but for the love of god and your own benefit, put a name constraint directly on the root cert

At least for the first year.

Any good instructions you would recommend for doing this?

Can't it automatically be renewed?

Let's Encrypt is meant yo be used with automated certificate renewal using the ACME protocol. There are many clients for this. Both standalone and built into e.g. Caddy, Traefik and other software that does SSL termination.

So this specific concern doesn't really make sense. But that doesn't mean I really see a use case for it either, since it usually makes more sense to access resources via a host name.

In much simpler terms:

Think of an IP address like a street address. 192 My Street.

There might be multiple businesses at one street address. In real life we address them with things like 1/192 My Street and 2/192 My Street, but there's no direct parallel to that in computer networks. Instead, what we do is more like directing your letter to say "Business A c/o 192 My Street". That's what SNI does.

Because we have to write all of that on the outside of the envelope, everyone gets to see that we're communicating with Business A. But what if one of the businesses at 192 My Street is highly sensitive and we'd rather people didn't know we were communicating with them? @bjoern_tantau@swg-empire.de's proposal is basically like if you put the "Business A" part inside the envelope, so the mailman (and anyone who sees the letter on the way) only see that it's going to 192 My Street. Then the front room at that address could open the envelope and see that the ultimate destination is Business A, and pass it along to them.

Currently before establishing an encrypted connection to a webserver the domain is sent to the webserver unencrypted so that the server can choose the appropriate certificate to use for encryption. That is called SNI, Server Name Indication.

Of course that's a privacy risk. There are finally protocols to fix this but they aren't very widespread and depend on DNS over HTTPS.

I think issuing certificates based on the IP and sending the domain name encrypted based on that certificate could have fixed this issue ages ago.

You can totally host something on carrier-grade NAT using techniques like NAT hole punching.