How does the connection actually happen? Like for two home users with dynamic IPs, nat, firewall, and/or CGNAT?

It doesn't use IPs at all, otherwise there would be no privacy. Everything goes through Tor. Each PeerBox instance gets its own .onion address, and all connections are made through that. Your contacts never see your IP, you never see theirs. SSH handles the authentication and encryption on top of that. So NAT, dynamic IPs, firewalls, CGNAT, none of that matters. You don't even need a VPN, Tor already maxes out the security.

I'm wondering that myself. Without digging much deeper, my guess is:

• It's trivially easy for anyone on Tor to make a service that is accessible to everyone else on Tor
• Two clients can connect directly and communicate if they know each other's Tor "addresses"