diff --git a/templates/tirreno/assets/logo.png b/templates/tirreno/assets/logo.png
new file mode 100644
index 000000000..f445a6e94
Binary files /dev/null and b/templates/tirreno/assets/logo.png differ
diff --git a/templates/tirreno/assets/screenshot.png b/templates/tirreno/assets/screenshot.png
new file mode 100644
index 000000000..044da7942
Binary files /dev/null and b/templates/tirreno/assets/screenshot.png differ
diff --git a/templates/tirreno/index.ts b/templates/tirreno/index.ts
new file mode 100644
index 000000000..87bae7cb1
--- /dev/null
+++ b/templates/tirreno/index.ts
@@ -0,0 +1,47 @@
+import { Output, randomPassword, Services } from "~templates-utils";
+import { Input } from "./meta";
+
+export function generate(input: Input): Output {
+  const services: Services = [];
+  const dbServiceName = `${input.appServiceName}-db`;
+  const dbPassword = randomPassword();
+
+  services.push({
+    type: "app",
+    data: {
+      serviceName: input.appServiceName,
+      source: {
+        type: "image",
+        image: input.appServiceImage,
+      },
+      env: [
+        `DATABASE_URL=postgresql://postgres:${dbPassword}@$(PROJECT_NAME)_${dbServiceName}:5432/$(PROJECT_NAME)`,
+        `SITE=$(PRIMARY_DOMAIN)`,
+        `FORCE_HTTPS=${input.forceHttps ? "true" : "false"}`,
+      ].join("\n"),
+      domains: [
+        {
+          host: "$(EASYPANEL_DOMAIN)",
+          port: 80,
+        },
+      ],
+      mounts: [
+        {
+          type: "volume",
+          name: "data",
+          mountPath: "/var/www/html",
+        },
+      ],
+    },
+  });
+
+  services.push({
+    type: "postgres",
+    data: {
+      serviceName: dbServiceName,
+      password: dbPassword,
+    },
+  });
+
+  return { services };
+}
diff --git a/templates/tirreno/meta.yaml b/templates/tirreno/meta.yaml
new file mode 100644
index 000000000..3bd208d97
--- /dev/null
+++ b/templates/tirreno/meta.yaml
@@ -0,0 +1,79 @@
+name: Tirreno
+description:
+  Tirreno is an open-source security framework that helps understand, monitor,
+  and protect your product from threats, fraud, and abuse. It ingests events
+  through a simple API, then gives you a real-time dashboard covering user risk
+  scoring, blacklists, rule-based detection, and behaviour analysis for account
+  takeover, credential stuffing, promo abuse, and other attacks against your
+  application logic.
+instructions: >-
+  Tirreno automatically creates its database schema on first boot using the
+  bundled PostgreSQL service, and its cron job runs inside the container, so no
+  manual setup is required there. Once the service is running, open
+  `https://your-domain/signup/` to create the administrator account, then start
+  sending events through the API or one of the official SDKs. The "data" volume
+  persists the app's config, uploads, and logs across restarts.
+changeLog:
+  - date: 2026-08-07
+    description: first release
+links:
+  - label: Website
+    url: https://www.tirreno.com
+  - label: GitHub
+    url: https://github.com/tirrenotechnologies/tirreno
+  - label: Documentation
+    url: https://docs.tirreno.com
+contributors:
+  - name: Ahson Shaikh
+    url: https://github.com/Ahson-Shaikh
+schema:
+  type: object
+  required:
+    - appServiceName
+    - appServiceImage
+  properties:
+    appServiceName:
+      type: string
+      title: App Service Name
+      default: tirreno
+    appServiceImage:
+      type: string
+      title: App Service Image
+      default: tirreno/tirreno:v0.10.0
+    forceHttps:
+      type: boolean
+      title: Force HTTPS
+      description:
+        "Tirreno generates links and cookies as HTTPS by default, matching how
+        Easypanel serves the domain. Disable only if you're not using TLS."
+      default: true
+benefits:
+  - title: Real-Time Threat Dashboard
+    description:
+      Get a live view of activity, risk scores, and flagged users across your
+      product from a single interface
+  - title: Rule-Based Risk Scoring
+    description:
+      Detect account takeover, credential stuffing, promo abuse, bot traffic,
+      and other threats with preset or custom rules
+  - title: Single User View
+    description:
+      Drill into behaviour patterns, connected identities, risk scores, and full
+      activity timelines for any specific user
+features:
+  - title: Review Queue
+    description:
+      Automatically suspend risky accounts or flag them for manual review based
+      on configurable thresholds
+  - title: Field Audit Trail
+    description:
+      Track what changed and when across important fields to streamline audits
+      and compliance reviews
+  - title: Low-Dependency PHP Stack
+    description:
+      Hand-written, few-dependency PHP and PostgreSQL application that installs
+      in minutes and is easy to self-host
+tags:
+  - Security
+  - Analytics
+  - Monitoring