a server. Though you can also find lists of public servers though again im not sure how reliable these will be.

ICE

ICE leverages both TURN and STUN. And supports either UDP or TCP. But i can’t find much more information on it other than the official RFC which can be found here.