Cant get screego to work without network_mode: host

I checked the faq:

• you are using https to access Screego. yep with nginx proxy manager
• SCREEGO_EXTERNAL_IP is set to your external IP. See Configuration yep public ip off the vps
• you are using TURN for NAT-Traversal. See NAT-Traversal. This isn’t allowed for app.screego.net, you’ve to self-host Screego logs show: INF Start TURN/STUN addr=0.0.0.0:3478 so that looks fine to me (web ui only shows stun though I would expect it to list TURN
• your browser doesn’t block WebRTC (extensions or other settings) yep, ex: The public demo & on devices on the same network work
• you have opened ports in your firewall. By default 5050, 3478 and any UDP port when using TURN. yep

docker compose:

    image: ghcr.io/screego/server:1.12.0
    container_name: screego
    ports:
      - 5050:5050
      - 3478:3478
      - 50000-50200:50000-50200/udp
    environment:
      SCREEGO_EXTERNAL_IP: "dns:screego.<my dns name>"
      SCREEGO_TURN_PORT_RANGE: "50000:50200"
      SCREEGO_TURN_DENY_PEERS: ""
      SCREEGO_SECRET: "<some secret>"
      SCREEGO_CORS_ALLOWED_ORIGINS: "https://screego.<my dns name>"
      SCREEGO_TURN_ADDRESS: 0.0.0.0:3478
      SCREEGO_LOG_LEVEL: debug
      SCREEGO_TRUST_PROXY_HEADERS: "true"
      SCREEGO_AUTH_MODE: turn

there are probs some unnecessary settings in here but this is the point where I gave up.

extra background.

I'm using nginx proxy manager as my reverse proxy. Container is running on a vps. Stream works with 2 devices on my home network, But not with devices on different networks. which to me hints towards the TURN/STUN magic. The ui shows Nat Traversal via: STUN before joining a room.

I've turned on debug logging but saw no errors.

I feel I'm missing something obvious here. anybody any suggestions?