Guide

Reverse proxy

Your reverse proxy already sends your Blue Iris address to Blue Iris. Add one more rule: requests under /caesa/ go to Caesa Bridge on the Blue Iris PC, port 8743. Everything else stays exactly as it is.

phone ── HTTPS ──▶ your reverse proxy
                     ├── /caesa/…        ──▶ Caesa Bridge (Blue Iris PC, port 8743)
                     └── everything else ──▶ Blue Iris (unchanged)

The Bridge keeps a connection open to each phone and sends a small line every 30 seconds, so the proxy must not buffer its responses and must allow long-lived connections.

nginx

Inside the server block that already serves Blue Iris:

location /caesa/ {
    proxy_pass http://BLUE-IRIS-PC:8743;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_buffering off;
    proxy_read_timeout 1h;
}

Replace BLUE-IRIS-PC with the PC’s name or address on your network. Then nginx -t and reload.

Caddy

In the site that serves Blue Iris, before its existing reverse_proxy:

handle /caesa/* {
    reverse_proxy BLUE-IRIS-PC:8743 {
        flush_interval -1
        header_up X-Real-IP {remote_host}
    }
}

Nginx Proxy Manager

Edit the proxy host for Blue Iris → Custom locations → Add location:

• Location: /caesa/
• Scheme: http, Forward hostname: your Blue Iris PC, Forward port: 8743
• In the location’s advanced settings (the gear):

proxy_buffering off;
proxy_read_timeout 1h;
proxy_set_header X-Real-IP $remote_addr;

Firewalls

If the reverse proxy runs on another machine, the network between them must allow it to reach the Blue Iris PC on TCP port 8743. The Bridge’s own Windows Firewall rule already allows this on private and domain networks.

Check it

Open https://your-blue-iris-address/caesa/hello in a browser. You should see a short message starting with {"caesa_bridge". If you see Blue Iris instead, the rule isn’t matching; if the page times out, the proxy can’t reach port 8743.

Why the real address matters: the Bridge slows down repeated failed sign-ins from the same address. The X-Real-IP line tells it the phone’s address rather than the proxy’s.